AixPb: Put /usr/bin to the front of the PATH #2057

Haroon-Khel · 2021-03-19T10:55:16Z

Following on from a discussion with @sxa in slack, /usr/bin should be at the beginning of the PATH variable, ahead of /opt/freeware/bin

Haroon-Khel · 2021-03-19T10:55:24Z

ping @aixtools

aixtools

Perhaps a typo - missing '/' in string PATH=usr/bin:...

Also, why not use something like the PATH: statement on line 11:

   +10    environment:
  +11      PATH: "/opt/IBM/xlC/13.1.3/bin:/opt/freeware/bin:{{ ansible_env.PATH }}"

And, I wonder if it should not ALSO be changed on line 11?

Haroon-Khel · 2021-03-19T18:17:09Z

I searched through the aix playbook. I dont think that PATH environment variable is used at all. Will need to make a more thorough search

Haroon-Khel · 2021-03-19T18:17:44Z

Before merging, I will have to test a build and test with this new PATH variable

Haroon-Khel · 2021-03-22T15:47:19Z

jdk11 hotspot build on test-ibm-aix71-ppc64-1 with the new PATH variable to test
https://ci.adoptopenjdk.net/job/build-scripts/job/jobs/job/jdk11u/job/jdk11u-aix-ppc64-hotspot/890/console

Haroon-Khel · 2021-03-22T16:30:36Z

jdk11 hotspot build on test-ibm-aix71-ppc64-1 with the new PATH variable to test
https://ci.adoptopenjdk.net/job/build-scripts/job/jobs/job/jdk11u/job/jdk11u-aix-ppc64-hotspot/890/console

That passed. Running a jdk11 openjdk sanity test
https://ci.adoptopenjdk.net/job/Grinder/7960/console

Haroon-Khel · 2021-03-22T18:12:21Z

That too passed. A nightly openj9 jdk8 job is running on the machine. Just for safe measure it can be used as a final indicator as to whether this new PATH variable breaks anything
https://ci.adoptopenjdk.net/job/build-scripts/job/jobs/job/jdk8u/job/jdk8u-aix-ppc64-openj9/999/consoleFull

Haroon-Khel · 2021-03-23T11:36:12Z

The above job passed. Ping @sxa for review

aixtools

While this works - have you tested it to be sure it works a second time?
i.e., when PATH=/usr/bin:/opt/IBM/xlC/13.1.3/bin:/opt/freeware/bin/:...

does not regexp to:

PATH=/usr/bin:/opt/IBM/xlC/13.1.3/bin:/opt/freeware/bin/:/opt/IBM/xlC/13.1.3/bin:/opt/freeware/bin/:...

How about including /etc in the regexp but replacing it - in a way that the regexp will not match a second time around?

Haroon-Khel · 2021-03-24T13:50:50Z

@aixtools Youre right it does.

The /etc idea is good, but the question is will all new machines have a /usr/bin:/etc block in their PATH?

I was thinking the updated PATH could start with /opt/IBM/xlC/13.1.3/bin:/usr/bin:/opt/freeware/bin instead? That would make the change idempotent as there wouldnt be a PATH=/usr/bin to for ansible to find

aixtools · 2021-03-24T14:28:08Z

I can look at few more systems for a default. If needed - in the future this could use an with: items: on the regexp. For now, =/usr/bin:/etc:... seems to have been default PATH for many levels.

…

On 24/03/2021 14:51, Haroon Khel wrote: @aixtools <https://github.com/aixtools> Youre right it does. The |/etc| idea is good, but the question is will all new machines have a |/usr/bin:/etc| block in their PATH? I was thinking the new PATH could be |/opt/IBM/xlC/13.1.3/bin:/usr/bin:/opt/freeware/bin|? That would make the change idempotent as there wouldnt be a |PATH=/usr/bin| to for ansible to find — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#2057 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACSZR5J3A4MVIPS25XO25OLTFHU43ANCNFSM4ZORVH4Q>.

