Merge ~mpontillo/maas:move-network-monitoring-to-maas-common into maas:master

[Mike Pontillo]

LP: #1702703 - Add /usr/lib/maas/maas-common command

 * Any commands not specific to the rack controller will
   now be available in /usr/lib/maas/maas-common.
 * Add a symbolic link in the snap to point to the maas-rack
   command.
 * Add buildout rules to generate bin/maas-common.
 * Change packaging to have maas-common depend on
   the Python code for the provisioning server, so that the
   command can successfully run.
 * Rename some scripts in /usr/lib/maas to remove the
   redundant maas- prefix, and prevent conflicts with
   the old packaging.
 * Update the debhelper compat level to 9, so dh-exec
   can be used to copy and rename files in the same step
   in .install files.
 * Rename get_maas_provision_command() to
   get_maas_common_command().

This branch isn't as large as it seems; most of the lines in the diff are renaming the script files to remove the maas- prefix.

For more information on the debhelper changes, see:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=245554
https://github.com/algernon/dh-exec

These changes have been tested end-to-end and verified to work in both the .deb (including an upgrade) and the snap.

Some packaging-related items to consider (from `man debhelper`):

       v8 Changes from v7 are:

           - Commands will fail rather than warning when they
                   are passed unknown options.

           - dh_makeshlibs will run dpkg-gensymbols on all
                   shared libraries that it generates shlibs files
                   for. So -X can be used to exclude libraries. Also,
                   libraries in unusual locations that dpkg-gensymbols
                   would not have processed before will be passed to
                   it, a behavior change that can cause some packages
                   to fail to build.

           - dh requires the sequence to run be specified as the
                   first parameter, and any switches come after it.
                   Ie, use "dh $@ --foo", not "dh --foo $@".

           - dh_auto_* prefer to use Perl's Module::Build in
                   preference to Makefile.PL.

       v9 This is the recommended mode of operation.

           Changes from v8 are:

           - Multiarch support. In particular, dh_auto_configure
                   passes multiarch directories to autoconf in
                   --libdir and --libexecdir.

           - dh is aware of the usual dependencies between
                   targets in debian/rules. So, "dh binary" will run
                   any build, build-arch, build-indep, install, etc
                   targets that exist in the rules file. There's no
                   need to define an explicit binary target with
                   explicit dependencies on the other targets.

           - dh_strip compresses debugging symbol files to
                   reduce the installed size of -dbg packages.

           - dh_auto_configure does not include the source
                   package name in --libexecdir when using autoconf.

           - dh does not default to enabling
                   --with=python-support

           - All of the dh_auto_* debhelper programs and dh set
                   environment variables listed by dpkg-buildflags,
                   unless they are already set.

           - dh_auto_configure passes dpkg-buildflags CFLAGS,
                   CPPFLAGS, and LDFLAGS to perl Makefile.PL and
                   Build.PL

           - dh_strip puts separated debug symbols in a location
                   based on their build-id.

           - Executable debhelper config files are run and their
                   output used as the configuration.

[Blake Rouse (blake-rouse)]

This looks great. Thanks for fixing this issue. There is a bug for this defiantly somewhere, please attach before landing.

review: Approve

[MAAS Lander (maas-lander)]

LANDING
-b move-network-monitoring-to-maas-common lp:~mpontillo/maas into -b master lp:~maas-committers/maas

STATUS: FAILED BUILD
LOG: http://maas-ci-jenkins.internal:8080/job/maas/job/branch-tester/254/consoleText

07644db... by Mike Pontillo on 2017-08-24

Fix tests.

diff --git a/Makefile b/Makefile
index 8abbebd..194b0f3 100644
--- a/Makefile
+++ b/Makefile
@@ -52,6 +52,7 @@ build: \
   bin/buildout \
   bin/database \
   bin/maas \
+  bin/maas-common \
   bin/maas-rack \
   bin/maas-region \
   bin/twistd.rack \
@@ -118,7 +119,7 @@ bin/maas-region bin/twistd.region: \
 
 bin/test.region: \
   bin/buildout buildout.cfg versions.cfg setup.py $(js_enums) \
-  bin/maas-region bin/maas-rack
+  bin/maas-region bin/maas-rack bin/maas-common
 	$(buildout) install region-test
 	@touch --no-create $@
 
@@ -152,7 +153,7 @@ bin/test.testing: \
 	$(buildout) install testing-test
 	@touch --no-create $@
 
-bin/maas-rack bin/twistd.rack: \
+bin/maas-rack bin/twistd.rack bin/maas-common: \
   bin/buildout buildout.cfg versions.cfg setup.py
 	$(buildout) install rack
 	@touch --no-create $@
@@ -568,13 +569,13 @@ services/dns/@deps: bin/py
 
 services/database/@deps: bin/database
 
-services/rackd/@deps: bin/twistd.rack bin/maas-rack
+services/rackd/@deps: bin/twistd.rack bin/maas-rack bin/maas-common
 
 services/reloader/@deps:
 
-services/regiond/@deps: bin/maas-region bin/maas-rack
+services/regiond/@deps: bin/maas-region bin/maas-rack bin/maas-common
 
-services/regiond2/@deps: bin/maas-region bin/maas-rack
+services/regiond2/@deps: bin/maas-region bin/maas-rack bin/maas-common
 
 #
 # Package building
diff --git a/buildout.cfg b/buildout.cfg
index 59f18a0..43b1b77 100644
--- a/buildout.cfg
+++ b/buildout.cfg
@@ -279,11 +279,13 @@ eggs =
   ${common:test-eggs}
 entry-points =
   maas-rack=provisioningserver.__main__:main
+  maas-common=provisioningserver.__main__:main
   twistd.rack=twisted.scripts.twistd:run
 extra-paths =
   ${common:extra-paths}
 scripts =
   maas-rack
+  maas-common
   twistd.rack
 initialization =
   ${common:initialization}
diff --git a/debian/changelog b/debian/changelog
index cc13ac8..f3ba3d5 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,8 +1,11 @@
 maas (2.3.0~alpha3-0ubuntu1) UNRELEASED; urgency=medium
 
-  * UNRELEASED
+  * Move scripts to maas-common that are used by the MAAS
+    region controller in addition to the rack.
+  * Add /usr/lib/maas/maas-common script.
+  * Move to debhelper compat level 9.
 
