Hi, I was working for a month on systemd support for FreeIPA and now there is something you may try -- http://koji.fedoraproject.org/koji/taskinfo?taskID=3399157
Provided you have Fedora 16 + updates-testing install, provided that you get FreeIPA packages from the Koji task above, FreeIPA can be installed and configured on Fedora 16. Note that systemd support *will not work* for anything before Fedora 16 + current updates-testing as it requires very recent systemd version (at least 36-3 build in F16) and depends on very recent dogtag, 389ds, and tomcat6 packages. Attached is also current patch to introduce systemd/fedora16 support. The patch is against ipa-2-1 branch, I have not checked how it applies to master yet. -- / Alexander Bokovoy
diff --git a/Makefile b/Makefile index 9d88025..3cd08e2 100644 --- a/Makefile +++ b/Makefile @@ -8,7 +8,7 @@ PRJ_PREFIX=freeipa RPMBUILD ?= $(PWD)/rpmbuild TARGET ?= master -SUPPORTED_PLATFORM=redhat +SUPPORTED_PLATFORM ?= redhat # After updating the version in VERSION you should run the version-update # target. diff --git a/freeipa.spec.in b/freeipa.spec.in index 8ebe189..2458eaa 100644 --- a/freeipa.spec.in +++ b/freeipa.spec.in @@ -28,6 +28,9 @@ BuildRequires: 389-ds-base-devel >= 1.2.9 BuildRequires: svrcore-devel BuildRequires: /usr/share/selinux/devel/Makefile BuildRequires: policycoreutils >= %{POLICYCOREUTILSVER} +%if 0%{?fedora} >= 16 +BuildRequires: systemd-units +%endif %endif BuildRequires: nspr-devel BuildRequires: nss-devel @@ -89,7 +92,11 @@ Requires(pre): 389-ds-base >= 1.2.9.7-1 Requires: openldap-clients Requires: nss Requires: nss-tools +%if 0%{?fedora} >= 16 +Requires: krb5-server >= 1.9.1-15 +%else Requires: krb5-server +%endif Requires: krb5-server-ldap Requires: krb5-pkinit-openssl Requires: cyrus-sasl-gssapi%{?_isa} @@ -102,6 +109,11 @@ Requires: python-ldap Requires: python-krbV Requires: acl Requires: python-pyasn1 >= 0.0.9a +%if 0%{?fedora} >= 16 +Requires: systemd-units >= 36-3 +Requires(pre): systemd-units +Requires(post): systemd-units +%endif %if 0%{?fedora} >= 15 Requires: selinux-policy >= 3.9.16-18 %else @@ -109,6 +121,12 @@ Requires: selinux-policy >= 3.9.7-27 %endif Requires(post): selinux-policy-base Requires: slapi-nis >= 0.21 +%if 0%{?fedora} >= 16 +Requires: pki-ca >= 9.0.14-1 +Requires: pki-silent >= 9.0.14-1 +# Only tomcat6 greater than this version provides proper systemd support +Requires: tomcat6 >= 6.0.32-17 +%else %if 0%{?fedora} >= 15 Requires: pki-ca >= 9.0.12 Requires: pki-silent >= 9.0.12 @@ -116,13 +134,19 @@ Requires: pki-silent >= 9.0.12 Requires: pki-ca >= 9.0.5 Requires: pki-silent >= 9.0.5 %endif +%endif Requires: dogtag-pki-common-theme Requires: dogtag-pki-ca-theme %if 0%{?rhel} Requires: subscription-manager %endif +%if 0%{?fedora} >= 16 +Requires(preun): python systemd-units +Requires(postun): python systemd-units +%else Requires(preun): python initscripts chkconfig Requires(postun): python initscripts chkconfig +%endif # We have a soft-requires on bind. It is an optional part of # IPA but if it is configured we need a way to require versions @@ -251,6 +275,9 @@ package. %build export CFLAGS="$CFLAGS %{optflags}" export CPPFLAGS="$CPPFLAGS %{optflags}" +%if 0%{?fedora} >= 16 +export SUPPORTED_PLATFORM=fedora16 +%endif make version-update cd ipa-client; ../autogen.sh --prefix=%{_usr} --sysconfdir=%{_sysconfdir} --localstatedir=%{_localstatedir} --libdir=%{_libdir} --mandir=%{_mandir}; cd .. %if ! %{ONLY_CLIENT} @@ -312,7 +339,16 @@ mkdir -p %{buildroot}%{_sysconfdir}/httpd/conf.d/ /bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa.conf /bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf /bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf -install -m755 ipa.init %{buildroot}%{_initrddir}/ipa +%if 0%{?fedora} >= 16 +# Default to systemd initscripts for F16 and above +mkdir -p %{buildroot}%{_unitdir} +for i in ipa.service ipa_kpasswd.service ; do + install -m 644 init/systemd/$i %{buildroot}%{_unitdir}/$i +done +rm -f %{buildroot}%{_initrddir}/ipa_kpasswd +%else +install -m755 init/SystemV/ipa.init %{buildroot}%{_initrddir}/ipa +%endif %endif mkdir -p %{buildroot}%{_sysconfdir}/ipa/ @@ -332,8 +368,14 @@ rm -rf %{buildroot} %if ! %{ONLY_CLIENT} %post server if [ $1 = 1 ]; then +%if 0%{?fedora} >= 16 +# Use systemd scheme + /bin/systemctl --system daemon-reload 2>&1 || : +%else +# Use SystemV scheme only before F16 /sbin/chkconfig --add ipa /sbin/chkconfig --add ipa_kpasswd +%endif fi if [ $1 -gt 1 ] ; then /usr/sbin/ipa-upgradeconfig || : @@ -342,14 +384,28 @@ fi %preun server if [ $1 = 0 ]; then +%if 0%{?fedora} >= 16 +# Use systemd scheme + /bin/systemctl --quiet stop ipa.service || : + /bin/systemctl --quiet disable ipa.service || : +%else +# Use SystemV scheme only before F16 /sbin/chkconfig --del ipa /sbin/chkconfig --del ipa_kpasswd /sbin/service ipa stop >/dev/null 2>&1 || : +%endif fi %postun server if [ "$1" -ge "1" ]; then +%if 0%{?fedora} >= 16 +# Use systemd scheme + /bin/systemctl --quiet is-active ipa.service >/dev/null && \ + /bin/systemctl try-restart ipa.service >/dev/null 2>&1 || : +%else +# Use SystemV scheme only before F16 /sbin/service ipa condrestart >/dev/null 2>&1 || : +%endif fi %pre server-selinux @@ -418,8 +474,15 @@ fi %{_sbindir}/ipa-upgradeconfig %{_sbindir}/ipa-compliance %{_sysconfdir}/cron.d/ipa-compliance +%if 0%{?fedora} >= 16 +# Use systemd scheme +%attr(644,root,root) %{_unitdir}/ipa.service +%attr(644,root,root) %{_unitdir}/ipa_kpasswd.service +%else +# Use SystemV scheme only before F16 %attr(755,root,root) %{_initrddir}/ipa %attr(755,root,root) %{_initrddir}/ipa_kpasswd +%endif %dir %{python_sitelib}/ipaserver %{python_sitelib}/ipaserver/* %dir %{_usr}/share/ipa @@ -550,6 +613,9 @@ fi %ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/ipa/default.conf %changelog +* Mon Oct 3 2011 Alexander Bokovoy <aboko...@redhat.com> - 2.1.1-2 +- Default to systemd for Fedora 16 and onwards + * Mon Sep 12 2011 Alexander Bokovoy <aboko...@redhat.com> - 2.1.1-1 - Make sure platform adaptation is packaged in -python sub-package diff --git a/init/SystemV/ipa.init b/init/SystemV/ipa.init new file mode 100644 index 0000000..ead7df0 --- /dev/null +++ b/init/SystemV/ipa.init @@ -0,0 +1,40 @@ +#!/bin/sh +# +# ipa This starts and stops ipa controlled daemons +# +# chkconfig: - 21 79 +# description: IPA Server +# configdir: /etc/ipa/ +# + +export SYSTEMCTL_SKIP_REDIRECT=1 + +# Source function library. +if [ -f /etc/rc.d/init.d/functions ] ; then +. /etc/rc.d/init.d/functions +fi +# Source networking configuration. +if [ -f /etc/sysconfig/network ] ; then +. /etc/sysconfig/network +fi + +# Check that networking is up. +if [ "${NETWORKING}" = "no" ] +then + echo "Networking is down" + exit 0 +fi + +case "$1" in + start|stop|restart|status) + /usr/sbin/ipactl $1 + ;; + condrestart) + /sbin/service dirsrv status + RETVAL=$? + [ $RETVAL = 0 ] && /usr/sbin/ipactl restart + ;; + *) + echo "Usage: $0 {start|stop|status|restart|condrestart}" + exit 2 +esac diff --git a/init/systemd/ipa.service b/init/systemd/ipa.service new file mode 100644 index 0000000..ba27d1d --- /dev/null +++ b/init/systemd/ipa.service @@ -0,0 +1,14 @@ +[Unit] +Description=Identity, Policy, Audit +Requires=syslog.target network.target +After=syslog.target network.target + +[Service] +Type=oneshot +ExecStart=/usr/sbin/ipactl start +ExecStop=/usr/sbin/ipactl stop +RemainAfterExit=yes +TimeoutSec=0 + +[Install] +WantedBy=multi-user.target diff --git a/init/systemd/ipa_kpasswd.service b/init/systemd/ipa_kpasswd.service new file mode 100644 index 0000000..17aa463 --- /dev/null +++ b/init/systemd/ipa_kpasswd.service @@ -0,0 +1,10 @@ +[Unit] +Description=IPA Kerberos password service +Requires=krb5kdc.service +Wants=krb5kdc.service + +[Service] +Type=forking +PIDFile=/var/run/ipa_kpasswd.pid +ExecStart=/usr/sbin/ipa_kpasswd + diff --git a/install/tools/ipactl b/install/tools/ipactl index 4055cf9..13e4b00 100755 --- a/install/tools/ipactl +++ b/install/tools/ipactl @@ -24,7 +24,7 @@ try: from ipaserver.install import service from ipapython import services as ipaservices from ipaserver.install.dsinstance import config_dirname, realm_to_serverid - from ipaserver.install.installutils import is_ipa_configured + from ipaserver.install.installutils import is_ipa_configured, wait_for_open_ports, wait_for_open_socket from ipapython import sysrestore from ipapython import config from ipalib import api, errors @@ -32,6 +32,7 @@ try: import logging import ldap import ldap.sasl + import ldapurl import socket except ImportError: print >> sys.stderr, """\ @@ -117,6 +118,15 @@ def get_config(): attrs = ['cn', 'ipaConfigString'] try: + # systemd services are so fast that we come here before + # Directory Server actually starts listening. Wait for + # the socket/port be really available. + lurl = ldapurl.LDAPUrl(api.env.ldap_uri) + if lurl.urlscheme == 'ldapi': + wait_for_open_socket(lurl.hostport, timeout=6) + else: + (host,port) = lurl.hostport.split(':') + wait_for_open_ports(host, [port], timeout=6) con = ldap.initialize(api.env.ldap_uri) con.sasl_interactive_bind_s('', SASL_EXTERNAL) res = con.search_st(base, diff --git a/ipa.init b/ipa.init deleted file mode 100755 index ead7df0..0000000 --- a/ipa.init +++ /dev/null @@ -1,40 +0,0 @@ -#!/bin/sh -# -# ipa This starts and stops ipa controlled daemons -# -# chkconfig: - 21 79 -# description: IPA Server -# configdir: /etc/ipa/ -# - -export SYSTEMCTL_SKIP_REDIRECT=1 - -# Source function library. -if [ -f /etc/rc.d/init.d/functions ] ; then -. /etc/rc.d/init.d/functions -fi -# Source networking configuration. -if [ -f /etc/sysconfig/network ] ; then -. /etc/sysconfig/network -fi - -# Check that networking is up. -if [ "${NETWORKING}" = "no" ] -then - echo "Networking is down" - exit 0 -fi - -case "$1" in - start|stop|restart|status) - /usr/sbin/ipactl $1 - ;; - condrestart) - /sbin/service dirsrv status - RETVAL=$? - [ $RETVAL = 0 ] && /usr/sbin/ipactl restart - ;; - *) - echo "Usage: $0 {start|stop|status|restart|condrestart}" - exit 2 -esac diff --git a/ipapython/config.py b/ipapython/config.py index 051e39f..4e0fb11 100644 --- a/ipapython/config.py +++ b/ipapython/config.py @@ -178,7 +178,7 @@ def __discover_config(discover_server = True): if not config.default_domain: #try once with REALM -> domain - dom_name = config.default_realm.lower() + dom_name = config.default_realm.lower() #pylint: disable=E1103 name = "_ldap._tcp."+dom_name+"." rs = ipapython.dnsclient.query(name, ipapython.dnsclient.DNS_C_IN, ipapython.dnsclient.DNS_T_SRV) rl = len(rs) diff --git a/ipapython/ipautil.py b/ipapython/ipautil.py index cfc979e..52ff9e2 100644 --- a/ipapython/ipautil.py +++ b/ipapython/ipautil.py @@ -1163,3 +1163,93 @@ def get_ipa_basedn(conn): return None +def config_replace_variables(filepath, replacevars=dict(), appendvars=dict()): + """ + Take a key=value based configuration file, and write new version + with certain values replaced or appended + + All (key,value) pairs from replacevars and appendvars that were not found + in the configuration file, will be added there. + + It is responsibility of a caller to ensure that replacevars and + appendvars do not overlap. + + It is responsibility of a caller to back up file. + + returns dictionary of affected keys and their previous values + + One have to run restore_context(filepath) afterwards or + security context of the file will not be correct after modification + """ + pattern = re.compile(''' +(^ + \s* + (?P<option> [^\#;]+?) + (\s*=\s*) + (?P<value> .+?)? + (\s*((\#|;).*)?)? +$)''', re.VERBOSE) + orig_stat = os.stat(filepath) + old_values = dict() + temp_filename = None + with tempfile.NamedTemporaryFile(delete=False) as new_config: + temp_filename = new_config.name + with open(filepath, 'r') as f: + for line in f: + new_line = line + m = pattern.match(line) + if m: + option, value = m.group('option', 'value') + if option is not None: + if replacevars and option in replacevars: + # replace value completely + new_line = u"%s=%s\n" % (option, replacevars[option]) + old_values[option] = value + if appendvars and option in appendvars: + # append new value unless it is already existing in the original one + if value.find(appendvars[option]) == -1: + new_line = u"%s=%s %s\n" % (option, value, appendvars[option]) + old_values[option] = value + new_config.write(new_line) + # Now add all options from replacevars and appendvars that were not found in the file + new_vars = replacevars.copy() + new_vars.update(appendvars) + newvars_view = new_vars.viewkeys() - old_values.viewkeys() + append_view = (appendvars.viewkeys() - replacevars.viewkeys()) - old_values.viewkeys() + for item in newvars_view: + new_config.write("%s=%s\n" % (item,new_vars[item])) + for item in append_view: + new_config.write("%s=%s\n" % (item,appendvars[item])) + new_config.flush() + # Make