Update to v48

With socket activation, we can now select() and time out before accept()
and exit, releasing all resource we used back to the system.

The default timeout is set for 10 minutes. If no more connections
arrive, the daemon exits.

Socket activation is done through the clr_debug_daemon.socket unit, which
the clr_debug_fuse service requires, so this should be extra robust when
starting up.

The daemon ignores stat() requests for trash that gnome sends when it
sees the fuse system mounted, and returns the underlying stat() for
the root node instead of a remote value, because there is no value
in fetching this info over curl.

.gitignore

@@ -8,6 +8,7 @@ clr_debug_prepare
 Makefile
 Makefile.in
 aclocal.m4
+ar-lib
 autom4te.cache/
 compile
 config.h

Makefile.am

@@ -1,4 +1,4 @@
-EXTRA_DIST = COPYING clr_debug_fuse.service clr_debug_daemon.service debuginfo.conf
+EXTRA_DIST = COPYING clr_debug_fuse.service clr_debug_daemon.service clr_debug_daemon.socket debuginfo.conf
 
 DISTCHECK_CONFIGURE_FLAGS = \
 	--with-systemdsystemunitdir=$$dc_install_base/$(systemdsystemunitdir) \
@@ -33,15 +33,16 @@ clr_debug_fuse_SOURCES = src/fuse.c src/client.c
 clr_debug_daemon_SOURCES = src/server.c
 clr_debug_daemon_CFLAGS = \
 	-pthread \
-	$(AM_CFLAGS)
+	$(AM_CFLAGS) \
+	$(LIBSYSTEMD_CFLAGS)
 
 clr_debug_prepare_SOURCES = src/prepare.c
 
 
 clr_debug_fuse_LDADD = ${fuse_LIBS} libnica.la
-clr_debug_daemon_LDADD = ${curl_LIBS} libnica.la
+clr_debug_daemon_LDADD = ${curl_LIBS} libnica.la ${LIBSYSTEMD_LIBS}
 clr_debug_prepare_LDADD = libnica.la
 
-systemdsystemunit_DATA = clr_debug_fuse.service clr_debug_daemon.service
+systemdsystemunit_DATA = clr_debug_fuse.service clr_debug_daemon.service clr_debug_daemon.socket
 
 tmpfiles_DATA = debuginfo.conf

clr_debug_daemon.service

@@ -1,5 +1,6 @@
 [Unit]
 Description=Clear Linux debuginfo daemon
+DefaultDependencies=no
 
 [Service]
 Type=simple

clr_debug_daemon.socket

@@ -0,0 +1,9 @@
+[Unit]
+Description=Clear Linux OS debuginfo daemon
+
+[Socket]
+ListenStream=/run/clr-debug-info
+SocketMode=0600
+
+[Install]
+WantedBy=sockets.target

clr_debug_fuse.service

@@ -1,6 +1,8 @@
 [Unit]
 Description=Clear Linux debuginfo fuse monitor
-After=clr_debug_daemon.service
+After=clr_debug_daemon.socket
+Requires=clr_debug_daemon.socket
+DefaultDependencies=no
 
 [Service]
 Type=simple

configure.ac

@@ -2,17 +2,21 @@
 # Process this file with autoconf to produce a configure script.
 
 AC_PREREQ([2.66])
-AC_INIT(clr-debug-info, 38, arjan@linux.intel.com)
+AC_INIT(clr-debug-info, 48, arjan@linux.intel.com)
 AM_INIT_AUTOMAKE([foreign -Wall -W subdir-objects])
 AM_SILENT_RULES([yes])
 AC_PROG_CC
+AM_PROG_AR
 AC_LANG(C)
 AC_CONFIG_HEADERS([config.h])
 PKG_CHECK_MODULES([curl], [libcurl])
 PKG_CHECK_MODULES([fuse], [fuse])
 PKG_CHECK_MODULES([SYSTEMD], [systemd])
+PKG_CHECK_MODULES([LIBSYSTEMD], [libsystemd])
 LT_INIT
 
