Merge lp:~blake-rouse/maas/fix-lease-notifier-packaging into lp:~maas-maintainers/maas/packaging

[Blake Rouse]

Add to apparmor profile to allow dhcpd to call maas-rackd. Fix maas-rack command to allow dhcpd user to call dhcp-notify only. Remove KillSignal from maas-dhcpd and maas-dhcpd6 as the fixed isc-dhcp-server no longer requires that kill signal to stop.

[Mike Pontillo (mpontillo)]

Looks good.

review: Approve

=== modified file 'debian/extras/99-maas-sudoers'
--- debian/extras/99-maas-sudoers	2016-03-09 19:35:04 +0000
+++ debian/extras/99-maas-sudoers	2016-03-17 19:07:30 +0000
@@ -9,7 +9,6 @@
 maas ALL= NOPASSWD: /bin/systemctl status tgt
 maas ALL= NOPASSWD: /bin/systemctl start tgt
 maas ALL= NOPASSWD: /usr/sbin/maas-rack
-dhcpd ALL= NOPASSWD: /usr/sbin/maas-rack
 maas ALL= NOPASSWD: SETENV: /usr/sbin/tgt-admin, /usr/bin/uec2roottar
 maas ALL= NOPASSWD: /usr/bin/lshw
 maas ALL= NOPASSWD: /sbin/blockdev

=== modified file 'debian/extras/maas-rack'
--- debian/extras/maas-rack	2016-03-07 22:01:56 +0000
+++ debian/extras/maas-rack	2016-03-17 19:07:30 +0000
@@ -15,13 +15,18 @@
 
 import grp
 import os
+import pwd
 import sys
 
 
-def check_user():
-    # At present, only root should execute this.
-    if os.getuid() != 0:
-        raise SystemExit("This utility may only be run as root.")
+def check_users(users):
+    """Check that the runnig user is in users."""
+    uid = os.getuid()
+    for user in users:
+        user_uid = pwd.getpwnam(user)[2]
+        if uid == user_uid:
+            return user
+    raise SystemExit("This utility may only be run as %s." % ", ".join(users))
 
 
 def set_group():
@@ -52,9 +57,18 @@
             "removed in a future version. From now on please use 'maas-rack' "
             "instead.\n")
 
-    check_user()
-    set_group()
-    set_umask()
+    # Allow dhcpd user to call dhcp-notify.
+    users = ["root"]
+    if len(sys.argv) > 1:
+        if sys.argv[1] == "dhcp-notify":
+            users.append("dhcpd")
+
+    # Only set the group and umask when running as root.
+    if check_users(users) == "root":
+        set_group()
+        set_umask()
+
+    # Run the script.
     run()
 
 

=== modified file 'debian/maas-dhcp.apparmor'
--- debian/maas-dhcp.apparmor	2016-03-16 13:20:16 +0000
+++ debian/maas-dhcp.apparmor	2016-03-17 19:07:30 +0000
@@ -6,3 +6,4 @@
 /var/lib/maas/dhcp/dhcpd*.leases* lrw,
 /var/lib/maas/dhcpd.conf r,
 /var/lib/maas/dhcpd6.conf r,
+/usr/sbin/maas-rack Ux,

=== modified file 'debian/maas-dhcp.maas-dhcpd.service'
--- debian/maas-dhcp.maas-dhcpd.service	2016-03-16 14:20:34 +0000
+++ debian/maas-dhcp.maas-dhcpd.service	2016-03-17 19:07:30 +0000
@@ -9,10 +9,6 @@
 ConditionPathExists=/var/lib/maas/dhcpd-interfaces
 
 [Service]
-# Kill the DHCP server with SIGKILL. Without this dhcpd can take a very long
-# time to stop, which prevents the quick reload of the dhcpd.conf that MAAS
-# requires.
-KillSignal=SIGKILL
 # Allow dhcp server to write lease and pid file as 'dhcpd' user
 ExecStartPre=/bin/mkdir -p /run/maas/dhcp
 # The leases files need to be root:dhcpd even when dropping privileges

=== modified file 'debian/maas-dhcp.maas-dhcpd6.service'
--- debian/maas-dhcp.maas-dhcpd6.service	2016-03-16 14:19:23 +0000
+++ debian/maas-dhcp.maas-dhcpd6.service	2016-03-17 19:07:30 +0000
@@ -9,10 +9,6 @@
 ConditionPathExists=/var/lib/maas/dhcpd-interfaces
 
 [Service]
-# Kill the DHCP server with SIGKILL. Without this dhcpd can take a very long
-# time to stop, which prevents the quick reload of the dhcpd6.conf that MAAS
-# requires.
-KillSignal=SIGKILL
 # Allow dhcp server to write lease and pid file as 'dhcpd' user
 ExecStartPre=/bin/mkdir -p /run/maas/dhcp
 # The leases files need to be root:dhcpd even when dropping privileges