From: Martin Langhoff <[EMAIL PROTECTED]>
After a complete rsync transfer, clients will touch a file in
a "trigger" directory. incrond will call postprocess.py to
perform any actions required. With this commit we have
- a paranoid initial part of postprocess, that performs
sanity checks and then drops privs to the matching user
- an incron config
---
server/incron-ds-backup.conf | 1 +
server/postprocess.py | 73 ++++++++++++++++++++++++++++++++++++++++++
2 files changed, 74 insertions(+), 0 deletions(-)
create mode 100644 server/incron-ds-backup.conf
create mode 100755 server/postprocess.py
diff --git a/server/incron-ds-backup.conf b/server/incron-ds-backup.conf
new file mode 100644
index 0000000..5bb4dff
--- /dev/null
+++ b/server/incron-ds-backup.conf
@@ -0,0 +1 @@
+/var/lib/ds-backup/completion IN_CREATE
/usr/local/ds-backup/server/postprocess.py $@ $#
\ No newline at end of file
diff --git a/server/postprocess.py b/server/postprocess.py
new file mode 100755
index 0000000..82a2418
--- /dev/null
+++ b/server/postprocess.py
@@ -0,0 +1,73 @@
+#!/usr/bin/python
+#
+# Once a backup from a client is complete,
+# postprocess is called by incrond finish off
+# the task. Should be called in as root, and it will
+# drop privileges to the user it will process.
+#
+# The incrond invocation line should be
+# /path/to/dir IN_CREATE /path/to/postprocess.py $@ $#
+#
+# (in other words, we expect 2 parameters, dirpath, filename)
+#
+import sys
+import os
+import re
+import pwd
+
+homebasepath = '/library/users'
+dirpath = sys.argv[1]
+fname = sys.argv[2]
+fpath = dirpath + '/' + fname
+
+#
+# Sanity checks:
+# - must be a file
+# - username must be ^\w+$
+# - uid must match username
+# - must exist in /library/users
+#
+# Note: there are race conditions here.
+# We will drop privs before doing
+# potentially damanging stuff.
+#
+
+if not os.path.isfile(fpath):
+ exit(1)
+if os.path.islink(fpath):
+ exit(1)
+if not re.match('\w+$', fname):
+ exit(1)
+
+# we'll hit a KeyError exception and exit 1
+# if the user is not found
+user = pwd.getpwnam(fname)
+# match with /library/users
+if not re.match(homebasepath, user[5]):
+ exit(1)
+# user uid must match file owner uid
+if not (user[3] == os.stat(fpath)[4]):
+ exit(1)
+
+# Checks done -now we drop privs and
+# - remove flag file
+# - hardlink files as appropriate
+#
+try:
+ os.setgid(user[3])
+ os.setuid(user[2])
+except OSError, e:
+ sys.stderr.write('Could not set gid %s uid %s' % user[3], user[2])
+
+# rm the flagfile
+os.unlink(fpath)
+
+# os.system() rsync
+#print
+
+
+
+
+
+
+
--
1.5.6.dirty
_______________________________________________
Server-devel mailing list
Server-devel@lists.laptop.org
http://lists.laptop.org/listinfo/server-devel
