X-Git-Url: http://git.archive.openwrt.org/?a=blobdiff_plain;f=service%2Finstance.c;h=917b003b3907c5e06014129db9e9ca95bdf17100;hb=dfb68f8556df63878add145ad9c656381bc20656;hp=d7d1f82eac318127cc3d01a54f68e77edc9bd5ea;hpb=64970552b42b33cc22220e0943671b597d9243f6;p=project%2Fprocd.git diff --git a/service/instance.c b/service/instance.c index d7d1f82..917b003 100644 --- a/service/instance.c +++ b/service/instance.c @@ -17,6 +17,7 @@ #include #include #include +#include #include #include #include @@ -54,6 +55,8 @@ enum { INSTANCE_ATTR_TRACE, INSTANCE_ATTR_SECCOMP, INSTANCE_ATTR_PIDFILE, + INSTANCE_ATTR_RELOADSIG, + INSTANCE_ATTR_TERMTIMEOUT, __INSTANCE_ATTR_MAX }; @@ -77,6 +80,8 @@ static const struct blobmsg_policy instance_attr[__INSTANCE_ATTR_MAX] = { [INSTANCE_ATTR_TRACE] = { "trace", BLOBMSG_TYPE_BOOL }, [INSTANCE_ATTR_SECCOMP] = { "seccomp", BLOBMSG_TYPE_STRING }, [INSTANCE_ATTR_PIDFILE] = { "pidfile", BLOBMSG_TYPE_STRING }, + [INSTANCE_ATTR_RELOADSIG] = { "reload_signal", BLOBMSG_TYPE_INT32 }, + [INSTANCE_ATTR_TERMTIMEOUT] = { "term_timeout", BLOBMSG_TYPE_INT32 }, }; enum { @@ -137,8 +142,6 @@ static const struct rlimit_name rlimit_names[] = { { NULL, 0 } }; -static char trace[] = "/sbin/utrace"; - static void closefd(int fd) { if (fd > STDERR_FILENO) @@ -239,8 +242,7 @@ instance_removepid(struct service_instance *in) { if (!in->pidfile) return 0; if (unlink(in->pidfile)) { - ERROR("Failed to removed pidfile: %s: %d - %s\n", - in->pidfile, errno, strerror(errno)); + ERROR("Failed to removed pidfile: %s: %m\n", in->pidfile); return 1; } return 0; @@ -256,18 +258,16 @@ instance_writepid(struct service_instance *in) } _pidfile = fopen(in->pidfile, "w"); if (_pidfile == NULL) { - ERROR("failed to open pidfile for writing: %s: %d (%s)", - in->pidfile, errno, strerror(errno)); + ERROR("failed to open pidfile for writing: %s: %m", in->pidfile); return 1; } if (fprintf(_pidfile, "%d\n", in->proc.pid) < 0) { - ERROR("failed to write pidfile: %s: %d (%s)", - in->pidfile, errno, strerror(errno)); + ERROR("failed to write pidfile: %s: %m", in->pidfile); + fclose(_pidfile); return 2; } if (fclose(_pidfile)) { - ERROR("failed to close pidfile: %s: %d (%s)", - in->pidfile, errno, strerror(errno)); + ERROR("failed to close pidfile: %s: %m", in->pidfile); return 3; } @@ -280,7 +280,6 @@ instance_run(struct service_instance *in, int _stdout, int _stderr) struct blobmsg_list_node *var; struct blob_attr *cur; char **argv; - char *ld_preload; int argc = 1; /* NULL terminated */ int rem, _stdin; bool seccomp = !in->trace && !in->has_jail && in->seccomp; @@ -298,23 +297,27 @@ instance_run(struct service_instance *in, int _stdout, int _stderr) if (seccomp) setenv("SECCOMP_FILE", in->seccomp, 1); - if ((seccomp || setlbf) && asprintf(&ld_preload, "LD_PRELOAD=%s%s%s", - seccomp ? "/lib/libpreload-seccomp.so" : "", - seccomp && setlbf ? ":" : "", - setlbf ? "/lib/libsetlbf.so" : "") > 0) - putenv(ld_preload); + if (setlbf) + setenv("LD_PRELOAD", "/lib/libsetlbf.so", 1); blobmsg_list_for_each(&in->limits, var) instance_limits(blobmsg_name(var->data), blobmsg_data(var->data)); - if (in->trace) + if (in->trace || seccomp) argc += 1; argv = alloca(sizeof(char *) * (argc + in->jail.argc)); argc = 0; +#ifdef SECCOMP_SUPPORT if (in->trace) - argv[argc++] = trace; + argv[argc++] = "/sbin/utrace"; + else if (seccomp) + argv[argc++] = "/sbin/seccomp-trace"; +#else + if (in->trace || seccomp) + ULOG_WARN("Seccomp support for %s::%s not available\n", in->srv->name, in->name); +#endif if (in->has_jail) argc = jail_run(in, argv); @@ -345,12 +348,16 @@ instance_run(struct service_instance *in, int _stdout, int _stderr) closefd(_stderr); } + if (in->user && in->gid && initgroups(in->user, in->gid)) { + ERROR("failed to initgroups() for user %s: %m\n", in->user); + exit(127); + } if (in->gid && setgid(in->gid)) { - ERROR("failed to set group id %d: %d (%s)\n", in->gid, errno, strerror(errno)); + ERROR("failed to set group id %d: %m\n", in->gid); exit(127); } if (in->uid && setuid(in->uid)) { - ERROR("failed to set user id %d: %d (%s)\n", in->uid, errno, strerror(errno)); + ERROR("failed to set user id %d: %m\n", in->uid); exit(127); } @@ -386,26 +393,34 @@ instance_start(struct service_instance *in) return; } - if (in->proc.pending) + if (!in->command) { + LOG("Not starting instance %s::%s, command not set\n", in->srv->name, in->name); + return; + } + + if (in->proc.pending) { + if (in->halt) + in->restart = true; return; + } instance_free_stdio(in); if (in->_stdout.fd.fd > -2) { if (pipe(opipe)) { - ULOG_WARN("pipe() failed: %d (%s)\n", errno, strerror(errno)); + ULOG_WARN("pipe() failed: %m\n"); opipe[0] = opipe[1] = -1; } } if (in->_stderr.fd.fd > -2) { if (pipe(epipe)) { - ULOG_WARN("pipe() failed: %d (%s)\n", errno, strerror(errno)); + ULOG_WARN("pipe() failed: %m\n"); epipe[0] = epipe[1] = -1; } } in->restart = false; - in->halt = !in->respawn; + in->halt = false; if (!in->valid) return; @@ -431,11 +446,13 @@ instance_start(struct service_instance *in) if (opipe[0] > -1) { ustream_fd_init(&in->_stdout, opipe[0]); closefd(opipe[1]); + fcntl(opipe[0], F_SETFD, FD_CLOEXEC); } if (epipe[0] > -1) { ustream_fd_init(&in->_stderr, epipe[0]); closefd(epipe[1]); + fcntl(epipe[0], F_SETFD, FD_CLOEXEC); } service_event("instance.start", in->srv->name, in->name); @@ -491,7 +508,11 @@ instance_timeout(struct uloop_timeout *t) in = container_of(t, struct service_instance, timeout); - if (!in->halt && (in->restart || in->respawn)) + if (in->halt) { + LOG("Instance %s::%s pid %d not stopped on SIGTERM, sending SIGKILL instead\n", + in->srv->name, in->name, in->proc.pid); + kill(in->proc.pid, SIGKILL); + } else if (in->restart || in->respawn) instance_start(in); } @@ -508,12 +529,21 @@ instance_exit(struct uloop_process *p, int ret) runtime = tp.tv_sec - in->start.tv_sec; DEBUG(2, "Instance %s::%s exit with error code %d after %ld seconds\n", in->srv->name, in->name, ret, runtime); - if (upgrade_running) - return; uloop_timeout_cancel(&in->timeout); + service_event("instance.stop", in->srv->name, in->name); + if (in->halt) { instance_removepid(in); + if (in->restart) + instance_start(in); + else { + struct service *s = in->srv; + + avl_delete(&s->instances.avl, &in->node.avl); + instance_free(in); + service_stopped(s); + } } else if (in->restart) { instance_start(in); } else if (in->respawn) { @@ -526,22 +556,23 @@ instance_exit(struct uloop_process *p, int ret) in->srv->name, in->name, in->respawn_count, runtime); in->restart = in->respawn = 0; in->halt = 1; + service_event("instance.fail", in->srv->name, in->name); } else { + service_event("instance.respawn", in->srv->name, in->name); uloop_timeout_set(&in->timeout, in->respawn_timeout * 1000); } } - service_event("instance.stop", in->srv->name, in->name); } void -instance_stop(struct service_instance *in) +instance_stop(struct service_instance *in, bool halt) { if (!in->proc.pending) return; - in->halt = true; + in->halt = halt; in->restart = in->respawn = false; kill(in->proc.pid, SIGTERM); - instance_removepid(in); + uloop_timeout_set(&in->timeout, in->term_timeout * 1000); } static void @@ -549,10 +580,21 @@ instance_restart(struct service_instance *in) { if (!in->proc.pending) return; - in->halt = false; + + if (in->reload_signal) { + kill(in->proc.pid, in->reload_signal); + return; + } + + in->halt = true; in->restart = true; kill(in->proc.pid, SIGTERM); - instance_removepid(in); + uloop_timeout_set(&in->timeout, in->term_timeout * 1000); +} + +static bool string_changed(const char *a, const char *b) +{ + return !((!a && !b) || (a && b && !strcmp(a, b))); } static bool @@ -567,9 +609,6 @@ instance_config_changed(struct service_instance *in, struct service_instance *in if (!blobmsg_list_equal(&in->env, &in_new->env)) return true; - if (!blobmsg_list_equal(&in->data, &in_new->data)) - return true; - if (!blobmsg_list_equal(&in->netdev, &in_new->netdev)) return true; @@ -579,20 +618,23 @@ instance_config_changed(struct service_instance *in, struct service_instance *in if (in->nice != in_new->nice) return true; + if (string_changed(in->user, in_new->user)) + return true; + if (in->uid != in_new->uid) return true; if (in->gid != in_new->gid) return true; - if (in->pidfile && in_new->pidfile) - if (strcmp(in->pidfile, in_new->pidfile)) - return true; - - if (in->pidfile && !in_new->pidfile) + if (string_changed(in->pidfile, in_new->pidfile)) return true; - if (!in->pidfile && in_new->pidfile) + if (in->respawn_retry != in_new->respawn_retry) + return true; + if (in->respawn_threshold != in_new->respawn_threshold) + return true; + if (in->respawn_timeout != in_new->respawn_timeout) return true; if (!blobmsg_list_equal(&in->limits, &in_new->limits)) @@ -752,32 +794,45 @@ instance_jail_parse(struct service_instance *in, struct blob_attr *attr) } static bool -instance_config_parse(struct service_instance *in) +instance_config_parse_command(struct service_instance *in, struct blob_attr **tb) { - struct blob_attr *tb[__INSTANCE_ATTR_MAX]; struct blob_attr *cur, *cur2; - int argc = 0; + bool ret = false; int rem; - blobmsg_parse(instance_attr, __INSTANCE_ATTR_MAX, tb, - blobmsg_data(in->config), blobmsg_data_len(in->config)); - cur = tb[INSTANCE_ATTR_COMMAND]; - if (!cur) - return false; + if (!cur) { + in->command = NULL; + return true; + } if (!blobmsg_check_attr_list(cur, BLOBMSG_TYPE_STRING)) return false; blobmsg_for_each_attr(cur2, cur, rem) { - argc++; + ret = true; break; } - if (!argc) - return false; in->command = cur; + return ret; +} + +static bool +instance_config_parse(struct service_instance *in) +{ + struct blob_attr *tb[__INSTANCE_ATTR_MAX]; + struct blob_attr *cur, *cur2; + int rem; + blobmsg_parse(instance_attr, __INSTANCE_ATTR_MAX, tb, + blobmsg_data(in->config), blobmsg_data_len(in->config)); + + if (!instance_config_parse_command(in, tb)) + return false; + + if (tb[INSTANCE_ATTR_TERMTIMEOUT]) + in->term_timeout = blobmsg_get_u32(tb[INSTANCE_ATTR_TERMTIMEOUT]); if (tb[INSTANCE_ATTR_RESPAWN]) { int i = 0; uint32_t vals[3] = { 3600, 5, 5}; @@ -815,8 +870,10 @@ instance_config_parse(struct service_instance *in) } if (tb[INSTANCE_ATTR_USER]) { - struct passwd *p = getpwnam(blobmsg_get_string(tb[INSTANCE_ATTR_USER])); + const char *user = blobmsg_get_string(tb[INSTANCE_ATTR_USER]); + struct