+AC_DEFINE([SOCKET_PATH], ["/run/clr-debug-info"], [path to communication socket])
+
 dir=""
 AC_ARG_WITH([systemdsystemunitdir], AS_HELP_STRING([--with-systemdsystemunitdir=DIR],
 	    [path to systemd system service dir @<:@default=/usr/lib/systemd/system@:>@]), [dir=${withval}],

debuginfo.conf

@@ -8,5 +8,7 @@
 # See tmpfiles.d(5) for details
 
 # Clear tmp directories separately, to make them easier to override
-d /var/cache/debuginfo/lib 755 root root 10d
+# Unfortunatly tmpfiles doesn't change the ownership for things if they
-d /var/cache/debuginfo/src 755 root root 1d
+# are not listed.
+d /var/cache/debuginfo/lib 755 dbginfo dbginfo 10d
+d /var/cache/debuginfo/src 755 dbginfo dbginfo 1d

src/client.c

@@ -36,9 +36,11 @@
 #include <time.h>
 #include <unistd.h>
 
+#include "config.h"
+
 /* 0.75 seconds timeout */
-#define TIMEOUT 750000
+#define TIMEOUT 75000
-#define TIMEOUT2 15000
+#define TIMEOUT2 1500
 #define TIMEOUT3 500
 
 char *prefix = "src";
@@ -58,7 +60,7 @@ void try_to_get(const char *path, int pid, time_t timestamp)
         int shorttime = 0;
         __nc_unused__ size_t wr = -1;
 
-        //	printf("Trying to aquire %s\n", path);
+        // printf("Trying to aquire %s\n", path);
 
         sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
         if (sockfd < 0) {
@@ -66,14 +68,13 @@ void try_to_get(const char *path, int pid, time_t timestamp)
         }
 
         sun.sun_family = AF_UNIX;
-        strcpy(sun.sun_path, ":clr-debug-info");
+        strcpy(sun.sun_path, SOCKET_PATH);
-        sun.sun_path[0] = 0; /* anonymous unix socket */
 
         ret = connect(sockfd,
                       (struct sockaddr *)&sun,
-                      offsetof(struct sockaddr_un, sun_path) + strlen(":clr-debug-info") + 1);
+                      offsetof(struct sockaddr_un, sun_path) + strlen(SOCKET_PATH) + 1);
         if (ret < 0) {
-                printf("Cannot connect %s\n", strerror(errno));
+                printf("Cannot connect to %s: %s\n", SOCKET_PATH, strerror(errno));
                 close(sockfd);
                 return;
         }

src/fuse.c

@@ -75,6 +75,16 @@ static int xmp_getattr(const char *path, struct stat *stbuf)
         memset(stbuf, 0, sizeof(struct stat));
         res = lstat(newpath, stbuf);
 
+        /*
+         * filter out things that never should get fetched
+         * this prevents us from asking curl to fetch us useless things
+         */
+        if (strncmp(path, "/.Trash", strlen("/.Trash")) == 0) {
+                return -ENOENT;
+        } else if (strcmp(path, "/") == 0) {
+                return 0;
+        }
+
         /*
          * get the file. if the st_mtime is set, this is just an async refresh, otherwise it's
          * a synchronous request.

src/server.c

@@ -27,9 +27,11 @@
 #define _GNU_SOURCE
 
 #include <errno.h>
+#include <grp.h>
 #include <linux/capability.h>
 #include <malloc.h>
 #include <pthread.h>
+#include <pwd.h>
 #include <signal.h>
 #include <stddef.h>
 #include <stdio.h>
@@ -47,16 +49,20 @@
 
 #include <curl/curl.h>
 
+#include "systemd/sd-daemon.h"
+
 #include "config.h"
 
