pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone

Blame SOURCES/0037-Use-Custodia-0.3.1-features.patch

ac7d03
From a93e6040fdadd41dc7d1c46c09110b7321ed333c Mon Sep 17 00:00:00 2001
ac7d03
From: Christian Heimes <cheimes@redhat.com>
ac7d03
Date: Tue, 28 Feb 2017 12:07:19 +0100
ac7d03
Subject: [PATCH] Use Custodia 0.3.1 features
ac7d03
ac7d03
* Use sd-notify in ipa-custodia.service
ac7d03
* Introduce libexec/ipa/ipa-custodia script. It comes with correct
ac7d03
  default setting for IPA's config file. The new file also makes it
ac7d03
  simpler to run IPA's custodia instance with its own SELinux context.
ac7d03
* ipapython no longer depends on custodia
ac7d03
ac7d03
The patch addresses three issues:
ac7d03
ac7d03
* https://bugzilla.redhat.com/show_bug.cgi?id=1430247
ac7d03
  Forward compatibility with Custodia 0.3 in Fedora rawhide
ac7d03
* https://pagure.io/freeipa/issue/5825
ac7d03
  Use sd-notify
ac7d03
* https://pagure.io/freeipa/issue/6788
ac7d03
  Prepare for separate SELinux context
ac7d03
ac7d03
Signed-off-by: Christian Heimes <cheimes@redhat.com>
ac7d03
Reviewed-By: Martin Basti <mbasti@redhat.com>
ac7d03
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
ac7d03
---
ac7d03
 freeipa.spec.in                      | 13 ++++++++-----
ac7d03
 init/systemd/Makefile.am             |  1 +
ac7d03
 init/systemd/ipa-custodia.service.in |  5 ++---
ac7d03
 install/tools/Makefile.am            |  1 +
ac7d03
 install/tools/ipa-custodia           |  6 ++++++
ac7d03
 ipapython/setup.py                   |  1 -
ac7d03
 ipaserver/secrets/service.py         | 30 ++++++++++++++++++++++++++++++
ac7d03
 ipaserver/setup.py                   |  1 +
ac7d03
 ipasetup.py.in                       |  1 +
ac7d03
 9 files changed, 50 insertions(+), 9 deletions(-)
ac7d03
 create mode 100755 install/tools/ipa-custodia
ac7d03
 create mode 100644 ipaserver/secrets/service.py
ac7d03
ac7d03
diff --git a/freeipa.spec.in b/freeipa.spec.in
ac7d03
index 9c8a14a580ad80ed10e797bef9661e7b1feb81b3..91fca6ea974bd70847feb1e3b6db8ae3cbda061c 100644
ac7d03
--- a/freeipa.spec.in
ac7d03
+++ b/freeipa.spec.in
ac7d03
@@ -181,7 +181,8 @@ BuildRequires:  pki-base-python2
ac7d03
 BuildRequires:  python-pytest-multihost
ac7d03
 BuildRequires:  python-pytest-sourceorder
ac7d03
 BuildRequires:  python-jwcrypto
ac7d03
-BuildRequires:  python-custodia
ac7d03
+# 0.3: sd_notify (https://pagure.io/freeipa/issue/5825)
ac7d03
+BuildRequires:  python-custodia >= 0.3.1
ac7d03
 BuildRequires:  dbus-python
ac7d03
 BuildRequires:  python-dateutil
ac7d03
 BuildRequires:  python-enum34
ac7d03
@@ -216,7 +217,8 @@ BuildRequires:  pki-base-python3
ac7d03
 BuildRequires:  python3-pytest-multihost
ac7d03
 BuildRequires:  python3-pytest-sourceorder
ac7d03
 BuildRequires:  python3-jwcrypto
ac7d03
-BuildRequires:  python3-custodia
ac7d03
+# 0.3: sd_notify (https://pagure.io/freeipa/issue/5825)
ac7d03
+BuildRequires:  python3-custodia >= 0.3.1
ac7d03
 BuildRequires:  python3-dbus
ac7d03
 BuildRequires:  python3-dateutil
ac7d03
 BuildRequires:  python3-enum34
ac7d03
@@ -340,6 +342,7 @@ BuildArch: noarch
ac7d03
 Requires: %{name}-server-common = %{version}-%{release}
ac7d03
 Requires: %{name}-common = %{version}-%{release}
ac7d03
 Requires: python2-ipaclient = %{version}-%{release}
ac7d03
+Requires: python-custodia >= 0.3.1
ac7d03
 Requires: python-ldap >= 2.4.15
ac7d03
 Requires: python-lxml
ac7d03
 Requires: python-gssapi >= 1.2.0
ac7d03
@@ -370,6 +373,7 @@ BuildArch: noarch
ac7d03
 Requires: %{name}-server-common = %{version}-%{release}
ac7d03
 Requires: %{name}-common = %{version}-%{release}
ac7d03
 Requires: python3-ipaclient = %{version}-%{release}
ac7d03
+Requires: python3-custodia >= 0.3.1
ac7d03
 Requires: python3-pyldap >= 2.4.15
ac7d03
 Requires: python3-lxml
ac7d03
 Requires: python3-gssapi >= 1.2.0
ac7d03
@@ -399,7 +403,7 @@ BuildArch: noarch
ac7d03
 Requires: %{name}-client-common = %{version}-%{release}
ac7d03
 Requires: httpd >= 2.4.6-31
ac7d03
 Requires: systemd-units >= 38
ac7d03
-Requires: custodia
ac7d03
+Requires: custodia >= 0.3.1
ac7d03
 
ac7d03
 Provides: %{alt_name}-server-common = %{version}
ac7d03
 Conflicts: %{alt_name}-server-common
ac7d03
@@ -650,7 +654,6 @@ Requires: python-jwcrypto
ac7d03
 Requires: python-cffi
ac7d03
 Requires: python-ldap >= 2.4.15
ac7d03
 Requires: python-requests
ac7d03
-Requires: python-custodia
ac7d03
 Requires: python-dns >= 1.15
ac7d03
 Requires: python-enum34
ac7d03
 Requires: python-netifaces >= 0.10.4
ac7d03
@@ -699,7 +702,6 @@ Requires: python3-six
ac7d03
 Requires: python3-jwcrypto
ac7d03
 Requires: python3-cffi
ac7d03
 Requires: python3-pyldap >= 2.4.15
ac7d03
-Requires: python3-custodia
ac7d03
 Requires: python3-requests
ac7d03
 Requires: python3-dns >= 1.15
ac7d03
 Requires: python3-netifaces >= 0.10.4
ac7d03
@@ -1160,6 +1162,7 @@ fi
ac7d03
 %{_libexecdir}/certmonger/dogtag-ipa-ca-renew-agent-submit
ac7d03
 %{_libexecdir}/certmonger/ipa-server-guard
ac7d03
 %dir %{_libexecdir}/ipa
ac7d03
+%{_libexecdir}/ipa/ipa-custodia
ac7d03
 %{_libexecdir}/ipa/ipa-dnskeysyncd
ac7d03
 %{_libexecdir}/ipa/ipa-dnskeysync-replica
ac7d03
 %{_libexecdir}/ipa/ipa-ods-exporter
ac7d03
diff --git a/init/systemd/Makefile.am b/init/systemd/Makefile.am
ac7d03
index 325e8574812a2ec507911128dbac0315070d2897..945f6ac22a050f393990cad27156e092ce4f7a29 100644
ac7d03
--- a/init/systemd/Makefile.am
ac7d03
+++ b/init/systemd/Makefile.am
ac7d03
@@ -18,5 +18,6 @@ CLEANFILES = $(systemdsystemunit_DATA)
ac7d03
 		-e 's|@IPA_SYSCONF_DIR[@]|$(IPA_SYSCONF_DIR)|g' \
ac7d03
 		-e 's|@localstatedir[@]|$(localstatedir)|g' \
ac7d03
 		-e 's|@sbindir[@]|$(sbindir)|g' \
ac7d03
+		-e 's|@libexecdir[@]|$(libexecdir)|g' \
ac7d03
 		-e 's|@sysconfenvdir[@]|$(sysconfenvdir)|g' \
ac7d03
 		'$(srcdir)/$@.in' >$@
ac7d03
diff --git a/init/systemd/ipa-custodia.service.in b/init/systemd/ipa-custodia.service.in
ac7d03
index 3f9b128aa1b7ee373c52e1e3566048ec6028c826..0247bd8826529d638c692d827ae31393db292b4a 100644
ac7d03
--- a/init/systemd/ipa-custodia.service.in
ac7d03
+++ b/init/systemd/ipa-custodia.service.in
ac7d03
@@ -2,9 +2,8 @@
ac7d03
 Description=IPA Custodia Service
ac7d03
 
ac7d03
 [Service]
ac7d03
-Type=simple
ac7d03
-
ac7d03
-ExecStart=@sbindir@/custodia @IPA_SYSCONF_DIR@/custodia/custodia.conf
ac7d03
+Type=notify
ac7d03
+ExecStart=@libexecdir@/ipa/ipa-custodia @IPA_SYSCONF_DIR@/custodia/custodia.conf
ac7d03
 PrivateTmp=yes
ac7d03
 Restart=on-failure
ac7d03
 RestartSec=60s
ac7d03
diff --git a/install/tools/Makefile.am b/install/tools/Makefile.am
ac7d03
index f2c2ce2953c3ac146a80f7e4515769683a01f843..493e5ff4a8290be8ef076135104a85f8315b7842 100644
ac7d03
--- a/install/tools/Makefile.am
ac7d03
+++ b/install/tools/Makefile.am
ac7d03
@@ -32,6 +32,7 @@ dist_sbin_SCRIPTS =		\
ac7d03
 
