18 Commits

Author SHA1 Message Date
9eebd56869 fix selinux policy on gentoo 2020-05-06 18:35:36 +02:00
5d5947c99e still needs to transition when doing restarts... 2020-04-13 10:31:57 +02:00
afa616916d make sau unconfined again... I admit defeat for now. 2020-04-13 10:22:05 +02:00
fd66a30de4 another attempt to fix sau service restart... 2020-03-08 07:33:08 +01:00
994b93e3b4 updated selinux policy; hopefully services are no longer started as
sau_t after restart
2020-03-01 08:20:41 +01:00
8a29ab82b0 handle case when process is none in services 2020-02-26 08:11:22 +01:00
13e56c6d56 raise timeout on gentoo because gentoo... 2020-02-08 08:18:23 +01:00
4ca971687b remove deprecated SafeConfigParser usage 2020-01-06 07:37:08 +01:00
eca94f40d9 upgrade to python 3.7 2020-01-06 07:31:51 +01:00
81dfa5567e log reboot message to info-level 2019-12-22 08:39:07 +01:00
b1c520b257 use eix-sync if it exists - running eix-update after a sync does not
update cache for overlays
2019-12-21 17:05:41 +01:00
712a4e986f restore 'reboot' policy 2019-12-16 23:12:50 +01:00
32b98e4dbc fixed missing log assignment 2019-12-16 21:29:53 +01:00
44088bd64b fix service check 2019-12-16 21:21:59 +01:00
aadd0e2641 fix warnings 2019-12-16 20:33:41 +01:00
1322918dcc added support for silent-reboot and gentoo without gentoo-sources kernel 2019-12-16 20:03:49 +01:00
79dd24809d execute subcommands in parent enviornment (resepect http_proxy and
similar)
2019-10-25 19:57:50 +02:00
04cbedb9c0 added option to reboot for specific services 2019-10-12 21:37:26 +02:00
9 changed files with 100 additions and 41 deletions

View File

@ -1,4 +1,4 @@
#!/usr/bin/env python3.6
#!/usr/bin/env python3.7
import configparser
import logging
import logging.handlers
@ -12,7 +12,7 @@ import sau.services
import sau.platforms
def init():
sau.config = configparser.SafeConfigParser()
sau.config = configparser.ConfigParser()
conf = sau.config
if platform.system() == 'FreeBSD':
@ -106,9 +106,9 @@ def main():
if conf.getboolean('default', 'do_reboot', fallback=False):
if reboot_required:
log.warning('Rebooting because of a system upgrade')
log.info('Rebooting because of a system upgrade')
elif reboot_recommended:
log.warning('Rebooting because service restarts did not close all deleted files')
log.info('Rebooting because service restarts did not close all deleted files')
if reboot_required or reboot_recommended:
fork_and_reboot()

View File

@ -64,7 +64,7 @@ qemu-system-x86_64=
#ruby24=puppetserver puppetdb
# The services section contains restart policy for specific services.
# valid policies are 'ignore', 'warn', 'restart' and 'silent-restart'.
# valid policies are 'ignore', 'warn', 'restart', 'silent-restart' and 'reboot'.
# 'silent-restart' is like 'restart', but will not log a warning when
# the service is restarted.
[services]

View File

@ -5,7 +5,7 @@ import re
import sau
import sau.helpers
EIX_UPDATE_PATH='/usr/bin/eix-update'
EIX_SYNC_PATH='/usr/bin/eix-sync'
RC_SERVICE_PATH='/sbin/rc-service'
EMERGE_PATH='/usr/bin/emerge'
EQUERY_PATH='/usr/bin/equery'
@ -78,8 +78,12 @@ def system_upgrade():
def _sync_portage():
log = logging.getLogger(sau.LOGNAME)
cmd = [ EMERGE_PATH, '-q', '--sync' ]
ret, out, err = sau.helpers.exec_cmd(cmd, timeout=3600)
if os.path.exists(EIX_SYNC_PATH):
cmd = [ EIX_SYNC_PATH, '-q' ]
ret, out, err = sau.helpers.exec_cmd(cmd, timeout=3600)
else:
cmd = [ EMERGE_PATH, '-q', '--sync' ]
ret, out, err = sau.helpers.exec_cmd(cmd, timeout=3600)
if ret != 0:
log.warning("Portage sync failed:")
@ -88,16 +92,6 @@ def _sync_portage():
for line in err.splitlines():
log.warning("stderr: {}".format(line))
if os.path.exists(EIX_UPDATE_PATH):
cmd = [ EIX_UPDATE_PATH, '-q' ]
ret, out, err = sau.helpers.exec_cmd(cmd, timeout=3600)
if ret != 0:
log.warning("eix-update failed:")
for line in out.splitlines():
log.warning("stdout: {}".format(line))
for line in err.splitlines():
log.warning("stderr: {}".format(line))
def pkg_upgrade():
@ -157,7 +151,7 @@ def pkg_upgrade():
return False
cmd = [ EMERGE_PATH, '--color', 'n', '-uDNq', '@world' ]
ret, out, err = sau.helpers.exec_cmd(cmd, timeout=36000)
ret, out, err = sau.helpers.exec_cmd(cmd, timeout=72000)
if ret != 0 or err:
log.warning('emerge returned {}'.format(ret))
@ -172,7 +166,7 @@ def pkg_upgrade():
log.warning(line)
cmd = [ EMERGE_PATH, '--color', 'n', '-q', '@preserved-rebuild' ]
ret, out, err = sau.helpers.exec_cmd(cmd, timeout=36000)
ret, out, err = sau.helpers.exec_cmd(cmd, timeout=72000)
if ret != 0 or err:
log.warning('preserved-rebuild returned {}'.format(ret))

View File

@ -1,17 +1,21 @@
import logging
import os
import subprocess
import time
import sau
def exec_cmd(cmd, timeout=900, env = None):
my_env = os.environ.copy()
if env:
my_env.update(env)
log = logging.getLogger(sau.LOGNAME)
log.debug('Executing "{}"'.format(' '.join(cmd)))
proc = subprocess.Popen(
cmd,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
env = env)
env = my_env)
out = b""
err = b""

View File

@ -1,3 +1,4 @@
import os
import platform
import sau.errors
@ -9,9 +10,10 @@ def get_platform():
if platform.system() == 'FreeBSD':
platform_mod = sau.freebsd
elif platform.system() == 'Linux':
if 'gentoo' in platform.release():
if os.path.exists('/usr/bin/emerge'):
platform_mod = sau.gentoo
if not platform_mod:
raise sau.errors.PlatformNotSupported("System: {} Release: {} Version: {} is not supported".format(
platform.system(),

View File

@ -1,4 +1,3 @@
#!/usr/bin/env python3.6
import logging
import os
import re
@ -12,6 +11,11 @@ import sau.platforms
proc_fd_map_re = re.compile(r'^.*(/[^\(]*) \(deleted\)$')
def _warn(policy, msg):
log = logging.getLogger(sau.LOGNAME)
if not policy.startswith('silent'):
log.warning(msg)
def _get_deleted_open_files(proc):
log = logging.getLogger(sau.LOGNAME)
files = set()
@ -93,6 +97,8 @@ def restart_services():
processes = {}
services = {}
for proc in service_procs:
if not proc:
continue
try:
service_exe = proc.exe()
proc_name = proc.name()
@ -108,6 +114,7 @@ def restart_services():
services[proc_name] = service_name
processes[service_name] = [proc]
recommend_restart = False
for service in set([x for x in services.values() if x]):
policy = _get_service_restart_policy(service)
if policy == 'ignore':
@ -116,11 +123,12 @@ def restart_services():
elif policy == 'warn':
log.warning('Service "{}" has open deleted files and should be restarted'.format(service))
continue
if not policy.startswith('silent'):
log.warning('Restarting service {}'.format(service))
elif 'reboot' in policy:
_warn(policy, 'Rebooting because {} has opened files'.format(service))
recommend_restart = True
_warn(policy, 'Restarting service {}'.format(service))
platform.restart_service(service)
recommend_restart = False
tested_parents = set()
for proc in retest_procs:
parent = _get_top_parent(proc)
@ -138,10 +146,11 @@ def restart_services():
log.warning('could not re-check process {} - failed to identify service'.format(proc))
recommend_restart = True
continue
policy = _get_service_restart_policy(service)
log.debug('{} is in service {}'.format(proc, service))
if parent_name in services and not services[parent_name]:
log.warning('{} (parent {}) does not belong to a service and could not be restarted'.format(proc, parent))
_warn(policy, '{} (parent {}) does not belong to a service and could not be restarted'.format(proc, parent))
recommend_restart = True
continue
elif parent_name in services:
@ -149,7 +158,7 @@ def restart_services():
log.debug('service {} has policy {}'.format(service, policy))
if policy in ('ignore', 'warn'):
continue
log.warning('{} (parent {}) still has deleted files open'.format(proc, parent))
_warn(policy, '{} (parent {}) still has deleted files open'.format(proc, parent))
recommend_restart = True
return recommend_restart
@ -157,13 +166,13 @@ def _get_service_restart_policy(service):
log = logging.getLogger(sau.LOGNAME)
conf = sau.config
policy = conf.get('services', service, fallback=None)
if policy and policy.lower() in ('restart', 'warn', 'ignore', 'silent-restart'):
if policy and policy.lower() in ('restart', 'warn', 'ignore', 'silent-restart', 'reboot', 'silent-reboot'):
return policy.lower()
elif policy:
log.warning('service policy {} for {} is invalid'.format(policy, service))
default_policy = conf.get('default', 'default_service_policy', fallback='warn')
if default_policy.lower() in ('restart', 'warn', 'ignore', 'silent-restart'):
if default_policy.lower() in ('restart', 'warn', 'ignore', 'silent-restart', 'reboot'):
return default_policy.lower()
log.warning('default service policy {} is invalid'.format(default_policy))
return 'warn'

View File

@ -1,2 +1,7 @@
/usr/bin/sau gen_context(system_u:object_r:sau_exec_t,s0)
/etc/sau.cfg gen_context(system_u:object_r:sau_config_t,s0)
/usr/bin/sau -- gen_context(system_u:object_r:sau_exec_t,s0)
# on gentoo python executables are executed via python-exec
/usr/lib/python-exec/python[0-9\.]*/sau -- gen_context(system_u:object_r:sau_exec_t,s0)
/etc/sau.cfg -- gen_context(system_u:object_r:sau_config_t,s0)

View File

@ -1,4 +1,4 @@
policy_module(sau, 0.1)
policy_module(sau, 0.9.1)
gen_require(`
type system_cronjob_t;
@ -16,6 +16,11 @@ domain_type(sau_t)
domain_entry_file(sau_t, sau_exec_t)
files_config_file(sau_config_t)
read_files_pattern(sau_t, etc_t, sau_config_t);
read_files_pattern(sau_t, etc_t, etc_t)
files_read_etc_runtime_files(sau_t);
search_dirs_pattern(sau_t, etc_t, etc_runtime_t);
files_manage_generic_tmp_files(sau_t)
files_manage_generic_tmp_dirs(sau_t)
role sysadm_r types sau_t;
role system_r types sau_t;
@ -23,14 +28,54 @@ role system_r types sau_t;
domain_auto_transition_pattern(sysadm_t, sau_exec_t, sau_t)
domain_auto_transition_pattern(system_cronjob_t, sau_exec_t, sau_t)
# this should be fixed, but I don't know enough selinux magic to restrict this
# while still allowing it to inspect all open files for all processes
unconfined_domain_noaudit(sau_t)
domain_use_interactive_fds(sau_t)
userdom_use_user_ptys(sau_t)
userdom_use_all_users_fds(sau_t)
# required for python
corecmd_mmap_bin_files(sau_t)
mmap_exec_files_pattern(sau_t, tmp_t, tmp_t);
read_files_pattern(sau_t, usr_t, usr_t)
miscfiles_read_localization(sau_t)
logging_send_syslog_msg(sau_t)
allow sau_t self:fifo_file { read write };
corecmd_exec_shell(sau_t)
corecmd_exec_bin(sau_t)
# list processes
kernel_read_system_state(sau_t)
domain_read_all_domains_state(sau_t)
allow sau_t self:capability sys_ptrace;
# I've tried it all; I don't know how to give sau permission to
# run init-scripts :(
init_all_labeled_script_domtrans(sau_t)
init_domtrans_script(sau_t)
init_read_utmp(sau_t)
init_signull_script(sau_t)
#init_startstop_all_script_services(sau_t)
#init_use_script_ptys(sau_t)
#init_domtrans_labeled_script(sau_t)
#init_manage_script_service(sau_t)
#init_read_script_status_files(sau_t)
#allow sau_t initrc_state_t:lnk_file { getattr read };
#allow sau_t initrc_state_t:dir { search read };
#init_admin(sau_t)
# FIXME: shouldn't have to be unconfined...
unconfined_domain(sau_t)
# allow during troubleshooting...
#files_getattr_all_dirs(sau_t)
#files_getattr_all_files(sau_t)
# Gentoo specific
portage_read_config(sau_t)
portage_read_ebuild(sau_t)
portage_read_db(sau_t)
portage_read_cache(sau_t)
portage_domtrans(sau_t)
# postfix
postfix_admin(sau_t, system_r)

View File

@ -1,11 +1,11 @@
#!/usr/bin/env python3.6
#!/usr/bin/env python3.7
from os import environ
from setuptools import setup, find_packages
setup(
name='sau',
version='0.9.0',
version='0.9.1',
description='Tool for auto-updating OS and packages',
author='Feffe',
author_email='feffe@fulh.ax',