freeipa/ipaplatform/base/services.py

# Author: Alexander Bokovoy <abokovoy@redhat.com>
#         Tomas Babej <tbabej@redhat.com>
#
# Copyright (C) 2014   Red Hat
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.    See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
#

'''
This base module contains default implementations of IPA interface for
interacting with system services.
'''

import os
import json
import time
import collections

import six

import ipalib
from ipapython import ipautil
from ipaplatform.paths import paths

# Canonical names of services as IPA wants to see them. As we need to have
# *some* naming, set them as in Red Hat distributions. Actual implementation
# should make them available through knownservices.<name> and take care of
# re-mapping internally, if needed
wellknownservices = ['certmonger', 'dirsrv', 'httpd', 'ipa', 'krb5kdc',
                     'messagebus', 'nslcd', 'nscd', 'ntpd', 'portmap',
                     'rpcbind', 'kadmin', 'sshd', 'autofs', 'rpcgssd',
                     'rpcidmapd', 'pki_tomcatd', 'chronyd', 'domainname',
                     'named', 'ods_enforcerd', 'ods_signerd']

# The common ports for these services. This is used to wait for the
# service to become available.
wellknownports = {
    'dirsrv': [389],  # only used if the incoming instance name is blank
    'pki-tomcatd@pki-tomcat.service': [8080, 8443],
    'pki-tomcat': [8080, 8443],
    'pki-tomcatd': [8080, 8443],  # used if the incoming instance name is blank
}

SERVICE_POLL_INTERVAL = 0.1 # seconds


class KnownServices(collections.Mapping):
    """
    KnownServices is an abstract class factory that should give out instances
    of well-known platform services. Actual implementation must create these
    instances as its own attributes on first access (or instance creation)
    and cache them.
    """

    def __init__(self, d):
        self.__d = d

    def __getitem__(self, key):
        return self.__d[key]

    def __iter__(self):
        return iter(self.__d)

    def __len__(self):
        return len(self.__d)

    def __call__(self):
        return six.itervalues(self.__d)

    def __getattr__(self, name):
        try:
            return self.__d[name]
        except KeyError:
            raise AttributeError(name)


class PlatformService(object):
    """
    PlatformService abstracts out external process running on the system
    which is possible to administer (start, stop, check status, etc).

    """

    def __init__(self, service_name, api=ipalib.api):
        self.service_name = service_name
        self.api = api

    def start(self, instance_name="", capture_output=True, wait=True,
        update_service_list=True):
        """
        When a service is started record the fact in a special file.
        This allows ipactl stop to always stop all services that have
        been started via ipa tools
        """
        if not update_service_list:
            return
        svc_list = []
        try:
            with open(paths.SVC_LIST_FILE, 'r') as f:
                svc_list = json.load(f)
        except Exception:
            # not fatal, may be the first service
            pass

        if self.service_name not in svc_list:
            svc_list.append(self.service_name)

        with open(paths.SVC_LIST_FILE, 'w') as f:
            json.dump(svc_list, f)

        return

    def stop(self, instance_name="", capture_output=True,
             update_service_list=True):
        """
        When a service is stopped remove it from the service list file.
        """
        if not update_service_list:
            return
        svc_list = []
        try:
            with open(paths.SVC_LIST_FILE, 'r') as f:
                svc_list = json.load(f)
        except Exception:
            # not fatal, may be the first service
            pass

        while self.service_name in svc_list:
            svc_list.remove(self.service_name)

        with open(paths.SVC_LIST_FILE, 'w') as f:
            json.dump(svc_list, f)

        return

    def restart(self, instance_name="", capture_output=True, wait=True):
        return

    def is_running(self, instance_name="", wait=True):
        return False

    def is_installed(self):
        return False

    def is_enabled(self, instance_name=""):
        return False

    def is_masked(self, instance_name=""):
        return False

    def enable(self, instance_name=""):
        return

    def disable(self, instance_name=""):
        return

    def mask(self, instance_name=""):
        return

    def unmask(self, instance_name=""):
        return

    def install(self, instance_name=""):
        return

    def remove(self, instance_name=""):
        return

    def get_config_dir(self, instance_name=""):
        return


class SystemdService(PlatformService):
    SYSTEMD_SRV_TARGET = "%s.target.wants"

    def __init__(self, service_name, systemd_name, **kwargs):
        super(SystemdService, self).__init__(service_name, **kwargs)
        self.systemd_name = systemd_name
        self.lib_path = os.path.join(paths.LIB_SYSTEMD_SYSTEMD_DIR, self.systemd_name)
        self.lib_path_exists = None

    def service_instance(self, instance_name, operation=None):
        if self.lib_path_exists is None:
            self.lib_path_exists = os.path.exists(self.lib_path)

        elements = self.systemd_name.split("@")