- -- Andres Rodriguez <[e-mail]>  Wed, 23 Aug 2017 10:13:52 -0400
+ -- Mike Pontillo <[e-mail]>  Tue, 22 Aug 2017 15:28:42 -0700
 
 maas (2.3.0~alpha2-6194-g7fb23b0-0ubuntu1) artful; urgency=medium
 
diff --git a/debian/compat b/debian/compat
index 7f8f011..ec63514 100644
--- a/debian/compat
+++ b/debian/compat
@@ -1 +1 @@
-7
+9
diff --git a/debian/control b/debian/control
index d3fb250..e0beb12 100644
--- a/debian/control
+++ b/debian/control
@@ -4,6 +4,7 @@ Priority: optional
 Maintainer: Ubuntu Developers <[e-mail]>
 Build-Depends: debhelper (>= 8.1.0~),
                dh-apport,
+               dh-exec,
                dh-python,
                dh-systemd,
                po-debconf,
@@ -57,7 +58,8 @@ Description: "Metal as a Service" is a physical cloud and IPAM
 Package: maas-common
 Architecture: all
 Depends: rsyslog,
-         ${misc:Depends}
+         ${misc:Depends},
+         python3-maas-provisioningserver
 Breaks: maas ( <= 0.1+bzr1048+dfsg-0ubuntu1 )
 Replaces: maas ( <= 0.1+bzr1048+dfsg-0ubuntu1 )
 Description: MAAS server common files
diff --git a/debian/extras/99-maas-common-sudoers b/debian/extras/99-maas-common-sudoers
index a4e6542..da4a5af 100644
--- a/debian/extras/99-maas-common-sudoers
+++ b/debian/extras/99-maas-common-sudoers
@@ -1,6 +1,10 @@
 maas ALL= NOPASSWD: /usr/bin/lshw
 maas ALL= NOPASSWD: /sbin/blockdev
 
+# MAAS network monitoring tools.
+maas ALL= NOPASSWD: /usr/lib/maas/network-monitor
+maas ALL= NOPASSWD: /usr/lib/maas/beacon-monitor
+
 # Control of the NTP server: MAAS needs to reconfigure it after editing
 # its configuration file, and start it again if stopped manually.
 maas ALL= NOPASSWD: /bin/systemctl restart ntp
diff --git a/debian/extras/99-maas-sudoers b/debian/extras/99-maas-sudoers
index 5d0b0be..c36b644 100644
--- a/debian/extras/99-maas-sudoers
+++ b/debian/extras/99-maas-sudoers
@@ -11,6 +11,4 @@ maas ALL= NOPASSWD: /bin/systemctl start tgt
 maas ALL= NOPASSWD: /bin/systemctl disable maas-rackd
 maas ALL= NOPASSWD: /bin/systemctl stop maas-rackd
 maas ALL= NOPASSWD: /usr/sbin/maas-rack scan-network *
-maas ALL= NOPASSWD: /usr/lib/maas/maas-network-monitor
-maas ALL= NOPASSWD: /usr/lib/maas/maas-beacon-monitor
 maas ALL= NOPASSWD: SETENV: /usr/sbin/tgt-admin, /usr/bin/uec2roottar
diff --git a/debian/extras/maas-rack b/debian/extras/maas-rack
old mode 100644
new mode 100755
index 4b69afa..4b69afa
--- a/debian/extras/maas-rack
+++ b/debian/extras/maas-rack
diff --git a/debian/maas-common.install b/debian/maas-common.install
old mode 100644
new mode 100755
index a9a647c..fa268cc
--- a/debian/maas-common.install
+++ b/debian/maas-common.install
@@ -1,4 +1,16 @@
+#!/usr/bin/dh-exec --with=install
+
 debian/tmp/usr/share/maas/maas-rsyslog.conf
 debian/extras/99-maas-common-sudoers etc/sudoers.d
 debian/tmp/usr/lib/maas/maas-delete-file
 debian/tmp/usr/lib/maas/maas-write-file
+
+# Install network monitoring scripts
+debian/tmp/usr/lib/maas/network-monitor
+debian/tmp/usr/lib/maas/beacon-monitor
+debian/tmp/usr/lib/maas/dhcp-monitor
+
+# Install an alias to maas-rack as maas-common.
+# For information on the usage of '=>' here, see:
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=245554
+debian/extras/maas-rack => /usr/lib/maas/maas-common
diff --git a/debian/maas-rack-controller.install b/debian/maas-rack-controller.install
index a641331..d448c3a 100644
--- a/debian/maas-rack-controller.install
+++ b/debian/maas-rack-controller.install
@@ -4,11 +4,6 @@ debian/tmp/usr/bin/uec2roottar
 # Install maas-dhcp-helper
 debian/tmp/usr/sbin/maas-dhcp-helper
 
-# Install network monitoring scripts
-debian/tmp/usr/lib/maas/maas-network-monitor
-debian/tmp/usr/lib/maas/maas-beacon-monitor
-debian/tmp/usr/lib/maas/maas-dhcp-monitor
-
 # Install test scripts
 debian/tmp/usr/lib/maas/maas-test-enlistment
 
