IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Add support for systemd environments and use it to support Fedora 16

Browse Source 
https://fedorahosted.org/freeipa/ticket/1192
This commit is contained in:
Alexander Bokovoy
2011-10-10 15:25:15 +03:00
committed by Martin Kosek
parent f098b213eb
commit 25d5d7ed93
11 changed files with 371 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
Makefile
View File

@@ -8,7 +8,7 @@ PRJ_PREFIX=freeipa
RPMBUILD ?= $(PWD)/rpmbuild
TARGET ?= master
SUPPORTED_PLATFORM=redhat
SUPPORTED_PLATFORM ?= redhat
# After updating the version in VERSION you should run the version-update
# target.

0
ipa.init → init/SystemV/ipa.init Executable file → Normal file
View File

14
init/systemd/ipa.service Normal file
View File

@@ -0,0 +1,14 @@
[Unit]
Description=Identity, Policy, Audit
Requires=syslog.target network.target
After=syslog.target network.target
[Service]
Type=oneshot
ExecStart=/usr/sbin/ipactl start
ExecStop=/usr/sbin/ipactl stop
RemainAfterExit=yes
TimeoutSec=0
[Install]
WantedBy=multi-user.target

12
install/tools/ipactl
View File

@@ -24,7 +24,7 @@ try:
from ipaserver.install import service
from ipapython import services as ipaservices
from ipaserver.install.dsinstance import config_dirname, realm_to_serverid
from ipaserver.install.installutils import is_ipa_configured
from ipaserver.install.installutils import is_ipa_configured, wait_for_open_ports, wait_for_open_socket
from ipapython import sysrestore
from ipapython import config
from ipalib import api, errors
@@ -32,6 +32,7 @@ try:
import logging
import ldap
import ldap.sasl
import ldapurl
import socket
except ImportError:
print >> sys.stderr, """\
@@ -117,6 +118,15 @@ def get_config():
attrs = ['cn', 'ipaConfigString']
try:
# systemd services are so fast that we come here before
# Directory Server actually starts listening. Wait for
# the socket/port be really available.
lurl = ldapurl.LDAPUrl(api.env.ldap_uri)
if lurl.urlscheme == 'ldapi':
wait_for_open_socket(lurl.hostport, timeout=6)
else:
(host,port) = lurl.hostport.split(':')
wait_for_open_ports(host, [int(port)], timeout=6)
con = ldap.initialize(api.env.ldap_uri)
con.sasl_interactive_bind_s('', SASL_EXTERNAL)
res = con.search_st(base,

14
ipapython/platform/base.py
View File

@@ -22,7 +22,7 @@ from ipalib.plugable import MagicDict
# set them as in Red Hat distributions. Actual implementation should make them available
# through knownservices.<name> and take care of remapping internally, if needed
wellknownservices = ['certmonger', 'dirsrv', 'httpd', 'ipa', 'krb5kdc', 'messagebus',
'nslcd', 'nscd', 'ntpd', 'portmap', 'rpcbind']
'nslcd', 'nscd', 'ntpd', 'portmap', 'rpcbind', 'kadmin']
class AuthConfig(object):
"""
@@ -120,25 +120,25 @@ class PlatformService(object):
def restart(self, instance_name="", capture_output=True):
return
def is_running(self):
def is_running(self, instance_name=""):
return False
def is_installed(self):
return False
def is_enabled(self):
def is_enabled(self, instance_name=""):
return False
def enable(self):
def enable(self, instance_name=""):
return
def disable(self):
def disable(self, instance_name=""):
return
def install(self):
def install(self, instance_name=""):
return
def remove(self):
def remove(self, instance_name=""):
return
class KnownServices(MagicDict):

