update to vdsm-4.10.0-13

- setup: move the certificate generation

0045-setup-configure-selinux-for-sanlock-on-nfs.patch

@@ -0,0 +1,59 @@
+From 59722223c4d241a47ba8b4cf9f5281996b2db374 Mon Sep 17 00:00:00 2001
+From: Federico Simoncelli <fsimonce@redhat.com>
+Date: Thu, 27 Sep 2012 08:31:08 -0400
+Subject: [PATCH] setup: configure selinux for sanlock on nfs
+
+Signed-off-by: Federico Simoncelli <fsimonce@redhat.com>
+Change-Id: Id9005d23d009c65770b7836feb81ab97206e9a8a
+Reviewed-on: http://gerrit.ovirt.org/8255
+Reviewed-by: Douglas Schilling Landgraf <dougsland@redhat.com>
+Reviewed-by: Ayal Baron <abaron@redhat.com>
+Reviewed-on: http://gerrit.ovirt.org/8755
+---
+ vdsm.spec.in | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/vdsm.spec.in b/vdsm.spec.in
+index 6be7da4..5f5f989 100644
+--- a/vdsm.spec.in
++++ b/vdsm.spec.in
+@@ -380,17 +380,21 @@ rm -rf %{buildroot}
+ # The next lines will collect the default selinux behaviour for the booleans
+ virtNFS=$(/usr/sbin/semanage boolean -l | /bin/grep virt_use_nfs | cut -d ',' -f 2)
+ virtSANLOCK=$(/usr/sbin/semanage boolean -l | /bin/grep virt_use_sanlock | cut -d ',' -f 2)
++snlkNFS=$(/usr/sbin/semanage boolean -l | /bin/grep sanlock_use_nfs | cut -d ',' -f 2)
+ 
+-if [[ "${virtNFS}" == *off* || "${virtSANLOCK}" == *off* ]]; then
++if [[ "${virtNFS}" == *off* || "${virtSANLOCK}" == *off* || \
++      "${snlkNFS}" == *off* ]]; then
+     /usr/sbin/semanage boolean -m -S targeted -F /dev/stdin  << _EOF
+ virt_use_nfs=1
+ virt_use_sanlock=1
++sanlock_use_nfs=1
+ _EOF
+ fi
+ 
+ if /usr/sbin/selinuxenabled; then
+     /usr/sbin/setsebool virt_use_nfs on
+     /usr/sbin/setsebool virt_use_sanlock on
++    /usr/sbin/setsebool sanlock_use_nfs on
+ fi
+ 
+ %post
+@@ -434,11 +438,13 @@ then
+     /usr/sbin/semanage boolean -m -S targeted -F /dev/stdin  << _EOF
+ virt_use_nfs=0
+ virt_use_sanlock=0
++sanlock_use_nfs=0
+ _EOF
+ 
+     if /usr/sbin/selinuxenabled; then
+         /usr/sbin/setsebool virt_use_nfs off
+         /usr/sbin/setsebool virt_use_sanlock off
++        /usr/sbin/setsebool sanlock_use_nfs off
+     fi
+ 
+     /usr/sbin/saslpasswd2 -p -a libvirt -d vdsm@rhevh
+-- 
+1.7.11.7
+

0046-setup-move-the-certificate-generation.patch

@@ -0,0 +1,76 @@
+From b59c8430b2a511bcea3bc1a954eee4ca1c0f4861 Mon Sep 17 00:00:00 2001
+From: Federico Simoncelli <fsimonce@redhat.com>
+Date: Mon, 15 Oct 2012 12:09:17 -0400
+Subject: [PATCH] setup: move the certificate generation
+
+Generating the certificate at the service startup (instead of during the
+rpm installation) has a better chance to succeed (and a better recovery
+process). Moreover this allows appliances (like ovirt-node) to postpone
+the certificate generation when the service is actually used for the
+first time.
+
+In this patch:
+* Move the certificate generation from the spec file to the init file
+
+Bug-Url: https://bugzilla.redhat.com/show_bug.cgi?id=860067
+Signed-off-by: Federico Simoncelli <fsimonce@redhat.com>
+Change-Id: I40fa3d9a6a54e312e399af3f87ac67e843078360
+Reviewed-on: http://gerrit.ovirt.org/8368
+Reviewed-by: Dan Kenigsberg <danken@redhat.com>
+Reviewed-by: Michael Burns <mburns@redhat.com>
+Tested-by: Michael Burns <mburns@redhat.com>
+Reviewed-on: http://gerrit.ovirt.org/10615
+---
+ vdsm.spec.in             | 3 ---
+ vdsm/vdsm-gencerts.sh.in | 4 ++++
+ vdsm/vdsmd.init.in       | 5 +++++
+ 3 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/vdsm.spec.in b/vdsm.spec.in
+index 5f5f989..572b338 100644
+--- a/vdsm.spec.in
++++ b/vdsm.spec.in
+@@ -404,9 +404,6 @@ if [ -f /etc/pki/vdsm/keys/libvirt_password ]; then
+         /etc/pki/vdsm/keys/libvirt_password
+ fi
+ 
+-# generate the vdsm certificates (if missing)
+-%{_libexecdir}/%{vdsm_name}/vdsm-gencerts.sh
+-
+ %if 0%{?rhel}
+ if [ "$1" -eq 1 ] ; then
+     /sbin/chkconfig --add vdsmd
+diff --git a/vdsm/vdsm-gencerts.sh.in b/vdsm/vdsm-gencerts.sh.in
+index 1e11b69..3ee38c3 100755
+--- a/vdsm/vdsm-gencerts.sh.in
++++ b/vdsm/vdsm-gencerts.sh.in
+@@ -33,6 +33,10 @@ VDSM_PERMS="@VDSMUSER@:@VDSMGROUP@"
+ 
+ umask 077
+ 
++if [ "$1" = "--check" ]; then
++    [ -s "$VDSM_KEY" -a -s "$VDSM_CA" -a -s "$VDSM_CRT" ] && exit 0 || exit 1
++fi
++
+ if [ ! -f "$VDSM_KEY" ]; then
+     /usr/bin/certtool --generate-privkey --outfile "$VDSM_KEY" 2> /dev/null
+     /bin/chown "$VDSM_PERMS" "$VDSM_KEY"
+diff --git a/vdsm/vdsmd.init.in b/vdsm/vdsmd.init.in
+index dd6f3c6..a288c16 100755
+--- a/vdsm/vdsmd.init.in
++++ b/vdsm/vdsmd.init.in
+@@ -498,6 +498,11 @@ start() {
+ 
+     shutdown_conflicting_srv && stop_libvirtd_sysv
+ 
++    if ! @LIBEXECDIR@/vdsm-gencerts.sh --check; then
++        echo -n $"Configuring a self-signed VDSM host certificate: "
++        @LIBEXECDIR@/vdsm-gencerts.sh && success || failure ; echo
++    fi
++
+     reconfigure noforce
+     ret_val=$?
+     if [ $ret_val -ne 0 ]
+-- 
+1.7.11.7
+

