URL: https://github.com/freeipa/freeipa/pull/1281 Author: tomaskrizek Title: #1281: [Backport][ipa-4-5] Backup ipa-custodia conf and keys Action: opened
PR body: """ This PR was opened automatically because PR #1257 was pushed to master and backport to ipa-4-5 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1281/head:pr1281 git checkout pr1281
From bb303c75612d0366a4fb3d667cde52927ae729ab Mon Sep 17 00:00:00 2001 From: Christian Heimes <chei...@redhat.com> Date: Wed, 8 Nov 2017 15:15:30 +0100 Subject: [PATCH] Backup ipa-custodia conf and keys https://pagure.io/freeipa/issue/7247 Signed-off-by: Christian Heimes <chei...@redhat.com> --- install/share/custodia.conf.template | 2 +- ipaplatform/base/paths.py | 1 + ipapython/ipautil.py | 19 +++++++++++++++++++ ipaserver/install/custodiainstance.py | 24 +++++++++++++----------- ipaserver/install/ipa_backup.py | 2 ++ ipatests/test_ipapython/test_ipautil.py | 7 +++++++ 6 files changed, 43 insertions(+), 12 deletions(-) diff --git a/install/share/custodia.conf.template b/install/share/custodia.conf.template index 855a1b3ba2..ee3c43ca7e 100644 --- a/install/share/custodia.conf.template +++ b/install/share/custodia.conf.template @@ -16,7 +16,7 @@ header = GSS_NAME handler = ipaserver.secrets.kem.IPAKEMKeys paths = /keys store = ipa -server_keys = $IPA_CUSTODIA_CONF_DIR/server.keys +server_keys = $IPA_CUSTODIA_KEYS [store:ipa] handler = ipaserver.secrets.store.IPASecStore diff --git a/ipaplatform/base/paths.py b/ipaplatform/base/paths.py index 804fddee60..42240a7106 100644 --- a/ipaplatform/base/paths.py +++ b/ipaplatform/base/paths.py @@ -349,6 +349,7 @@ class BasePathNamespace(object): NETWORK_MANAGER_CONFIG_DIR = '/etc/NetworkManager/conf.d' IPA_CUSTODIA_CONF_DIR = '/etc/ipa/custodia' IPA_CUSTODIA_CONF = '/etc/ipa/custodia/custodia.conf' + IPA_CUSTODIA_KEYS = '/etc/ipa/custodia/server.keys' IPA_CUSTODIA_SOCKET = '/run/httpd/ipa-custodia.sock' IPA_CUSTODIA_AUDIT_LOG = '/var/log/ipa-custodia.audit.log' IPA_GETKEYTAB = '/usr/sbin/ipa-getkeytab' diff --git a/ipapython/ipautil.py b/ipapython/ipautil.py index cc52af6d92..426b32ef05 100644 --- a/ipapython/ipautil.py +++ b/ipapython/ipautil.py @@ -307,6 +307,25 @@ def write_tmp_file(txt): return fd + +def flush_sync(f): + """Flush and fsync file to disk + + :param f: a file object with fileno and name + """ + # flush file buffer to file descriptor + f.flush() + # flush Kernel buffer to disk + os.fsync(f.fileno()) + # sync metadata in directory + dirname = os.path.dirname(os.path.abspath(f.name)) + dirfd = os.open(dirname, os.O_RDONLY | os.O_DIRECTORY) + try: + os.fsync(dirfd) + finally: + os.close(dirfd) + + def shell_quote(string): if isinstance(string, str): return "'" + string.replace("'", "'\\''") + "'" diff --git a/ipaserver/install/custodiainstance.py b/ipaserver/install/custodiainstance.py index bc3cea7063..0a90bb3954 100644 --- a/ipaserver/install/custodiainstance.py +++ b/ipaserver/install/custodiainstance.py @@ -25,8 +25,7 @@ class CustodiaInstance(SimpleServiceInstance): def __init__(self, host_name=None, realm=None): super(CustodiaInstance, self).__init__("ipa-custodia") self.config_file = paths.IPA_CUSTODIA_CONF - self.server_keys = os.path.join(paths.IPA_CUSTODIA_CONF_DIR, - 'server.keys') + self.server_keys = paths.IPA_CUSTODIA_KEYS self.ldap_uri = None self.fqdn = host_name self.realm = realm @@ -35,16 +34,19 @@ def __config_file(self): template_file = os.path.basename(self.config_file) + '.template' template = os.path.join(paths.USR_SHARE_IPA_DIR, template_file) httpd_info = pwd.getpwnam(constants.HTTPD_USER) - sub_dict = dict(IPA_CUSTODIA_CONF_DIR=paths.IPA_CUSTODIA_CONF_DIR, - IPA_CUSTODIA_SOCKET=paths.IPA_CUSTODIA_SOCKET, - IPA_CUSTODIA_AUDIT_LOG=paths.IPA_CUSTODIA_AUDIT_LOG, - LDAP_URI=installutils.realm_to_ldapi_uri(self.realm), - UID=httpd_info.pw_uid, GID=httpd_info.pw_gid) + sub_dict = dict( + IPA_CUSTODIA_CONF_DIR=paths.IPA_CUSTODIA_CONF_DIR, + IPA_CUSTODIA_KEYS=paths.IPA_CUSTODIA_KEYS, + IPA_CUSTODIA_SOCKET=paths.IPA_CUSTODIA_SOCKET, + IPA_CUSTODIA_AUDIT_LOG=paths.IPA_CUSTODIA_AUDIT_LOG, + LDAP_URI=installutils.realm_to_ldapi_uri(self.realm), + UID=httpd_info.pw_uid, + GID=httpd_info.pw_gid + ) conf = ipautil.template_file(template, sub_dict) - fd = open(self.config_file, "w+") - fd.write(conf) - fd.flush() - fd.close() + with open(self.config_file, "w") as f: + f.write(conf) + ipautil.flush_sync(f) def create_instance(self): suffix = ipautil.realm_to_suffix(self.realm) diff --git a/ipaserver/install/ipa_backup.py b/ipaserver/install/ipa_backup.py index f8cdd56d26..93b154330d 100644 --- a/ipaserver/install/ipa_backup.py +++ b/ipaserver/install/ipa_backup.py @@ -181,6 +181,8 @@ class Backup(admintool.AdminTool): paths.DNSSEC_SOFTHSM_PIN_SO, paths.IPA_ODS_EXPORTER_KEYTAB, paths.IPA_DNSKEYSYNCD_KEYTAB, + paths.IPA_CUSTODIA_KEYS, + paths.IPA_CUSTODIA_CONF, paths.HOSTS, ) + tuple( os.path.join(paths.IPA_NSSDB_DIR, file) diff --git a/ipatests/test_ipapython/test_ipautil.py b/ipatests/test_ipapython/test_ipautil.py index 9c351bd0ed..5e1f58003e 100644 --- a/ipatests/test_ipapython/test_ipautil.py +++ b/ipatests/test_ipapython/test_ipautil.py @@ -25,6 +25,7 @@ import nose import pytest import six +import tempfile from ipapython import ipautil @@ -478,3 +479,9 @@ def test_backcompat(): assert rc is result.returncode assert out is result.output assert err is result.error_output + + +def test_flush_sync(): + with tempfile.NamedTemporaryFile('wb+') as f: + f.write(b'data') + ipautil.flush_sync(f)
_______________________________________________ FreeIPA-devel mailing list -- freeipa-devel@lists.fedorahosted.org To unsubscribe send an email to freeipa-devel-le...@lists.fedorahosted.org