ac7d03
 appdir = $(libexecdir)/ipa/
ac7d03
 dist_app_SCRIPTS =		\
ac7d03
+	ipa-custodia		\
ac7d03
 	ipa-httpd-kdcproxy	\
ac7d03
 	ipa-pki-retrieve-key	\
ac7d03
 	$(NULL)
ac7d03
diff --git a/install/tools/ipa-custodia b/install/tools/ipa-custodia
ac7d03
new file mode 100755
ac7d03
index 0000000000000000000000000000000000000000..5deeeffdd78db323b6534934065772bb0ae67438
ac7d03
--- /dev/null
ac7d03
+++ b/install/tools/ipa-custodia
ac7d03
@@ -0,0 +1,6 @@
ac7d03
+#!/usr/bin/python2
ac7d03
+# Copyright (C) 2017  IPA Project Contributors, see COPYING for license
ac7d03
+from ipaserver.secrets.service import main
ac7d03
+
ac7d03
+if __name__ == '__main__':
ac7d03
+    main()
ac7d03
diff --git a/ipapython/setup.py b/ipapython/setup.py
ac7d03
index 86e4131e5f9cfc106393875018d6ac2645a38be1..2fc039fe7bb673add17404d13bf477c5b8bb0606 100755
ac7d03
--- a/ipapython/setup.py
ac7d03
+++ b/ipapython/setup.py
ac7d03
@@ -38,7 +38,6 @@ if __name__ == '__main__':
ac7d03
         ],
ac7d03
         install_requires=[
ac7d03
             "cffi",
ac7d03
-            "custodia",
ac7d03
             "cryptography",
ac7d03
             "dnspython",
ac7d03
             "gssapi",
ac7d03
diff --git a/ipaserver/secrets/service.py b/ipaserver/secrets/service.py
ac7d03
new file mode 100644
ac7d03
index 0000000000000000000000000000000000000000..f51c46a30e4caf76e38659c2f0a6a2c645376978
ac7d03
--- /dev/null
ac7d03
+++ b/ipaserver/secrets/service.py
ac7d03
@@ -0,0 +1,30 @@
ac7d03
+# Copyright (C) 2017  IPA Project Contributors, see COPYING for license
ac7d03
+import argparse
ac7d03
+
ac7d03
+import custodia.server
ac7d03
+
ac7d03
+
ac7d03
+argparser = argparse.ArgumentParser(
ac7d03
+    prog='ipa-custodia',
ac7d03
+    description='IPA Custodia service'
ac7d03
+)
ac7d03
+argparser.add_argument(
ac7d03
+    '--debug',
ac7d03
+    action='store_true',
ac7d03
+    help='Debug mode'
ac7d03
+)
ac7d03
+argparser.add_argument(
ac7d03
+    'configfile',
ac7d03
+    nargs='?',
ac7d03
+    type=argparse.FileType('r'),
ac7d03
+    help="Path to IPA's custodia server config",
ac7d03
+    default='/etc/ipa/custodia/custodia.conf'
ac7d03
+)
ac7d03
+
ac7d03
+
ac7d03
+def main():
ac7d03
+    return custodia.server.main(argparser)
ac7d03
+
ac7d03
+
ac7d03
+if __name__ == '__main__':
ac7d03
+    main()
ac7d03
diff --git a/ipaserver/setup.py b/ipaserver/setup.py
ac7d03
index d3c735c0f9e604512d6ccd14dcd16a186c6ecad4..42b0c1b0618ef9867acb1fe2add5702a756cf2d2 100755
ac7d03
--- a/ipaserver/setup.py
ac7d03
+++ b/ipaserver/setup.py
ac7d03
@@ -47,6 +47,7 @@ if __name__ == '__main__':
ac7d03
         ],
ac7d03
         install_requires=[
ac7d03
             "cryptography",
ac7d03
+            "custodia",
ac7d03
             "dbus-python",
ac7d03
             "dnspython",
ac7d03
             "dogtag-pki",
ac7d03
diff --git a/ipasetup.py.in b/ipasetup.py.in
ac7d03
index 915f0edee7ca291cc4921f6b8e4d38498253b372..7f9b2c918c0cd582706edee087ed5944451aaf2e 100644
ac7d03
--- a/ipasetup.py.in
ac7d03
+++ b/ipasetup.py.in
ac7d03
@@ -64,6 +64,7 @@ if SETUPTOOLS_VERSION < (8, 0, 0):
ac7d03
 
ac7d03
 PACKAGE_VERSION = {
ac7d03
     'cryptography': 'cryptography >= 1.4',
ac7d03
+    'custodia': 'custodia >= 0.3.1',
ac7d03
     'dnspython': 'dnspython >= 1.15',
ac7d03
     'gssapi': 'gssapi >= 1.2.0',
ac7d03
     'ipaclient': 'ipaclient == {}'.format(VERSION),
ac7d03
-- 
ac7d03
2.12.1
ac7d03