passwd *p = getpwnam(user); if (p) { + in->user = strdup(user); in->uid = p->pw_uid; in->gid = p->pw_gid; } @@ -828,15 +885,8 @@ instance_config_parse(struct service_instance *in) if (tb[INSTANCE_ATTR_NO_NEW_PRIVS]) in->no_new_privs = blobmsg_get_bool(tb[INSTANCE_ATTR_NO_NEW_PRIVS]); - if (!in->trace && tb[INSTANCE_ATTR_SECCOMP]) { - char *seccomp = blobmsg_get_string(tb[INSTANCE_ATTR_SECCOMP]); - struct stat s; - - if (stat(seccomp, &s)) - ERROR("%s: not starting seccomp as %s is missing\n", in->name, seccomp); - else - in->seccomp = seccomp; - } + if (!in->trace && tb[INSTANCE_ATTR_SECCOMP]) + in->seccomp = blobmsg_get_string(tb[INSTANCE_ATTR_SECCOMP]); if (tb[INSTANCE_ATTR_PIDFILE]) { char *pidfile = blobmsg_get_string(tb[INSTANCE_ATTR_PIDFILE]); @@ -844,6 +894,9 @@ instance_config_parse(struct service_instance *in) in->pidfile = pidfile; } + if (tb[INSTANCE_ATTR_RELOADSIG]) + in->reload_signal = blobmsg_get_u32(tb[INSTANCE_ATTR_RELOADSIG]); + if (!in->trace && tb[INSTANCE_ATTR_JAIL]) in->has_jail = instance_jail_parse(in, tb[INSTANCE_ATTR_JAIL]); @@ -899,7 +952,11 @@ instance_config_move(struct service_instance *in, struct service_instance *in_sr in->trigger = in_src->trigger; in->command = in_src->command; in->pidfile = in_src->pidfile; + in->respawn_retry = in_src->respawn_retry; + in->respawn_threshold = in_src->respawn_threshold; + in->respawn_timeout = in_src->respawn_timeout; in->name = in_src->name; + in->trace = in_src->trace; in->node.avl.key = in_src->node.avl.key; free(in->config); @@ -907,25 +964,22 @@ instance_config_move(struct service_instance *in, struct service_instance *in_sr in_src->config = NULL; } -bool +void instance_update(struct service_instance *in, struct service_instance *in_new) { bool changed = instance_config_changed(in, in_new); bool running = in->proc.pending; + bool stopping = in->halt; - if (!changed && running) - return false; - - if (!running) { - if (changed) - instance_config_move(in, in_new); + if (!running || stopping) { + instance_config_move(in, in_new); instance_start(in); } else { - instance_restart(in); + if (changed) + instance_restart(in); instance_config_move(in, in_new); /* restart happens in the child callback handler */ } - return true; } void @@ -938,6 +992,7 @@ instance_free(struct service_instance *in) watch_del(in); instance_config_cleanup(in); free(in->config); + free(in->user); free(in); } @@ -950,6 +1005,7 @@ instance_init(struct service_instance *in, struct service *s, struct blob_attr * in->config = config; in->timeout.cb = instance_timeout; in->proc.cb = instance_exit; + in->term_timeout = 5; in->_stdout.fd.fd = -2; in->_stdout.stream.string_data = true; @@ -980,7 +1036,9 @@ void instance_dump(struct blob_buf *b, struct service_instance *in, int verbose) blobmsg_add_u8(b, "running", in->proc.pending); if (in->proc.pending) blobmsg_add_u32(b, "pid", in->proc.pid); - blobmsg_add_blob(b, in->command); + if (in->command) + blobmsg_add_blob(b, in->command); + blobmsg_add_u32(b, "term_timeout", in->term_timeout); if (!avl_is_empty(&in->errors.avl)) { struct blobmsg_list_node *var; @@ -1014,6 +1072,9 @@ void instance_dump(struct blob_buf *b, struct service_instance *in, int verbose) blobmsg_close_table(b, e); } + if (in->reload_signal) + blobmsg_add_u32(b, "reload_signal", in->reload_signal); + if (in->respawn) { void *r = blobmsg_open_table(b, "respawn"); blobmsg_add_u32(b, "threshold", in->respawn_threshold);