        # Make sure the correct DS instance is returned
        if elements[0] == 'dirsrv' and not instance_name:

            return ('dirsrv@%s.service'
                    % str(self.api.env.realm.replace('.', '-')))

        # Short-cut: if there is already exact service name, return it
        if self.lib_path_exists and instance_name:
            if len(elements) == 1:
                # service name is like pki-tomcatd.target or krb5kdc.service
                return self.systemd_name
            if len(elements) > 1 and elements[1][0] != '.':
                # Service name is like pki-tomcatd@pki-tomcat.service
                # and that file exists
                return self.systemd_name

        if len(elements) > 1:
            # We have dynamic service
            if instance_name:
                # Instanciate dynamic service
                return "%s@%s.service" % (elements[0], instance_name)
            else:
                # No instance name, try with target
                tgt_name = "%s.target" % (elements[0])
                srv_lib = os.path.join(paths.LIB_SYSTEMD_SYSTEMD_DIR, tgt_name)
                if os.path.exists(srv_lib):
                    return tgt_name

        return self.systemd_name

    def parse_variables(self, text, separator=None):
        """
        Parses 'systemctl show' output and returns a dict[variable]=value
        Arguments: text -- 'systemctl show' output as string
                   separator -- optional (defaults to None), what separates
                                the key/value pairs in the text
        """

        def splitter(x, separator=None):
            if len(x) > 1:
                y = x.split(separator)
                return (y[0], y[-1])
            return (None, None)

        return dict(splitter(x, separator=separator) for x in text.split("\n"))

    def wait_for_open_ports(self, instance_name=""):
        """
        If this is a service we need to wait for do so.
        """
        ports = None
        if instance_name in wellknownports:
            ports = wellknownports[instance_name]
        else:
            elements = self.systemd_name.split("@")
            if elements[0] in wellknownports:
                ports = wellknownports[elements[0]]
        if ports:
            ipautil.wait_for_open_ports('localhost', ports,
                                        self.api.env.startup_timeout)

    def stop(self, instance_name="", capture_output=True):
        instance = self.service_instance(instance_name)
        args = [paths.SYSTEMCTL, "stop", instance]

        # The --ignore-dependencies switch is used to avoid possible
        # deadlock during the shutdown transaction. For more details, see
        # https://fedorahosted.org/freeipa/ticket/3729#comment:1 and
        # https://bugzilla.redhat.com/show_bug.cgi?id=973331#c11
        if instance == "ipa-otpd.socket":
            args.append("--ignore-dependencies")

        ipautil.run(args, skip_output=not capture_output)

        update_service_list = getattr(self.api.env, 'context',
                                      None) in ['ipactl', 'installer']
        super(SystemdService, self).stop(
            instance_name,
            update_service_list=update_service_list)

    def start(self, instance_name="", capture_output=True, wait=True):
        ipautil.run([paths.SYSTEMCTL, "start",
                     self.service_instance(instance_name)],
                    skip_output=not capture_output)

        update_service_list = getattr(self.api.env, 'context',
                                      None) in ['ipactl', 'installer']

        if wait and self.is_running(instance_name):
            self.wait_for_open_ports(self.service_instance(instance_name))
        super(SystemdService, self).start(
            instance_name,
            update_service_list=update_service_list)

    def restart(self, instance_name="", capture_output=True, wait=True):
        ipautil.run([paths.SYSTEMCTL, "restart",
                     self.service_instance(instance_name)],
                    skip_output=not capture_output)

        if wait and self.is_running(instance_name):
            self.wait_for_open_ports(self.service_instance(instance_name))

    def is_running(self, instance_name="", wait=True):
        instance = self.service_instance(instance_name, 'is-active')

        while True:
            try:
                result = ipautil.run(
                    [paths.SYSTEMCTL, "is-active", instance],
                    capture_output=True
                )
            except ipautil.CalledProcessError as e:
                if e.returncode == 3 and 'activating' in str(e.output):
                    time.sleep(SERVICE_POLL_INTERVAL)
                    continue
                return False
            else:
                # activating
                if result.returncode == 3 and 'activating' in result.output:
                    time.sleep(SERVICE_POLL_INTERVAL)
                    continue
                # active
                if result.returncode == 0:
                    return True
                # not active
                return False

    def is_installed(self):
        try:
            result = ipautil.run(
                [paths.SYSTEMCTL, "list-unit-files", "--full"],
                capture_output=True)
            if result.returncode != 0:
                return False
            else:
                svar = self.parse_variables(result.output)
                if not self.service_instance("") in svar:
                    # systemd doesn't show the service
                    return False
        except ipautil.CalledProcessError:
                return False