Haroon-Khel · 2021-03-24T16:14:51Z

That works. This regexp is now idempotent

sxa

Can we ensure that this does not run if the adoptopenjdk tag is skipped - we shouldn't be modfiying system defaults like this if someone else is running them and skipping the adoptopenjdk ones, especially since it could remove things that they already have in there.

Haroon-Khel · 2021-03-24T17:02:55Z

@sxa Just that task? Or the other login_shell tagged tasks too?

    - name: Add bash to available login shells
      replace:
        path: /etc/security/login.cfg
        regexp: 'shells = '
        replace: 'shells = /bin/bash,'
      tags: login_shell

    - name: Add bash to available login shells
      blockinfile:
        dest: /etc/shells
        block: |
          /bin/bash
      tags: login_shell

    # move to role later
    - name: Set variables for global environment
      blockinfile:
        dest: /etc/environment
        block: |
          AIXTHREAD_HRT=true
          PKG_CONFIG_PATH=/opt/freeware/lib64/pkgconfig:/opt/freeware/lib/pkgconfig
          PERL5LIB=/opt/freemarker/lib/perl5
      tags: login_shell

sxa · 2021-03-24T17:26:21Z

Can we ensure that this does not run if the adoptopenjdk tag is skipped - we shouldn't be modfiying system defaults like this if someone else is running them and skipping the adoptopenjdk ones, especially since it could remove things that they already have in there.

Most of those are additions rather than potentially breaking things, so while it's not as critical, I'd say that yes they should all have it, although I'm not sure why we need to add bash to the list. It shouldn't be critical for jenkins to work.

aixtools

Couple of things:

Considering /bin/bash is a symbolic link outside of / I do not consider it a fantastic argument for a shell (for AIX admin accounts - /bin/sh and /bin/ksh used to be as login shells AND the AIX install makes sure 'shells' are installed as binary programs - not links - these may be in the default shells - BETTER - would be (even as a symbolic link) as more inline with AIX user administration to have the bash shell be /usr/bin/bash.
Also, the regexp used to add bash as a shell leaves it open for recursive addition
Suggestion: replace regexp with 'shells = /bin' and the new string to be 'shells = /usr/bin/bash,/usr'

aixtools

replace /bin/bash with /usr/bin/bash

aixtools

Urgh - my two - now comments - are meant as request changes - so this comment is actually two requests for change

Haroon-Khel · 2021-03-26T16:20:32Z

@aixtools instead of a regexp, why not something like

chsec -f /etc/security/login.cfg -s usw -a shells=/usr/bin/bash ?

On ojdk06, the shells in /etc/security/login.cfg in the usw stanza are

/usr/bin/ksh,/usr/bin/ksh93,/usr/bin/rksh,/usr/bin/rksh93,/bin/false

So how about something tidier like

chsec -f /etc/security/login.cfg -s usw -a shells=/usr/bin/bash,/usr/bin/ksh ?

Would that suffice? This command is also idempotent

aixtools · 2021-04-01T10:22:04Z

That the shells include /bin/false is part of my standard hardening (and I have already shortened the default list of shells)
Using command: chsec seems like a good idea - but to be completely idempotent still use something to check if bash is already among the shells (e.g, not the first one).
Deleting shells is not a major issue (it mainly affects chsh iirc, but please leave /bin/false as a security measure (to block accounts that are not meant to have a shell from ever getting a shell, even via su).

Haroon-Khel · 2021-04-01T14:08:23Z

@aixtools regarding your idempotency comment, would it not be more consistent for all new systems to simply have /usr/bin/bash,/usr/bin/ksh,/bin/false in their shells line?

Also, would changing this list of shells affect the way jenkins behaves on the machine?

aixtools · 2021-04-07T08:26:34Z

@aixtools regarding your idempotency comment, would it not be more consistent for all new systems to simply have /usr/bin/bash,/usr/bin/ksh,/bin/false in their shells line?

Also, would changing this list of shells affect the way jenkins behaves on the machine?

