我正在嘗試追蹤rpm.spec文件中%pre /%post scriptlets的最佳做法。RPM%post scriptlet最佳實踐
具體而言,我有一個系統,有一個非常複雜的安裝。除其他事項外,它需要做大量的「安全增強Linux」自定義,iptable的編輯,創建用戶(使用密碼)和「CHOWN」 -ing等
的問題是在哪裏做呢?這應該放入前/後腳本?最好的做法似乎是保持這些爲simple as possible and definitely don't make it interactive。
我注意到Postgres安裝程序(和其他一些)執行「手動安裝後」步驟,其中root用戶需要運行腳本來執行某些操作,例如設置postgres用戶的密碼等。您可以在下面看到它其中的rpm打印這樣的:To initialize, run /etc/init.d/postgres-9.1-openscg start as root user.
下面是所提取的小腳本:
rpm -qp --scripts postgres-9.1.2-1.i386.openscg.rpm
預安裝的scriptlet(使用/ bin/sh的):
if [ "$1" = "2" ]; then
#Perform maintenance tasks before server upgrade begins.
#Determine if server is running, stops it.
/etc/init.d/postgres-9.1-openscg status &> /dev/null
if [ "$?" = "0" ];
then
/etc/init.d/postgres-9.1-openscg stop
touch /tmp/pg_9.1.stopped
fi
fi
安裝後的scriptlet(使用/ bin/sh的):
if type "/usr/bin/chcon" &> /dev/null ; then
/usr/bin/chcon -t textrel_shlib_t $RPM_INSTALL_PREFIX/lib/libedit.so &> /dev/null
fi
#Create a soft link to init script
if [ ! -f /etc/init.d/postgres-9.1-openscg ]
then
ln -s $RPM_INSTALL_PREFIX/bin/postgres-9.1-openscg /etc/init.d/postgres-9.1-openscg
fi
#In case of upgrade, dump environment values file
#if [ "$1" = "2" ];
#then
#Fix for psql dumb terminal issue
LD_PRELOAD_VALUE=""
for libreadline in `find -L /lib -type f -name libreadline.\* 2> /dev/null`
do
LD_PRELOAD_VALUE="$libreadline:$LD_PRELOAD_VALUE"
done
if [ x"$LD_PRELOAD_VALUE" != x"" ];
then
LD_PRELOAD_VALUE="export LD_PRELOAD=$LD_PRELOAD_VALUE"
fi
#Dump environment values
cat <<ENVEOF > $RPM_INSTALL_PREFIX/pg91-openscg.env
#!/bin/bash
$LD_PRELOAD_VALUE
export PGHOME=$RPM_INSTALL_PREFIX
export PGDATA=$RPM_INSTALL_PREFIX/data
export PATH=$RPM_INSTALL_PREFIX/bin:\$PATH
export LD_LIBRARY_PATH=$RPM_INSTALL_PREFIX/lib:\$LD_LIBRARY_PATH
export PGUSER=postgres
export PGDATABASE=postgres
ENVEOF
#Determine port from postgresql.conf
PGPORT_VALUE=""
if [ -f $RPM_INSTALL_PREFIX/data/postgresql.conf ]; then
PGPORT_VALUE=`grep "port =" $RPM_INSTALL_PREFIX/data/postgresql.conf | sed -e "s/^.*port[[:space:]]=[[:space:]]\([0-9]\+\).*$/\1/"`
PGPORT_VALUE="export PGPORT=$PGPORT_VALUE"
cat <<ENVEOF >> $RPM_INSTALL_PREFIX/pg91-openscg.env
$PGPORT_VALUE
ENVEOF
fi
#fi
# If it is an upgrade, and we stopped a running server, start it.
if [ "$1" = "2" -a -f /tmp/pg_9.1.stopped ];
then
rm /tmp/pg_9.1.stopped
/etc/init.d/postgres-9.1-openscg start
fi
if [ "$1" = "1" ];
then
echo "PostgreSQL 9.1 is now installed in $RPM_INSTALL_PREFIX."
echo
echo "To initialize, run /etc/init.d/postgres-9.1-openscg start"
echo "as root user."
fi
if [ "$1" = "2" ];
then
echo "PostgreSQL 9.1 is upgraded in $RPM_INSTALL_PREFIX."
fi
preuninstall scriptlet的(使用/ bin/sh的):
if [ "$1" = "0" ]; then
#Action is uninstallation, not called due to upgrade of a new package
#Determine if server is running, stops it.
/etc/init.d/postgres-9.1-openscg status &> /dev/null
if [ "$?" = "0" ];
then
echo "Attempting to stop server..."
/etc/init.d/postgres-9.1-openscg stop
fi
echo "Attempting to update server startup status..."
if type "/sbin/chkconfig" &> /dev/null ; then
/sbin/chkconfig --del postgres-9.1-openscg
fi
fi
postuninstall scriptlet的(使用/ bin/sh的):
if [ "$1" = "0" ]; then
#Action is uninstallation, not called due to upgrade of a new package
rm /etc/init.d/postgres-9.1-openscg
echo "Uninstallation complete."
fi
不...我得到的互動是壞的...對於我打賭它打破百勝。我的問題是更多...是否可以將條目注入到iptables配置中作爲RPM腳本的一部分?你應該告訴用戶你正在做這件事嗎?你應該像postgres那樣打破它,並要求用戶運行「安裝後腳本」? – mlathe
兩種方式都可以,並且很好的做法。你應該這樣做的方式取決於這種情況下的用戶。他們是技術人員嗎?他們是否理解應用或不應用iptables規則的後果?等等。順便說一下,我在O/S安裝期間在kickstart中設置了iptables。 –
這是一個商業產品,用戶可能是用戶的混合。我認爲在某些情況下,用戶會非常害怕。假設它安裝在政府/軍事系統中,安裝程序現在打開端口並與其他系統配置混合。我認爲Kickstart有點不同,因爲你寫了腳本,所以你知道你在做什麼。我認爲教訓是「這是一條好路線,你應該小心行事」。 – mlathe