123
ipapython/platform/fedora16.py Normal file
View File

@@ -0,0 +1,123 @@
# Author: Alexander Bokovoy <abokovoy@redhat.com>
#
# Copyright (C) 2011 Red Hat
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
from ipapython import ipautil
from ipapython.platform import base, redhat, systemd
import os
# All what we allow exporting directly from this module
# Everything else is made available through these symbols when they directly imported into ipapython.services:
# authconfig -- class reference for platform-specific implementation of authconfig(8)
# service -- class reference for platform-specific implementation of a PlatformService class
# knownservices -- factory instance to access named services IPA cares about, names are ipapython.services.wellknownservices
# backup_and_replace_hostname -- platform-specific way to set hostname and make it persistent over reboots
# restore_context -- platform-sepcific way to restore security context, if applicable
__all__ = ['authconfig', 'service', 'knownservices', 'backup_and_replace_hostname', 'restore_context']
# For beginning just remap names to add .service
# As more services will migrate to systemd, unit names will deviate and
# mapping will be kept in this dictionary
system_units = dict(map(lambda x: (x, "%s.service" % (x)), base.wellknownservices))
# Rewrite dirsrv and pki-cad services as they support instances via separate service generator
# To make this working, one needs to have both foo@.service and foo.target -- the latter is used
# when request should be coming for all instances (like stop). systemd, unfortunately, does not allow
# to request action for all service instances at once if only foo@.service unit is available.
# To add more, if any of those services need to be started/stopped automagically, one needs to manually
# create symlinks in /etc/systemd/system/foo.target.wants/ (look into systemd.py's enable() code).
system_units['dirsrv'] = 'dirsrv@.service'
# Our directory server instance for PKI is dirsrv@PKI-IPA.service
system_units['pkids'] = 'dirsrv@PKI-IPA.service'
# Our PKI instance is pki-cad@pki-ca.service
system_units['pki-cad'] = 'pki-cad@pki-ca.service'
class Fedora16Service(systemd.SystemdService):
def __init__(self, service_name):
if service_name in system_units:
service_name = system_units[service_name]
else:
if len(service_name.split('.')) == 1:
# if service_name does not have a dot, it is not foo.service and not a foo.target
# Thus, not correct service name for systemd, default to foo.service style then
service_name = "%s.service" % (service_name)
super(Fedora16Service, self).__init__(service_name)
# Special handling of directory server service
# LimitNOFILE needs to be increased or any value set in the directory for this value will fail
# Read /lib/systemd/system/dirsrv@.service for details.
# We do modification of LimitNOFILE on service.enable() but we also need to explicitly enable instances
# to install proper symlinks as dirsrv.target.wants/ dependencies. Unfortunately, ipa-server-install
# does not do explicit dirsrv.enable() because the service startup is handled by ipactl.
# If we wouldn't do this, our instances will not be started as systemd would not have any clue
# about instances (PKI-IPA and the domain we serve) at all. Thus, hook into dirsrv.restart().
class Fedora16DirectoryService(Fedora16Service):
def enable(self, instance_name=""):
super(Fedora16DirectoryService, self).enable(instance_name)
srv_etc = os.path.join(self.SYSTEMD_ETC_PATH, self.service_name)
if os.path.exists(srv_etc):
# We need to enable LimitNOFILE=8192 in the dirsrv@.service
# We rely on the fact that [Service] section is the last one
# and if variable is not there, it will be added as the last line
replacevars = {'LimitNOFILE':'8192'}
ipautil.config_replace_variables(srv_etc, replacevars=replacevars)
redhat.restore_context(srv_etc)
ipautil.run(["/bin/systemctl", "--system", "daemon-reload"],raiseonerr=False)
def restart(self, instance_name="", capture_output=True):
if len(instance_name) > 0:
elements = self.service_name.split("@")
srv_etc = os.path.join(self.SYSTEMD_ETC_PATH, self.service_name)
srv_tgt = os.path.join(self.SYSTEMD_ETC_PATH, self.SYSTEMD_SRV_TARGET % (elements[0]))
srv_lnk = os.path.join(srv_tgt, self.service_instance(instance_name))
if not os.path.exists(srv_etc):
self.enable(instance_name)
elif not os.path.samefile(srv_etc, srv_lnk):
os.unlink(srv_lnk)
os.symlink(srv_etc, srv_lnk)
super(Fedora16DirectoryService, self).restart(instance_name, capture_output=capture_output)
# Enforce restart of IPA services when we do enable it
# This gets around the fact that after ipa-server-install systemd thinks ipa.service is not yet started
# but all services were actually started already.
class Fedora16IPAService(Fedora16Service):
def enable(self, instance_name=""):
super(Fedora16IPAService, self).enable(instance_name)
self.restart(instance_name)
# Redirect directory server service through special sub-class due to its special handling of instances
def f16_service(name):
if name == 'dirsrv':
return Fedora16DirectoryService(name)
if name == 'ipa':
return Fedora16IPAService(name)
return Fedora16Service(name)
class Fedora16Services(base.KnownServices):
def __init__(self):
services = dict()
for s in base.wellknownservices:
services[s] = f16_service(s)
# Call base class constructor. This will lock services to read-only
super(Fedora16Services, self).__init__(services)
authconfig = redhat.authconfig
service = f16_service
knownservices = Fedora16Services()
restore_context = redhat.restore_context
backup_and_replace_hostname = redhat.backup_and_replace_hostname

10
ipapython/platform/redhat.py
View File

@@ -66,20 +66,20 @@ class RedHatService(base.PlatformService):
installed = False
return installed
def is_enabled(self):
def is_enabled(self, instance_name=""):
(stdout, stderr, returncode) = ipautil.run(["/sbin/chkconfig", self.service_name],raiseonerr=False)
return (returncode == 0)
def enable(self):
def enable(self, instance_name=""):
ipautil.run(["/sbin/chkconfig", self.service_name, "on"])
def disable(self):
def disable(self, instance_name=""):
ipautil.run(["/sbin/chkconfig", self.service_name, "off"])
def install(self):
def install(self, instance_name=""):
ipautil.run(["/sbin/chkconfig", "--add", self.service_name])
def remove(self):
def remove(self, instance_name=""):
ipautil.run(["/sbin/chkconfig", "--del", self.service_name])
class RedHatAuthConfig(base.AuthConfig):