No, won't change anything for existing accounts. It changes the behavior of mkuser, chuser, and chsh - all from memory.
I am fine with only three shells in the setting - and the regexp can be to test for that string, and change it if it is different. Should something additional ever be needed - there will be an issue and a PR to fix it. I don't expect anything. Although - would be nice to leave ksh93. :)

aixtools · 2021-04-08T05:52:44Z

Can we ensure that this does not run if the adoptopenjdk tag is skipped - we shouldn't be modfiying system defaults like this if someone else is running them and skipping the adoptopenjdk ones, especially since it could remove things that they already have in there.

Most of those are additions rather than potentially breaking things, so while it's not as critical, I'd say that yes they should all have it, although I'm not sure why we need to add bash to the list. It shouldn't be critical for jenkins to work.

FYI: jenkins userid does not need bash as shell. iirc - gmake is calling bash directly.

aixtools · 2021-04-13T08:33:22Z

Fixes: #1544

sxa · 2021-04-30T09:25:28Z

FYI: jenkins userid does not need bash as shell. iirc - gmake is calling bash directly.
Correct - in fact the playbooks create the jenkins user with /usr/bin/ksh as the shell so ... to be honest I don't know why we even make that change - presumably somewhere in the past liked creating other user IDs with bash as the shell ;-)

sxa

For reference, the existing /etc/security/login.cfg on aix72-2 (ojdk04) looks like this:
shells = /bin/bash,/bin/bash,/bin/bash,/bin/bash,/bin/bash,/bin/bash,/bin/bash,/bin/bash,/bin/sh,/bin/bsh,/bin/csh,/bin/ksh,/bin/tsh,/bin/ksh93,/usr/bin/sh,/usr/bin/bsh,/usr/bin/csh,/usr/bin/ksh,/usr/bin/tsh,/usr/bin/ksh93,/usr/bin/rksh,/usr/bin/rksh93,/usr/sbin/uucp/uucico,/usr/sbin/sliplogin,/usr/sbin/snappd
And the chsec command will wipe most of those out, which seems somewat undersirable. I feel this role needs to just add entries, not change the ones already on the system.

However I'm not sure what the relationship between these entries and /etc/shells is - @aixtools do you know?

aixtools · 2021-07-07T18:58:46Z

@sxa - not sure why or when /etc/shells showed up in AIX.

it exists in AIX 5.3 (so as early as 2004)
it may have come with AIX 5.1 as part of Linux affinity (since Linux chsh uses /etc/shells the same way AIX chsh uses shells attribute of stanza usw in /etc/login.cfg.
As far as I know the shells attribute is the only bit that affects chsh, and perhaps [mk|ch]user commands.

Haroon-Khel · 2021-08-03T12:25:10Z

Closing due to pr not passing eclipse auth check. Reopened at #2288

reverse aix path

d9e177a

Haroon-Khel added the os:aix label Mar 19, 2021

Haroon-Khel added this to the March 2021 milestone Mar 19, 2021

Haroon-Khel requested a review from sxa March 19, 2021 10:55

github-actions bot added the ansible label Mar 19, 2021

Haroon-Khel changed the title ~~AixPb: reverse aix path~~ AixPb: Put /usr/bin to the front of the PATH Mar 19, 2021

