From patchwork Wed Oct 6 13:48:35 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 4765 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4HPbQR1wKWz3xWd for ; Wed, 6 Oct 2021 13:48:47 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4HPbQQ0bn8z1mh; Wed, 6 Oct 2021 13:48:46 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4HPbQQ0Y1Vz2y4S; Wed, 6 Oct 2021 13:48:46 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4HPbQN4VcGz2x9h for ; Wed, 6 Oct 2021 13:48:44 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4HPbQM6zcVzqF; Wed, 6 Oct 2021 13:48:43 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1633528124; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=2B+cTtFm53WaTfOPic2CFH/OD5Du7AQ7mcHkNeYiOO4=; b=cW/UD4fv2QI3NGgzPL+LpSt6Qhc1JEVlRdDl5L4c+5yASdrci+InODKDovWz2e7rESImW9 ePOOLe/aJbk+QCBw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1633528124; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=2B+cTtFm53WaTfOPic2CFH/OD5Du7AQ7mcHkNeYiOO4=; b=exyLPDU+Pv8VlpbQ7EihH7Ui0uT9898iyPwFr93JKrLvHGK5znitalWfBB/OgrpS5HUJPe Kvm1j0zq2aYbCEuRulu/JoHsE3EZw+ILIYag/5IhAe2noSvmltFSKQNIjR2b44jUDRho+D jPKtDQozsJuzmM+bvvF1VAbZ9yXxdL7LbD4IwnLNNx+SkXKTIdjq1/8vweGUeq3t7AEzVe Iej3PrXFuu6EGos8GZL7ei4a6yraN3M/X3j1p+0YI81B0eYQrRE7QGkFyDiPaYTXv7fMR3 YG+iKwE4+c5VvrcuM9AL8sCSs7kfMaWIhpAJmjuNXvQigb/Cov/IesHYZMdGag== From: Adolf Belka To: development@lists.ipfire.org Subject: [PATCH] logwatch: mdadm status missing - Fix for Bug 12080 Date: Wed, 6 Oct 2021 15:48:35 +0200 Message-Id: <20211006134835.3476503-1-adolf.belka@ipfire.org> MIME-Version: 1.0 X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" - Addition of mdadm module to logwatch - Addition of logwatch to sudoers list to run mdadm commands - patch to change logwatch mdadm.conf to allow scan for raid drives, change mdadm script to run mdadm scan commands with sudo, allow clean but degraded drives to be listed in the output. Fixes: 12080 Tested-by: Adolf Belka Signed-off-by: Adolf Belka Reviewed-by: Michael Tremer --- config/logwatch/sudoers/logwatch-mdadm | 2 + config/rootfiles/common/logwatch | 6 ++- lfs/logwatch | 8 +++- .../logwatch-7.5.5-enable-mdadm-sudo.patch | 46 +++++++++++++++++++ 4 files changed, 59 insertions(+), 3 deletions(-) create mode 100644 config/logwatch/sudoers/logwatch-mdadm create mode 100644 src/patches/logwatch/logwatch-7.5.5-enable-mdadm-sudo.patch diff --git a/config/logwatch/sudoers/logwatch-mdadm b/config/logwatch/sudoers/logwatch-mdadm new file mode 100644 index 000000000..cdc524def --- /dev/null +++ b/config/logwatch/sudoers/logwatch-mdadm @@ -0,0 +1,2 @@ +# The following commands need to be executed by logwatch in case there's an MD Raid +logwatch ALL=(root) NOPASSWD: /sbin/mdadm --misc --detail /dev/md*, /sbin/mdadm --detail --scan diff --git a/config/rootfiles/common/logwatch b/config/rootfiles/common/logwatch index c47fb4199..1e4a0a81b 100644 --- a/config/rootfiles/common/logwatch +++ b/config/rootfiles/common/logwatch @@ -3,6 +3,8 @@ etc/logwatch/conf #etc/logwatch/logwatch.cron etc/logwatch/scripts etc/logwatch/scripts/services +#etc/sudoers.d +etc/sudoers.d/logwatch-mdadm usr/sbin/logwatch #usr/share/logwatch #usr/share/logwatch/HOWTO-Customize-LogWatch @@ -117,7 +119,7 @@ usr/share/logwatch/default.conf/services/kernel.conf #usr/share/logwatch/default.conf/services/knockd.conf #usr/share/logwatch/default.conf/services/lvm.conf #usr/share/logwatch/default.conf/services/mailscanner.conf -#usr/share/logwatch/default.conf/services/mdadm.conf +usr/share/logwatch/default.conf/services/mdadm.conf #usr/share/logwatch/default.conf/services/mod_security2.conf