diff --git a/debian/maas-rack-controller.lintian-overrides b/debian/maas-rack-controller.lintian-overrides
index a434dac..6ae74f7 100644
--- a/debian/maas-rack-controller.lintian-overrides
+++ b/debian/maas-rack-controller.lintian-overrides
@@ -1 +1,2 @@
-maas-rack-controller: binary-without-manpage usr/bin/uec2roottar usr/sbin/maas-dhcp-helper usr/lib/maas/maas-network-monitor usr/lib/maas/maas-beacon-monitor usr/lib/maas/maas-dhcp-monitor usr/lib/maas/maas-test-enlistment
+maas-rack-controller: binary-without-manpage usr/bin/uec2roottar usr/sbin/maas-dhcp-helper usr/lib/maas/maas-test-enlistment
+maas-common: binary-without-manpage usr/lib/maas/network-monitor usr/lib/maas/beacon-monitor usr/lib/maas/dhcp-monitor
diff --git a/scripts/beacon-monitor b/scripts/beacon-monitor
new file mode 100755
index 0000000..d06a128
--- /dev/null
+++ b/scripts/beacon-monitor
@@ -0,0 +1,24 @@
+#!/bin/sh -euf
+# Copyright 2016-2017 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+# Utility script to wrap `tcpdump`, so that this script can be called with
+# `sudo` without allowing MAAS access to read arbitrary network traffic.
+# This script is designed to be as minimal as possible, to prevent arbitrary
+# code execution.
+
+if [ $# -ne 1 ]; then
+    echo "Writes beacon traffic (and beacon traffic on VLANs) to stdout" >&2
+    echo "using tcpdump's binary PCAP format." >&2
+    echo "" >&2
+    echo "Usage:" >&2
+    echo "    $0 <interface>" >&2
+    exit 32
+fi
+
+FILTER="udp dst port 5240"
+
+exec "${SNAP:-}/usr/sbin/tcpdump" --interface "$1" --direction=in \
+    --no-promiscuous-mode --packet-buffered --immediate-mode \
+    --snapshot-length=16384 -n -w - \
+    "($FILTER) or (vlan and $FILTER)"
diff --git a/scripts/dhcp-monitor b/scripts/dhcp-monitor
new file mode 100755
index 0000000..450a704
--- /dev/null
+++ b/scripts/dhcp-monitor
@@ -0,0 +1,20 @@
+#!/bin/sh -euf
+# Copyright 2016 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+# Utility script to wrap `tcpdump`, so that this script can be called with
+# `sudo` without allowing MAAS access to read arbitrary network traffic.
+# This script is designed to be as minimal as possible, to prevent arbitrary
+# code execution.
+
+if [ $# -ne 1 ]; then
+    echo "Write DHCP traffic to stdout using tcpdump's binary PCAP format." >&2
+    echo "" >&2
+    echo "Usage:" >&2
+    echo "    $0 <interface>" >&2
+    exit 32
+fi
+
+exec /usr/sbin/tcpdump --interface "$1" --no-promiscuous-mode \
+    --packet-buffered --immediate-mode --snapshot-length=1500 -n -w - \
+    "udp and (port 67 or port 68) or (vlan and udp and (port 67 or port 68))"
diff --git a/scripts/maas-beacon-monitor b/scripts/maas-beacon-monitor
deleted file mode 100755
index d06a128..0000000
--- a/scripts/maas-beacon-monitor
+++ /dev/null
@@ -1,24 +0,0 @@
-#!/bin/sh -euf
-# Copyright 2016-2017 Canonical Ltd.  This software is licensed under the
-# GNU Affero General Public License version 3 (see the file LICENSE).
-
-# Utility script to wrap `tcpdump`, so that this script can be called with
-# `sudo` without allowing MAAS access to read arbitrary network traffic.
-# This script is designed to be as minimal as possible, to prevent arbitrary
-# code execution.
-
-if [ $# -ne 1 ]; then
-    echo "Writes beacon traffic (and beacon traffic on VLANs) to stdout" >&2
-    echo "using tcpdump's binary PCAP format." >&2
-    echo "" >&2
-    echo "Usage:" >&2
-    echo "    $0 <interface>" >&2
-    exit 32
-fi
-
-FILTER="udp dst port 5240"
-
-exec "${SNAP:-}/usr/sbin/tcpdump" --interface "$1" --direction=in \
-    --no-promiscuous-mode --packet-buffered --immediate-mode \
-    --snapshot-length=16384 -n -w - \
-    "($FILTER) or (vlan and $FILTER)"
diff --git a/scripts/maas-dhcp-monitor b/scripts/maas-dhcp-monitor
deleted file mode 100755
index d044d1e..0000000
--- a/scripts/maas-dhcp-monitor
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/bin/sh -euf
-# Copyright 2016 Canonical Ltd.  This software is licensed under the
-# GNU Affero General Public License version 3 (see the file LICENSE).
-
-# Utility script to wrap `tcpdump`, so that this script can be called with 
-# `sudo` without allowing MAAS access to read arbitrary network traffic.
-# This script is designed to be as minimal as possible, to prevent arbitrary
-# code execution.
-
-if [ $# -ne 1 ]; then
-    echo "Write DHCP traffic to stdout using tcpdump's binary PCAP format." >&2
-    echo "" >&2
-    echo "Usage:" >&2
-    echo "    $0 <interface>" >&2
-    exit 32
-fi 
-
-exec /usr/sbin/tcpdump --interface "$1" --no-promiscuous-mode \
-    --packet-buffered --immediate-mode --snapshot-length=1500 -n -w - \
-    "udp and (port 67 or port 68) or (vlan and udp and (port 67 or port 68))"
diff --git a/scripts/maas-multicast-helper b/scripts/maas-multicast-helper
deleted file mode 100755
index 8e2cfc2..0000000
--- a/scripts/maas-multicast-helper
+++ /dev/null
@@ -1,89 +0,0 @@
-#!/bin/sh -euf
-# Copyright 2017 Canonical Ltd.  This software is licensed under the
-# GNU Affero General Public License version 3 (see the file LICENSE).
-
-# Helper script to join or leave MAAS-reserved multicast groups.
-# See the IANA registries for more information:
-# https://www.iana.org/assignments/multicast-addresses/multicast-addresses.xhtml
-# https://www.iana.org/assignments/ipv6-multicast-addresses/ipv6-multicast-addresses.xhtml
-
-IP="/sbin/ip"
-
-# Note: The 'ip maddr add <mcast-address> dev <ifname>' command only supports
-# link-layer multicast addresses. Specifying an IPv4 address will not work.
-# This is the equivalent of "224.0.0.118".
-IPV4_GROUP="01:00:5e:00:00:76"
-
-# This is the equivalent of the MAAS variable-scope multicast group, and
-# corresponds to the link-local scoped group "ff02::15a".
-IPV6_GROUP="33:33:00:00:01:5a"
-
-usage()
-{
-    echo "Usage: $0 <leave | join> [ifname...]" 1>&2
-    echo "    Attempts to join or leave the MAAS multicast groups." 1>&2
-    echo "    If no interfaces are specified, joins or leaves on all "`
-            `"interfaces." 1>&2
-}
-
-if [ $# -lt 1 ]; then
-    usage
-    exit 1
-
-fi
-
-SUCCESSES=0
-FAILURES=""
-
-success()
-{
-    SUCCESSES=$(($SUCCESSES+1))
-    echo "$*"
-}
-
-join()
-{
-    "$IP" maddr add "$IPV4_GROUP" dev "$1" 2> /dev/null && \
-        success "$1: joined $IPV4_GROUP" || true
-    "$IP" maddr add "$IPV6_GROUP" dev "$1" 2> /dev/null && \
-        success "$1: joined $IPV6_GROUP" || true
-}
-
-leave()
-{
-    "$IP" maddr del "$IPV4_GROUP" dev "$1" 2> /dev/null  && \
-        success "$1: left $IPV4_GROUP" || true
-    "$IP" maddr del "$IPV6_GROUP" dev "$1" 2> /dev/null && \
-        success "$1: left $IPV6_GROUP" || true
-}
-
-cmd="$1"
-shift
-
-if [ "$#" -eq 0 ]; then
-    interfaces="$(ip maddr show | awk '/^[0-9]*:/ { print $2 }')"
-else
-    interfaces="$*"
-fi
-
-
-if [ "$cmd" = "join" ]; then
-    for ifname in $interfaces; do
-        join "$ifname"
-    done
-elif [ "$cmd" = "leave" ]; then
-    for ifname in $interfaces; do
-        leave "$ifname"
-    done
-else
-    usage
-    exit 1
-fi
-
-if [ $SUCCESSES -eq 0 ]; then
-    echo "$0: $cmd failed. (Try re-running with 'sudo'.)" 1>&2
-    if [ "$cmd" = "leave" ]; then
-        echo "(This is normal if no groups were joined to begin with.)" 1>&2
-    fi
-    exit 2
-fi
diff --git a/scripts/maas-network-monitor b/scripts/maas-network-monitor
deleted file mode 100755
index 155f0b8..0000000
--- a/scripts/maas-network-monitor
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/bin/sh -euf
-# Copyright 2016 Canonical Ltd.  This software is licensed under the
-# GNU Affero General Public License version 3 (see the file LICENSE).
-
-# Utility script to wrap `tcpdump`, so that this script can be called with
-# `sudo` without allowing MAAS access to read arbitrary network traffic.
-# This script is designed to be as minimal as possible, to prevent arbitrary
-# code execution.
-
-if [ $# -ne 1 ]; then
-    echo "Writes ARP traffic (and ARP traffic on tagged VLANs) to stdout" >&2
-    echo "using tcpdump's binary PCAP format." >&2
-    echo "" >&2
-    echo "Usage:" >&2
-    echo "    $0 <interface>" >&2
-    exit 32
-fi
-
-exec "${SNAP:-}/usr/sbin/tcpdump" --interface "$1" --no-promiscuous-mode \
-    --packet-buffered --immediate-mode --snapshot-length=64 -n -w - \
-    "arp or (vlan and arp)"
diff --git a/scripts/multicast-helper b/scripts/multicast-helper
new file mode 100755
index 0000000..8e2cfc2
--- /dev/null
+++ b/scripts/multicast-helper
@@ -0,0 +1,89 @@
+#!/bin/sh -euf
+# Copyright 2017 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+# Helper script to join or leave MAAS-reserved multicast groups.
+# See the IANA registries for more information:
+# https://www.iana.org/assignments/multicast-addresses/multicast-addresses.xhtml
+# https://www.iana.org/assignments/ipv6-multicast-addresses/ipv6-multicast-addresses.xhtml
+
+IP="/sbin/ip"
+
+# Note: The 'ip maddr add <mcast-address> dev <ifname>' command only supports
+# link-layer multicast addresses. Specifying an IPv4 address will not work.
+# This is the equivalent of "224.0.0.118".
+IPV4_GROUP="01:00:5e:00:00:76"
+
+# This is the equivalent of the MAAS variable-scope multicast group, and
+# corresponds to the link-local scoped group "ff02::15a".
+IPV6_GROUP="33:33:00:00:01:5a"
+
+usage()
+{
+    echo "Usage: $0 <leave | join> [ifname...]" 1>&2
+    echo "    Attempts to join or leave the MAAS multicast groups." 1>&2
+    echo "    If no interfaces are specified, joins or leaves on all "`
+            `"interfaces." 1>&2
+}
+
+if [ $# -lt 1 ]; then
+    usage
+    exit 1
+
+fi
+
+SUCCESSES=0
+FAILURES=""
+
+success()
+{
+    SUCCESSES=$(($SUCCESSES+1))
+    echo "$*"
+}
+
+join()
+{
+    "$IP" maddr add "$IPV4_GROUP" dev "$1" 2> /dev/null && \
+        success "$1: joined $IPV4_GROUP" || true
+    "$IP" maddr add "$IPV6_GROUP" dev "$1" 2> /dev/null && \
+        success "$1: joined $IPV6_GROUP" || true
+}
+
+leave()
+{
+    "$IP" maddr del "$IPV4_GROUP" dev "$1" 2> /dev/null  && \
+        success "$1: left $IPV4_GROUP" || true
+    "$IP" maddr del "$IPV6_GROUP" dev "$1" 2> /dev/null && \
+        success "$1: left $IPV6_GROUP" || true
+}
+
+cmd="$1"
+shift
+
+if [ "$#" -eq 0 ]; then
+    interfaces="$(ip maddr show | awk '/^[0-9]*:/ { print $2 }')"
+else
+    interfaces="$*"
+fi
+
+
+if [ "$cmd" = "join" ]; then
+    for ifname in $interfaces; do
+        join "$ifname"
+    done
+elif [ "$cmd" = "leave" ]; then
+    for ifname in $interfaces; do
+        leave "$ifname"
+    done
+else
+    usage
+    exit 1
+fi
+
+if [ $SUCCESSES -eq 0 ]; then
+    echo "$0: $cmd failed. (Try re-running with 'sudo'.)" 1>&2
+    if [ "$cmd" = "leave" ]; then
+        echo "(This is normal if no groups were joined to begin with.)" 1>&2
+    fi
+    exit 2
+fi
diff --git a/scripts/network-monitor b/scripts/network-monitor
new file mode 100755
index 0000000..155f0b8
--- /dev/null
+++ b/scripts/network-monitor
@@ -0,0 +1,21 @@
+#!/bin/sh -euf
+# Copyright 2016 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+# Utility script to wrap `tcpdump`, so that this script can be called with
+# `sudo` without allowing MAAS access to read arbitrary network traffic.
+# This script is designed to be as minimal as possible, to prevent arbitrary
+# code execution.
+
+if [ $# -ne 1 ]; then
+    echo "Writes ARP traffic (and ARP traffic on tagged VLANs) to stdout" >&2
+    echo "using tcpdump's binary PCAP format." >&2
+    echo "" >&2
+    echo "Usage:" >&2
+    echo "    $0 <interface>" >&2
+    exit 32
+fi
+
+exec "${SNAP:-}/usr/sbin/tcpdump" --interface "$1" --no-promiscuous-mode \
+    --packet-buffered --immediate-mode --snapshot-length=64 -n -w - \
+    "arp or (vlan and arp)"
diff --git a/setup.py b/setup.py
index 5182ca5..dffe046 100644
--- a/setup.py
+++ b/setup.py
@@ -117,9 +117,9 @@ setup(
         ('/usr/sbin',
             ['scripts/maas-dhcp-helper']),
         ('/usr/lib/maas',
-            ['scripts/maas-dhcp-monitor',
-             'scripts/maas-beacon-monitor',
-             'scripts/maas-network-monitor',
+            ['scripts/dhcp-monitor',
+             'scripts/beacon-monitor',
+             'scripts/network-monitor',
              'scripts/maas-delete-file',
              'scripts/maas-test-enlistment',
              'scripts/maas-write-file']),
diff --git a/snap/usr/lib/maas/maas-common b/snap/usr/lib/maas/maas-common
new file mode 120000
index 0000000..6d482d7
--- /dev/null
+++ b/snap/usr/lib/maas/maas-common
@@ -0,0 +1 @@
+../../../bin/maas-rack
\ No newline at end of file
diff --git a/src/provisioningserver/__main__.py b/src/provisioningserver/__main__.py
index 4016e35..042f6b3 100644
--- a/src/provisioningserver/__main__.py
+++ b/src/provisioningserver/__main__.py
@@ -4,6 +4,8 @@
 