aixtools suggested changes Mar 19, 2021

View reviewed changes

path typo

15dcc9c

aixtools approved these changes Mar 19, 2021

View reviewed changes

aixtools suggested changes Mar 24, 2021

View reviewed changes

change regexp to /usr/bin:/etc

92f873f

sxa requested changes Mar 24, 2021

View reviewed changes

add adoptopenjdk tags

2f96d9d

Haroon-Khel requested review from sxa and aixtools March 24, 2021 17:43

aixtools suggested changes Mar 26, 2021

View reviewed changes

aixtools reviewed Mar 26, 2021

View reviewed changes

aixtools suggested changes Mar 26, 2021

View reviewed changes

karianna modified the milestones: March 2021, April 2021 Apr 1, 2021

replace regex with chsec command

ed48224

Haroon-Khel mentioned this pull request Apr 6, 2021

AIX playbook should not put /opt/freeware/bin at start of /etc/environment #1544

Open

sxa reviewed Apr 30, 2021

View reviewed changes

karianna modified the milestones: April 2021, May 2021 May 4, 2021

Haroon-Khel modified the milestones: May 2021, June 2021 Jun 21, 2021

sxa modified the milestones: June 2021, July 2021 Jul 5, 2021

Haroon-Khel added 3 commits August 3, 2021 12:56

remove login shell changes

954c6ed

trailing spaces

364d747

last trailing space

3309c2e

Haroon-Khel mentioned this pull request Aug 3, 2021

AixPB: Put /usr/bin at the front of PATH for AIX #2288

Closed

5 tasks

Haroon-Khel closed this Aug 3, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

AixPb: Put /usr/bin to the front of the PATH #2057

AixPb: Put /usr/bin to the front of the PATH #2057

Haroon-Khel commented Mar 19, 2021

Haroon-Khel commented Mar 19, 2021

aixtools left a comment

Haroon-Khel commented Mar 19, 2021

Haroon-Khel commented Mar 19, 2021

Haroon-Khel commented Mar 22, 2021

Haroon-Khel commented Mar 22, 2021

Haroon-Khel commented Mar 22, 2021

Haroon-Khel commented Mar 23, 2021 •

edited

Loading

aixtools left a comment

Haroon-Khel commented Mar 24, 2021 •

edited

Loading

aixtools commented Mar 24, 2021 via email

Haroon-Khel commented Mar 24, 2021

sxa left a comment

Haroon-Khel commented Mar 24, 2021

sxa commented Mar 24, 2021

aixtools left a comment

aixtools left a comment

aixtools left a comment

Haroon-Khel commented Mar 26, 2021 •

edited

Loading

aixtools commented Apr 1, 2021

Haroon-Khel commented Apr 1, 2021

aixtools commented Apr 7, 2021

aixtools commented Apr 8, 2021

aixtools commented Apr 13, 2021

sxa commented Apr 30, 2021

sxa left a comment •

edited

Loading

aixtools commented Jul 7, 2021

Haroon-Khel commented Aug 3, 2021

AixPb: Put /usr/bin to the front of the PATH #2057

AixPb: Put /usr/bin to the front of the PATH #2057

Conversation

Haroon-Khel commented Mar 19, 2021

Haroon-Khel commented Mar 19, 2021

aixtools left a comment

Choose a reason for hiding this comment

Haroon-Khel commented Mar 19, 2021

Haroon-Khel commented Mar 19, 2021

Haroon-Khel commented Mar 22, 2021

Haroon-Khel commented Mar 22, 2021

Haroon-Khel commented Mar 22, 2021

Haroon-Khel commented Mar 23, 2021 • edited Loading

aixtools left a comment

Choose a reason for hiding this comment

Haroon-Khel commented Mar 24, 2021 • edited Loading

aixtools commented Mar 24, 2021 via email

Haroon-Khel commented Mar 24, 2021

sxa left a comment

Choose a reason for hiding this comment

Haroon-Khel commented Mar 24, 2021

sxa commented Mar 24, 2021

aixtools left a comment

Choose a reason for hiding this comment

aixtools left a comment

Choose a reason for hiding this comment

aixtools left a comment

Choose a reason for hiding this comment

Haroon-Khel commented Mar 26, 2021 • edited Loading

aixtools commented Apr 1, 2021

Haroon-Khel commented Apr 1, 2021

aixtools commented Apr 7, 2021

aixtools commented Apr 8, 2021

aixtools commented Apr 13, 2021

sxa commented Apr 30, 2021

sxa left a comment • edited Loading

Choose a reason for hiding this comment

aixtools commented Jul 7, 2021

Haroon-Khel commented Aug 3, 2021

Haroon-Khel commented Mar 23, 2021 •

edited

Loading

Haroon-Khel commented Mar 24, 2021 •

edited

Loading

Haroon-Khel commented Mar 26, 2021 •

edited

Loading

sxa left a comment •

edited

Loading