/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to debian/mandos-client.postinst

  • Committer: Teddy Hogeborn
  • Date: 2015-05-23 20:18:34 UTC
  • mto: (237.7.304 trunk)
  • mto: This revision was merged to the branch mainline in revision 325.
  • Revision ID: teddy@recompile.se-20150523201834-e89ex4ito93yni8x
mandos: Use multiprocessing module to run checkers.

For a long time, the Mandos server has occasionally logged the message
"ERROR: Child process vanished".  This was never a fatal error, but it
has been annoying and slightly worrying, since a definite cause was
not found.  One potential cause could be the "multiprocessing" and
"subprocess" modules conflicting w.r.t. SIGCHLD.  To avoid this,
change the running of checkers from using subprocess.Popen
asynchronously to instead first create a multiprocessing.Process()
(which is asynchronous) calling a function, and have that function
then call subprocess.call() (which is synchronous).  In this way, the
only thing using any asynchronous subprocesses is the multiprocessing
module.

This makes it necessary to change one small thing in the D-Bus API,
since the subprocesses.call() function does not expose the raw wait(2)
status value.

DBUS-API (CheckerCompleted): Change the second value provided by this
                             D-Bus signal from the raw wait(2) status
                             to the actual terminating signal number.
mandos (subprocess_call_pipe): New function to be called by
                               multiprocessing.Process (starting a
                               separate process).
(Client.last_checker signal): New attribute for signal which
                              terminated last checker.  Like
                              last_checker_status, only not accessible
                              via D-Bus.
(Client.checker_callback): Take new "connection" argument and use it
                           to get returncode; set last_checker_signal.
                           Return False so gobject does not call this
                           callback again.
(Client.start_checker): Start checker using a multiprocessing.Process
                        instead of a subprocess.Popen.
(ClientDBus.checker_callback): Take new "connection" argument.        Call
                               Client.checker_callback early to have
                               it set last_checker_status and
                               last_checker_signal; use those.  Change
                               second value provided to D-Bus signal
                               CheckerCompleted to use
                               last_checker_signal if checker was
                               terminated by signal.
mandos-monitor: Update to reflect DBus API change.
(MandosClientWidget.checker_completed): Take "signal" instead of
                                        "condition" argument.  Use it
                                        accordingly.  Remove dead code
                                        (os.WCOREDUMP case).

Show diffs side-by-side

added added

removed removed

Lines of Context:
20
20
# Update the initial RAM file system image
21
21
update_initramfs()
22
22
{
23
 
    update-initramfs -u -k all
 
23
    if [ -x /usr/sbin/update-initramfs ]; then
 
24
        update-initramfs -u -k all
 
25
    fi
24
26
    
25
27
    if dpkg --compare-versions "$2" lt-nl "1.0.10-1"; then
26
28
        # Make old initrd.img files unreadable too, in case they were
50
52
    fi
51
53
}
52
54
 