 """Command-line interface for the MAAS provisioning component."""
 
+import sys
+
 from provisioningserver import security
 import provisioningserver.boot.install_grub
 import provisioningserver.cluster_config_command
@@ -19,17 +21,20 @@ from provisioningserver.utils.script import MainScript
 import provisioningserver.utils.send_beacons
 
 
-script_commands = {
-    'check-for-shared-secret': security.CheckForSharedSecretScript,
-    'config': provisioningserver.cluster_config_command,
-    'install-shared-secret': security.InstallSharedSecretScript,
-    'install-uefi-config': provisioningserver.boot.install_grub,
+COMMON_COMMANDS = {
     'observe-arp': provisioningserver.utils.arp,
     'observe-beacons': provisioningserver.utils.beaconing,
     'observe-mdns': provisioningserver.utils.avahi,
     'observe-dhcp': provisioningserver.utils.dhcp,
     'send-beacons': provisioningserver.utils.send_beacons,
     'scan-network': provisioningserver.utils.scan_network,
+}
+
+RACK_ONLY_COMMANDS = {
+    'check-for-shared-secret': security.CheckForSharedSecretScript,
+    'config': provisioningserver.cluster_config_command,
+    'install-shared-secret': security.InstallSharedSecretScript,
+    'install-uefi-config': provisioningserver.boot.install_grub,
     'register': provisioningserver.register_command,
     'support-dump': provisioningserver.support_dump,
     'upgrade-cluster': provisioningserver.upgrade_cluster,
@@ -37,6 +42,14 @@ script_commands = {
 
 
 main = MainScript(__doc__)
-for name, command in sorted(script_commands.items()):
+
+commands = COMMON_COMMANDS.copy()
+
+# If 'maas-common' isn't being executed, add rack-specific commands in addition
+# to the generic set of commands.
+if not sys.argv[0].endswith('/maas-common'):
+    commands.update(RACK_ONLY_COMMANDS)
+
+for name, command in sorted(commands.items()):
     main.register(name, command)
 main()
diff --git a/src/provisioningserver/rpc/clusterservice.py b/src/provisioningserver/rpc/clusterservice.py
index 50019d3..a7c62ab 100644
--- a/src/provisioningserver/rpc/clusterservice.py
+++ b/src/provisioningserver/rpc/clusterservice.py
@@ -86,7 +86,7 @@ from provisioningserver.utils.env import (
     set_maas_id,
 )
 from provisioningserver.utils.fs import (
-    get_maas_provision_command,
+    get_maas_common_command,
     NamedLock,
 )
 from provisioningserver.utils.network import (
@@ -162,7 +162,7 @@ def get_scan_all_networks_args(
 
