/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-ctl.xml

  • Committer: Teddy Hogeborn
  • Date: 2019-08-02 22:16:53 UTC
  • Revision ID: teddy@recompile.se-20190802221653-ic1iko9hbefzwsk7
Fix bug in server Debian package: Fails to start on first install

There has been a very long-standing bug where installation of the
server (the "mandos" Debian package) would fail to start the server
properly right after installation.  It would work on manual (re)start
after installation, or after reboot, and even after package purge and
reinstall, it would then work the first time.  The problem, it turns
out, is when the new "_mandos" user (and corresponding group) is
created, the D-Bus server is not reloaded, and is therefore not aware
of that user, and does not recognize the user and group name in the
/etc/dbus-1/system.d/mandos.conf file.  The Mandos server, when it
tries to start and access the D-Bus, is then not permitted to connect
to its D-Bus bus name, and disables D-Bus use as a fallback measure;
i.e. the server works, but it is not controllable via D-Bus commands
(via mandos-ctl or mandos-monitor).  The next time the D-Bus daemon is
reloaded for any reason, the new user & group would become visible to
the D-Bus daemon and after that, any restart of the Mandos server
would succeed and it would bind to its D-Bus name properly, and
thereby be visible and controllable by mandos-ctl & mandos-monitor.
This was mostly invisible when using sysvinit, but systemd makes the
problem visible since the systemd service file for the Mandos server
is configured to not consider the Mandos server "started" until the
D-Bus name has been bound; this makes the starting of the service wait
for 90 seconds and then fail with a timeout error.

Fixing this should also make the Debian CI autopkgtest tests work.

* debian/mandos.postinst (configure): After creating (or renaming)
                                      user & group, reload D-Bus
                                      daemon (if present).

Show diffs side-by-side

added added

removed removed

Lines of Context:
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY COMMANDNAME "mandos-ctl">
5
 
<!ENTITY TIMESTAMP "2012-06-22">
 
5
<!ENTITY TIMESTAMP "2019-07-29">
6
6
<!ENTITY % common SYSTEM "common.ent">
7
7
%common;
8
8
]>
34
34
      <year>2010</year>
35
35
      <year>2011</year>
36
36
      <year>2012</year>
 
37
      <year>2013</year>
 
38
      <year>2014</year>
 
39
      <year>2015</year>
 
40
      <year>2016</year>
 
41
      <year>2017</year>
 
42
      <year>2018</year>
 
43
      <year>2019</year>
37
44
      <holder>Teddy Hogeborn</holder>
38
45
      <holder>Björn Påhlsson</holder>
39
46
    </copyright>
48
55
  <refnamediv>
49
56
    <refname><command>&COMMANDNAME;</command></refname>
50
57
    <refpurpose>
51
 
      Control the operation of the Mandos server
 
58
      Control or query the operation of the Mandos server
52
59
    </refpurpose>
53
60
  </refnamediv>
54
61
  
56
63
    <cmdsynopsis>
57
64
      <command>&COMMANDNAME;</command>
58
65
      <group>
59
 
        <arg choice="plain"><option>--enable</option></arg>
60
 
        <arg choice="plain"><option>-e</option></arg>
61
 
        <sbr/>
62
 
        <arg choice="plain"><option>--disable</option></arg>
63
 
        <arg choice="plain"><option>-d</option></arg>
64
 
      </group>
65
 
      <sbr/>
66
 
      <group>
67
 
        <arg choice="plain"><option>--bump-timeout</option></arg>
68
 
        <arg choice="plain"><option>-b</option></arg>
69
 
      </group>
70
 
      <sbr/>
71
 
      <group>
72
 
        <arg choice="plain"><option>--start-checker</option></arg>
73
 
      </group>
74
 
      <sbr/>
75
 
      <group>
76
 
        <arg choice="plain"><option>--stop-checker</option></arg>
77
 
      </group>
78
 
      <sbr/>
79
 
      <group>
80
 
        <arg choice="plain"><option>--remove</option></arg>
81
 
        <arg choice="plain"><option>-r</option></arg>
82
 
      </group>
83
 
      <sbr/>
84
 
      <group>
85
 
        <arg choice="plain"><option>--checker
86
 
        <replaceable>COMMAND</replaceable></option></arg>
87
 
        <arg choice="plain"><option>-c
88
 
        <replaceable>COMMAND</replaceable></option></arg>
89
 
      </group>
90
 
      <sbr/>
91
 
      <group>
92
 
        <arg choice="plain"><option>--timeout
93
 
        <replaceable>TIME</replaceable></option></arg>
94
 
        <arg choice="plain"><option>-t
95
 
        <replaceable>TIME</replaceable></option></arg>
96
 
      </group>
97
 
      <sbr/>
98
 
      <group>
99
 
        <arg choice="plain"><option>--extended-timeout
100
 
        <replaceable>TIME</replaceable></option></arg>
101
 
      </group>
102
 
      <sbr/>
103
 
      <group>
104
 
        <arg choice="plain"><option>--interval
105
 
        <replaceable>TIME</replaceable></option></arg>
106
 
        <arg choice="plain"><option>-i
107
 
        <replaceable>TIME</replaceable></option></arg>
108
 
      </group>
109
 
      <sbr/>
110
 
      <group>
111
 
        <arg choice="plain"><option>--approve-by-default</option
112
 
        ></arg>
113
 
        <sbr/>
114
 
        <arg choice="plain"><option>--deny-by-default</option></arg>
115
 
      </group>
116
 
      <sbr/>
117
 
      <group>
118
 
        <arg choice="plain"><option>--approval-delay
119
 
        <replaceable>TIME</replaceable></option></arg>
120
 
      </group>
121
 
      <sbr/>
122
 
      <group>
123
 
        <arg choice="plain"><option>--approval-duration
124
 
        <replaceable>TIME</replaceable></option></arg>
125
 
      </group>
126
 
      <sbr/>
127
 
      <group>
128
 
        <arg choice="plain"><option>--interval
129
 
        <replaceable>TIME</replaceable></option></arg>
130
 
        <arg choice="plain"><option>-i
131
 
        <replaceable>TIME</replaceable></option></arg>
132
 
      </group>
133
 
      <sbr/>
134
 
      <group>
135
 
        <arg choice="plain"><option>--host
136
 
        <replaceable>STRING</replaceable></option></arg>
137
 
        <arg choice="plain"><option>-H
138
 
        <replaceable>STRING</replaceable></option></arg>
139
 
      </group>
140
 
      <sbr/>
141
 
      <group>
142
 
        <arg choice="plain"><option>--secret
143
 
        <replaceable>FILENAME</replaceable></option></arg>
144
 
        <arg choice="plain"><option>-s
145
 
        <replaceable>FILENAME</replaceable></option></arg>
146
 
      </group>
147
 
      <sbr/>
148
 
      <group>
149
 
        <arg choice="plain"><option>--approve</option></arg>
150
 
        <arg choice="plain"><option>-A</option></arg>
151
 
        <sbr/>
 
66
          <arg choice="plain"><option>--verbose</option></arg>
 
67
          <arg choice="plain"><option>-v</option></arg>
 
68
          <sbr/>
 
69
          <arg choice="plain"><option>--dump-json</option></arg>
 
70
          <arg choice="plain"><option>-j</option></arg>
 
71
      </group>
 
72
      <arg><option>--debug</option></arg>
 
73
      <group>
 
74
        <arg rep='repeat' choice='plain'>
 
75
          <replaceable>CLIENT</replaceable>
 
76
        </arg>
 
77
      </group>
 
78
    </cmdsynopsis>
 
79
    <cmdsynopsis>
 
80
      <command>&COMMANDNAME;</command>
 
81
      <group choice="req">
 
82
        <group>
 
83
          <arg choice="plain"><option>--enable</option></arg>
 
84
          <arg choice="plain"><option>-e</option></arg>
 
85
          <sbr/>
 
86
          <arg choice="plain"><option>--disable</option></arg>
 
87
          <arg choice="plain"><option>-d</option></arg>
 
88
        </group>
 
89
        <sbr/>
 
90
        <group>
 
91
          <arg choice="plain"><option>--bump-timeout</option></arg>
 
92
          <arg choice="plain"><option>-b</option></arg>
 
