1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
|
From: Philip Hands <phil@hands.com>
Date: Mon, 22 Feb 2021 11:52:10 +0100
Subject: Debian uses apt to list packages
Forwarded: not-needed
---
etc/openqa/workers.ini | 2 +-
profiles/apparmor.d/usr.share.openqa.script.worker | 10 ++++++++++
2 files changed, 11 insertions(+), 1 deletion(-)
diff --git a/etc/openqa/workers.ini b/etc/openqa/workers.ini
index c6126d1..35be33d 100644
--- a/etc/openqa/workers.ini
+++ b/etc/openqa/workers.ini
@@ -75,7 +75,7 @@
# packages against the list of packages during the previous last good job.
# Configuring this variable provides a command line to list the packages and
# their versions in plain text.
-#PACKAGES_CMD = rpm -qa
+#PACKAGES_CMD = apt list --installed
# Specifies the threshold to consider the load on the machine critical. If the
# average load (over the last 15 minutes) exceeds the specified value the worker
diff --git a/profiles/apparmor.d/usr.share.openqa.script.worker b/profiles/apparmor.d/usr.share.openqa.script.worker
index fe30c88..3e896b2 100644
--- a/profiles/apparmor.d/usr.share.openqa.script.worker
+++ b/profiles/apparmor.d/usr.share.openqa.script.worker
@@ -30,8 +30,11 @@
/dev/ptmx rw,
/dev/pts/* rw,
/dev/tty rw,
+ /etc/apt/** r,
+ /etc/dpkg/dpkg.cfg{,.d,.d/*} r,
/etc/gitconfig r,
/etc/libnl/classid r,
+ /etc/machine-id r,
/etc/openqa/client.conf r,
/etc/openqa/client.conf.d/ r,
/etc/openqa/client.conf.d/** r,
@@ -59,6 +62,7 @@
/dev/shm/libpod_rootless_lock_* rw,
/proc/*/auxv r,
/proc/*/cmdline r,
+ /proc/*/fd/ r,
/proc/*/mountinfo r,
/proc/*/net/psched r,
/proc/*/stat r,
@@ -87,12 +91,14 @@
/sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,
/tmp/** rwk,
/usr/bin/Xvnc rCx,
+ /usr/bin/apt rix,
/{usr/,}bin/cat rix,
/usr/bin/chattr rix,
/usr/bin/cksum rix,
/usr/bin/cp rix,
/usr/bin/date rix,
/usr/bin/dirname rix,
+ /usr/bin/dpkg rix,
/usr/bin/eatmydata rix,
/usr/bin/env rix,
/usr/bin/find rix,
@@ -142,6 +148,7 @@
/usr/bin/x3270 cx,
/usr/bin/xterm-console rix,
/usr/bin/xz rix,
+ /var/cache/apt/** r,
/usr/lib*/qemu/block-curl.so rix,
/usr/lib*/qemu/block-iscsi.so mr,
/usr/lib*/qemu/block-rbd.so mr,
@@ -156,6 +163,7 @@
/usr/lib/utempter/utempter rix,
/usr/sbin/smbd rix,
/usr/sbin/ipmiconsole rix,
+ /usr/share/dpkg/* r,
/usr/share/openqa/lib/** r,
/usr/share/openqa/lib/DBIx/Class/Timestamps.pm r,
/usr/share/openqa/lib/OpenQA/** r,
@@ -167,6 +175,8 @@
/usr/share/seabios/* r,
/usr/share/qemu/keymaps/* r,
/usr/share/{AA,O}VMF/* rk,
+ /var/lib/apt/** r,
+ /var/lib/dpkg/status r,
/var/lib/openqa/cache/ r,
/var/lib/openqa/cache/** rwk,
/var/lib/openqa/pool/ r,
|