     :param cidrs: an iterable of CIDR strings
     """
-    args = [get_maas_provision_command(), 'scan-network']
+    args = [get_maas_common_command(), 'scan-network']
     if not is_dev_environment():
         args = sudo(args)
     if threads is not None:
diff --git a/src/provisioningserver/rpc/tests/test_clusterservice.py b/src/provisioningserver/rpc/tests/test_clusterservice.py
index 4b54fc9..e37d162 100644
--- a/src/provisioningserver/rpc/tests/test_clusterservice.py
+++ b/src/provisioningserver/rpc/tests/test_clusterservice.py
@@ -110,7 +110,7 @@ from provisioningserver.service_monitor import service_monitor
 from provisioningserver.testing.config import ClusterConfigurationFixture
 from provisioningserver.utils.env import set_maas_id
 from provisioningserver.utils.fs import (
-    get_maas_provision_command,
+    get_maas_common_command,
     NamedLock,
 )
 from provisioningserver.utils.network import get_all_interfaces_definition
@@ -2470,7 +2470,7 @@ class TestClusterProtocol_ScanNetworks(
     def test_get_scan_all_networks_args_returns_expected_binary_args(self):
         args = get_scan_all_networks_args(scan_all=True)
         self.assertThat(args, Equals(
-            [get_maas_provision_command().encode('utf-8'), b'scan-network']
+            [get_maas_common_command().encode('utf-8'), b'scan-network']
         ))
 
     def test_get_scan_all_networks_args_sudo(self):
@@ -2479,7 +2479,7 @@ class TestClusterProtocol_ScanNetworks(
         is_dev_environment_mock.return_value = False
         args = get_scan_all_networks_args(scan_all=True)
         self.assertThat(args, Equals([
-            b'sudo', b'-n', get_maas_provision_command().encode('utf-8'),
+            b'sudo', b'-n', get_maas_common_command().encode('utf-8'),
             b'scan-network']
         ))
 
@@ -2487,7 +2487,7 @@ class TestClusterProtocol_ScanNetworks(
         args = get_scan_all_networks_args(cidrs=[
             IPNetwork('192.168.0.0/24'), IPNetwork('192.168.1.0/24')])
         self.assertThat(args, Equals([
-            get_maas_provision_command().encode('utf-8'),
+            get_maas_common_command().encode('utf-8'),
             b'scan-network',
             b'192.168.0.0/24',
             b'192.168.1.0/24'
@@ -2497,7 +2497,7 @@ class TestClusterProtocol_ScanNetworks(
     def test_get_scan_all_networks_args_returns_supplied_interface(self):
         args = get_scan_all_networks_args(interface='eth0')
         self.assertThat(args, Equals([
-            get_maas_provision_command().encode('utf-8'),
+            get_maas_common_command().encode('utf-8'),
             b'scan-network',
             b'eth0'
         ]
@@ -2510,7 +2510,7 @@ class TestClusterProtocol_ScanNetworks(
             interface='eth0', cidrs=[
                 IPNetwork('192.168.0.0/24'), IPNetwork('192.168.1.0/24')])
         self.assertThat(args, Equals([
-            get_maas_provision_command().encode('utf-8'),
+            get_maas_common_command().encode('utf-8'),
             b'scan-network',
             b'--threads', str(threads).encode('utf-8'),
             b'--ping',
diff --git a/src/provisioningserver/utils/arp.py b/src/provisioningserver/utils/arp.py
index 8e1f024..70528e7 100644
--- a/src/provisioningserver/utils/arp.py
+++ b/src/provisioningserver/utils/arp.py
@@ -366,7 +366,7 @@ def add_arguments(parser):
     parser.add_argument(
         '-i', '--input-file', type=str, required=False,
         help="File to read PCAP output from. Use - for stdin. Default is to "
-             "call `sudo /usr/lib/maas/maas-network-monitor` to get input.")
+             "call `sudo /usr/lib/maas/network-monitor` to get input.")
 
 
 def run(args, output=sys.stdout, stdin=sys.stdin,
@@ -381,7 +381,7 @@ def run(args, output=sys.stdout, stdin=sys.stdin,
     if args.input_file is None:
         if args.interface is None:
             raise ActionScriptError("Required argument: interface")
-        cmd = [get_path("/usr/lib/maas/maas-network-monitor"), args.interface]
+        cmd = [get_path("/usr/lib/maas/network-monitor"), args.interface]
         cmd = sudo(cmd)
         network_monitor = subprocess.Popen(
             cmd, stdin=subprocess.DEVNULL, stdout=subprocess.PIPE)
diff --git a/src/provisioningserver/utils/beaconing.py b/src/provisioningserver/utils/beaconing.py
index c28132c..2554725 100644
--- a/src/provisioningserver/utils/beaconing.py
+++ b/src/provisioningserver/utils/beaconing.py
@@ -339,7 +339,7 @@ def add_arguments(parser):
     parser.add_argument(
         '-i', '--input-file', type=str, required=False,
         help="File to read beaconing output from. Use - for stdin. Default is "
-             "to call `sudo /usr/lib/maas/maas-beacon-monitor` to get input.")
+             "to call `sudo /usr/lib/maas/beacon-monitor` to get input.")
 
 
 def run(args, output=sys.stdout, stdin=sys.stdin,
@@ -355,7 +355,7 @@ def run(args, output=sys.stdout, stdin=sys.stdin,
         if args.interface is None:
             raise ActionScriptError("Required argument: interface")
         cmd = sudo(
-            [get_path("/usr/lib/maas/maas-beacon-monitor"), args.interface])
+            [get_path("/usr/lib/maas/beacon-monitor"), args.interface])
         network_monitor = subprocess.Popen(
             cmd, stdin=subprocess.DEVNULL, stdout=subprocess.PIPE)
         infile = network_monitor.stdout
diff --git a/src/provisioningserver/utils/dhcp.py b/src/provisioningserver/utils/dhcp.py
index c912855..84e199a 100644
--- a/src/provisioningserver/utils/dhcp.py
+++ b/src/provisioningserver/utils/dhcp.py
@@ -244,7 +244,7 @@ def add_arguments(parser):
     parser.add_argument(
         '-i', '--input-file', type=str, required=False,
         help="File to read PCAP output from. Use - for stdin. Default is to "
-             "call `sudo /usr/lib/maas/maas-dhcp-monitor` to get input.")
+             "call `sudo /usr/lib/maas/dhcp-monitor` to get input.")
 
 
 def run(args, output=sys.stdout, stdin=sys.stdin,
@@ -255,7 +255,7 @@ def run(args, output=sys.stdout, stdin=sys.stdin,
         if args.interface is None:
             raise ActionScriptError("Required argument: interface")
         cmd = sudo(
-            [get_path("/usr/lib/maas/maas-dhcp-monitor"), args.interface])
+            [get_path("/usr/lib/maas/dhcp-monitor"), args.interface])
         network_monitor = subprocess.Popen(
             cmd, stdin=subprocess.DEVNULL, stdout=subprocess.PIPE,
             stderr=subprocess.DEVNULL
diff --git a/src/provisioningserver/utils/fs.py b/src/provisioningserver/utils/fs.py
index 70502ef..b78ef3c 100644
--- a/src/provisioningserver/utils/fs.py
+++ b/src/provisioningserver/utils/fs.py
@@ -61,7 +61,7 @@ from twisted.python.filepath import FilePath
 from twisted.python.lockfile import FilesystemLock
 
 
-def get_maas_provision_command():
+def get_maas_common_command():
     """Return path to the maas-rack command.
 