53
 
# Create client key pairs
54
 
create_keys(){
55
 
    # If the OpenPGP key files do not exist, generate all keys using
56
 
    # mandos-keygen
57
 
    if ! [ -r /etc/keys/mandos/pubkey.txt \
58
 
              -a -r /etc/keys/mandos/seckey.txt ]; then
 
55
# Create client key pair
 
56
create_key(){
 
57
    if [ -r /etc/keys/mandos/pubkey.txt \
 
58
        -a -r /etc/keys/mandos/seckey.txt ]; then
 
59
        return 0
 
60
    fi
 
61
    if [ -x /usr/sbin/mandos-keygen ]; then
59
62
        mandos-keygen
60
 
        gpg-connect-agent KILLAGENT /bye || :
61
 
        return 0
62
 
    fi
63
 
 
64
 
    # If the TLS keys already exists, do nothing
65
 
    if [ -r /etc/keys/mandos/tls-privkey.pem \
66
 
            -a -r /etc/keys/mandos/tls-pubkey.pem ]; then
67
 
        return 0
68
 
    fi
69
 
 
70
 
    # If this is an upgrade from an old installation, the TLS keys
71
 
    # will not exist; create them.
72
 
 
73
 
    # First try certtool from GnuTLS
74
 
    if ! certtool --generate-privkey --password='' \
75
 
         --outfile /etc/keys/mandos/tls-privkey.pem \
76
 
         --sec-param ultra --key-type=ed25519 --pkcs8 --no-text \
77
 
         2>/dev/null; then
78
 
        # Otherwise try OpenSSL
79
 
        if ! openssl genpkey -algorithm X25519 \
80
 
             -out /etc/keys/mandos/tls-privkey.pem; then
81
 
            rm --force /etc/keys/mandos/tls-privkey.pem
82
 
            # None of the commands succeded; give up
83
 
            return 1
84
 
        fi
85
 
    fi
86
 
 
87
 
    local umask=$(umask)
88
 
    umask 077
89
 
    # First try certtool from GnuTLS
90
 
    if ! certtool --password='' \
91
 
         --load-privkey=/etc/keys/mandos/tls-privkey.pem \
92
 
         --outfile=/etc/keys/mandos/tls-pubkey.pem --pubkey-info \
93
 
         --no-text 2>/dev/null; then
94
 
        # Otherwise try OpenSSL
95
 
        if ! openssl pkey -in /etc/keys/mandos/tls-privkey.pem \
96
 
             -out /etc/keys/mandos/tls-pubkey.pem -pubout; then
97
 
            rm --force /etc/keys/mandos/tls-pubkey.pem
98
 
            # None of the commands succeded; give up
99
 
            umask $umask
100
 
            return 1
101
 
        fi
102
 
    fi
103
 
    umask $umask
104
 
}
105
 
 
106
 
create_dh_params(){
107
 
    if [ -r /etc/keys/mandos/dhparams.pem ]; then
108
 
        return 0
109
 
    fi
110
 
    # Create a Diffe-Hellman parameters file
111
 
    DHFILE="`mktemp -t mandos-client-dh-parameters.XXXXXXXXXX.pem`"
112
 
    # First try certtool from GnuTLS
113
 
    if ! certtool --generate-dh-params --sec-param high \
114
 
         --outfile "$DHFILE"; then
115
 
        # Otherwise try OpenSSL
116
 
        if ! openssl genpkey -genparam -algorithm DH -out "$DHFILE" \
117
 
             -pkeyopt dh_paramgen_prime_len:3072; then
118
 
            # None of the commands succeded; give up
119
 
            rm -- "$DHFILE"
120
 
            return 1
121
 
        fi
122
 
    fi
123
 
    sed --in-place --expression='0,/^-----BEGIN DH PARAMETERS-----$/d' \
124
 
        "$DHFILE"
125
 
    sed --in-place --expression='1i-----BEGIN DH PARAMETERS-----' \
126
 
            "$DHFILE"
127
 
    cp --archive "$DHFILE" /etc/keys/mandos/dhparams.pem
128
 
    rm -- "$DHFILE"
 
63
    fi
129
64
}
130
65
 
131
66
case "$1" in
132
67
    configure)
133
68
        add_mandos_user "$@"
134
 
        create_keys "$@"
135
 
        create_dh_params "$@" || :
 
69
        create_key "$@"
136
70
        update_initramfs "$@"
137
 
        if dpkg --compare-versions "$2" lt-nl "1.7.10-1"; then
138
 
            PLUGINHELPERDIR=/usr/lib/$(dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null)/mandos/plugin-helpers
139
 
            if ! dpkg-statoverride --list "$PLUGINHELPERDIR" \
140
 
                 >/dev/null 2>&1; then
141
 
                chmod u=rwx,go= -- "$PLUGINHELPERDIR"
142
 
            fi
143
 
            if ! dpkg-statoverride --list /etc/mandos/plugin-helpers \
144
 
                 >/dev/null 2>&1; then
145
 
                chmod u=rwx,go= -- /etc/mandos/plugin-helpers
146
 
            fi
147
 
        fi
148
71
        ;;
149
72
    abort-upgrade|abort-deconfigure|abort-remove)
150
73
        ;;