From a93e6040fdadd41dc7d1c46c09110b7321ed333c Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Tue, 28 Feb 2017 12:07:19 +0100
Subject: [PATCH] Use Custodia 0.3.1 features
* Use sd-notify in ipa-custodia.service
* Introduce libexec/ipa/ipa-custodia script. It comes with correct
default setting for IPA's config file. The new file also makes it
simpler to run IPA's custodia instance with its own SELinux context.
* ipapython no longer depends on custodia
The patch addresses three issues:
* https://bugzilla.redhat.com/show_bug.cgi?id=1430247
Forward compatibility with Custodia 0.3 in Fedora rawhide
* https://pagure.io/freeipa/issue/5825
Use sd-notify
* https://pagure.io/freeipa/issue/6788
Prepare for separate SELinux context
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
---
freeipa.spec.in | 13 ++++++++-----
init/systemd/Makefile.am | 1 +
init/systemd/ipa-custodia.service.in | 5 ++---
install/tools/Makefile.am | 1 +
install/tools/ipa-custodia | 6 ++++++
ipapython/setup.py | 1 -
ipaserver/secrets/service.py | 30 ++++++++++++++++++++++++++++++
ipaserver/setup.py | 1 +
ipasetup.py.in | 1 +
9 files changed, 50 insertions(+), 9 deletions(-)
create mode 100755 install/tools/ipa-custodia
create mode 100644 ipaserver/secrets/service.py
diff --git a/freeipa.spec.in b/freeipa.spec.in
index 9c8a14a580ad80ed10e797bef9661e7b1feb81b3..91fca6ea974bd70847feb1e3b6db8ae3cbda061c 100644
--- a/freeipa.spec.in
+++ b/freeipa.spec.in
@@ -181,7 +181,8 @@ BuildRequires: pki-base-python2
BuildRequires: python-pytest-multihost
BuildRequires: python-pytest-sourceorder
BuildRequires: python-jwcrypto
-BuildRequires: python-custodia
+# 0.3: sd_notify (https://pagure.io/freeipa/issue/5825)
+BuildRequires: python-custodia >= 0.3.1
BuildRequires: dbus-python
BuildRequires: python-dateutil
BuildRequires: python-enum34
@@ -216,7 +217,8 @@ BuildRequires: pki-base-python3
BuildRequires: python3-pytest-multihost
BuildRequires: python3-pytest-sourceorder
BuildRequires: python3-jwcrypto
-BuildRequires: python3-custodia
+# 0.3: sd_notify (https://pagure.io/freeipa/issue/5825)
+BuildRequires: python3-custodia >= 0.3.1
BuildRequires: python3-dbus
BuildRequires: python3-dateutil
BuildRequires: python3-enum34
@@ -340,6 +342,7 @@ BuildArch: noarch
Requires: %{name}-server-common = %{version}-%{release}
Requires: %{name}-common = %{version}-%{release}
Requires: python2-ipaclient = %{version}-%{release}
+Requires: python-custodia >= 0.3.1
Requires: python-ldap >= 2.4.15
Requires: python-lxml
Requires: python-gssapi >= 1.2.0
@@ -370,6 +373,7 @@ BuildArch: noarch
Requires: %{name}-server-common = %{version}-%{release}
Requires: %{name}-common = %{version}-%{release}
Requires: python3-ipaclient = %{version}-%{release}
+Requires: python3-custodia >= 0.3.1
Requires: python3-pyldap >= 2.4.15
Requires: python3-lxml
Requires: python3-gssapi >= 1.2.0
@@ -399,7 +403,7 @@ BuildArch: noarch
Requires: %{name}-client-common = %{version}-%{release}
Requires: httpd >= 2.4.6-31
Requires: systemd-units >= 38
-Requires: custodia
+Requires: custodia >= 0.3.1
Provides: %{alt_name}-server-common = %{version}
Conflicts: %{alt_name}-server-common
@@ -650,7 +654,6 @@ Requires: python-jwcrypto
Requires: python-cffi
Requires: python-ldap >= 2.4.15
Requires: python-requests
-Requires: python-custodia
Requires: python-dns >= 1.15
Requires: python-enum34
Requires: python-netifaces >= 0.10.4
@@ -699,7 +702,6 @@ Requires: python3-six
Requires: python3-jwcrypto
Requires: python3-cffi
Requires: python3-pyldap >= 2.4.15
-Requires: python3-custodia
Requires: python3-requests
Requires: python3-dns >= 1.15
Requires: python3-netifaces >= 0.10.4
@@ -1160,6 +1162,7 @@ fi
%{_libexecdir}/certmonger/dogtag-ipa-ca-renew-agent-submit
%{_libexecdir}/certmonger/ipa-server-guard
%dir %{_libexecdir}/ipa
+%{_libexecdir}/ipa/ipa-custodia
%{_libexecdir}/ipa/ipa-dnskeysyncd
%{_libexecdir}/ipa/ipa-dnskeysync-replica
