[Starlingx-discuss] fmClientCli and fm_core usage without keystone authentication

[Liu, Tao]

If the decision is to remove the fmClientCli  utility from the image,  one or two dependencies will also need to be updated (i.e. IMA appraisal failure event is raised using this tool).

Tao

-----Original Message-----
From: Jones, Bruce E [mailto:bruce.e.jones at intel.com] 
Sent: Tuesday, October 15, 2019 5:58 PM
To: Liu, Tao; Cordoba Malibran, Erich; starlingx-discuss at lists.starlingx.io
Subject: RE: [Starlingx-discuss] fmClientCli and fm_core usage without keystone authentication

Bug https://bugs.launchpad.net/starlingx/+bug/1848280 filed for this issue.

       brucej

-----Original Message-----
From: Liu, Tao [mailto:Tao.Liu at windriver.com] 
Sent: Tuesday, October 15, 2019 2:43 PM
To: Cordoba Malibran, Erich <erich.cordoba.malibran at intel.com>; starlingx-discuss at lists.starlingx.io
Subject: Re: [Starlingx-discuss] fmClientCli and fm_core usage without keystone authentication

Hi Erich

The fmClientCli is not a customer interface and it does not require authentication.  This tool is mainly used for debugging/testing and it requires access to a shell session.  
It is debatable whether this tool should be packaged in the load.

The fm cli (from python-fmclient) that requires authentication is the fm shell and it supports the following subcommands:
    alarm-delete        Delete an active alarm.
    alarm-list          List all active alarms.
    alarm-show          Show an active alarm.
    alarm-summary       Show a summary of active alarms.
    event-list          List event logs.
    event-show          Show an event log.
    event-suppress      Suppress specified Event ID's.
    event-suppress-list
                        List Suppressed Event ID's
    event-unsuppress    Unsuppress specified Event ID's.
    event-unsuppress-all
                        Unsuppress all Event ID's.

Tao

-----Original Message-----
From: Cordoba Malibran, Erich [mailto:erich.cordoba.malibran at intel.com]
Sent: Tuesday, October 15, 2019 5:00 PM
To: starlingx-discuss at lists.starlingx.io
Subject: [Starlingx-discuss] fmClientCli and fm_core usage without keystone authentication

Hi,

I was playing around with fault components and I noticed that I'm able to query, create and delete alarms with fmClientCli and the fm_core python module.

As I understand the `fm` cli (from python-fmclient) creates a request to keystone before connecting to the fm-rest-api to perform the operation. However this is not the case for fmClientCli, I can create an alarm with the following command. 

$ fmClientCli -c "blabla###100.114###set###host###host=controller-0.ntp###2019-10-14 02:28:09.5432###major###This is a dummy alarm created by hand###communication###not-applicable###Monitor and if condition persists, we are sorry###False###True###False###"

and delete it with:

$ fmClientCli -d "###100.114###host=controller-0.ntp"

This without doing the `source /etc/platform/openrc`, I'm even allowed to create alarms from a non sysadmin user.

The same case with the `fm_core` python module, which links with libfmcommon as fmClientCli does.

>>> fm_core.get_by_eid("host=controller-0")
['c0d94f45-bc6d-4709-9cc6-6a937659c593###100.114###set###host###host=controller-0.ntp###2019-10-14 02:28:09.005432###major###This is a dummy alarm created by hand###communication###not-applicable###Monitor and if condition persists, we are sorry###False###True###False###']


So, I'm wondering if this an expected behavior or something is missing in libfmcommon to enable authentication.

Also, do you know if the fmClientCli tool is really used?

Thanks!

-Erich




_______________________________________________
Starlingx-discuss mailing list
Starlingx-discuss at lists.starlingx.io
http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
_______________________________________________
Starlingx-discuss mailing list
Starlingx-discuss at lists.starlingx.io
http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss