URL: https://github.com/freeipa/freeipa/pull/517
Author: tiran
Title: #517: [WIP] Use Custodia 0.3 features
Action: opened
PR body:
"""
* Use sd-notify in ipa-custodia.service
* Introduce libexec/ipa/ipa-custodia script. It comes with correct
default setting for IPA's config file. The new file also makes it
simpler to run IPA's custodia instance with its own SELinux context.
Signed-off-by: Christian Heimes <chei...@redhat.com>
PR depends on new custodia release.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/517/head:pr517
git checkout pr517
From 43ecc712f398c3d777ee7d8029b527a7fe43405a Mon Sep 17 00:00:00 2001
From: Christian Heimes <chei...@redhat.com>
Date: Tue, 28 Feb 2017 12:07:19 +0100
Subject: [PATCH] Use Custodia 0.3 features
* Use sd-notify in ipa-custodia.service
* Introduce libexec/ipa/ipa-custodia script. It comes with correct
default setting for IPA's config file. The new file also makes it
simpler to run IPA's custodia instance with its own SELinux context.
Signed-off-by: Christian Heimes <chei...@redhat.com>
---
freeipa.spec.in | 13 ++++++++-----
init/systemd/ipa-custodia.service.in | 5 ++---
install/tools/Makefile.am | 1 +
install/tools/ipa-custodia | 6 ++++++
ipaserver/secrets/service.py | 30 ++++++++++++++++++++++++++++++
ipasetup.py.in | 1 +
6 files changed, 48 insertions(+), 8 deletions(-)
create mode 100755 install/tools/ipa-custodia
create mode 100644 ipaserver/secrets/service.py
diff --git a/freeipa.spec.in b/freeipa.spec.in
index 5c835ca..5400df9 100644
--- a/freeipa.spec.in
+++ b/freeipa.spec.in
@@ -148,7 +148,8 @@ BuildRequires: pki-base-python2
BuildRequires: python-pytest-multihost
BuildRequires: python-pytest-sourceorder
BuildRequires: python-jwcrypto
-BuildRequires: python-custodia
+# 0.3: sd-notify and ipaserver.secrets.service
+BuildRequires: python-custodia >= 0.3
BuildRequires: dbus-python
BuildRequires: python-dateutil
BuildRequires: python-enum34
@@ -184,7 +185,8 @@ BuildRequires: pki-base-python3
BuildRequires: python3-pytest-multihost
BuildRequires: python3-pytest-sourceorder
BuildRequires: python3-jwcrypto
-BuildRequires: python3-custodia
+# 0.3: sd-notify and ipaserver.secrets.service
+BuildRequires: python3-custodia >= 0.3
BuildRequires: python3-dbus
BuildRequires: python3-dateutil
BuildRequires: python3-enum34
@@ -361,7 +363,7 @@ BuildArch: noarch
Requires: %{name}-client-common = %{version}-%{release}
Requires: httpd >= 2.4.6-31
Requires: systemd-units >= 38
-Requires: custodia
+Requires: custodia >= 0.3
Provides: %{alt_name}-server-common = %{version}
Conflicts: %{alt_name}-server-common
@@ -608,7 +610,7 @@ Requires: python-jwcrypto
Requires: python-cffi
Requires: python-ldap >= 2.4.15
Requires: python-requests
-Requires: python-custodia
+Requires: python-custodia >= 0.3
Requires: python-dns >= 1.15
Requires: python-enum34
Requires: python-netifaces >= 0.10.4
@@ -657,7 +659,7 @@ Requires: python3-six
Requires: python3-jwcrypto
Requires: python3-cffi
Requires: python3-pyldap >= 2.4.15
-Requires: python3-custodia
+Requires: python3-custodia >= 0.3
Requires: python3-requests
Requires: python3-dns >= 1.15
Requires: python3-netifaces >= 0.10.4
@@ -1110,6 +1112,7 @@ fi
%{_libexecdir}/certmonger/dogtag-ipa-ca-renew-agent-submit
%{_libexecdir}/certmonger/ipa-server-guard
%dir %{_libexecdir}/ipa
+%{_libexecdir}/ipa/ipa-custodia
%{_libexecdir}/ipa/ipa-dnskeysyncd
%{_libexecdir}/ipa/ipa-dnskeysync-replica
%{_libexecdir}/ipa/ipa-ods-exporter
diff --git a/init/systemd/ipa-custodia.service.in b/init/systemd/ipa-custodia.service.in
index 3f9b128..0247bd8 100644
--- a/init/systemd/ipa-custodia.service.in
+++ b/init/systemd/ipa-custodia.service.in
@@ -2,9 +2,8 @@
Description=IPA Custodia Service
[Service]
-Type=simple
-
-ExecStart=@sbindir@/custodia @IPA_SYSCONF_DIR@/custodia/custodia.conf
+Type=notify
+ExecStart=@libexecdir@/ipa/ipa-custodia @IPA_SYSCONF_DIR@/custodia/custodia.conf
PrivateTmp=yes
Restart=on-failure
RestartSec=60s
diff --git a/install/tools/Makefile.am b/install/tools/Makefile.am
index f2c2ce2..493e5ff 100644
--- a/install/tools/Makefile.am
+++ b/install/tools/Makefile.am
@@ -32,6 +32,7 @@ dist_sbin_SCRIPTS = \
appdir = $(libexecdir)/ipa/
dist_app_SCRIPTS = \
+ ipa-custodia \
ipa-httpd-kdcproxy \
ipa-pki-retrieve-key \
$(NULL)
diff --git a/install/tools/ipa-custodia b/install/tools/ipa-custodia
new file mode 100755
index 0000000..5deeeff
--- /dev/null
+++ b/install/tools/ipa-custodia
@@ -0,0 +1,6 @@
+#!/usr/bin/python2
+# Copyright (C) 2017 IPA Project Contributors, see COPYING for license
+from ipaserver.secrets.service import main
+
+if __name__ == '__main__':
+ main()
diff --git a/ipaserver/secrets/service.py b/ipaserver/secrets/service.py
new file mode 100644
index 0000000..f51c46a
--- /dev/null
+++ b/ipaserver/secrets/service.py
@@ -0,0 +1,30 @@
+# Copyright (C) 2017 IPA Project Contributors, see COPYING for license
+import argparse
+
+import custodia.server
+
+
+argparser = argparse.ArgumentParser(
+ prog='ipa-custodia',
+ description='IPA Custodia service'
+)
+argparser.add_argument(
+ '--debug',
+ action='store_true',
+ help='Debug mode'
+)
+argparser.add_argument(
+ 'configfile',
+ nargs='?',
+ type=argparse.FileType('r'),
+ help="Path to IPA's custodia server config",
+ default='/etc/ipa/custodia/custodia.conf'
+)
+
+
+def main():
+ return custodia.server.main(argparser)
+
+
+if __name__ == '__main__':
+ main()
diff --git a/ipasetup.py.in b/ipasetup.py.in
index 915f0ed..1d39f03 100644
--- a/ipasetup.py.in
+++ b/ipasetup.py.in
@@ -64,6 +64,7 @@ if SETUPTOOLS_VERSION < (8, 0, 0):
PACKAGE_VERSION = {
'cryptography': 'cryptography >= 1.4',
+ 'custodia': 'custodia >= 0.3',
'dnspython': 'dnspython >= 1.15',
'gssapi': 'gssapi >= 1.2.0',
'ipaclient': 'ipaclient == {}'.format(VERSION),
--
Manage your subscription for the Freeipa-devel mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-devel
Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code