vdsm.spec

@@ -28,7 +28,7 @@
 
 Name:           %{vdsm_name}
 Version:        4.10.0
-Release:        11%{?vdsm_relvtag}%{?dist}%{?extra_release}
+Release:        13%{?vdsm_relvtag}%{?dist}%{?extra_release}
 Summary:        Virtual Desktop Server Manager
 
 Group:          Applications/System
@@ -87,6 +87,8 @@ Patch40: 0041-BZ-842948-deployUtil-safely-remove-bridge.patch
 Patch41: 0042-Ship-the-version-file-with-the-tarballs.patch
 Patch42: 0043-Use-the-recommended-alignment-instead-of-using-pages.patch
 Patch43: 0044-Use-buffer-size-in-multiplies-of-the-recommended-tra.patch
+Patch44: 0045-setup-configure-selinux-for-sanlock-on-nfs.patch
+Patch45: 0046-setup-move-the-certificate-generation.patch
 
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -434,6 +436,8 @@ Gluster plugin enables VDSM to serve Gluster functionalities.
 %{__chmod} +x build-aux/pkg-version  # required by patch41
 %patch42 -p1 -b .patch42
 %patch43 -p1 -b .patch43
+%patch44 -p1 -b .patch44
+%patch45 -p1 -b .patch45
 
 %build
 %if 0%{?enable_autotools}
@@ -506,17 +510,21 @@ rm -rf %{buildroot}
 # The next lines will collect the default selinux behaviour for the booleans
 virtNFS=$(/usr/sbin/semanage boolean -l | /bin/grep virt_use_nfs | cut -d ',' -f 2)
 virtSANLOCK=$(/usr/sbin/semanage boolean -l | /bin/grep virt_use_sanlock | cut -d ',' -f 2)
+snlkNFS=$(/usr/sbin/semanage boolean -l | /bin/grep sanlock_use_nfs | cut -d ',' -f 2)
 
-if [[ "${virtNFS}" == *off* || "${virtSANLOCK}" == *off* ]]; then
+if [[ "${virtNFS}" == *off* || "${virtSANLOCK}" == *off* || \
+      "${snlkNFS}" == *off* ]]; then
     /usr/sbin/semanage boolean -m -S targeted -F /dev/stdin  << _EOF
 virt_use_nfs=1
 virt_use_sanlock=1
+sanlock_use_nfs=1
 _EOF
 fi
 
 if /usr/sbin/selinuxenabled; then
     /usr/sbin/setsebool virt_use_nfs on
     /usr/sbin/setsebool virt_use_sanlock on
+    /usr/sbin/setsebool sanlock_use_nfs on
 fi
 
 %post
@@ -526,9 +534,6 @@ if [ -f /etc/pki/vdsm/keys/libvirt_password ]; then
         /etc/pki/vdsm/keys/libvirt_password
 fi
 
-# generate the vdsm certificates (if missing)
-%{_libexecdir}/%{vdsm_name}/vdsm-gencerts.sh
-
 %if 0%{?rhel}
 if [ "$1" -eq 1 ] ; then
     /sbin/chkconfig --add vdsmd
@@ -560,11 +565,13 @@ then
     /usr/sbin/semanage boolean -m -S targeted -F /dev/stdin  << _EOF
 virt_use_nfs=0
 virt_use_sanlock=0
+sanlock_use_nfs=0
 _EOF
 
     if /usr/sbin/selinuxenabled; then
         /usr/sbin/setsebool virt_use_nfs off
         /usr/sbin/setsebool virt_use_sanlock off
+        /usr/sbin/setsebool sanlock_use_nfs off
     fi
 
     /usr/sbin/saslpasswd2 -p -a libvirt -d vdsm@rhevh
@@ -998,6 +1005,12 @@ exit 0
 %{_datadir}/%{vdsm_name}/gluster/hostname.py*
 
 %changelog
+* Wed Oct 24 2012 Federico Simoncelli <fsimonce@redhat.com> 4.10.0-13
+- setup: move the certificate generation (#875367, #875368)
+
+* Wed Oct 24 2012 Federico Simoncelli <fsimonce@redhat.com> 4.10.0-12
+- configure selinux for sanlock on nfs
+
 * Sat Oct 20 2012 Peter Robinson <pbrobinson@fedoraproject.org> 4.10.0-11
 - Merge F17 changes into F18+ and disable make check due to pep8 issues
 - Add pyparted dependency