IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-07-29 15:55:47 -05:00
Code Issues Packages Projects Releases Wiki Activity

Don't create log files from help scripts

Browse Source 
Helper scripts now use api.bootstrap(log=None) to avoid the creation of
log files. Helper scripts are typically executed from daemons which
perform their own logging. The helpers still log to stderr/stdout.

This also gets rid of some SELinux AVCs when the script tries to write
to /root/.ipa/.

Fixes: https://pagure.io/freeipa/issue/8075
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
This commit is contained in:
Christian Heimes
2019-09-24 15:23:30 +02:00
parent 98ee5f2472
commit 90f7232454
9 changed files with 24 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
install/certmonger/dogtag-ipa-ca-renew-agent-submit.in
+3 -1
View File
@@ -477,7 +477,9 @@ def main():
if operation not in ('SUBMIT', 'POLL'): if operation not in ('SUBMIT', 'POLL'):
return OPERATION_NOT_SUPPORTED_BY_HELPER return OPERATION_NOT_SUPPORTED_BY_HELPER
api.bootstrap(in_server=True, context='renew', confdir=paths.ETC_IPA) api.bootstrap(
in_server=True, context='renew', confdir=paths.ETC_IPA, log=None
)
api.finalize() api.finalize()
tmpdir = tempfile.mkdtemp(prefix="tmp-") tmpdir = tempfile.mkdtemp(prefix="tmp-")
install/restart_scripts/renew_ca_cert.in
+3 -1
View File
@@ -43,7 +43,9 @@ from ipapython.certdb import TrustFlags
def _main(): def _main():
nickname = sys.argv[1] nickname = sys.argv[1]
api.bootstrap(in_server=True, context='restart', confdir=paths.ETC_IPA) api.bootstrap(
in_server=True, context='restart', confdir=paths.ETC_IPA, log=None
)
api.finalize() api.finalize()
dogtag_service = services.knownservices['pki_tomcatd'] dogtag_service = services.knownservices['pki_tomcatd']
install/restart_scripts/renew_ra_cert.in
+3 -1
View File
@@ -34,7 +34,9 @@ from ipaplatform.paths import paths
def _main(): def _main():
api.bootstrap(in_server=True, context='restart', confdir=paths.ETC_IPA) api.bootstrap(
in_server=True, context='restart', confdir=paths.ETC_IPA, log=None
)
api.finalize() api.finalize()
tmpdir = tempfile.mkdtemp(prefix="tmp-") tmpdir = tempfile.mkdtemp(prefix="tmp-")
install/restart_scripts/restart_dirsrv.in
+3 -1
View File
@@ -34,7 +34,9 @@ def _main():
except IndexError: except IndexError:
instance = "" instance = ""
api.bootstrap(in_server=True, context='restart', confdir=paths.ETC_IPA) api.bootstrap(
in_server=True, context='restart', confdir=paths.ETC_IPA, log=None
)
api.finalize() api.finalize()
syslog.syslog(syslog.LOG_NOTICE, "certmonger restarted dirsrv instance '%s'" % instance) syslog.syslog(syslog.LOG_NOTICE, "certmonger restarted dirsrv instance '%s'" % instance)
install/restart_scripts/stop_pkicad.in
+3 -1
View File
@@ -28,7 +28,9 @@ from ipaserver.install import certs
def main(): def main():
api.bootstrap(in_server=True, context='restart', confdir=paths.ETC_IPA) api.bootstrap(
in_server=True, context='restart', confdir=paths.ETC_IPA, log=None
)
api.finalize() api.finalize()
dogtag_service = services.knownservices['pki_tomcatd'] dogtag_service = services.knownservices['pki_tomcatd']
install/tools/ipa-custodia-check.in
+1 -1
View File
@@ -102,7 +102,7 @@ class IPACustodiaTester:
self.args = args self.args = args
if not api.isdone('bootstrap'): if not api.isdone('bootstrap'):
# bootstrap to initialize api.env # bootstrap to initialize api.env
api.bootstrap() api.bootstrap(log=None)
self.debug("IPA API bootstrapped") self.debug("IPA API bootstrapped")
self.realm = api.env.realm self.realm = api.env.realm
self.host = api.env.host self.host = api.env.host
install/tools/ipa-httpd-kdcproxy.in
+4 -2
View File
@@ -186,8 +186,10 @@ class KDCProxyConfig:
def main(debug=DEBUG, time_limit=TIME_LIMIT): def main(debug=DEBUG, time_limit=TIME_LIMIT):
# initialize API without file logging # initialize API without file logging
if not api.isdone('bootstrap'): if not api.isdone('bootstrap'):
api.bootstrap(context='server', confdir=paths.ETC_IPA, api.bootstrap(
log=None, debug=debug) context='server', confdir=paths.ETC_IPA, log=None,
debug=debug
)
standard_logging_setup(verbose=True, debug=debug) standard_logging_setup(verbose=True, debug=debug)
try: try:
install/tools/ipa-pki-wait-running.in
+1 -1
View File
@@ -88,7 +88,7 @@ def main():
sys.exit(EXIT_SUCCESS) sys.exit(EXIT_SUCCESS)
# bootstrap ipalib.api to parse config file # bootstrap ipalib.api to parse config file
api.bootstrap(confdir=paths.ETC_IPA) api.bootstrap(confdir=paths.ETC_IPA, log=None)
timeout = api.env.startup_timeout timeout = api.env.startup_timeout
conn = get_conn(api.env.host, subsystem=SUBSYSTEM) conn = get_conn(api.env.host, subsystem=SUBSYSTEM)
ipaserver/secrets/handlers/dmldap.py
+3 -3
View File
@@ -8,9 +8,9 @@ import os
from ipalib import api from ipalib import api
from ipalib import errors from ipalib import errors
from ipaplatform.paths import paths
from ipapython.dn import DN from ipapython.dn import DN
from ipapython.ipaldap import LDAPClient from ipapython.ipaldap import LDAPClient, realm_to_ldapi_uri
from ipaserver.install.installutils import realm_to_ldapi_uri
from . import common from . import common
CN_CONFIG = DN(('cn', 'config')) CN_CONFIG = DN(('cn', 'config'))
@@ -46,7 +46,7 @@ def main():
# create LDAP connection using LDAPI and EXTERNAL bind as root # create LDAP connection using LDAPI and EXTERNAL bind as root
if not api.isdone('bootstrap'): if not api.isdone('bootstrap'):
api.bootstrap() api.bootstrap(confdir=paths.ETC_IPA, log=None)
realm = api.env.realm realm = api.env.realm
ldap_uri = realm_to_ldapi_uri(realm) ldap_uri = realm_to_ldapi_uri(realm)
conn = LDAPClient(ldap_uri=ldap_uri, no_schema=True) conn = LDAPClient(ldap_uri=ldap_uri, no_schema=True)