93
        </group>
 
94
        <sbr/>
 
95
        <group>
 
96
          <arg choice="plain"><option>--start-checker</option></arg>
 
97
          <arg choice="plain"><option>--stop-checker</option></arg>
 
98
        </group>
 
99
        <sbr/>
 
100
        <group>
 
101
          <arg choice="plain"><option>--checker
 
102
          <replaceable>COMMAND</replaceable></option></arg>
 
103
          <arg choice="plain"><option>-c
 
104
          <replaceable>COMMAND</replaceable></option></arg>
 
105
        </group>
 
106
        <sbr/>
 
107
        <group>
 
108
          <arg choice="plain"><option>--timeout
 
109
          <replaceable>TIME</replaceable></option></arg>
 
110
          <arg choice="plain"><option>-t
 
111
          <replaceable>TIME</replaceable></option></arg>
 
112
        </group>
 
113
        <sbr/>
 
114
        <group>
 
115
          <arg choice="plain"><option>--extended-timeout
 
116
          <replaceable>TIME</replaceable></option></arg>
 
117
        </group>
 
118
        <sbr/>
 
119
        <group>
 
120
          <arg choice="plain"><option>--interval
 
121
          <replaceable>TIME</replaceable></option></arg>
 
122
          <arg choice="plain"><option>-i
 
123
          <replaceable>TIME</replaceable></option></arg>
 
124
        </group>
 
125
        <sbr/>
 
126
        <group>
 
127
          <arg choice="plain"><option>--approve-by-default</option
 
128
          ></arg>
 
129
          <sbr/>
 
130
          <arg choice="plain"><option>--deny-by-default</option></arg>
 
131
        </group>
 
132
        <sbr/>
 
133
        <group>
 
134
          <arg choice="plain"><option>--approval-delay
 
135
          <replaceable>TIME</replaceable></option></arg>
 
136
        </group>
 
137
        <sbr/>
 
138
        <group>
 
139
          <arg choice="plain"><option>--approval-duration
 
140
          <replaceable>TIME</replaceable></option></arg>
 
141
        </group>
 
142
        <sbr/>
 
143
        <group>
 
144
          <arg choice="plain"><option>--host
 
145
          <replaceable>STRING</replaceable></option></arg>
 
146
          <arg choice="plain"><option>-H
 
147
          <replaceable>STRING</replaceable></option></arg>
 
148
        </group>
 
149
        <sbr/>
 
150
        <group>
 
151
          <arg choice="plain"><option>--secret
 
152
          <replaceable>FILENAME</replaceable></option></arg>
 
153
          <arg choice="plain"><option>-s
 
154
          <replaceable>FILENAME</replaceable></option></arg>
 
155
        </group>
 
156
        <sbr/>
 
157
        <group>
 
158
          <arg choice="plain"><option>--approve</option></arg>
 
159
          <arg choice="plain"><option>-A</option></arg>
 
160
          <sbr/>
 
161
          <arg choice="plain"><option>--deny</option></arg>
 
162
          <arg choice="plain"><option>-D</option></arg>
 
163
        </group>
 
164
      </group>
 
165
      <sbr/>
 
166
      <arg><option>--debug</option></arg>
 
167
      <group choice="req">
 
168
        <arg choice="plain"><option>--all</option></arg>
 
169
        <arg choice="plain"><option>-a</option></arg>
 
170
        <arg rep='repeat' choice='plain'>
 
171
          <replaceable>CLIENT</replaceable>
 
172
        </arg>
 
173
      </group>
 
174
    </cmdsynopsis>
 
175
    <cmdsynopsis>
 
176
      <command>&COMMANDNAME;</command>
 
177
      <group>
152
178
        <arg choice="plain"><option>--deny</option></arg>
153
179
        <arg choice="plain"><option>-D</option></arg>
154
180
      </group>
 
181
      <group choice="req">
 
182
          <arg choice="plain"><option>--remove</option></arg>
 
183
          <arg choice="plain"><option>-r</option></arg>
 
184
      </group>
155
185
      <sbr/>
 
186
      <arg><option>--debug</option></arg>
156
187
      <group choice="req">
157
188
        <arg choice="plain"><option>--all</option></arg>
158
189
        <arg choice="plain"><option>-a</option></arg>
163
194
    </cmdsynopsis>
164
195
    <cmdsynopsis>
165
196
      <command>&COMMANDNAME;</command>
166
 
      <group>
167
 
        <arg choice="plain"><option>--verbose</option></arg>
168
 
        <arg choice="plain"><option>-v</option></arg>
169
 
      </group>
170
 
      <group>
171
 
        <arg rep='repeat' choice='plain'>
172
 
          <replaceable>CLIENT</replaceable>
173
 
        </arg>
174
 
      </group>
175
 
    </cmdsynopsis>
176
 
    <cmdsynopsis>
177
 
      <command>&COMMANDNAME;</command>
178
197
      <group choice="req">
179
198
        <arg choice="plain"><option>--is-enabled</option></arg>
180
199
        <arg choice="plain"><option>-V</option></arg>
181
200
      </group>
 