%{_libexecdir}/ipa/ipa-ods-exporter
diff --git a/init/systemd/Makefile.am b/init/systemd/Makefile.am
index 325e8574812a2ec507911128dbac0315070d2897..945f6ac22a050f393990cad27156e092ce4f7a29 100644
--- a/init/systemd/Makefile.am
+++ b/init/systemd/Makefile.am
@@ -18,5 +18,6 @@ CLEANFILES = $(systemdsystemunit_DATA)
-e 's|@IPA_SYSCONF_DIR[@]|$(IPA_SYSCONF_DIR)|g' \
-e 's|@localstatedir[@]|$(localstatedir)|g' \
-e 's|@sbindir[@]|$(sbindir)|g' \
+ -e 's|@libexecdir[@]|$(libexecdir)|g' \
-e 's|@sysconfenvdir[@]|$(sysconfenvdir)|g' \
'$(srcdir)/$@.in' >$@
diff --git a/init/systemd/ipa-custodia.service.in b/init/systemd/ipa-custodia.service.in
index 3f9b128aa1b7ee373c52e1e3566048ec6028c826..0247bd8826529d638c692d827ae31393db292b4a 100644
--- a/init/systemd/ipa-custodia.service.in
+++ b/init/systemd/ipa-custodia.service.in
@@ -2,9 +2,8 @@
Description=IPA Custodia Service
[Service]
-Type=simple
-
-ExecStart=@sbindir@/custodia @IPA_SYSCONF_DIR@/custodia/custodia.conf
+Type=notify
+ExecStart=@libexecdir@/ipa/ipa-custodia @IPA_SYSCONF_DIR@/custodia/custodia.conf
PrivateTmp=yes
Restart=on-failure
RestartSec=60s
diff --git a/install/tools/Makefile.am b/install/tools/Makefile.am
index f2c2ce2953c3ac146a80f7e4515769683a01f843..493e5ff4a8290be8ef076135104a85f8315b7842 100644
--- a/install/tools/Makefile.am
+++ b/install/tools/Makefile.am
@@ -32,6 +32,7 @@ dist_sbin_SCRIPTS = \
appdir = $(libexecdir)/ipa/
dist_app_SCRIPTS = \
+ ipa-custodia \
ipa-httpd-kdcproxy \
ipa-pki-retrieve-key \
$(NULL)
diff --git a/install/tools/ipa-custodia b/install/tools/ipa-custodia
new file mode 100755
index 0000000000000000000000000000000000000000..5deeeffdd78db323b6534934065772bb0ae67438
--- /dev/null
+++ b/install/tools/ipa-custodia
@@ -0,0 +1,6 @@
+#!/usr/bin/python2
+# Copyright (C) 2017 IPA Project Contributors, see COPYING for license
+from ipaserver.secrets.service import main
+
+if __name__ == '__main__':
+ main()
diff --git a/ipapython/setup.py b/ipapython/setup.py
index 86e4131e5f9cfc106393875018d6ac2645a38be1..2fc039fe7bb673add17404d13bf477c5b8bb0606 100755
--- a/ipapython/setup.py
+++ b/ipapython/setup.py
@@ -38,7 +38,6 @@ if __name__ == '__main__':
],
install_requires=[
"cffi",
- "custodia",
"cryptography",
"dnspython",
"gssapi",
diff --git a/ipaserver/secrets/service.py b/ipaserver/secrets/service.py
new file mode 100644
index 0000000000000000000000000000000000000000..f51c46a30e4caf76e38659c2f0a6a2c645376978
--- /dev/null
+++ b/ipaserver/secrets/service.py
@@ -0,0 +1,30 @@
+# Copyright (C) 2017 IPA Project Contributors, see COPYING for license
+import argparse
+
+import custodia.server
+
+
+argparser = argparse.ArgumentParser(
+ prog='ipa-custodia',
+ description='IPA Custodia service'
+)
+argparser.add_argument(
+ '--debug',
+ action='store_true',
+ help='Debug mode'
+)
+argparser.add_argument(
+ 'configfile',
+ nargs='?',
+ type=argparse.FileType('r'),
+ help="Path to IPA's custodia server config",
+ default='/etc/ipa/custodia/custodia.conf'
+)
+
+
+def main():
+ return custodia.server.main(argparser)
+
+
+if __name__ == '__main__':
+ main()
diff --git a/ipaserver/setup.py b/ipaserver/setup.py
index d3c735c0f9e604512d6ccd14dcd16a186c6ecad4..42b0c1b0618ef9867acb1fe2add5702a756cf2d2 100755
--- a/ipaserver/setup.py
+++ b/ipaserver/setup.py
@@ -47,6 +47,7 @@ if __name__ == '__main__':
],
install_requires=[
"cryptography",
+ "custodia",
"dbus-python",
"dnspython",
"dogtag-pki",
diff --git a/ipasetup.py.in b/ipasetup.py.in
index 915f0edee7ca291cc4921f6b8e4d38498253b372..7f9b2c918c0cd582706edee087ed5944451aaf2e 100644
--- a/ipasetup.py.in
+++ b/ipasetup.py.in
@@ -64,6 +64,7 @@ if SETUPTOOLS_VERSION < (8, 0, 0):
PACKAGE_VERSION = {
'cryptography': 'cryptography >= 1.4',
+ 'custodia': 'custodia >= 0.3.1',
'dnspython': 'dnspython >= 1.15',
'gssapi': 'gssapi >= 1.2.0',
'ipaclient': 'ipaclient == {}'.format(VERSION),
--
2.12.1