     In production mode this will just return 'maas-rack', but in
@@ -72,9 +72,9 @@ def get_maas_provision_command():
     from provisioningserver.config import is_dev_environment
     if is_dev_environment():
         from maastesting import root
-        return os.path.join(root, "bin", "maas-rack")
+        return os.path.join(root, "bin", "maas-common")
     else:
-        return "maas-rack"
+        return os.path.join(get_path("/usr/lib/maas"), "maas-common")
 
 
 def get_library_script_path(name):
diff --git a/src/provisioningserver/utils/services.py b/src/provisioningserver/utils/services.py
index 68f62f5..08becc3 100644
--- a/src/provisioningserver/utils/services.py
+++ b/src/provisioningserver/utils/services.py
@@ -40,7 +40,7 @@ from provisioningserver.utils.beaconing import (
     TopologyHint,
 )
 from provisioningserver.utils.fs import (
-    get_maas_provision_command,
+    get_maas_common_command,
     NamedLock,
 )
 from provisioningserver.utils.network import (
@@ -289,7 +289,7 @@ class NeighbourDiscoveryService(ProcessProtocolService):
         return "Neighbour observation process for %s" % self.ifname
 
     def getProcessParameters(self):
-        maas_rack_cmd = get_maas_provision_command().encode("utf-8")
+        maas_rack_cmd = get_maas_common_command().encode("utf-8")
         return [
             maas_rack_cmd,
             b"observe-arp",
@@ -313,7 +313,7 @@ class BeaconingService(ProcessProtocolService):
         return "Beaconing process for %s" % self.ifname
 
     def getProcessParameters(self):
-        maas_rack_cmd = get_maas_provision_command().encode("utf-8")
+        maas_rack_cmd = get_maas_common_command().encode("utf-8")
         return [
             maas_rack_cmd,
             b"observe-beacons",
@@ -336,7 +336,7 @@ class MDNSResolverService(ProcessProtocolService):
         return "mDNS observation process"
 
     def getProcessParameters(self):
-        maas_rack_cmd = get_maas_provision_command().encode("utf-8")
+        maas_rack_cmd = get_maas_common_command().encode("utf-8")
         return [
             maas_rack_cmd,
             b"observe-mdns",
diff --git a/src/provisioningserver/utils/tests/test_arp.py b/src/provisioningserver/utils/tests/test_arp.py
index e8622a5..86ee5ac 100644
--- a/src/provisioningserver/utils/tests/test_arp.py
+++ b/src/provisioningserver/utils/tests/test_arp.py
@@ -443,7 +443,7 @@ class TestObserveARPCommand(MAASTestCase):
         self.assertThat(
             popen,
             MockCalledOnceWith(
-                ['sudo', '-n', '/usr/lib/maas/maas-network-monitor', 'eth0'],
+                ['sudo', '-n', '/usr/lib/maas/network-monitor', 'eth0'],
                 stdin=subprocess.DEVNULL, stdout=subprocess.PIPE))
 
     def test__calls_subprocess_for_interface_sudo(self):
@@ -459,7 +459,7 @@ class TestObserveARPCommand(MAASTestCase):
         self.assertThat(
             popen,
             MockCalledOnceWith(
-                ['sudo', '-n', '/usr/lib/maas/maas-network-monitor', 'eth0'],
+                ['sudo', '-n', '/usr/lib/maas/network-monitor', 'eth0'],
                 stdin=subprocess.DEVNULL, stdout=subprocess.PIPE))
 
     def test__checks_for_pipe(self):
diff --git a/src/provisioningserver/utils/tests/test_beaconing.py b/src/provisioningserver/utils/tests/test_beaconing.py
index 514b209..708512a 100644
--- a/src/provisioningserver/utils/tests/test_beaconing.py
+++ b/src/provisioningserver/utils/tests/test_beaconing.py
@@ -234,7 +234,7 @@ class TestObserveBeaconsCommand(MAASTestCase):
         self.assertThat(
             popen,
             MockCalledOnceWith(
-                ['sudo', '-n', '/usr/lib/maas/maas-beacon-monitor', 'eth0'],
+                ['sudo', '-n', '/usr/lib/maas/beacon-monitor', 'eth0'],
                 stdin=subprocess.DEVNULL, stdout=subprocess.PIPE))
 
     def test__calls_subprocess_for_interface_sudo(self):
@@ -250,7 +250,7 @@ class TestObserveBeaconsCommand(MAASTestCase):
         self.assertThat(
             popen,
             MockCalledOnceWith(
-                ['sudo', '-n', '/usr/lib/maas/maas-beacon-monitor', 'eth0'],
+                ['sudo', '-n', '/usr/lib/maas/beacon-monitor', 'eth0'],
                 stdin=subprocess.DEVNULL, stdout=subprocess.PIPE))
 
     def test__checks_for_pipe(self):
diff --git a/src/provisioningserver/utils/tests/test_fs.py b/src/provisioningserver/utils/tests/test_fs.py
index 9954e20..cc1329d 100644
--- a/src/provisioningserver/utils/tests/test_fs.py
+++ b/src/provisioningserver/utils/tests/test_fs.py
@@ -51,7 +51,7 @@ from provisioningserver.utils.fs import (
     atomic_write,
     FileLock,
     get_library_script_path,
-    get_maas_provision_command,
+    get_maas_common_command,
     incremental_write,
     NamedLock,
     read_text_file,
@@ -374,14 +374,15 @@ class TestGetMAASProvisionCommand(MAASTestCase):
     def test__returns_just_command_for_production(self):
         self.patch(provisioningserver.config, "is_dev_environment")
         provisioningserver.config.is_dev_environment.return_value = False
-        self.assertEqual("maas-rack", get_maas_provision_command())
+        self.assertEqual(
+            "/usr/lib/maas/maas-common", get_maas_common_command())
 
     def test__returns_full_path_for_development(self):
         self.patch(provisioningserver.config, "is_dev_environment")
         provisioningserver.config.is_dev_environment.return_value = True
         self.assertEqual(
-            root.rstrip("/") + "/bin/maas-rack",
-            get_maas_provision_command())
+            root.rstrip("/") + "/bin/maas-common",
+            get_maas_common_command())
 
 
 class TestGetLibraryScriptPath(MAASTestCase):
diff --git a/src/provisioningserver/utils/tests/test_services.py b/src/provisioningserver/utils/tests/test_services.py
index 36090ea..c83eeb7 100644
--- a/src/provisioningserver/utils/tests/test_services.py
+++ b/src/provisioningserver/utils/tests/test_services.py
@@ -567,7 +567,7 @@ class TestNeighbourDiscoveryService(MAASTestCase):
         service = NeighbourDiscoveryService(ifname, Mock())
         args = service.getProcessParameters()
         self.assertThat(args, HasLength(3))
-        self.assertTrue(args[0].endswith(b'maas-rack'))
+        self.assertTrue(args[0].endswith(b'maas-common'))
         self.assertTrue(args[1], Equals(b"observe-arp"))
         self.assertTrue(args[2], Equals(ifname.encode('utf-8')))
 
@@ -619,7 +619,7 @@ class TestBeaconingService(MAASTestCase):
         service = BeaconingService(ifname, Mock())
         args = service.getProcessParameters()
         self.assertThat(args, HasLength(3))
-        self.assertTrue(args[0].endswith(b'maas-rack'))
+        self.assertTrue(args[0].endswith(b'maas-common'))
         self.assertTrue(args[1], Equals(b"observe-beacons"))
         self.assertTrue(args[2], Equals(ifname.encode('utf-8')))
 
@@ -670,7 +670,7 @@ class TestMDNSResolverService(MAASTestCase):
         service = MDNSResolverService(Mock())
         args = service.getProcessParameters()
         self.assertThat(args, HasLength(2))
-        self.assertTrue(args[0].endswith(b"maas-rack"))
+        self.assertTrue(args[0].endswith(b"maas-common"))
         self.assertTrue(args[1], Equals(b"observe-mdns"))
 
     @inlineCallbacks
diff --git a/utilities/install-sudoers b/utilities/install-sudoers
index ed498d6..9d421e0 100755
--- a/utilities/install-sudoers
+++ b/utilities/install-sudoers
@@ -2,33 +2,33 @@
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
-echo "Copying /usr/lib/maas/maas-network-monitor..."
+echo "Copying /usr/lib/maas/network-monitor..."
 sudo mkdir -p /usr/lib/maas
-sudo cp "$SCRIPT_DIR/../scripts/maas-network-monitor" /usr/lib/maas/maas-network-monitor
-echo "Copying /usr/lib/maas/maas-dhcp-monitor..."
-sudo cp "$SCRIPT_DIR/../scripts/maas-dhcp-monitor" /usr/lib/maas/maas-dhcp-monitor
-echo "Copying /usr/lib/maas/maas-beacon-monitor..."
-sudo cp "$SCRIPT_DIR/../scripts/maas-beacon-monitor" /usr/lib/maas/maas-beacon-monitor
+sudo cp "$SCRIPT_DIR/../scripts/network-monitor" /usr/lib/maas/network-monitor
+echo "Copying /usr/lib/maas/dhcp-monitor..."
+sudo cp "$SCRIPT_DIR/../scripts/dhcp-monitor" /usr/lib/maas/dhcp-monitor
+echo "Copying /usr/lib/maas/beacon-monitor..."
+sudo cp "$SCRIPT_DIR/../scripts/beacon-monitor" /usr/lib/maas/beacon-monitor
 
 SUDOERS_FILE=/etc/sudoers.d/99-maas-dev-$USER
 
 echo "Installing sudoers file: $SUDOERS_FILE"
 cat << EOF | sudo tee $SUDOERS_FILE
-$USER ALL= NOPASSWD: /usr/lib/maas/maas-network-monitor
-$USER ALL= NOPASSWD: /usr/lib/maas/maas-dhcp-monitor
-$USER ALL= NOPASSWD: /usr/lib/maas/maas-beacon-monitor
+$USER ALL= NOPASSWD: /usr/lib/maas/network-monitor
+$USER ALL= NOPASSWD: /usr/lib/maas/dhcp-monitor
+$USER ALL= NOPASSWD: /usr/lib/maas/beacon-monitor
 EOF
 sudo chmod 440 $SUDOERS_FILE
 
 echo ""
 echo "Done. You should now be able to run the following to get raw 'tcpdump' output:"
-echo "    sudo /usr/lib/maas/maas-network-monitor <interface>"
-echo "    sudo /usr/lib/maas/maas-dhcp-monitor <interface>"
-echo "    sudo /usr/lib/maas/maas-beacon-monitor <interface>"
+echo "    sudo /usr/lib/maas/network-monitor <interface>"
+echo "    sudo /usr/lib/maas/dhcp-monitor <interface>"
+echo "    sudo /usr/lib/maas/beacon-monitor <interface>"
 echo ""
 echo "In addition, the following commands should now work in the dev env:"
 echo "Done. You should now be able to do the following to get raw 'tcpdump' output:"
-echo "    sudo /usr/lib/maas/maas-dhcp-monitor <interface>"
+echo "    sudo /usr/lib/maas/dhcp-monitor <interface>"
 echo "In addition, the following command should now work in the dev env:"
 echo "    bin/maas-rack observe-arp <interface>"
 echo "    bin/maas-rack observe-dhcp <interface>"