sure the resulting file is readable by others before installing it + os.fchmod(new_config.fileno(), orig_stat.st_mode) + os.fchown(new_config.fileno(), orig_stat.st_uid, orig_stat.st_gid) + + # At this point new_config is closed but not removed due to 'delete=False' above + # Now, install the temporary file as configuration and ensure old version is available as .orig + # While .orig file is not used during uninstall, it is left there for administrator. + install_file(temp_filename, filepath) + + return old_values + +def backup_config_and_replace_variables(fstore, filepath, replacevars=dict(), appendvars=dict()): + """ + Take a key=value based configuration file, back up it, and + write new version with certain values replaced or appended + + All (key,value) pairs from replacevars and appendvars that + were not found in the configuration file, will be added there. + + It is responsibility of a caller to ensure that replacevars and + appendvars do not overlap. + + returns dictionary of affected keys and their previous values + + One have to run restore_context(filepath) afterwards or + security context of the file will not be correct after modification + """ + # Backup original filepath + fstore.backup_file(filepath) + old_values = config_replace_variables(filepath, replacevars, appendvars) + + return old_values diff --git a/ipapython/platform/base.py b/ipapython/platform/base.py index f9d4099..7e03f48 100644 --- a/ipapython/platform/base.py +++ b/ipapython/platform/base.py @@ -22,7 +22,7 @@ from ipalib.plugable import MagicDict # set them as in Red Hat distributions. Actual implementation should make them available # through knownservices.<name> and take care of remapping internally, if needed wellknownservices = ['certmonger', 'dirsrv', 'httpd', 'ipa', 'krb5kdc', 'messagebus', - 'nslcd', 'nscd', 'ntpd', 'portmap', 'rpcbind'] + 'nslcd', 'nscd', 'ntpd', 'portmap', 'rpcbind', 'ipa_kpasswd'] class AuthConfig(object): """ @@ -120,25 +120,25 @@ class PlatformService(object): def restart(self, instance_name="", capture_output=True): return - def is_running(self): + def is_running(self, instance_name=""): return False def is_installed(self): return False - def is_enabled(self): + def is_enabled(self, instance_name=""): return False - def enable(self): + def enable(self, instance_name=""): return - def disable(self): + def disable(self, instance_name=""): return - def install(self): + def install(self, instance_name=""): return - def remove(self): + def remove(self, instance_name=""): return class KnownServices(MagicDict): diff --git a/ipapython/platform/fedora16.py b/ipapython/platform/fedora16.py new file mode 100644 index 0000000..bad1fac --- /dev/null +++ b/ipapython/platform/fedora16.py @@ -0,0 +1,113 @@ +# Author: Alexander Bokovoy <aboko...@redhat.com> +# +# Copyright (C) 2011 Red Hat +# see file 'COPYING' for use and warranty information +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. +# + +from ipapython import ipautil +from ipapython.platform import base, redhat, systemd +import os + +# All what we allow exporting directly from this module +# Everything else is made available through these symbols when they directly imported into ipapython.services: +# authconfig -- class reference for platform-specific implementation of authconfig(8) +# service -- class reference for platform-specific implementation of a PlatformService class +# knownservices -- factory instance to access named services IPA cares about, names are ipapython.services.wellknownservices +# backup_and_replace_hostname -- platform-specific way to set hostname and make it persistent over reboots +# restore_context -- platform-sepcific way to restore security context, if applicable +__all__ = ['authconfig', 'service', 'knownservices', 'backup_and_replace_hostname', 'restore_context'] + +# For beginning just remap names to add .service +# As more services will migrate to systemd, unit names will deviate and +# mapping will be kept in this dictionary +system_units = dict(map(lambda x: (x, "%s.service" % (x)), base.wellknownservices)) + +# Rewrite dirsrv and pki-cad services as they support instances via separate service generator +# To make this working, one needs to have both foo@.service and foo.target -- the