oslo.rootwrap/oslo_rootwrap/cmd.py

# Copyright (c) 2011 OpenStack Foundation.
# All Rights Reserved.
#
#    Licensed under the Apache License, Version 2.0 (the "License"); you may
#    not use this file except in compliance with the License. You may obtain
#    a copy of the License at
#
#         http://www.apache.org/licenses/LICENSE-2.0
#
#    Unless required by applicable law or agreed to in writing, software
#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
#    License for the specific language governing permissions and limitations
#    under the License.

"""Root wrapper for OpenStack services

   Filters which commands a service is allowed to run as another user.

   To use this with oslo, you should set the following in
   oslo.conf:
   rootwrap_config=/etc/oslo/rootwrap.conf

   You also need to let the oslo user run oslo-rootwrap
   as root in sudoers:
   oslo ALL = (root) NOPASSWD: /usr/bin/oslo-rootwrap
                                   /etc/oslo/rootwrap.conf *

   Service packaging should deploy .filters files only on nodes where
   they are needed, to avoid allowing more than is necessary.
"""
import configparser
import logging
import os
import sys

from oslo_rootwrap import subprocess
from oslo_rootwrap import wrapper

try:
    # This isn't available on all platforms (e.g. Windows).
    import resource
except ImportError:
    resource = None

RC_UNAUTHORIZED = 99
RC_NOCOMMAND = 98
RC_BADCONFIG = 97
RC_NOEXECFOUND = 96
SIGNAL_BASE = 128


def _exit_error(execname, message, errorcode, log=True):
    print("%s: %s" % (execname, message), file=sys.stderr)
    if log:
        logging.error(message)
    sys.exit(errorcode)


def daemon():
    return main(run_daemon=True)


def main(run_daemon=False):
    # Split arguments, require at least a command
    execname = sys.argv.pop(0)
    if run_daemon:
        if len(sys.argv) != 1:
            _exit_error(execname, "Extra arguments to daemon", RC_NOCOMMAND,
                        log=False)
    else:
        if len(sys.argv) < 2:
            _exit_error(execname, "No command specified", RC_NOCOMMAND,
                        log=False)

    configfile = sys.argv.pop(0)

    # Load configuration
    try:
        rawconfig = configparser.RawConfigParser()
        rawconfig.read(configfile)
        config = wrapper.RootwrapConfig(rawconfig)
    except ValueError as exc:
        msg = "Incorrect value in %s: %s" % (configfile, exc.args[0])
        _exit_error(execname, msg, RC_BADCONFIG, log=False)
    except configparser.Error:
        _exit_error(execname, "Incorrect configuration file: %s" % configfile,
                    RC_BADCONFIG, log=False)

    if resource:
        # When use close_fds=True on Python 2.x, calling subprocess with
        # close_fds=True (which we do by default) can be inefficient when
        # the current fd ulimits are large, because it blindly closes
        # all fds in the range(1, $verylargenumber)

        # Lower our ulimit to a reasonable value to regain performance.
        fd_limits = resource.getrlimit(resource.RLIMIT_NOFILE)
        sensible_fd_limit = min(config.rlimit_nofile, fd_limits[0])
        if (fd_limits[0] > sensible_fd_limit):
            # Close any fd beyond sensible_fd_limit prior adjusting our
            # rlimit to ensure all fds are closed
            for fd_entry in os.listdir('/proc/self/fd'):
                # NOTE(dmllr): In a previous patch revision non-numeric
                # dir entries were silently ignored which reviewers
                # didn't like. Readd exception handling when it occurs.
                fd = int(fd_entry)
                if fd >= sensible_fd_limit:
                    os.close(fd)
            # Unfortunately this inherits to our children, so allow them to
            # re-raise by passing through the hard limit unmodified
            resource.setrlimit(
                resource.RLIMIT_NOFILE, (sensible_fd_limit, fd_limits[1]))
            # This is set on import to the hard ulimit. if its defined we
            # already have imported it, so we need to update it to the new
            # limit.
            if (hasattr(subprocess, 'MAXFD') and
                    subprocess.MAXFD > sensible_fd_limit):
                subprocess.MAXFD = sensible_fd_limit

    if config.use_syslog:
        wrapper.setup_syslog(execname,
                             config.syslog_log_facility,
                             config.syslog_log_level)

    filters = wrapper.load_filters(config.filters_path)

    if run_daemon:
        # NOTE(dims): When not running as daemon, this import
        # slows us down just a bit. So moving it here so we have
        # it only when we need it.
        from oslo_rootwrap import daemon as daemon_mod
        daemon_mod.daemon_start(config, filters)
    else:
        run_one_command(execname, config, filters, sys.argv)


def run_one_command(execname, config, filters, userargs):
    # Execute command if it matches any of the loaded filters
    try:
        obj = wrapper.start_subprocess(
            filters, userargs,
            exec_dirs=config.exec_dirs,
            log=config.use_syslog,
            stdin=sys.stdin,
            stdout=sys.stdout,
            stderr=sys.stderr)
        returncode = obj.wait()
        # Fix returncode of Popen
        if returncode < 0:
            returncode = SIGNAL_BASE - returncode
        sys.exit(returncode)

    except wrapper.FilterMatchNotExecutable as exc:
        msg = ("Executable not found: %s (filter match = %s)"
               % (exc.match.exec_path, exc.match.name))
        _exit_error(execname, msg, RC_NOEXECFOUND, log=config.use_syslog)

    except wrapper.NoFilterMatched:
        msg = ("Unauthorized command: %s (no filter matched)"
               % ' '.join(userargs))
        _exit_error(execname, msg, RC_UNAUTHORIZED, log=config.use_syslog)