Package: python-pyhsm
Version: 1.0.4l-1
Severity: wishlist
Hi,
attached patch adds systemd support to yhsm-daemon. It's
functionally equivalent to the sysvinit script with one
exception: YHSM_DAEMON_ENABLE from /etc/default/yhsm-daemon
isn't abided; systemd has built-in support to control whether
a unit is disabled or not and these should be used instead.
(For people still using sysvinit nothing changes)
This unit is working fine in my YubiHSM test setup.
I'm also planning to extend the systemd unit with additional
service hardening options, but that's for later since it
needs more testing.
Cheers,
Moritz
diff -Naur python-pyhsm-1.0.4l.orig/debian/control python-pyhsm-1.0.4l/debian/control
--- python-pyhsm-1.0.4l.orig/debian/control 2014-09-29 19:02:29.000000000 +0200
+++ python-pyhsm-1.0.4l/debian/control 2015-12-22 15:45:19.801903666 +0100
@@ -5,7 +5,8 @@
Priority: optional
Build-Depends: python-setuptools (>= 0.6b3),
debhelper (>= 9),
- python3
+ python3,
+ dh-systemd
Vcs-Git: git://github.com/Yubico/python-pyhsm-dpkg.git
Vcs-Browser: https://github.com/Yubico/python-pyhsm-dpkg
Homepage: https://developers.yubico.com/python-pyhsm/
diff -Naur python-pyhsm-1.0.4l.orig/debian/rules python-pyhsm-1.0.4l/debian/rules
--- python-pyhsm-1.0.4l.orig/debian/rules 2014-09-16 14:42:42.000000000 +0200
+++ python-pyhsm-1.0.4l/debian/rules 2015-12-22 15:45:19.805903670 +0100
@@ -4,4 +4,4 @@
dh_installchangelogs ChangeLog
%:
- dh $@ --with python3 --buildsystem=python_distutils
+ dh $@ --with python3 --buildsystem=python_distutils --with systemd
diff -Naur python-pyhsm-1.0.4l.orig/debian/yhsm-daemon.default python-pyhsm-1.0.4l/debian/yhsm-daemon.default
--- python-pyhsm-1.0.4l.orig/debian/yhsm-daemon.default 2014-09-16 14:42:42.000000000 +0200
+++ python-pyhsm-1.0.4l/debian/yhsm-daemon.default 2015-12-22 15:47:14.246271161 +0100
@@ -1,6 +1,8 @@
# Should the YubiHSM server daemon be started?
#
-# Valid values: "true" or "false"
+# Valid values: "true" or "false" (only used with sysvinit, use
+# "systemctl enable yhsm-daemon.service" and
+# "systemctl disable yhsm-daemon.service" with systemd)
YHSM_DAEMON_ENABLE="true"
# The device name of the YubiHSM. For a production setting, a name that is
diff -Naur python-pyhsm-1.0.4l.orig/debian/yhsm-daemon.install python-pyhsm-1.0.4l/debian/yhsm-daemon.install
--- python-pyhsm-1.0.4l.orig/debian/yhsm-daemon.install 2014-09-16 14:42:42.000000000 +0200
+++ python-pyhsm-1.0.4l/debian/yhsm-daemon.install 2015-12-22 15:45:19.805903670 +0100
@@ -1 +1,2 @@
utils/yhsm-daemon usr/sbin/
+debian/yhsm-daemon-keystore-unlock-helper /usr/bin
diff -Naur python-pyhsm-1.0.4l.orig/debian/yhsm-daemon-keystore-unlock-helper python-pyhsm-1.0.4l/debian/yhsm-daemon-keystore-unlock-helper
--- python-pyhsm-1.0.4l.orig/debian/yhsm-daemon-keystore-unlock-helper 1970-01-01 01:00:00.000000000 +0100
+++ python-pyhsm-1.0.4l/debian/yhsm-daemon-keystore-unlock-helper 2015-12-22 15:45:19.809903673 +0100
@@ -0,0 +1,10 @@
+#! /bin/sh
+
+if [ "x$YHSM_DAEMON_UNLOCK_PASSPHRASE" != "x" ]; then
+ echo "Unlocking YubiHSM key store"
+ echo "$YHSM_DAEMON_UNLOCK_PASSPHRASE" | /usr/sbin/yhsm-keystore-unlock --stdin --no-otp --device "$YHSM_DAEMON_DEVICE"
+ if [ $? -ne 0 ]; then
+ echo "Failed unlocking YubiHSM key store"
+ return 2
+ fi
+fi
diff -Naur python-pyhsm-1.0.4l.orig/debian/yhsm-daemon.service python-pyhsm-1.0.4l/debian/yhsm-daemon.service
--- python-pyhsm-1.0.4l.orig/debian/yhsm-daemon.service 1970-01-01 01:00:00.000000000 +0100
+++ python-pyhsm-1.0.4l/debian/yhsm-daemon.service 2015-12-22 15:45:19.809903673 +0100
@@ -0,0 +1,15 @@
+[Unit]
+Description=YubiHSM server daemon
+After=network.target
+
+[Install]
+WantedBy=multi-user.target
+
+[Service]
+EnvironmentFile=-/etc/default/yhsm-daemon
+ExecStart=/usr/sbin/yhsm-daemon
+User=yhsm-daemon
+Type=simple
+Restart=on-failure
+ExecReload=/bin/kill -HUP $MAINPID
+ExecStartPre=/usr/bin/yhsm-daemon-keystore-unlock-helper