204
ipapython/platform/systemd.py Normal file
View File

@@ -0,0 +1,204 @@
# Author: Alexander Bokovoy <abokovoy@redhat.com>
#
# Copyright (C) 2011 Red Hat
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
from ipapython import ipautil
from ipapython.platform import base
import sys, os, shutil
class SystemdService(base.PlatformService):
SYSTEMD_ETC_PATH = "/etc/systemd/system/"
SYSTEMD_LIB_PATH = "/lib/systemd/system/"
SYSTEMD_SRV_TARGET = "%s.target.wants"
def __init__(self, service_name):
super(SystemdService, self).__init__(service_name)
self.lib_path = os.path.join(self.SYSTEMD_LIB_PATH, self.service_name)
self.lib_path_exists = None
def service_instance(self, instance_name):
if self.lib_path_exists is None:
self.lib_path_exists = os.path.exists(self.lib_path)
elements = self.service_name.split("@")
# Short-cut: if there is already exact service name, return it
if self.lib_path_exists and len(instance_name) == 0:
if len(elements) == 1:
# service name is like pki-cad.target or krb5kdc.service
return self.service_name
if len(elements) > 1 and elements[1][0] != '.':
# Service name is like pki-cad@pki-ca.service and that file exists
return self.service_name
if len(elements) > 1:
# We have dynamic service
if len(instance_name) > 0:
# Instanciate dynamic service
return "%s@%s.service" % (elements[0], instance_name)
else:
# No instance name, try with target
tgt_name = "%s.target" % (elements[0])
srv_lib = os.path.join(self.SYSTEMD_LIB_PATH, tgt_name)
if os.path.exists(srv_lib):
return tgt_name
return self.service_name
def parse_variables(self, text, separator=None):
"""
Parses 'systemctl show' output and returns a dict[variable]=value
Arguments: text -- 'systemctl show' output as string
separator -- optional (defaults to None), what separates the key/value pairs in the text
"""
def splitter(x, separator=None):
if len(x) > 1:
y = x.split(separator)
return (y[0], y[-1])
return (None,None)
return dict(map(lambda x: splitter(x, separator=separator), text.split("\n")))
def stop(self, instance_name="", capture_output=True):
ipautil.run(["/bin/systemctl", "stop", self.service_instance(instance_name)], capture_output=capture_output)
def start(self, instance_name="", capture_output=True):
ipautil.run(["/bin/systemctl", "start", self.service_instance(instance_name)], capture_output=capture_output)
def restart(self, instance_name="", capture_output=True):
# Restart command is broken before systemd-36-3.fc16
# If you have older systemd version, restart of dependent services will hang systemd indefinetly
ipautil.run(["/bin/systemctl", "restart", self.service_instance(instance_name)], capture_output=capture_output)
def is_running(self, instance_name=""):
ret = True
try:
(sout, serr, rcode) = ipautil.run(["/bin/systemctl", "is-active", self.service_instance(instance_name)],capture_output=True)
if rcode != 0:
ret = False
except ipautil.CalledProcessError:
ret = False
return ret
def is_installed(self):
installed = True
try:
(sout,serr,rcode) = ipautil.run(["/bin/systemctl", "list-unit-files", "--full"])
if rcode != 0:
installed = False
else:
svar = self.parse_variables(sout)
if not self.service_instance("") in svar:
# systemd doesn't show the service
installed = False
except ipautil.CalledProcessError, e:
installed = False
return installed
def is_enabled(self, instance_name=""):
enabled = True
try:
(sout,serr,rcode) = ipautil.run(["/bin/systemctl", "is-enabled", self.service_instance(instance_name)])
if rcode != 0:
enabled = False
except ipautil.CalledProcessError, e:
enabled = False
return enabled
def enable(self, instance_name=""):
if self.lib_path_exists is None:
self.lib_path_exists = os.path.exists(self.lib_path)
elements = self.service_name.split("@")
l = len(elements)
if self.lib_path_exists and (l > 1 and elements[1][0] != '.'):
# There is explicit service unit supporting this instance, follow normal systemd enabler
self.__enable(instance_name)
return
if self.lib_path_exists and (l == 1):
# There is explicit service unit which does not support the instances, ignore instance
self.__enable()
return
if len(instance_name) > 0 and l > 1:
# New instance, we need to do following:
# 1. Copy <service>@.service to /etc/systemd/system/ if it is not there
# 2. Make /etc/systemd/system/<service>.target.wants/ if it is not there
# 3. Link /etc/systemd/system/<service>.target.wants/<service>@<instance_name>.service to
# /etc/systemd/system/<service>@.service
srv_etc = os.path.join(self.SYSTEMD_ETC_PATH, self.service_name)
srv_tgt = os.path.join(self.SYSTEMD_ETC_PATH, self.SYSTEMD_SRV_TARGET % (elements[0]))
srv_lnk = os.path.join(srv_tgt, self.service_instance(instance_name))
try:
if not ipautil.file_exists(srv_etc):
shutil.copy(self.lib_path, srv_etc)
if not ipautil.dir_exists(srv_tgt):
os.mkdir(srv_tgt)
if os.path.exists(srv_lnk):
# Remove old link
os.unlink(srv_lnk)
if not os.path.exists(srv_lnk):
# object does not exist _or_ is a broken link
if not os.path.islink(srv_lnk):
# if it truly does not exist, make a link
os.symlink(srv_etc, srv_lnk)
else:
# Link exists and it is broken, make new one
os.unlink(srv_lnk)
os.symlink(srv_etc, srv_lnk)
ipautil.run(["/bin/systemctl", "--system", "daemon-reload"])
except:
pass
else:
self.__enable(instance_name)
def disable(self, instance_name=""):
elements = self.service_name.split("@")
if instance_name != "" and len(elements) > 1:
# Remove instance, we need to do following:
# Remove link from /etc/systemd/system/<service>.target.wants/<service>@<instance_name>.service
# to /etc/systemd/system/<service>@.service
srv_tgt = os.path.join(self.SYSTEMD_ETC_PATH, self.SYSTEMD_SRV_TARGET % (elements[0]))
srv_lnk = os.path.join(srv_tgt, self.service_instance(instance_name))
try:
if ipautil.dir_exists(srv_tgt):
if os.path.islink(srv_lnk):
os.unlink(srv_lnk)
ipautil.run(["/bin/systemctl", "--system", "daemon-reload"])
except:
pass
else:
self.__disable(instance_name)
def __enable(self, instance_name=""):
try:
ipautil.run(["/bin/systemctl", "enable", self.service_instance(instance_name)])
except ipautil.CalledProcessError, e:
pass
def __disable(self, instance_name=""):
try:
ipautil.run(["/bin/systemctl", "disable", self.service_instance(instance_name)])
except ipautil.CalledProcessError, e:
pass
def install(self):
self.enable()
def remove(self):
self.disable()

