Merge ~aieri/charm-juju-lxd/+git/charm-juju-lxd:fix/109728 into charm-juju-lxd:master

[Andrea Ieri]

This commit fixes RT 109728 by making sure that the group specified as lxd-group in the charm configuration will be fully synced with group lxd, i.e. after a config change both groups will contain exactly the same users.
If lxd-group is set to an empty string, all users in group lxd will be removed.

[Alvaro Uria (aluria)]

lgtm

review: Approve

diff --git a/reactive/juju_lxd.py b/reactive/juju_lxd.py
index 15250c9..c48a917 100644
--- a/reactive/juju_lxd.py
+++ b/reactive/juju_lxd.py
@@ -19,9 +19,10 @@
 from charms.reactive import when, when_not, set_state, remove_state
 from charms.reactive.helpers import data_changed
 from charmhelpers.core import hookenv
-from charmhelpers.core.host import add_user_to_group
+from charmhelpers.core.host import group_exists
 import subprocess
 import os
+import grp
 
 
 @when_not('juju-lxd.installed')
@@ -49,15 +50,21 @@ def status_set(state, message):
 @when_not('juju-lxd.configured')
 def juju_lxd_configure():
     config = hookenv.config()
-    group = config.get('lxd-group')
+    src_group = config.get('lxd-group')
+    dst_group = 'lxd'
 
-    if group is not None and group != '' and \
-            is_valid_group(group):
-
-        add_group_to_lxd(group)
-        data_changed('juju-lxd.config', config)
-        set_state('juju-lxd.configured')
-        status_set('active', 'Ready')
+    if group_exists(dst_group):
+        try:
+            sync_groups(src=src_group, dst='lxd')
+        except KeyError:
+            status_set('blocked',
+                       'lxd-group "{0}" does not exist'.format(src_group))
+        finally:
+            data_changed('juju-lxd.config', config)
+            set_state('juju-lxd.configured')
+            status_set('active', 'Ready')
+    else:
+        status_set('blocked', 'group "{0}" does not exist'.format(dst_group))
 
 
 @when('juju-lxd.configured')
@@ -110,32 +117,13 @@ def git_repo():
         pass
 
 
-def add_group_to_lxd(group):
-    users = getent_group_users(group)
-    status_set("maintenance", "configuring users in lxd group")
-    for user in users:
-        try:
-            add_user_to_group(user, 'lxd')
-        except:
-            pass
-
-
-def is_valid_group(group):
-    output = ''
-
-    try:
-        output = subprocess.check_output(['getent', 'group', group])
-    except:
-        return False
-
-    if output is None or output == '':
-        return False
+def sync_groups(src, dst):
+    ''' Makes the dst group contain the same users as the src group.
+    If src is empty, the dst group will be emptied too'''
+    # Will raise KeyError if src is empty or non-existent
+    if src in [None, '']:
+        users = ''
     else:
-        return True
-
-
-def getent_group_users(group):
-    output = str(subprocess.check_output(['getent', 'group',
-                                          group])).rstrip("'")
-    members = output.split(':')[3]
-    return members.split(',')
+        users = ','.join(grp.getgrnam(src).gr_mem)
+    status_set("maintenance", "configuring users in lxd group")
+    subprocess.call(['gpasswd', '-M', users, dst])