From a93e6040fdadd41dc7d1c46c09110b7321ed333c Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Tue, 28 Feb 2017 12:07:19 +0100 Subject: [PATCH] Use Custodia 0.3.1 features * Use sd-notify in ipa-custodia.service * Introduce libexec/ipa/ipa-custodia script. It comes with correct default setting for IPA's config file. The new file also makes it simpler to run IPA's custodia instance with its own SELinux context. * ipapython no longer depends on custodia The patch addresses three issues: * https://bugzilla.redhat.com/show_bug.cgi?id=1430247 Forward compatibility with Custodia 0.3 in Fedora rawhide * https://pagure.io/freeipa/issue/5825 Use sd-notify * https://pagure.io/freeipa/issue/6788 Prepare for separate SELinux context Signed-off-by: Christian Heimes Reviewed-By: Martin Basti Reviewed-By: Jan Cholasta --- freeipa.spec.in | 13 ++++++++----- init/systemd/Makefile.am | 1 + init/systemd/ipa-custodia.service.in | 5 ++--- install/tools/Makefile.am | 1 + install/tools/ipa-custodia | 6 ++++++ ipapython/setup.py | 1 - ipaserver/secrets/service.py | 30 ++++++++++++++++++++++++++++++ ipaserver/setup.py | 1 + ipasetup.py.in | 1 + 9 files changed, 50 insertions(+), 9 deletions(-) create mode 100755 install/tools/ipa-custodia create mode 100644 ipaserver/secrets/service.py diff --git a/freeipa.spec.in b/freeipa.spec.in index 9c8a14a580ad80ed10e797bef9661e7b1feb81b3..91fca6ea974bd70847feb1e3b6db8ae3cbda061c 100644 --- a/freeipa.spec.in +++ b/freeipa.spec.in @@ -181,7 +181,8 @@ BuildRequires: pki-base-python2 BuildRequires: python-pytest-multihost BuildRequires: python-pytest-sourceorder BuildRequires: python-jwcrypto -BuildRequires: python-custodia +# 0.3: sd_notify (https://pagure.io/freeipa/issue/5825) +BuildRequires: python-custodia >= 0.3.1 BuildRequires: dbus-python BuildRequires: python-dateutil BuildRequires: python-enum34 @@ -216,7 +217,8 @@ BuildRequires: pki-base-python3 BuildRequires: python3-pytest-multihost BuildRequires: python3-pytest-sourceorder BuildRequires: python3-jwcrypto -BuildRequires: python3-custodia +# 0.3: sd_notify (https://pagure.io/freeipa/issue/5825) +BuildRequires: python3-custodia >= 0.3.1 BuildRequires: python3-dbus BuildRequires: python3-dateutil BuildRequires: python3-enum34 @@ -340,6 +342,7 @@ BuildArch: noarch Requires: %{name}-server-common = %{version}-%{release} Requires: %{name}-common = %{version}-%{release} Requires: python2-ipaclient = %{version}-%{release} +Requires: python-custodia >= 0.3.1 Requires: python-ldap >= 2.4.15 Requires: python-lxml Requires: python-gssapi >= 1.2.0 @@ -370,6 +373,7 @@ BuildArch: noarch Requires: %{name}-server-common = %{version}-%{release} Requires: %{name}-common = %{version}-%{release} Requires: python3-ipaclient = %{version}-%{release} +Requires: python3-custodia >= 0.3.1 Requires: python3-pyldap >= 2.4.15 Requires: python3-lxml Requires: python3-gssapi >= 1.2.0 @@ -399,7 +403,7 @@ BuildArch: noarch Requires: %{name}-client-common = %{version}-%{release} Requires: httpd >= 2.4.6-31 Requires: systemd-units >= 38 -Requires: custodia +Requires: custodia >= 0.3.1 Provides: %{alt_name}-server-common = %{version} Conflicts: %{alt_name}-server-common @@ -650,7 +654,6 @@ Requires: python-jwcrypto Requires: python-cffi Requires: python-ldap >= 2.4.15 Requires: python-requests -Requires: python-custodia Requires: python-dns >= 1.15 Requires: python-enum34 Requires: python-netifaces >= 0.10.4 @@ -699,7 +702,6 @@ Requires: python3-six Requires: python3-jwcrypto Requires: python3-cffi Requires: python3-pyldap >= 2.4.15 -Requires: python3-custodia Requires: python3-requests Requires: python3-dns >= 1.15 Requires: python3-netifaces >= 0.10.4 @@ -1160,6 +1162,7 @@ fi %{_libexecdir}/certmonger/dogtag-ipa-ca-renew-agent-submit %{_libexecdir}/certmonger/ipa-server-guard %dir %{_libexecdir}/ipa +%{_libexecdir}/ipa/ipa-custodia %{_libexecdir}/ipa/ipa-dnskeysyncd %{_libexecdir}/ipa/ipa-dnskeysync-replica %{_libexecdir}/ipa/ipa-ods-exporter diff --git a/init/systemd/Makefile.am b/init/systemd/Makefile.am index 325e8574812a2ec507911128dbac0315070d2897..945f6ac22a050f393990cad27156e092ce4f7a29 100644 --- a/init/systemd/Makefile.am +++ b/init/systemd/Makefile.am @@ -18,5 +18,6 @@ CLEANFILES = $(systemdsystemunit_DATA) -e 's|@IPA_SYSCONF_DIR[@]|$(IPA_SYSCONF_DIR)|g' \ -e 's|@localstatedir[@]|$(localstatedir)|g' \ -e 's|@sbindir[@]|$(sbindir)|g' \ + -e 's|@libexecdir[@]|$(libexecdir)|g' \ -e 's|@sysconfenvdir[@]|$(sysconfenvdir)|g' \ '$(srcdir)/$@.in' >$@ diff --git a/init/systemd/ipa-custodia.service.in b/init/systemd/ipa-custodia.service.in index 3f9b128aa1b7ee373c52e1e3566048ec6028c826..0247bd8826529d638c692d827ae31393db292b4a 100644 --- a/init/systemd/ipa-custodia.service.in +++ b/init/systemd/ipa-custodia.service.in @@ -2,9 +2,8 @@ Description=IPA Custodia Service [Service] -Type=simple - -ExecStart=@sbindir@/custodia @IPA_SYSCONF_DIR@/custodia/custodia.conf +Type=notify +ExecStart=@libexecdir@/ipa/ipa-custodia @IPA_SYSCONF_DIR@/custodia/custodia.conf PrivateTmp=yes Restart=on-failure RestartSec=60s diff --git a/install/tools/Makefile.am b/install/tools/Makefile.am index f2c2ce2953c3ac146a80f7e4515769683a01f843..493e5ff4a8290be8ef076135104a85f8315b7842 100644 --- a/install/tools/Makefile.am +++ b/install/tools/Makefile.am @@ -32,6 +32,7 @@ dist_sbin_SCRIPTS = \ appdir = $(libexecdir)/ipa/ dist_app_SCRIPTS = \ + ipa-custodia \ ipa-httpd-kdcproxy \ ipa-pki-retrieve-key \ $(NULL) diff --git a/install/tools/ipa-custodia b/install/tools/ipa-custodia new file mode 100755 index 0000000000000000000000000000000000000000..5deeeffdd78db323b6534934065772bb0ae67438 --- /dev/null +++ b/install/tools/ipa-custodia @@ -0,0 +1,6 @@ +#!/usr/bin/python2 +# Copyright (C) 2017 IPA Project Contributors, see COPYING for license +from ipaserver.secrets.service import main + +if __name__ == '__main__': + main() diff --git a/ipapython/setup.py b/ipapython/setup.py index 86e4131e5f9cfc106393875018d6ac2645a38be1..2fc039fe7bb673add17404d13bf477c5b8bb0606 100755 --- a/ipapython/setup.py +++ b/ipapython/setup.py @@ -38,7 +38,6 @@ if __name__ == '__main__': ], install_requires=[ "cffi", - "custodia", "cryptography", "dnspython", "gssapi", diff --git a/ipaserver/secrets/service.py b/ipaserver/secrets/service.py new file mode 100644 index 0000000000000000000000000000000000000000..f51c46a30e4caf76e38659c2f0a6a2c645376978 --- /dev/null +++ b/ipaserver/secrets/service.py @@ -0,0 +1,30 @@ +# Copyright (C) 2017 IPA Project Contributors, see COPYING for license +import argparse + +import custodia.server + + +argparser = argparse.ArgumentParser( + prog='ipa-custodia', + description='IPA Custodia service' +) +argparser.add_argument( + '--debug', + action='store_true', + help='Debug mode' +) +argparser.add_argument( + 'configfile', + nargs='?', + type=argparse.FileType('r'), + help="Path to IPA's custodia server config", + default='/etc/ipa/custodia/custodia.conf' +) + + +def main(): + return custodia.server.main(argparser) + + +if __name__ == '__main__': + main() diff --git a/ipaserver/setup.py b/ipaserver/setup.py index d3c735c0f9e604512d6ccd14dcd16a186c6ecad4..42b0c1b0618ef9867acb1fe2add5702a756cf2d2 100755 --- a/ipaserver/setup.py +++ b/ipaserver/setup.py @@ -47,6 +47,7 @@ if __name__ == '__main__': ], install_requires=[ "cryptography", + "custodia", "dbus-python", "dnspython", "dogtag-pki", diff --git a/ipasetup.py.in b/ipasetup.py.in index 915f0edee7ca291cc4921f6b8e4d38498253b372..7f9b2c918c0cd582706edee087ed5944451aaf2e 100644 --- a/ipasetup.py.in +++ b/ipasetup.py.in @@ -64,6 +64,7 @@ if SETUPTOOLS_VERSION < (8, 0, 0): PACKAGE_VERSION = { 'cryptography': 'cryptography >= 1.4', + 'custodia': 'custodia >= 0.3.1', 'dnspython': 'dnspython >= 1.15', 'gssapi': 'gssapi >= 1.2.0', 'ipaclient': 'ipaclient == {}'.format(VERSION), -- 2.12.1