usr/share/logwatch/default.conf/services/modprobe.conf #usr/share/logwatch/default.conf/services/mountd.conf @@ -262,7 +264,7 @@ usr/share/logwatch/scripts/services/kernel #usr/share/logwatch/scripts/services/knockd #usr/share/logwatch/scripts/services/lvm #usr/share/logwatch/scripts/services/mailscanner -#usr/share/logwatch/scripts/services/mdadm +usr/share/logwatch/scripts/services/mdadm #usr/share/logwatch/scripts/services/mod_security2 usr/share/logwatch/scripts/services/modprobe #usr/share/logwatch/scripts/services/mountd diff --git a/lfs/logwatch b/lfs/logwatch index 8baaef2ce..628dafe6f 100644 --- a/lfs/logwatch +++ b/lfs/logwatch @@ -74,6 +74,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP)/lib && patch < $(DIR_SRC)/src/patches/logwatch/logwatch-7.3.6-date_manip6.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/logwatch/logwatch-7.5.4-disable_iptables.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/logwatch/logwatch-7.5.5-enable-mdadm-sudo.patch @cd $(DIR_APP) && chmod 755 install_logwatch.sh cd $(DIR_APP) && yes "" | ./install_logwatch.sh @@ -103,6 +104,11 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) chmod -v 755 /var/log/logwatch -rm -rf /etc/logwatch/conf ln -vsf /usr/share/logwatch/default.conf /etc/logwatch/conf - + + -mkdir -p /etc/sudoers.d + chmod -v 755 /etc/sudoers.d + install -v -m 644 $(DIR_SRC)/config/logwatch/sudoers/logwatch-mdadm \ + /etc/sudoers.d/logwatch-mdadm + @rm -rf $(DIR_APP) @$(POSTBUILD) diff --git a/src/patches/logwatch/logwatch-7.5.5-enable-mdadm-sudo.patch b/src/patches/logwatch/logwatch-7.5.5-enable-mdadm-sudo.patch new file mode 100644 index 000000000..b7034077b --- /dev/null +++ b/src/patches/logwatch/logwatch-7.5.5-enable-mdadm-sudo.patch @@ -0,0 +1,46 @@ +diff -Naur logwatch-7.5.5-orig/conf/services/mdadm.conf logwatch-7.5.5/conf/services/mdadm.conf +--- logwatch-7.5.5-orig/conf/services/mdadm.conf 2021-01-22 21:59:40.000000000 +0100 ++++ logwatch-7.5.5/conf/services/mdadm.conf 2021-10-04 13:52:30.850057355 +0200 +@@ -13,7 +13,7 @@ + # Logwatch will try to find md devices in /etc/mdadm.conf or + # /etc/mdadm/mdadm.conf. If none of these files exist it can scan actively + # for md devices. Set to 'Yes' to enable active scanning: +-$mdadm_enable_scan = No ++$mdadm_enable_scan = Yes + + # Logwatch will emit an error for md devices listed in /etc/mdadm.conf + # that are not present. If you do not want this (e.g. raid devices may come +diff -Naur logwatch-7.5.5-orig/scripts/services/mdadm logwatch-7.5.5/scripts/services/mdadm +--- logwatch-7.5.5-orig/scripts/services/mdadm 2021-01-22 21:59:40.000000000 +0100 ++++ logwatch-7.5.5/scripts/services/mdadm 2021-10-06 11:41:14.800307603 +0200 +@@ -35,7 +35,7 @@ + } elsif ( -f "/etc/mdadm/mdadm.conf" ) { + open(MDADM,"< /etc/mdadm/mdadm.conf"); + } elsif ($enable_scan) { +- open(MDADM,"mdadm --detail --scan 2>/dev/null|"); ++ open(MDADM,"sudo mdadm --detail --scan 2>/dev/null|"); + } + while () { + if (/^ARRAY/) { +@@ -51,7 +51,7 @@ + next; + } + +- open(MDADM,"mdadm --misc --detail $dev 2>&1 |"); ++ open(MDADM,"sudo mdadm --misc --detail $dev 2>&1 |"); + while () { + if ($_ =~ /cannot open .*: No such file or directory/) { + print $_ unless $ignore_missing; +@@ -74,7 +74,11 @@ + + if ($Detail <= 4) { + if (lc($mdhash{'state'}) =~ /clean|active/) { +- print "$dev : $mdhash{'state'}\n" if $Detail; ++ if (lc($mdhash{'state'}) =~ /degraded/) { ++ print "$dev : $mdhash{'state'}\n"; ++ } else { ++ print "$dev : $mdhash{'state'}\n" if $Detail; ++ } + } else { + print "$dev : $mdhash{'state'}\n"; + if (defined($mdhash{'middle devices'})) {