 #ifdef HAVE_ATOMIC_SUPPORT
 #include <stdatomic.h>
 #endif
 
+#define TIMEOUT 600 /* 10 minutes */
+
 static pthread_mutex_t dupes_mutex = PTHREAD_MUTEX_INITIALIZER;
 
 char *urls[2] = { "https://cdn.download.clearlinux.org/debuginfo/",
-                  "https://cdn.download.clearlinux.org/debuginfo/" };
+                  "https://cdn-alt.download.clearlinux.org/debuginfo/" };
 int urlcounter = 1;
 
 static NcHashmap *hash = NULL;
@@ -162,6 +168,7 @@ static int curl_get_file(const char *url, const char *prefix, time_t timestamp)
 {
         CURLcode code;
         long ret;
+        long changed;
         int fd;
         char filename[PATH_MAX];
         CURL *curl = NULL;
@@ -203,6 +210,9 @@ static int curl_get_file(const char *url, const char *prefix, time_t timestamp)
         curl_easy_setopt(curl, CURLOPT_LOW_SPEED_TIME, 30);
         curl_easy_setopt(curl, CURLOPT_LOW_SPEED_LIMIT, 1024);
 
+        /* request timestamp of files from server */
+        curl_easy_setopt(curl, CURLOPT_FILETIME, 1);
+
         if (timestamp) {
                 curl_easy_setopt(curl, CURLOPT_TIMECONDITION, CURL_TIMECOND_IFMODSINCE);
                 curl_easy_setopt(curl, CURLOPT_TIMEVALUE, timestamp);
@@ -230,6 +240,17 @@ static int curl_get_file(const char *url, const char *prefix, time_t timestamp)
         }
 
         if (ret == 200) {
+                /* get timestamp, if any */
+                curl_easy_getinfo(curl, CURLINFO_FILETIME, &changed);
+                if (changed >= 0) {
+                        struct timespec times[2];
+                        times[0].tv_sec = (time_t)changed;
+                        times[0].tv_nsec = 0;
+                        times[1].tv_sec = (time_t)changed;
+                        times[1].tv_nsec = 0;
+                        futimens(fd, times);
+                }
+
                 autofree(char) *command = NULL;
                 //		printf("Filename is %s\n", filename);
 
@@ -237,7 +258,8 @@ static int curl_get_file(const char *url, const char *prefix, time_t timestamp)
                 stat(filename, &statbuf);
                 if (statbuf.st_size > 0 &&
                     asprintf(&command,
-                             "tar -C /var/cache/debuginfo/%s --no-same-owner  --no-same-permissions  -xf %s",
+                             "tar -C /var/cache/debuginfo/%s --no-same-owner "
+                             "--no-same-permissions  -xf %s",
                              prefix,
                              filename) >= 0) {
                         if (system(command) != 0) {
@@ -334,7 +356,7 @@ static void *server_thread(void *arg)
         }
 
         gettimeofday(&after, NULL);
-#if 0        
+#if 0
         if (timedelta(before, after) > 0.6)
                 printf("Request for %s took %5.2f seconds (%i - %i)\n",
                        url,
@@ -360,8 +382,19 @@ int main(__nc_unused__ int argc, __nc_unused__ char **argv)
         struct sockaddr_un sun;
         int ret;
         int curl_done = 0;
+        uid_t dbg_user = 0;
+        gid_t dbg_group = 0;
+        struct passwd *passwdentry;
         const char *required_paths[] = { "/var/cache/debuginfo/lib", "/var/cache/debuginfo/src" };
 
+        umask(0);
+        passwdentry = getpwnam("dbginfo");
+        if (passwdentry) {
+                dbg_user = passwdentry->pw_uid;
+                dbg_group = passwdentry->pw_gid;
+        }
+        endpwent();
+
         if (prctl(PR_SET_DUMPABLE, 0) != 0) {
                 fprintf(stderr,
                         "Failed to disable PR_SET_DUMPABLE. Do NOT gdb attach this process: %s\n",
@@ -376,44 +409,95 @@ int main(__nc_unused__ int argc, __nc_unused__ char **argv)
 
