From 978bfda4ece754c7acb8f8e42ebb71b9baa0974d Mon Sep 17 00:00:00 2001 From: Alex Crawford Date: Tue, 30 Sep 2014 14:55:55 -0700 Subject: [PATCH] Various fixes for CoreOS distro - Clean up service unit - Add /etc/machine-id to deprovision blacklist - Add custom RestartInterface() - Stop networkd before running DHCP client - Remove install/uninstall register/deregister functions - Make sure that newly-created user accounts aren't locked --- waagent | 108 +++++++++++++++++++++++++++++++++++--------------------- 1 file changed, 67 insertions(+), 41 deletions(-) diff --git a/waagent b/waagent index f4632c5..736a0d2 100644 --- a/waagent +++ b/waagent @@ -935,22 +935,6 @@ class centosDistro(redhatDistro): # CoreOSDistro ############################################################ -coreos_systemd_conf = """\ -[Unit] -Description=Microsoft Azure Agent -After=network.target -After=sshd.service -ConditionFileIsExecutable=/usr/share/oem/waagent/bin/waagent -ConditionPathExists=/etc/systemd/system/waagent.service - -[Service] -Type=simple -ExecStart=/usr/share/oem/python/bin/python /usr/share/oem/waagent/bin/waagent -daemon - -[Install] -WantedBy=multi-user.target -""" - class CoreOSDistro(AbstractDistro): """ CoreOS Distro concrete class @@ -961,7 +945,7 @@ class CoreOSDistro(AbstractDistro): self.requiredDeps += [ "/usr/bin/systemctl" ] self.agent_service_name = 'waagent' self.init_script_file='/etc/systemd/system/waagent.service' - self.init_file=coreos_systemd_conf + self.fileBlackList.append("/etc/machine-id") self.dhcp_client_name='systemd-networkd' self.getpidcmd='pidof ' self.shadow_file_mode=0640 @@ -997,35 +981,12 @@ class CoreOSDistro(AbstractDistro): """ return 0 - def installAgentServiceScriptFiles(self): - try: - SetFileContents(self.init_script_file, self.init_file) - os.chmod(self.init_script_file, 0744) - except OSError, e: - ErrorWithPrefix('installAgentServiceScriptFiles','Exception: '+str(e)+' occured creating ' + self.init_script_file) - return 1 - return 0 - - def registerAgentService(self): - if self.installAgentServiceScriptFiles() == 0: - return Run('systemctl enable ' + self.agent_service_name) - else : - return 1 - def startAgentService(self): return Run('systemctl start ' + self.agent_service_name) def stopAgentService(self): return Run('systemctl stop ' + self.agent_service_name) - def uninstallAgentService(self): - Run('systemctl disable ' + self.agent_service_name) - return Run('rm ' + self.init_script_file) - - def unregisterAgentService(self): - self.stopAgentService() - return self.uninstallAgentService() - def restartSshService(self): """ Service call to re(start) the SSH service @@ -1034,7 +995,7 @@ class CoreOSDistro(AbstractDistro): if retcode > 0: Error("Failed to restart SSH service with return code:" + str(retcode)) return retcode -# + def sshDeployPublicKey(self,fprint,path): """ We support PKCS8. @@ -1044,6 +1005,67 @@ class CoreOSDistro(AbstractDistro): else : return 0 + def RestartInterface(self, iface): + Run("systemctl restart systemd-networkd") + + def CreateAccount(user, password, expiration, thumbprint): + """ + Create a user account, with 'user', 'password', 'expiration', ssh keys + and sudo permissions. + Returns None if successful, error string on failure. + """ + userentry = None + try: + userentry = pwd.getpwnam(user) + except: + pass + uidmin = None + try: + uidmin = int(GetLineStartingWith("UID_MIN", "/etc/login.defs").split()[1]) + except: + pass + if uidmin == None: + uidmin = 100 + if userentry != None and userentry[2] < uidmin: + Error("CreateAccount: " + user + " is a system user. Will not set password.") + return "Failed to set password for system user: " + user + " (0x06)." + if userentry == None: + command = "useradd --create-home --password '*' " + user + if expiration != None: + command += " --expiredate " + expiration.split('.')[0] + if Run(command): + Error("Failed to create user account: " + user) + return "Failed to create user account: " + user + " (0x07)." + else: + Log("CreateAccount: " + user + " already exists. Will update password.") + if password != None: + RunSendStdin("chpasswd",(user + ":" + password + "\n")) + try: + if password == None: + SetFileContents("/etc/sudoers.d/waagent", user + " ALL = (ALL) NOPASSWD: ALL\n") + else: + SetFileContents("/etc/sudoers.d/waagent", user + " ALL = (ALL) ALL\n") + os.chmod("/etc/sudoers.d/waagent", 0440) + except: + Error("CreateAccount: Failed to configure sudo access for user.") + return "Failed to configure sudo privileges (0x08)." + home = MyDistro.GetHome() + if thumbprint != None: + dir = home + "/" + user + "/.ssh" + CreateDir(dir, user, 0700) + pub = dir + "/id_rsa.pub" + prv = dir + "/id_rsa" + Run("ssh-keygen -y -f " + thumbprint + ".prv > " + pub) + SetFileContents(prv, GetFileContents(thumbprint + ".prv")) + for f in [pub, prv]: + os.chmod(f, 0600) + ChangeOwner(f, user) + SetFileContents(dir + "/authorized_keys", GetFileContents(pub)) + ChangeOwner(dir + "/authorized_keys", user) + Log("Created user account: " + user) + return None + + ############################################################ # debianDistro ############################################################ @@ -4307,6 +4329,8 @@ class Agent(Util): Run("route add 255.255.255.255 dev " + ifname,chk_err=False) # We supress error logging on error. if MyDistro.dhcp_client_name == 'wickedd-dhcp4': Run("service " + MyDistro.dhcp_client_name + " stop",chk_err=False) + if MyDistro.dhcp_client_name == 'systemd-networkd': + Run("systemctl stop " + MyDistro.dhcp_client_name,chk_err=False) sock.bind(("0.0.0.0", 68)) sock.sendto(sendData, ("", 67)) sock.settimeout(10) @@ -4336,6 +4360,8 @@ class Agent(Util): Log("DoDhcpWork: Removing broadcast route for DHCP.") if MyDistro.dhcp_client_name == 'wickedd-dhcp4': Run("service " + MyDistro.dhcp_client_name + " start",chk_err=False) + if MyDistro.dhcp_client_name == 'systemd-networkd': + Run("systemctl start " + MyDistro.dhcp_client_name,chk_err=False) return None def UpdateAndPublishHostName(self, name):