latter is used +# when request should be coming for all instances (like stop). systemd, unfortunately, does not allow +# to request action for all service instances at once if only foo@.service unit is available. +# To add more, if any of those services need to be started/stopped automagically, one needs to manually +# create symlinks in /etc/systemd/system/foo.target.wants/ (look into systemd.py's enable() code). +system_units['dirsrv'] = 'dirsrv@.service' +# Our directory server instance for PKI is dirsrv@PKI-IPA.service +system_units['pkids'] = 'dirsrv@PKI-IPA.service' +# Our PKI instance is pki-cad@pki-ca.service +system_units['pki-cad'] = 'pki-cad@pki-ca.service' + +class Fedora16Service(systemd.SystemdService): + def __init__(self, service_name): + if service_name in system_units: + service_name = system_units[service_name] + else: + if len(service_name.split('.')) == 1: + # if service_name does not have a dot, it is not foo.service and not a foo.target + # Thus, not correct service name for systemd, default to foo.service style then + service_name = "%s.service" % (service_name) + super(Fedora16Service, self).__init__(service_name) + +# Special handling of directory server service +# LimitNOFILE needs to be increased or any value set in the directory for this value will fail +# Read /lib/systemd/system/dirsrv@.service for details. +# We do modification of LimitNOFILE on service.enable() but we also need to explicitly enable instances +# to install proper symlinks as dirsrv.target.wants/ dependencies. Unfortunately, ipa-server-install +# does not do explicit dirsrv.enable() because the service startup is handled by ipactl. +# If we wouldn't do this, our instances will not be started as systemd would not have any clue +# about instances (PKI-IPA and the domain we serve) at all. Thus, hook into dirsrv.restart(). +class Fedora16DirectoryService(Fedora16Service): + def enable(self, instance_name=""): + super(Fedora16DirectoryService, self).enable(instance_name) + srv_etc = os.path.join(self.SYSTEMD_ETC_PATH, self.service_name) + if os.path.exists(srv_etc): + # We need to enable LimitNOFILE=8192 in the dirsrv@.service + # We rely on the fact that [Service] section is the last one + # and if variable is not there, it will be added as the last line + replacevars = {'LimitNOFILE':'8192'} + ipautil.config_replace_variables(srv_etc, replacevars=replacevars) + redhat.restore_context(srv_etc) + ipautil.run(["/bin/systemctl", "--system", "daemon-reload"],raiseonerr=False) + + def restart(self, instance_name="", capture_output=True): + if len(instance_name) > 0: + elements = self.service_name.split("@") + srv_etc = os.path.join(self.SYSTEMD_ETC_PATH, self.service_name) + srv_tgt = os.path.join(self.SYSTEMD_ETC_PATH, self.SYSTEMD_SRV_TARGET % (elements[0])) + srv_lnk = os.path.join(srv_tgt, self.service_instance(instance_name)) + if not os.path.exists(srv_etc): + self.enable(instance_name) + elif not os.path.samefile(srv_etc, srv_lnk): + os.unlink(srv_lnk) + os.symlink(srv_etc, srv_lnk) + super(Fedora16DirectoryService, self).restart(instance_name, capture_output=capture_output) + +# Redirect directory server service through special sub-class due to its special handling of instances +def f16_service(name): + if name == 'dirsrv': + return Fedora16DirectoryService(name) + return Fedora16Service(name) + +class Fedora16Services(base.KnownServices): + def __init__(self): + services = dict() + for s in base.wellknownservices: + services[s] = f16_service(s) + # Call base class constructor. This will lock services to read-only + super(Fedora16Services, self).__init__(services) + +authconfig = redhat.authconfig +service = f16_service +knownservices = Fedora16Services() +restore_context = redhat.restore_context +backup_and_replace_hostname = redhat.backup_and_replace_hostname diff --git a/ipapython/platform/redhat.py b/ipapython/platform/redhat.py index 6bf8bf3..d9de3ab 100644 --- a/ipapython/platform/redhat.py +++ b/ipapython/platform/redhat.py @@ -65,20 +65,20 @@ class RedHatService(base.PlatformService): installed = False return installed - def is_enabled(self): + def is_enabled(self, instance_name=""): (stdout, stderr, returncode) = ipautil.run(["/sbin/chkconfig", self.service_name],raiseonerr=False) return (returncode == 0) - def enable(self): + def enable(self, instance_name=""): ipautil.run(["/sbin/chkconfig", self.service_name, "on"]) - def disable(self): + def disable(self, instance_name=""): ipautil.run(["/sbin/chkconfig", self.service_name, "off"]) - def install(self): + def install(self, instance_name=""): ipautil.run(["/sbin/chkconfig", "--add", self.service_name]) - def remove(self): + def remove(self, instance_name=""): ipautil.run(["/sbin/chkconfig", "--del", self.service_name]) class RedHatAuthConfig(base.AuthConfig): @@ -133,48 +133,11 @@ def restore_context(filepath): ipautil.run(["/sbin/restorecon", filepath], raiseonerr=False) def backup_and_replace_hostname(fstore, statestore, hostname): - network_filename = "/etc/sysconfig/network" - # Backup original /etc/sysconfig/network - fstore.backup_file(network_filename) - hostname_pattern = re.compile(''' -(^ - \s* - (?P<option> [^\#;]+?) - (\s*=\s*) - (?P<value> .+?)? - (\s*((\#|;).*)?)? -$)''', re.VERBOSE) - temp_filename = None - with tempfile.NamedTemporaryFile(delete=False) as new_config: - temp_filename = new_config.name - with open(network_filename, 'r') as f: - for line in f: - new_line = line - m = hostname_pattern.match(line) - if m: - option, value = m.group('option', 'value') - if option is not None and option == 'HOSTNAME': - if value is not None and hostname != value: - new_line = u"HOSTNAME=%s\n" % (hostname) - statestore.backup_state('network', 'hostname', value) - new_config.write(new_line) - new_config.flush() - # Make sure the resulting file is readable by others before installing it - os.fchmod(new_config.fileno(), stat.S_IRUSR | stat.S_IWUSR | stat.S_IRGRP | stat.S_IROTH) - os.fchown(new_config.fileno(), 0, 0) - - # At this point new_config is closed but not removed due to 'delete=False' above - # Now, install the temporary file as configuration and ensure old version is available as .orig - # While .orig file is not used during uninstall, it is left there for administrator. - ipautil.install_file(temp_filename, network_filename) - try: - ipautil.run(['/bin/hostname', hostname]) - except ipautil.CalledProcessError, e: - print >>sys.stderr, "Failed to set this machine hostname to %s (%s)." % (hostname, str(e)) - - # For SE Linux environments it is important to reset SE labels to the expected ones - try: - restore_context(network_filename) - except ipautil.CalledProcessError, e: - print >>sys.stderr, "Failed to set permissions for %s (%s)." % (network_filename, str(e)) + replacevars = {'HOSTNAME':hostname} + old_values = ipautil.backup_config_and_replace_variables(fstore, + "/etc/sysconfig/network", + replacevars=replacevars) + restore_context("/etc/sysconfig/network") + if old_values['HOSTNAME']: + statestore.backup_state('network', 'hostname', old_values['HOSTNAME']) diff --git a/ipapython/platform/systemd.py b/ipapython/platform/systemd.py new file mode 100644 index 0000000..e9990ab --- /dev/null +++ b/ipapython/platform/systemd.py @@ -0,0 +1,204 @@ +# Author: Alexander Bokovoy <aboko...@redhat.com> +# +# Copyright (C) 2011 Red Hat +# see file 'COPYING' for use and warranty information +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. +# + +from ipapython import ipautil +from ipapython.platform import base +import sys, os, shutil + +class SystemdService(base.PlatformService): + SYSTEMD_ETC_PATH = "/etc/systemd/system/" + SYSTEMD_LIB_PATH = "/lib/systemd/system/" + SYSTEMD_SRV_TARGET = "%s.target.wants" + + def __init__(self, service_name): + super(SystemdService, self).__init__(service_name) + self.lib_path = os.path.join(self.SYSTEMD_LIB_PATH, self.service_name) + self.lib_path_exists = None + + def service_instance(self, instance_name): + if self.lib_path_exists is None: + self.lib_path_exists = os.path.exists(self.lib_path) + + elements = self.service_name.split("@") + + # Short-cut: if there is already exact service name, return it + if self.lib_path_exists and len(instance_name) == 0: + if len(elements) == 1: + # service name is like pki-cad.target or krb5kdc.service + return self.service_name + if len(elements) > 1 and elements[1][0] != '.': + # Service name is like pki-cad@pki-ca.service and that file exists + return self.service_name + + if len(elements) > 1: + # We have dynamic service + if len(instance_name) > 