4
ipaserver/install/cainstance.py
View File

@@ -375,7 +375,7 @@ class CADSInstance(service.Service):
def restart_instance(self):
try:
ipaservices.knownservices.dirsrv.restart(self.serverid)
if not dsinstance.is_ds_running():
if not dsinstance.is_ds_running(self.serverid):
logging.critical("Failed to restart the directory server. See the installation log for details.")
sys.exit(1)
except Exception:
@@ -693,7 +693,7 @@ class CAInstance(service.Service):
def __restart_instance(self):
try:
self.restart()
self.restart(PKI_INSTANCE_NAME)
installutils.wait_for_open_ports('localhost', 9180, 300)
except Exception:
# TODO: roll back here?

6
ipaserver/install/dsinstance.py
View File

@@ -107,8 +107,8 @@ def check_ports():
ds_secure = installutils.port_available(636)
return (ds_unsecure, ds_secure)
def is_ds_running():
return ipaservices.knownservices.dirsrv.is_running()
def is_ds_running(server_id=''):
return ipaservices.knownservices.dirsrv.is_running(instance_name=server_id)
def has_managed_entries(host_name, dm_password):
"""Check to see if the Managed Entries plugin is available"""
@@ -413,7 +413,7 @@ class DsInstance(service.Service):
def restart(self, instance=''):
try:
super(DsInstance, self).restart(instance)
if not is_ds_running():
if not is_ds_running(instance):
logging.critical("Failed to restart the directory server. See the installation log for details.")
sys.exit(1)
installutils.wait_for_open_ports('localhost', self.open_ports, 300)

1
ipaserver/install/krbinstance.py
View File

@@ -371,6 +371,7 @@ class KrbInstance(service.Service):
self.fstore.backup_file("/etc/dirsrv/ds.keytab")
installutils.create_keytab("/etc/dirsrv/ds.keytab", ldap_principal)
update_key_val_in_file("/etc/sysconfig/dirsrv", "KRB5_KTNAME", "/etc/dirsrv/ds.keytab")
update_key_val_in_file("/etc/sysconfig/dirsrv", "export KRB5_KTNAME", "/etc/dirsrv/ds.keytab")
pent = pwd.getpwnam(dsinstance.DS_USER)
os.chown("/etc/dirsrv/ds.keytab", pent.pw_uid, pent.pw_gid)