Add checks for atomic update compatibility

Author: mtravitzky

configs/openSUSE/opensuse.toml

@@ -6,6 +6,10 @@ UseVarLockSubsys = false
 UseVersionInChangelog = false
 BadnessThreshold = 999
 
+# Set to true to issue a warning for ghost entries outside snapshots
+# when checking for atomic update compatibility
+AtomicCheckGhosts = false
+
 # Enabled checks for the rpmlint to be run (besides the default set)
 Checks = [
     "BashismsCheck",
@@ -24,13 +28,33 @@ Checks = [
     "SystemdTmpfilesCheck",
     "SUIDPermissionsCheck",
     "WorldWritableCheck",
+    "AtomicUpdateCheck",
 ]
 
 # List of directory prefixes that are not allowed in packages
 DisallowedDirs = [
     "/etc/NetworkManager/dispatcher.d",
 ]
 
+# Only these directories may be used by packages compatible with
+# atomic updates
+AtomicAllowedDirs = [
+    "/etc/",
+    "/usr/",
+    "/bin/",
+    "/lib/",
+    "/lib64/",
+    "/sbin/",
+    "/boot/",
+]
+
+# List of subdirectories which are disallowed for atomic updates
+# despite being within otherwise allowed directories
+AtomicDisallowedSubdirs = [
+    "/usr/local/",
+    "/boot/efi/",
+]
+
 FilterErrorTitles = [
     'cross-directory-hard-link',
 ]
@@ -83,6 +107,7 @@ Filters = [
     '^filesystem\..*: dir-or-file-in-tmp',
     '^filesystem\..*: dir-or-file-in-mnt',
     '^filesystem\..*: dir-or-file-in-home',
+    '^filesystem\..*: dir-or-file-outside-snapshot',
     '^filesystem\..*: hidden-file-or-dir /root/.gnupg',
     '^filesystem\..*: hidden-file-or-dir /root/.gnupg',
     '^filesystem\..*: hidden-file-or-dir /etc/skel/.config',

configs/openSUSE/scoring.toml

@@ -102,3 +102,7 @@ zypperplugin-file-unauthorized = 10
 patch-macro-old-format = 10000
 # TODO: raise to 10,000 after we surveyed affected packages
 logrotate-user-writable-log-dir = 100
+
+# Set to 10000 once affected packages have been updated
+# for atomic update compatibility
+dir-or-file-outside-snapshot = 100

rpmlint/checks/AtomicUpdateCheck.py

@@ -0,0 +1,44 @@
+from rpmlint.checks.AbstractCheck import AbstractCheck
+
+
+class AtomicUpdateCheck(AbstractCheck):
+
+    """
+    Requirements for atomic updates:
+        * All files must be stored inside the snapshot, which is in our case /etc and /usr, not /var,
+          /opt, /srv, /usr/local or anything else.
+        * (Re)starting daemons is not possible.
+        * Modifying files outside of /usr and /etc is not possible.
+        * Modifications outside the snapshot have to be done via systemd-tmpfiles and systemd services.
+    This check currently only implements checking for files at illegal paths.
+    """
+
+    def __init__(self, config, output):
+        super().__init__(config, output)
+        self.check_ghosts = self.config.configuration['AtomicCheckGhosts']
+        self.allowed_dirs = self.config.configuration['AtomicAllowedDirs']
+        self.disallowed_subdirs = self.config.configuration['AtomicDisallowedSubdirs']
+
+    def check(self, pkg):
+        if pkg.is_source:
+            return
+
+        # Check for files stored outside the snapshot
+        self._check_paths(pkg, self.check_ghosts)
+
+    def _check_paths(self, pkg, check_ghosts=False):
+        for file in pkg.files.keys():
+            if file in pkg.ghost_files:
+                continue  # Ghosts are only handled if explicitly desired
+            if not (self._check_single_path(file)):
+                self.output.add_info('E', pkg, 'dir-or-file-outside-snapshot', file)
+        if check_ghosts:
+            for ghost in pkg.ghost_files:
+                if not (self._check_single_path(ghost)):
+                    self.output.add_info('W', pkg, 'ghost-outside-snapshot', ghost)
+
+    def _check_single_path(self, file):
+        return (
+            file.startswith(tuple(self.allowed_dirs)) and
+            not file.startswith(tuple(self.disallowed_subdirs))
+        )

rpmlint/descriptions/AtomicUpdateCheck.toml

@@ -0,0 +1,9 @@
+dir-or-file-outside-snapshot="""
+The package contains files outside the snapshot, e.g. outside /etc and /usr
+or inside /usr/local.
+"""
+ghost-outside-snapshot="""
+The package contains ghosts outside the snapshot, e.g. outside /etc and /usr
+or inside /usr/local. This might become an issue upon removal of this
+package, but not during installation.
+"""