0: + # Instanciate dynamic service + return "%s@%s.service" % (elements[0], instance_name) + else: + # No instance name, try with target + tgt_name = "%s.target" % (elements[0]) + srv_lib = os.path.join(self.SYSTEMD_LIB_PATH, tgt_name) + if os.path.exists(srv_lib): + return tgt_name + + return self.service_name + + def parse_variables(self, text, separator=None): + """ + Parses 'systemctl show' output and returns a dict[variable]=value + Arguments: text -- 'systemctl show' output as string + separator -- optional (defaults to None), what separates the key/value pairs in the text + """ + def splitter(x, separator=None): + if len(x) > 1: + y = x.split(separator) + return (y[0], y[-1]) + return (None,None) + return dict(map(lambda x: splitter(x, separator=separator), text.split("\n"))) + + def stop(self, instance_name="", capture_output=True): + ipautil.run(["/bin/systemctl", "stop", self.service_instance(instance_name)], capture_output=capture_output) + + def start(self, instance_name="", capture_output=True): + ipautil.run(["/bin/systemctl", "start", self.service_instance(instance_name)], capture_output=capture_output) + + def restart(self, instance_name="", capture_output=True): + # Restart command is broken before systemd-36-3.fc16 + # If you have older systemd version, restart of dependent services will hang systemd indefinetly + ipautil.run(["/bin/systemctl", "restart", self.service_instance(instance_name)], capture_output=capture_output) + + def is_running(self, instance_name=""): + ret = True + try: + (sout, serr, rcode) = ipautil.run(["/bin/systemctl", "is-active", self.service_instance(instance_name)],capture_output=True) + if rcode != 0: + ret = False + except ipautil.CalledProcessError: + ret = False + return ret + + def is_installed(self): + installed = True + try: + (sout,serr,rcode) = ipautil.run(["/bin/systemctl", "list-unit-files", "--full"]) + if rcode != 0: + installed = False + else: + svar = self.parse_variables(sout) + if not self.service_instance("") in svar: + # systemd doesn't show the service + installed = False + except ipautil.CalledProcessError, e: + installed = False + return installed + + def is_enabled(self, instance_name=""): + enabled = True + try: + (sout,serr,rcode) = ipautil.run(["/bin/systemctl", "is-enabled", self.service_instance(instance_name)]) + if rcode != 0: + enabled = False + except ipautil.CalledProcessError, e: + enabled = False + return enabled + + def enable(self, instance_name=""): + if self.lib_path_exists is None: + self.lib_path_exists = os.path.exists(self.lib_path) + elements = self.service_name.split("@") + l = len(elements) + + if self.lib_path_exists and (l > 1 and elements[1][0] != '.'): + # There is explicit service unit supporting this instance, follow normal systemd enabler + self.__enable(instance_name) + return + + if self.lib_path_exists and (l == 1): + # There is explicit service unit which does not support the instances, ignore instance + self.__enable() + return + + if len(instance_name) > 0 and l > 1: + # New instance, we need to do following: + # 1. Copy <service>@.service to /etc/systemd/system/ if it is not there + # 2. Make /etc/systemd/system/<service>.target.wants/ if it is not there + # 3. Link /etc/systemd/system/<service>.target.wants/<service>@<instance_name>.service to + # /etc/systemd/system/<service>@.service + srv_etc = os.path.join(self.SYSTEMD_ETC_PATH, self.service_name) + srv_tgt = os.path.join(self.SYSTEMD_ETC_PATH, self.SYSTEMD_SRV_TARGET % (elements[0])) + srv_lnk = os.path.join(srv_tgt, self.service_instance(instance_name)) + try: + if not ipautil.file_exists(srv_etc): + shutil.copy(self.lib_path, srv_etc) + if not ipautil.dir_exists(srv_tgt): + os.mkdir(srv_tgt) + if os.path.exists(srv_lnk): + # Remove old link + os.unlink(srv_lnk) + if not os.path.exists(srv_lnk): + # object does not exist _or_ is a broken link + if not os.path.islink(srv_lnk): + # if it truly does not exist, make a link + os.symlink(srv_etc, srv_lnk) + else: + # Link exists and it is broken, make new one + os.unlink(srv_lnk) + os.symlink(srv_etc, srv_lnk) + ipautil.run(["/bin/systemctl", "--system", "daemon-reload"]) + except: + pass + else: + self.