Hi, Certain subcomponents of IPA, such as Dogtag, cannot function if non-critical directories (such as log directories) have not been stored in the backup.
This patch implements storage of selected empty directories, while preserving attributes and SELinux context. https://fedorahosted.org/freeipa/ticket/5297
From 744b691c127870e0c89becbb045755e67fc374ce Mon Sep 17 00:00:00 2001 From: Tomas Babej <tba...@redhat.com> Date: Thu, 17 Sep 2015 17:09:33 +0200 Subject: [PATCH] ipa-backup: Add mechanism to store empty directory structure Certain subcomponents of IPA, such as Dogtag, cannot function if non-critical directories (such as log directories) have not been stored in the backup. This patch implements storage of selected empty directories, while preserving attributes and SELinux context. https://fedorahosted.org/freeipa/ticket/5297 --- ipaplatform/base/paths.py | 3 +++ ipaserver/install/ipa_backup.py | 47 ++++++++++++++++++++++++++++++++++++++--- 2 files changed, 47 insertions(+), 3 deletions(-) diff --git a/ipaplatform/base/paths.py b/ipaplatform/base/paths.py index e5d73a395f04fc56fa365c36e0d194efb5ba3ca6..63b9c5abe28b1ce62431eb5bf4602416d6ca863e 100644 --- a/ipaplatform/base/paths.py +++ b/ipaplatform/base/paths.py @@ -330,6 +330,9 @@ class BasePathNamespace(object): TOMCAT_CA_DIR = "/var/log/pki/pki-tomcat/ca" TOMCAT_CA_ARCHIVE_DIR = "/var/log/pki/pki-tomcat/ca/archive" TOMCAT_SIGNEDAUDIT_DIR = "/var/log/pki/pki-tomcat/ca/signedAudit" + TOMCAT_KRA_DIR = "/var/log/pki/pki-tomcat/kra" + TOMCAT_KRA_ARCHIVE_DIR = "/var/log/pki/pki-tomcat/kra/archive" + TOMCAT_KRA_SIGNEDAUDIT_DIR = "/var/log/pki/pki-tomcat/kra/signedAudit" LOG_SECURE = "/var/log/secure" NAMED_RUN = "/var/named/data/named.run" VAR_OPENDNSSEC_DIR = "/var/opendnssec" diff --git a/ipaserver/install/ipa_backup.py b/ipaserver/install/ipa_backup.py index ce5cf9d4f3670bc162f588ee6b2095519410175e..b3ff9b3ddc0d03ca5664e5db89b08eacc73971d3 100644 --- a/ipaserver/install/ipa_backup.py +++ b/ipaserver/install/ipa_backup.py @@ -202,6 +202,16 @@ class Backup(admintool.AdminTool): paths.NAMED_RUN, ) + required_dirs=( + paths.TOMCAT_TOPLEVEL_DIR, + paths.TOMCAT_CA_DIR, + paths.TOMCAT_SIGNEDAUDIT_DIR, + paths.TOMCAT_CA_ARCHIVE_DIR, + paths.TOMCAT_KRA_DIR, + paths.TOMCAT_KRA_SIGNEDAUDIT_DIR, + paths.TOMCAT_KRA_ARCHIVE_DIR, + ) + def __init__(self, options, args): super(Backup, self).__init__(options, args) self._conn = None @@ -486,13 +496,15 @@ class Backup(admintool.AdminTool): def verify_directories(dirs): return [s for s in dirs if os.path.exists(s)] + tarfile = os.path.join(self.dir, 'files.tar') + self.log.info("Backing up files") args = ['tar', '--exclude=/var/lib/ipa/backup', '--xattrs', '--selinux', - '-czf', - os.path.join(self.dir, 'files.tar') + '-cf', + tarfile ] args.extend(verify_directories(self.dirs)) @@ -503,7 +515,36 @@ class Backup(admintool.AdminTool): (stdout, stderr, rc) = run(args, raiseonerr=False) if rc != 0: - raise admintool.ScriptError('tar returned non-zero %d: %s' % (rc, stdout)) + raise admintool.ScriptError('tar returned non-zero code ' + '%d: %s' % (rc, stderr)) + + # Backup the necessary directory structure + missing_directories = verify_directories(self.required_dirs) + + if missing_directories: + args = ['tar', + '--exclude=/var/lib/ipa/backup', + '--xattrs', + '--selinux', + '--no-recursion', + '-rf', + tarfile, + ] + args.extend(missing_directories) + + (stdout, stderr, rc) = run(args, raiseonerr=False) + if rc != 0: + raise admintool.ScriptError('tar returned non-zero %d when adding ' + 'directory structure: %s' % (rc, stderr)) + + # Compress the archive + (stdout, stderr, rc) = run(['gzip', tarfile], raiseonerr=False) + if rc != 0: + raise admintool.ScriptError('gzip returned non-zero %d when ' + 'compressing the backup: %s' % (rc, stderr)) + + # Rename the archive back to files.tar to preserve compatibility + os.rename(os.path.join(self.dir, 'files.tar.gz'), tarfile) def create_header(self, data_only): -- 2.1.0
-- Manage your subscription for the Freeipa-devel mailing list: https://www.redhat.com/mailman/listinfo/freeipa-devel Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code