         for (size_t i = 0; i < ARRAY_SIZE(required_paths); i++) {
                 const char *req_path = required_paths[i];
-                if (nc_file_exists(req_path)) {
+                struct stat st = { .st_ino = 0 };
-                        continue;
+                if (lstat(req_path, &st) == 0) {
+                        /* If the file already exists, check ownership
+                         * and delete tree if incorrect. Essentially a
+                         * one-off operation to transition from root owned to
+                         * dbginfo owned */
+                        if (st.st_uid == dbg_user) {
+                                continue;
+                        }
+                        fprintf(stderr, "Removing old debug information %s\n", req_path);
+                        nc_rm_rf(req_path);
                 }
                 if (!nc_mkdir_p(req_path, 00755)) {
                         fprintf(stderr, "Failed to mkdir: %s %s\n", strerror(errno), req_path);
                         return EXIT_FAILURE;
                 }
+                if (chown(req_path, dbg_user, dbg_group) != 0) {
+                        fprintf(stderr, "Failed to chown: %s %s\n", strerror(errno), req_path);
+                        return EXIT_FAILURE;
+                }
         }
 
         signal(SIGPIPE, SIG_IGN);
 
-        sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
+        if (sd_listen_fds(0) == 1) {
-        if (sockfd < 0) {
+                /* systemd socket activation */
-                return EXIT_FAILURE;
+                sockfd = SD_LISTEN_FDS_START + 0;
+        } else if (sd_listen_fds(0) > 1) {
+                printf("Too many file descriptors received.\n");
+                exit(EXIT_FAILURE);
+        } else {
+                sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
+                if (sockfd < 0) {
+                        exit(EXIT_FAILURE);
+                }
+
+                sun.sun_family = AF_UNIX;
+                strcpy(sun.sun_path, SOCKET_PATH);
+
+                ret = bind(sockfd,
+                        (struct sockaddr *)&sun,
+                        offsetof(struct sockaddr_un, sun_path) + strlen(SOCKET_PATH) + 1);
+                if (ret < 0) {
+                        fprintf(stderr, "Failed to bind:%s \n", strerror(errno));
+                        exit(EXIT_FAILURE);
+                }
+
+                if (listen(sockfd, 16) < 0) {
+                        fprintf(stderr, "Failed to listen:%s \n", strerror(errno));
+                        exit(EXIT_FAILURE);
+                }
         }
 
-        sun.sun_family = AF_UNIX;
+        if (setgid(dbg_group)) {
-        strcpy(sun.sun_path, ":clr-debug-info");
+                fprintf(stderr, "Unable to drop privileges setgid %s\n", strerror(errno));
-        sun.sun_path[0] = 0; /* anonymous unix socket */
+                exit(EXIT_FAILURE);
-
-        ret = bind(sockfd,
-                   (struct sockaddr *)&sun,
-                   offsetof(struct sockaddr_un, sun_path) + strlen(":clr-debug-info") + 1);
-        if (ret < 0) {
-                printf("Failed to bind:%s \n", strerror(errno));
-                return EXIT_FAILURE;
         }
-
+        if (setgroups(1, &dbg_group)) {
-        if (listen(sockfd, 16) < 0) {
+                fprintf(stderr, "Unable to drop privileges setgroups %s\n", strerror(errno));
-                printf("Failed to listen:%s \n", strerror(errno));
+                exit(EXIT_FAILURE);
-                return EXIT_FAILURE;
+        }
+        if (setuid(dbg_user)) {
+                fprintf(stderr, "Unable to drop privileges setuid  %s\n", strerror(errno));
+                exit(EXIT_FAILURE);
         }
 
         while (1) {
+                fd_set rfds;
+                struct timeval tv;
+                int ret;
                 int clientsock;
                 pthread_t thread;
 
                 malloc_trim(0);
+
+                /* use select() to timeout and exit gracefully */
+                FD_ZERO(&rfds);
+                FD_SET(sockfd, &rfds);
+                tv.tv_sec = TIMEOUT;
+                tv.tv_usec = 0;
+                ret = select(sockfd + 1, &rfds, NULL, NULL, &tv);
+                if (ret == -1) {
+                        perror("select()");
+                        exit(EXIT_FAILURE);
+                } else if (ret == 0) {
+                        break;
+                }
+
+
                 clientsock = accept(sockfd, NULL, NULL);
 
                 /* Too many connections, wait for the next loop/retry */
@@ -438,6 +522,4 @@ int main(__nc_unused__ int argc, __nc_unused__ char **argv)
         if (hash) {
                 nc_hashmap_free(hash);
         }
-
-        close(sockfd);
 }