__enable(instance_name) + + def disable(self, instance_name=""): + elements = self.service_name.split("@") + if instance_name != "" and len(elements) > 1: + # Remove instance, we need to do following: + # Remove link from /etc/systemd/system/<service>.target.wants/<service>@<instance_name>.service + # to /etc/systemd/system/<service>@.service + srv_tgt = os.path.join(self.SYSTEMD_ETC_PATH, self.SYSTEMD_SRV_TARGET % (elements[0])) + srv_lnk = os.path.join(srv_tgt, self.service_instance(instance_name)) + try: + if ipautil.dir_exists(srv_tgt): + if os.path.islink(srv_lnk): + os.unlink(srv_lnk) + ipautil.run(["/bin/systemctl", "--system", "daemon-reload"]) + except: + pass + else: + self.__disable(instance_name) + + def __enable(self, instance_name=""): + try: + ipautil.run(["/bin/systemctl", "enable", self.service_instance(instance_name)]) + except ipautil.CalledProcessError, e: + pass + + def __disable(self, instance_name=""): + try: + ipautil.run(["/bin/systemctl", "disable", self.service_instance(instance_name)]) + except ipautil.CalledProcessError, e: + pass + + def install(self): + self.enable() + + def remove(self): + self.disable() diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py index 6a86e8c..385710d 100644 --- a/ipaserver/install/cainstance.py +++ b/ipaserver/install/cainstance.py @@ -375,7 +375,7 @@ class CADSInstance(service.Service): def restart_instance(self): try: ipaservices.knownservices.dirsrv.restart(self.serverid) - if not dsinstance.is_ds_running(): + if not dsinstance.is_ds_running(self.serverid): logging.critical("Failed to restart the directory server. See the installation log for details.") sys.exit(1) except Exception: @@ -690,7 +690,7 @@ class CAInstance(service.Service): def __restart_instance(self): try: - self.restart() + self.restart(PKI_INSTANCE_NAME) installutils.wait_for_open_ports('localhost', 9180, 300) except Exception: # TODO: roll back here? diff --git a/ipaserver/install/dsinstance.py b/ipaserver/install/dsinstance.py index ca93fe9..60d0a43 100644 --- a/ipaserver/install/dsinstance.py +++ b/ipaserver/install/dsinstance.py @@ -107,8 +107,8 @@ def check_ports(): ds_secure = installutils.port_available(636) return (ds_unsecure, ds_secure) -def is_ds_running(): - return ipaservices.knownservices.dirsrv.is_running() +def is_ds_running(server_id=''): + return ipaservices.knownservices.dirsrv.is_running(instance_name=server_id) def has_managed_entries(host_name, dm_password): """Check to see if the Managed Entries plugin is available""" @@ -411,7 +411,7 @@ class DsInstance(service.Service): def restart(self, instance=''): try: super(DsInstance, self).restart(instance) - if not is_ds_running(): + if not is_ds_running(instance): logging.critical("Failed to restart the directory server. See the installation log for details.") sys.exit(1) installutils.wait_for_open_ports('localhost', self.open_ports, 300) diff --git a/ipaserver/install/krbinstance.py b/ipaserver/install/krbinstance.py index 513dc55..ad89e87 100644 --- a/ipaserver/install/krbinstance.py +++ b/ipaserver/install/krbinstance.py @@ -352,28 +352,16 @@ class KrbInstance(service.Service): min = version.LooseVersion(MIN_KRB5KDC_WITH_WORKERS) if ver >= min: workers = True + # Write down config file + # We write realm and also number of workers (for multi-CPU systems) + replacevars = {'KRB5REALM':self.realm} + appendvars = {} if workers and cpus > 1: - #read in memory, find KRB5KDC_ARGS, check/change it, then overwrite file - self.fstore.backup_file("/etc/sysconfig/krb5kdc") - - need_w = True - fd = open("/etc/sysconfig/krb5kdc", "r") - lines = fd.readlines() - fd.close() - for line in lines: - sline = line.strip() - if not sline.startswith('KRB5KDC_ARGS'): - continue - sline = sline.replace('"', '') - if sline.find("-w") != -1: - need_w = False - - if need_w: - fd = open("/etc/sysconfig/krb5kdc", "w") - for line in lines: - fd.write(line) - fd.write('KRB5KDC_ARGS="${KRB5KDC_ARGS} -w %s"\n' % str(cpus)) - fd.close() + appendvars = {'KRB5KDC_ARGS': "-w %s" % str(cpus)} + ipautil.backup_config_and_replace_variables(self.fstore, "/etc/sysconfig/krb5kdc", + replacevars=replacevars, + appendvars=appendvars) + ipaservices.restore_context("/etc/sysconfig/krb5kdc") def __write_stash_from_ds(self): try:
_______________________________________________ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel