Merge lp:~andreserl/maas/packaging_enable_authbind into lp:~maas-maintainers/maas/packaging

[Andres Rodriguez]

* Make use of authbind to allow maas-cluster-celery bind port as non-root.
  - debian/control: Depends on authbind for maas-cluster-controller.
  - debian/maas-cluster-controller.{postinst,postrm}: Handle creation
    and removal of required authbind file.

[lp:~andreserl/maas/packaging_enable_authbind]

215. By Andres Rodriguez on 2013-12-05

Update branch rev

216. By Andres Rodriguez on 2013-12-05

Update ubuntu rev

217. By Andres Rodriguez on 2013-12-05

* Make use of authbind to allow maas-cluster-celery bind port as non-root.
  - debian/control: Depends on authbind for maas-cluster-controller.
  - debian/maas-cluster-controller.{postinst,postrm}: Handle creation
    and removal of required authbind file.

[Diogo Matsubara (matsubara)]

I tested this change in the QA lab and it fixes the provisioningserver.tasks.periodic_probe_dhcp celery task failure <http://pastebin.ubuntu.com/6525577/>

review: Approve

=== modified file 'debian/changelog'
--- debian/changelog	2013-11-13 14:57:27 +0000
+++ debian/changelog	2013-12-05 19:05:25 +0000
@@ -1,4 +1,4 @@
-maas (1.4+bzr1701+dfsg-0ubuntu2) UNRELEASED; urgency=low
+maas (1.4+bzr1761+dfsg-0ubuntu1) UNRELEASED; urgency=low
 
   * UNRELEASED
 
@@ -8,6 +8,10 @@
   [ Andres Rodriguez ]
   * debian/maas-region-controller.postinst: Allo default-maas-url debconf
     option to be preseeded.
+  * Make use of authbind to allow maas-cluster-celery bind port as non-root.
+    - debian/control: Depends on authbind for maas-cluster-controller.
+    - debian/maas-cluster-controller.{postinst,postrm}: Handle creation
+      and removal of required authbind file.
 
  -- Andres Rodriguez <[e-mail]>  Thu, 10 Oct 2013 17:07:51 -0400
 

=== modified file 'debian/control'
--- debian/control	2013-10-07 19:58:03 +0000
+++ debian/control	2013-12-05 19:05:25 +0000
@@ -166,6 +166,7 @@
 Package: maas-cluster-controller
 Architecture: all
 Depends: apache2,
+         authbind,
          bind9utils,
          distro-info,
          freeipmi-tools,

=== modified file 'debian/maas-cluster-controller.maas-cluster-celery.upstart'
--- debian/maas-cluster-controller.maas-cluster-celery.upstart	2012-12-13 09:52:54 +0000
+++ debian/maas-cluster-controller.maas-cluster-celery.upstart	2013-12-05 19:05:25 +0000
@@ -26,5 +26,5 @@
     # Allow the cluster-controller process to read CLUSTER_UUID as set
     # in that config file.
     export CLUSTER_UUID
-    exec /usr/sbin/maas-provision start-cluster-controller $MAAS_URL -u maas -g maas
+    exec /usr/bin/authbind --deep /usr/sbin/maas-provision start-cluster-controller $MAAS_URL -u maas -g maas
 end script

=== modified file 'debian/maas-cluster-controller.postinst'
--- debian/maas-cluster-controller.postinst	2013-10-08 13:50:53 +0000
+++ debian/maas-cluster-controller.postinst	2013-12-05 19:05:25 +0000
@@ -94,6 +94,20 @@
     esac
 }
 
+configure_cluster_authbind() {
+    MAAS_UID="`id -u maas`"
+    if [ ! -f "/etc/authbind/byuid/$MAAS_UID" ]; then
+        if [ ! -d "/etc/authbind/byuid" ]; then
+            mkdir -p /etc/authbind/byuid
+            chmod 755 /etc/authbind
+            chmod 755 /etc/authbind/byuid
+        fi
+        echo '0.0.0.0/0:68,68' >/etc/authbind/byuid/$MAAS_UID
+        chown maas:maas /etc/authbind/byuid/$MAAS_UID
+        chmod 700 /etc/authbind/byuid/$MAAS_UID
+    fi
+}
+
 restart_apache2(){
     if [ -x /usr/sbin/invoke-rc.d ]; then
         invoke-rc.d apache2 restart || true
@@ -139,6 +153,7 @@
         /etc/maas/maas_cluster.conf
 
     configure_cluster_uuid
+    configure_cluster_authbind
     enable_apache_version_mod
     configure_cluster_http
     restart_apache2

=== modified file 'debian/maas-cluster-controller.postrm'
--- debian/maas-cluster-controller.postrm	2013-07-29 19:50:11 +0000
+++ debian/maas-cluster-controller.postrm	2013-12-05 19:05:25 +0000
@@ -35,4 +35,9 @@
 			rm -rf /etc/tgt/conf.d/maas.conf
 		fi
 
+		# Remove authbind
+		MAAS_UID="`id -u maas`"
+		if [ -f "/etc/authbind/byuid/$MAAS_UID" ]; then
+			rm -rf /etc/authbind/byuid/$MAAS_UID
+		fi
 esac