GitLab

Loopback mount @TBROOT@/lib/geni-lib directory read-only in the jail.
This way we don't have to copy geni-lib stuff into the base jail and worry
about multiple versions. The version mounted in the jail can either be
the standard version or a dev-tree version depending on which copy of the
script is run.

Create per-instance snapshots of the base jail rather than having one
"current" snapshot that all instances used. Not as efficient, but allows
us to update the base (e.g., with security fixes) without needing to
remember to create a new "current" snapshot!

Add -C option to just create a jail instance without running anything
in it. Then you can use "jexec" to test stuff in the jail. Use the new
-R option afterward to remove the instance.

Try to sanitize the environment passed to the command script. We cannot
just give it a "clean" environment because genilib passes stuff via the
environment. So we get rid of SUDO_* and SSH_* and set the assorted USER*
variables correctly. This may have to be refined depending on how much
geni-lib scripts expect from the environment.

new profile version.

we cannot get their project list, which causes create_instance to fail.

genilib-iocage uses the FreeBSD "iocage" jail management package to
setup a jail, run the script, and teardown the jail. Unfortunately,
this version is really, really slow (11 seconds for a one-shot jail).

So instead we will use genilib-jail which uses the template jail instance
I built using iocage, but creates the one-off jails by using raw zfs and
jail commands. It runs in about 1.3 seconds. genilib-iocage is left in
case the author speeds it up someday.

N.B. these are NOT plug in replacements for rungenilib.proxy.in.
In particular, the new scripts run as root and don't do any validation
of the caller or arguments. So genilib-jail will be called from rungenilib
for now (though I have not done that part yet!)

Do what we do in FreeBSD slicefix to set the console correctly.
Not perfect, but it is what it is.

Fix long standing bug that left garbage at the end of grub.cfg.
We were fixing grub.cfg by opening it for read/write, reading in the
whole file, fixing it, seeking to zero, and writing it back out.
However, if our fixes resulted in a shorter file than before, the
excess bits would be left in the file. Instead, we now truncate after
seeking to zero and before re-writing.

Fix another issue with CentOS 7. Make sure we look for linux16 and
initrd16 as well as linux and initrd.

both sides of the wires table for external network nodes.

the experiment expired (instead of being explicitly terminated).

In the current FreeNAS, the only options for configuring the web server
are to listen on a specific IP or to listen on INADDR_ANY. If you do the
former, then you cannot connect via "localhost". If you do the latter,
then any experiment with an iSCSI blockstore could connect (via its
per-blockstore VLAN/subnet/IP). While authentication is required to
connect, the latter still makes me nervous.

Note that I didn't have to change the "Dave API" to not use localhost
as it appears to hook in below the web server.

This REPLACES FreeNAS 9.2 support. The two are incompatible.

This new code uses the REST API whereever possible (i.e., when it is
implemented and works). There is some client-side reorg going on too.

Assigning -1 to (char) and then converting back to (int) did not seem
to sign extend--the result was 255 (0xff).

log file (after an AuditFork) to get immediately closed.

Also add some debugging stuff.

This avoids a problem that Chrome will try to save to file, if there are
control chars in the output (which there are on most of our consoles).

1. Do not pass -u option (update mode) to the mapper call in GetTicket, if
   not actually an update. This will now cause the mapper to pass the -F
   option to assign, so that fixnode (by the user rspec) will not override
   normal constraint checking.

2. MAINSITE: Add d820-explicit desire so we can actually use the shared
   node pool.

3. Add checks for out of memory errors from assign, and pass that back for
   the caller.

does not override normal constraint checking.