Augeas and grub.conf

721 views
Skip to first unread message

Erinn Looney-Triggs

unread,
Jul 14, 2010, 5:23:21 PM7/14/10
to puppet...@googlegroups.com
I hope that the answer to this isn't posted up somewhere else, I have
looked around and I haven't found much of anything, augeas documentation
seems to be thin. Is there even full documentation for all the augeas
function and language syntax? What I am trying to do is edit the
grub.conf file and modify some parameters for each kernel line, remove
rhgb, add audit = 1. I would like for this to happen on all kernels
listed in /etc/grub.conf, so for audit I have:

#Set audit=1 for grub.conf
augeas {"kernel_audit":
context => "/files/etc/grub.conf",
changes => "set title[*]/kernel/audit 1",
onlyif => "get title[*]/kernel/audit != 1",
}

This suprisingly works, but only for the first entry in grub.conf I say
surprisingly because running the set command via augtool fails, so this
behaviour is a bit different for the ruby bindings. Does anyone with
some wicked augeas skill know how to express what I am trying to express
here? Is it even possible?

Second problem, rhgb. This is an empty node, as in it comes back rhgb =
(none) in augtool, I am trying to write an onlyif rule but how do you
match none?

#Remove rhgb from kernel lines if it exists
augeas {"kernel_rhgb":
context => "/files/etc/grub.conf",
changes => "remove title[*]/kernel/rhgb",
onlyif => "match title[1]/kernel/rhgb == ['none']",
}

Now again I would really like it to match all, and remove from all,
removal from all seems to work, but the match, as I said, fails. I have
tried a lot of variants to the point where I don't think it is a text
match, but I am not sure how to match it. Again I am just getting
started with this stuff, my apologies if the answer is glaringly
obvious, but please at least point me in the right direction.

-Erinn

Rob McBroom

unread,
Jul 15, 2010, 9:04:53 AM7/15/10
to puppet...@googlegroups.com
On Jul 14, 2010, at 5:23 PM, Erinn Looney-Triggs wrote:

> I hope that the answer to this isn't posted up somewhere else, I have
> looked around and I haven't found much of anything, augeas documentation
> seems to be thin. Is there even full documentation for all the augeas
> function and language syntax?

I’m not sure what all you’ve seen, but there are these:

http://augeas.net/page/Main_Page#Using_Augeas (mostly the Path Expressions page)
http://docs.puppetlabs.com/references/latest/type.html#augeas

And then there’s the `help` command in `augtool` (and a man page).

> What I am trying to do is edit the
> grub.conf file and modify some parameters for each kernel line, remove
> rhgb, add audit = 1. I would like for this to happen on all kernels
> listed in /etc/grub.conf, so for audit I have:
>
> #Set audit=1 for grub.conf
> augeas {"kernel_audit":
> context => "/files/etc/grub.conf",
> changes => "set title[*]/kernel/audit 1",
> onlyif => "get title[*]/kernel/audit != 1",
> }
>
> This suprisingly works, but only for the first entry in grub.conf I say
> surprisingly because running the set command via augtool fails, so this
> behaviour is a bit different for the ruby bindings. Does anyone with
> some wicked augeas skill know how to express what I am trying to express
> here? Is it even possible?

I’ve done some experiments and haven’t come up with anything. The “onlyif” seems unnecessary to me, but of the thing doesn’t work in the first place, I suppose that doesn’t matter.

> Second problem, rhgb. This is an empty node, as in it comes back rhgb =
> (none) in augtool, I am trying to write an onlyif rule but how do you
> match none?
>
> #Remove rhgb from kernel lines if it exists
> augeas {"kernel_rhgb":
> context => "/files/etc/grub.conf",
> changes => "remove title[*]/kernel/rhgb",
> onlyif => "match title[1]/kernel/rhgb == ['none']",
> }
>
> Now again I would really like it to match all, and remove from all,
> removal from all seems to work, but the match, as I said, fails.

Have you tried just dropping the “onlyif”. I don’t see a need to check the value if you’re going to remove it anyway. In my experience, Puppet is pretty good about realizing when nothing needs to be done, so it should just pass it over silently if that value is missing.

In a lot of situations like this, you can use `count()` as in `match title[*]/kernel/*[count(rhgb) = 1]`. Unfortunately with this particular case, Augeas seems to assign a count of 0 to both missing items and items with a value of “(none)”, so you can’t distinguish. There might be a way. I’m no expert. For what it’s worth, I know how to *set* it to “(none)” (using `clear`). :)

--
Rob McBroom
<http://www.skurfer.com/>

Don't try to tell me something is important to you if the whole of your “support” entails getting Congress to force *others* to spend time and money on it.


Erinn Looney-Triggs

unread,
Jul 16, 2010, 10:21:54 AM7/16/10
to Puppet Users
Rob,
Thanks for the information, sometimes when I am just starting out on a
new project it is nice to have someone confirm that you are not all
crazy in what you are seeing. Removing the onlyifs seems reasonable,
and thanks for pointing out the count option as well as the
documentation. I will continue to work on this and if, somehow, I find
a solution to the audit = 1 problem I will post it up so maybe the
next person along the line can find it.

Thanks again,
-Erinn

On Jul 15, 7:04 am, Rob McBroom <mailingli...@skurfer.com> wrote:
> On Jul 14, 2010, at 5:23 PM, Erinn Looney-Triggs wrote:
>
> > I hope that the answer to this isn't posted up somewhere else, I have
> > looked around and I haven't found much of anything, augeas documentation
> > seems to be thin. Is there even full documentation for all the augeas
> > function and language syntax?
>
> I’m not sure what all you’ve seen, but there are these:
>
> http://augeas.net/page/Main_Page#Using_Augeas(mostly the Path Expressions page)http://docs.puppetlabs.com/references/latest/type.html#augeas

Paul Greenbank

unread,
Feb 3, 2015, 6:53:38 PM2/3/15
to puppet...@googlegroups.com
Hi You can try setm - I'm not expert but have managed to use setm to do what you need:

        # Enable audit prior to daemon
        augeas { 'set_audit':
                incl    => '/boot/grub/grub.conf',
                lens    => 'grub.lns',
                changes => [
                        'setm title[*]/kernel/ audit 1',
                ],
        }

and

        # Ensure selinux=1 and enforcing=1 are set in grub.conf
        augeas{ "grub-set-kernel-selinux":
                        incl    => "/etc/grub.conf",
                        lens    => "grub.lns",
                        changes => [
                                "setm title[*]/kernel/ selinux 1",
                                "setm title[*]/kernel/ enforcing 1",
                        ],
        }
Reply all
Reply to author
Forward
0 new messages