/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to plugin-runner.xml

  • Committer: Teddy Hogeborn
  • Date: 2015-05-23 20:18:34 UTC
  • mto: This revision was merged to the branch mainline in revision 756.
  • Revision ID: teddy@recompile.se-20150523201834-e89ex4ito93yni8x
mandos: Use multiprocessing module to run checkers.

For a long time, the Mandos server has occasionally logged the message
"ERROR: Child process vanished".  This was never a fatal error, but it
has been annoying and slightly worrying, since a definite cause was
not found.  One potential cause could be the "multiprocessing" and
"subprocess" modules conflicting w.r.t. SIGCHLD.  To avoid this,
change the running of checkers from using subprocess.Popen
asynchronously to instead first create a multiprocessing.Process()
(which is asynchronous) calling a function, and have that function
then call subprocess.call() (which is synchronous).  In this way, the
only thing using any asynchronous subprocesses is the multiprocessing
module.

This makes it necessary to change one small thing in the D-Bus API,
since the subprocesses.call() function does not expose the raw wait(2)
status value.

DBUS-API (CheckerCompleted): Change the second value provided by this
                             D-Bus signal from the raw wait(2) status
                             to the actual terminating signal number.
mandos (subprocess_call_pipe): New function to be called by
                               multiprocessing.Process (starting a
                               separate process).
(Client.last_checker signal): New attribute for signal which
                              terminated last checker.  Like
                              last_checker_status, only not accessible
                              via D-Bus.
(Client.checker_callback): Take new "connection" argument and use it
                           to get returncode; set last_checker_signal.
                           Return False so gobject does not call this
                           callback again.
(Client.start_checker): Start checker using a multiprocessing.Process
                        instead of a subprocess.Popen.
(ClientDBus.checker_callback): Take new "connection" argument.        Call
                               Client.checker_callback early to have
                               it set last_checker_status and
                               last_checker_signal; use those.  Change
                               second value provided to D-Bus signal
                               CheckerCompleted to use
                               last_checker_signal if checker was
                               terminated by signal.
mandos-monitor: Update to reflect DBus API change.
(MandosClientWidget.checker_completed): Take "signal" instead of
                                        "condition" argument.  Use it
                                        accordingly.  Remove dead code
                                        (os.WCOREDUMP case).

Show diffs side-by-side

added added

removed removed

Lines of Context:
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY COMMANDNAME "plugin-runner">
5
 
<!ENTITY TIMESTAMP "2016-03-17">
 
5
<!ENTITY TIMESTAMP "2012-01-01">
6
6
<!ENTITY % common SYSTEM "common.ent">
7
7
%common;
8
8
]>
33
33
    <copyright>
34
34
      <year>2008</year>
35
35
      <year>2009</year>
36
 
      <year>2010</year>
37
 
      <year>2011</year>
38
36
      <year>2012</year>
39
 
      <year>2013</year>
40
 
      <year>2014</year>
41
 
      <year>2015</year>
42
 
      <year>2016</year>
43
37
      <holder>Teddy Hogeborn</holder>
44
38
      <holder>Björn Påhlsson</holder>
45
39
    </copyright>
120
114
      <arg><option>--plugin-dir=<replaceable
121
115
      >DIRECTORY</replaceable></option></arg>
122
116
      <sbr/>
123
 
      <arg><option>--plugin-helper-dir=<replaceable
124
 
      >DIRECTORY</replaceable></option></arg>
125
 
      <sbr/>
126
117
      <arg><option>--config-file=<replaceable
127
118
      >FILE</replaceable></option></arg>
128
119
      <sbr/>
329
320
      </varlistentry>
330
321
      
331
322
      <varlistentry>
332
 
        <term><option>--plugin-helper-dir
333
 
        <replaceable>DIRECTORY</replaceable></option></term>
334
 
        <listitem>
335
 
          <para>
336
 
            Specify a different plugin helper directory.  The default
337
 
            is <filename>/lib/mandos/plugin-helpers</filename>, which
338
 
            will exist in the initial <acronym>RAM</acronym> disk
339
 
            environment.  (This will simply be passed to all plugins
340
 
            via the <envar>MANDOSPLUGINHELPERDIR</envar> environment
341
 
            variable.  See <xref linkend="writing_plugins"/>)
342
 
          </para>
343
 
        </listitem>
344
 
      </varlistentry>
345
 
      
346
 
      <varlistentry>
347
323
        <term><option>--config-file
348
324
        <replaceable>FILE</replaceable></option></term>
349
325
        <listitem>
450
426
      <para>
451
427
        The plugin will run in the initial RAM disk environment, so
452
428
        care must be taken not to depend on any files or running
453
 
        services not available there.  Any helper executables required
454
 
        by the plugin (which are not in the <envar>PATH</envar>) can
455
 
        be placed in the plugin helper directory, the name of which
456
 
        will be made available to the plugin via the
457
 
        <envar>MANDOSPLUGINHELPERDIR</envar> environment variable.
 
429
        services not available there.
458
430
      </para>
459
431
      <para>
460
432
        The plugin must exit cleanly and free all allocated resources
503
475
      only passes on its environment to all the plugins.  The
504
476
      environment passed to plugins can be modified using the
505
477
      <option>--global-env</option> and <option>--env-for</option>
506
 
      options.  Also, the <option>--plugin-helper-dir</option> option
507
 
      will affect the environment variable
508
 
      <envar>MANDOSPLUGINHELPERDIR</envar> for the plugins.
 
478
      options.
509
479
    </para>
510
480
  </refsect1>
511
481
  
544
514
            </para>
545
515
          </listitem>
546
516
        </varlistentry>
547
 
        <varlistentry>
548
 
          <term><filename class="directory"
549
 
          >/lib/mandos/plugins.d</filename></term>
550
 
          <listitem>
551
 
            <para>
552
 
              The default plugin directory; can be changed by the
553
 
              <option>--plugin-dir</option> option.
554
 
            </para>
555
 
          </listitem>
556
 
        </varlistentry>
557
 
        <varlistentry>
558
 
          <term><filename class="directory"
559
 
          >/lib/mandos/plugin-helpers</filename></term>
560
 
          <listitem>
561
 
            <para>
562
 
              The default plugin helper directory; can be changed by
563
 
              the <option>--plugin-helper-dir</option> option.
564
 
            </para>
565
 
          </listitem>
566
 
        </varlistentry>
567
517
      </variablelist>
568
518
    </para>
569
519
  </refsect1>
574
524
      The <option>--config-file</option> option is ignored when
575
525
      specified from within a configuration file.
576
526
    </para>
577
 
    <xi:include href="bugs.xml"/>
578
527
  </refsect1>
579
528
  
580
529
  <refsect1 id="examples">
623
572
    </informalexample>
624
573
    <informalexample>
625
574
      <para>
626
 
        Read a different configuration file, run plugins from a
627
 
        different directory, specify an alternate plugin helper
628
 
        directory and add two options to the
 
575
        Run plugins from a different directory, read a different
 
576
        configuration file, and add two options to the
629
577
        <citerefentry><refentrytitle >mandos-client</refentrytitle>
630
578
        <manvolnum>8mandos</manvolnum></citerefentry> plugin:
631
579
      </para>
632
580
      <para>
633
581
 
634
582
<!-- do not wrap this line -->
635
 
<userinput>cd /etc/keys/mandos; &COMMANDNAME;  --config-file=/etc/mandos/plugin-runner.conf --plugin-dir /usr/lib/x86_64-linux-gnu/mandos/plugins.d --plugin-helper-dir /usr/lib/x86_64-linux-gnu/mandos/plugin-helpers --options-for=mandos-client:--pubkey=pubkey.txt,--seckey=seckey.txt</userinput>
 
583
<userinput>cd /etc/keys/mandos; &COMMANDNAME;  --config-file=/etc/mandos/plugin-runner.conf --plugin-dir /usr/lib/mandos/plugins.d --options-for=mandos-client:--pubkey=pubkey.txt,--seckey=seckey.txt</userinput>
636
584
 
637
585
      </para>
638
586
    </informalexample>