        return True

    def is_enabled(self, instance_name=""):
        enabled = True
        try:
            result = ipautil.run(
                [paths.SYSTEMCTL, "is-enabled",
                 self.service_instance(instance_name)])

            if result.returncode != 0:
                enabled = False

        except ipautil.CalledProcessError:
                enabled = False
        return enabled

    def is_masked(self, instance_name=""):
        masked = False
        try:
            result = ipautil.run(
                [paths.SYSTEMCTL, "is-enabled",
                 self.service_instance(instance_name)],
                capture_output=True)

            if result.returncode == 1 and result.output == 'masked':
                masked = True

        except ipautil.CalledProcessError:
                pass
        return masked

    def enable(self, instance_name=""):
        if self.lib_path_exists is None:
            self.lib_path_exists = os.path.exists(self.lib_path)
        elements = self.systemd_name.split("@")
        l = len(elements)

        if self.lib_path_exists and (l > 1 and elements[1][0] != '.'):
            # There is explicit service unit supporting this instance,
            # follow normal systemd enabler
            self.__enable(instance_name)
            return

        if self.lib_path_exists and (l == 1):
            # There is explicit service unit which does not support
            # the instances, ignore instance
            self.__enable()
            return

        if len(instance_name) > 0 and l > 1:
            # New instance, we need to do following:
            # 1. Make /etc/systemd/system/<service>.target.wants/
            #    if it is not there
            # 2. Link /etc/systemd/system/<service>.target.wants/
            #    <service>@<instance_name>.service to
            #    /lib/systemd/system/<service>@.service

            srv_tgt = os.path.join(paths.ETC_SYSTEMD_SYSTEM_DIR,
                                   self.SYSTEMD_SRV_TARGET % (elements[0]))
            srv_lnk = os.path.join(srv_tgt,
                                   self.service_instance(instance_name))

            try:
                if not ipautil.dir_exists(srv_tgt):
                    os.mkdir(srv_tgt)
                    os.chmod(srv_tgt, 0o755)
                if os.path.exists(srv_lnk):
                    # Remove old link
                    os.unlink(srv_lnk)
                if not os.path.exists(srv_lnk):
                    # object does not exist _or_ is a broken link
                    if not os.path.islink(srv_lnk):
                        # if it truly does not exist, make a link
                        os.symlink(self.lib_path, srv_lnk)
                    else:
                        # Link exists and it is broken, make new one
                        os.unlink(srv_lnk)
                        os.symlink(self.lib_path, srv_lnk)
                ipautil.run([paths.SYSTEMCTL, "--system", "daemon-reload"])
            except Exception:
                pass
        else:
            self.__enable(instance_name)

    def disable(self, instance_name=""):
        elements = self.systemd_name.split("@")
        if instance_name != "" and len(elements) > 1:
            # Remove instance, we need to do following:
            # Remove link from /etc/systemd/system/<service>.target.wants/
            # <service>@<instance_name>.service
            # to /lib/systemd/system/<service>@.service

            srv_tgt = os.path.join(paths.ETC_SYSTEMD_SYSTEM_DIR,
                                   self.SYSTEMD_SRV_TARGET % (elements[0]))
            srv_lnk = os.path.join(srv_tgt,
                                   self.service_instance(instance_name))

            try:
                if ipautil.dir_exists(srv_tgt):
                    if os.path.islink(srv_lnk):
                        os.unlink(srv_lnk)
                ipautil.run([paths.SYSTEMCTL, "--system", "daemon-reload"])
            except Exception:
                pass
        else:
            try:
                ipautil.run([paths.SYSTEMCTL, "disable",
                             self.service_instance(instance_name)])
            except ipautil.CalledProcessError:
                pass

    def mask(self, instance_name=""):
        srv_tgt = os.path.join(paths.ETC_SYSTEMD_SYSTEM_DIR, self.service_instance(instance_name))
        if os.path.exists(srv_tgt):
            os.unlink(srv_tgt)
        try:
            ipautil.run([paths.SYSTEMCTL, "mask",
                         self.service_instance(instance_name)])
        except ipautil.CalledProcessError:
            pass

    def unmask(self, instance_name=""):
        try:
            ipautil.run([paths.SYSTEMCTL, "unmask",
                         self.service_instance(instance_name)])
        except ipautil.CalledProcessError:
            pass

    def __enable(self, instance_name=""):
        try:
            ipautil.run([paths.SYSTEMCTL, "enable",
                         self.service_instance(instance_name)])
        except ipautil.CalledProcessError:
            pass

    def install(self):
        self.enable()

    def remove(self):
        self.disable()


# Objects below are expected to be exported by platform module

service = None
knownservices = None

# System may support more time&date services. FreeIPA supports ntpd only, other
# services will be disabled during IPA installation
timedate_services = ['ntpd', 'chronyd']