201
      <arg><option>--debug</option></arg>
182
202
      <arg choice='plain'><replaceable>CLIENT</replaceable></arg>
183
203
    </cmdsynopsis>
184
204
    <cmdsynopsis>
204
224
  <refsect1 id="description">
205
225
    <title>DESCRIPTION</title>
206
226
    <para>
207
 
      <command>&COMMANDNAME;</command> is a program to control the
208
 
      operation of the Mandos server <citerefentry><refentrytitle
209
 
      >mandos</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
 
227
      <command>&COMMANDNAME;</command> is a program to control or
 
228
      query the operation of the Mandos server
 
229
      <citerefentry><refentrytitle>mandos</refentrytitle><manvolnum
 
230
      >8</manvolnum></citerefentry>.
210
231
    </para>
211
232
    <para>
212
233
      This program can be used to change client settings, approve or
470
491
      </varlistentry>
471
492
      
472
493
      <varlistentry>
 
494
        <term><option>--dump-json</option></term>
 
495
        <term><option>-j</option></term>
 
496
        <listitem>
 
497
          <para>
 
498
            Dump client settings as JSON to standard output.
 
499
          </para>
 
500
        </listitem>
 
501
      </varlistentry>
 
502
      
 
503
      <varlistentry>
473
504
        <term><option>--is-enabled</option></term>
474
505
        <term><option>-V</option></term>
475
506
        <listitem>
481
512
      </varlistentry>
482
513
      
483
514
      <varlistentry>
 
515
        <term><option>--debug</option></term>
 
516
        <listitem>
 
517
          <para>
 
518
            Show debug output; currently, this means show D-Bus calls.
 
519
          </para>
 
520
        </listitem>
 
521
      </varlistentry>
 
522
      
 
523
      <varlistentry>
484
524
        <term><option>--check</option></term>
485
525
        <listitem>
486
526
          <para>
510
550
    </para>
511
551
  </refsect1>
512
552
  
513
 
<!--   <refsect1 id="bugs"> -->
514
 
<!--     <title>BUGS</title> -->
515
 
<!--     <para> -->
516
 
<!--     </para> -->
517
 
<!--   </refsect1> -->
 
553
  <refsect1 id="bugs">
 
554
    <title>BUGS</title>
 
555
    <xi:include href="bugs.xml"/>
 
556
  </refsect1>
518
557
  
519
558
  <refsect1 id="example">
520
559
    <title>EXAMPLE</title>
 
560
    <!-- Name of test methods in class Test_commands_from_options are
 
561
         written in comments below.  When adding an example, add a
 
562
         test too which tests the documented behavior. -->
521
563
    <informalexample>
 
564
      <!-- Test method: test_manual_page_example_1() -->
522
565
      <para>
523
566
        To list all clients:
524
567
      </para>
528
571
    </informalexample>
529
572
    
530
573
    <informalexample>
 
574
      <!-- Test method: test_manual_page_example_2() -->
531
575
      <para>
532
576
        To list <emphasis>all</emphasis> settings for the clients
533
577
        named <quote>foo1.example.org</quote> and <quote
542
586
    </informalexample>
543
587
    
544
588
    <informalexample>
 
589
      <!-- Test method: test_manual_page_example_3() -->
545
590
      <para>
546
591
        To enable all clients:
547
592
      </para>
551
596
    </informalexample>
552
597
    
553
598
    <informalexample>
 
599
      <!-- Test method: test_manual_page_example_4() -->
554
600
      <para>
555
601
        To change timeout and interval value for the clients
556
602
        named <quote>foo1.example.org</quote> and <quote
559
605
      <para>
560
606
 
561
607
<!-- do not wrap this line -->
562
 
<userinput>&COMMANDNAME; --timeout="5m" --interval="1m" foo1.example.org foo2.example.org</userinput>
 
608
<userinput>&COMMANDNAME; --timeout=PT5M --interval=PT1M foo1.example.org foo2.example.org</userinput>
563
609
 
564
610
      </para>
565
611
    </informalexample>
566
612
    
567
613
    <informalexample>
 
614
      <!-- Test method: test_manual_page_example_5() -->
568
615
      <para>
569
 
        To approve all clients currently waiting for it:
 
616
        To approve all clients currently waiting for approval:
570
617
      </para>
571
618
      <para>
572
619
        <userinput>&COMMANDNAME; --approve --all</userinput>