4.22. conga

BZ#741169

Prior to this update, when a new cluster was being created with luci, and luci tried to list, install or update cluster packages, the installation process could become unresponsive and could not finish. With this update, the bug has been fixed, and the creation of a new cluster now completes successfully in the described scenario.

Security Fixes

CVE-2010-1104, CVE-2011-1948

Multiple cross-site scripting (XSS) flaws were found in luci, the conga web-based administration application. If a remote attacker could trick a user, who was logged into the luci interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's luci session.

Bug Fixes

BZ#709478

Previously, due to incorrect permissions from libvirt, the ricci daemon failed to detect if a host was capable of running a virtual machine. As a consequence, the Add a Virtual Machine Service tab was not displayed under Services when using the luci tool. With this update, calling the virsh program is now avoided, and the Add a Virtual Machine Service tab is now displayed under Services.

BZ#723000

If the user modified in luci the name attribute of a shared resource that was attached to an existing service, the ref attribute for the shared resource in the cluster.conf file was not updated. With this update, luci is modified so that the ref attribute in cluster.conf is correctly updated to reflect the new name of the resource.

BZ#723188

Previously, luci did not allow users to modify the __max_restarts and __restart_expire_time attributes for independent subtrees, but only for non-critical resources. If the user tried to set values for "Maximum number of restart failures before giving up (applies only for non-critical resources)" and "Restart expire time (applies only for non-critical resources)", these values were not added for the resource in the cluster.conf file. This update modifies luci so that users are now able to modify the aforementioned values in luci.

BZ#732483

Prior to this update, execution of external programs (such as /usr/sbin/clustat) from within the modclusterd daemon or ricci's helper program, modcluster, could make these unresponsive. In such a case, processes depending on them could also become unresponsive or indicate an error. For example, in tools like luci, the affected node could be listed as having communications problems, or the cluster creation could become unresponsive. Patches have been applied to address this issue, and deadlocks no longer occur when executing external programs.

BZ#734562

When adding a resource to a service, luci only checked to verify that the name of the resource did not match the name of a resource in the resources stanza. The luci tool did not check to see if any resources in other services shared the same name, and therefore allowed users to create two services with the resources of the same name. This led to unique attribute collisions. With this update, luci's name validation is improved, and adding a resource to a service no longer leads to collisions. In addition, certain error messages have been modified to display more verbose information.

BZ#739600

Previously, users were able to insert the quote character (") with NFS resources in the "resources" section of the cluster configuration in conga. The resource data submitted for this service was not properly formed and converted into the cluster.conf file. With this update, if the user inserts the quote character, the following error message appears:

The resource data submitted for this service is not properly formed

BZ#755941

Previously, the luci_admin restore command did not fully restore a database to the original state. This was because the luci_admin script only added items contained in the previously generated backup XML file. This update adds new options, -u (--update) and -r (--replace), that are used to either keep or remove existing configuration when restoring a database.

Enhancement

BZ#751359

The fence_ipmilan agent has been updated to support the "-L" option of the ipmilan daemon, thus supporting fencing with user session privileges level.