[cpp-sp] 04/04: Improve shibd init script
Scott Cantor
cantor.2 at osu.edu
Fri Jun 29 12:32:58 EDT 2018
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository cpp-sp.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=676c6f352f1caa0a8adaacc68d452e15485febf7
commit 676c6f352f1caa0a8adaacc68d452e15485febf7
Author: Russ Allbery <rra at debian.org>
AuthorDate: Sun Mar 16 16:20:55 2014 -0700
Improve shibd init script
Convert to use the LSB functions and be more formally correct
about exit status, startup and shutdown checking, and so forth.
Run shibd as the _shibd user and group if they can read the local
private key. Add a status command.
---
configs/shibd-debian.in | 133 +++++++++++++++++++++++++++++++++++++++---------
1 file changed, 110 insertions(+), 23 deletions(-)
diff --git a/configs/shibd-debian.in b/configs/shibd-debian.in
index 5149314..9f7e3bd 100644
--- a/configs/shibd-debian.in
+++ b/configs/shibd-debian.in
@@ -2,17 +2,19 @@
### BEGIN INIT INFO
# Provides: shibd
# Required-Start: $local_fs $remote_fs $network
-# Required-Stop: $local_fs $remote_fs $network
+# Required-Stop: $local_fs $remote_fs
# Default-Start: 2 3 4 5
-# Default-Stop: 0 1 6
+# Default-Stop:
# Short-Description: Shibboleth 3 Service Provider Daemon
# Description: Starts the separate daemon used by the Shibboleth
-# Apache module to manage sessions and to retrieve
-# attributes from Shibboleth Identity Providers.
+# Apache module to manage sessions and to retrieve
+# attributes from Shibboleth Identity Providers.
### END INIT INFO
#
# Written by Quanah Gibson-Mount <quanah at stanford.edu>
# Modified by Lukas Haemmerle <lukas.haemmerle at switch.ch> for Shibboleth 2
+# Updated to use the LSB init functions by Russ Allbery <rra at debian.org>
+#
# Based on the dh-make template written by:
#
# Written by Miquel van Smoorenburg <miquels at cistron.nl>.
@@ -30,6 +32,7 @@ DAEMON=@-PREFIX-@/sbin/$NAME
SCRIPTNAME=/etc/init.d/$NAME
PIDFILE=@-PKGRUNDIR-@/$NAME.pid
DAEMON_OPTS=""
+DAEMON_USER=_shibd
# Read configuration if it is present.
[ -r /etc/default/$NAME ] && . /etc/default/$NAME
@@ -49,38 +52,122 @@ DAEMON_OPTS="$DAEMON_OPTS -w $SHIBD_WAIT"
# Exit if the package is not installed.
[ -x "$DAEMON" ] || exit 0
-# Get the setting of VERBOSE and other rcS variables.
-[ -f /etc/default/rcS ] && . /etc/default/rcS
+# Load the VERBOSE setting and other rcS variables
+. /lib/init/vars.sh
+
+# Define LSB log_* functions.
+. /lib/lsb/init-functions
+
+prepare_environment () {
+ # Ensure @-PKGRUNDIR-@ exists. /var/run may be on a tmpfs file system.
+ [ -d '@-PKGRUNDIR-@' ] || mkdir -p '@-PKGRUNDIR-@'
+
+ # If $DAEMON_USER is set, try to run shibd as that user. However,
+ # versions of the Debian package prior to 2.3+dfsg-1 ran shibd as root,
+ # and the local administrator may not have made the server's private key
+ # readable by $DAEMON_USER. We therefore test first by running shibd -t
+ # and looking for the error code indicating that the private key could not
+ # be read. If we get that error, we fall back on running shibd as root.
+ if [ -n "$DAEMON_USER" ]; then
+ DIAG=$(su -s $DAEMON $DAEMON_USER -- -t $DAEMON_OPTS 2>/dev/null)
+ if [ $? = 0 ] ; then
+ # openssl errstr 200100D (hex for 33558541) says:
+ # error:0200100D:system library:fopen:Permission denied
+ ERROR='ERROR OpenSSL : error code: 33558541 '
+ if echo "$DIAG" | fgrep -q "$ERROR" ; then
+ unset DAEMON_USER
+ log_warning_msg "$NAME: file permissions require running as" \
+ "root"
+ else
+ chown -Rh "$DAEMON_USER" '@-PKGRUNDIR-@' '@-PKGLOGDIR-@'
+ fi
+ else
+ unset DAEMON_USER
+ log_warning_msg "$NAME: unable to run config check as user" \
+ "$DAEMON_USER"
+ fi
+ unset DIAG
+ fi
+}
+
+# Start shibd.
+do_start () {
+ # Return
+ # 0 if daemon has been started
+ # 1 if daemon was already running
+ # 2 if daemon could not be started
+ start-stop-daemon --start --quiet ${DAEMON_USER:+--chuid $DAEMON_USER} \
+ --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
+ || return 1
+ start-stop-daemon --start --quiet ${DAEMON_USER:+--chuid $DAEMON_USER} \
+ --pidfile $PIDFILE --exec $DAEMON -- $DAEMON_OPTS \
+ || return 2
+}
+
+# Stop shibd.
+do_stop () {
+ # Return
+ # 0 if daemon has been stopped
+ # 1 if daemon was already stopped
+ # 2 if daemon could not be stopped
+ # other if a failure occurred
+ start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 \
+ --pidfile $PIDFILE --name $NAME
+ RETVAL="$?"
+ return "$RETVAL"
+}
case "$1" in
start)
+ prepare_environment
+
# Don't start shibd if NO_START is set.
if [ "$NO_START" = 1 ] ; then
- echo "Not starting $DESC (see /etc/default/$NAME)"
+ if [ "$VERBOSE" != no ] ; then
+ echo "Not starting $DESC (see /etc/default/$NAME)"
+ fi
exit 0
fi
- echo -n "Starting $DESC: "
- start-stop-daemon --start --quiet \
- --pidfile $PIDFILE --exec $DAEMON -- $DAEMON_OPTS
- echo "$NAME."
+ [ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
+ do_start
+ case "$?" in
+ 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+ 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+ esac
;;
stop)
- echo -n "Stopping $DESC: "
- start-stop-daemon --stop --quiet --pidfile $PIDFILE \
- --exec $DAEMON
- echo "$NAME."
+ [ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
+ do_stop
+ case "$?" in
+ 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+ 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+ esac
;;
restart|force-reload)
- echo -n "Restarting $DESC: "
- start-stop-daemon --stop --quiet --pidfile $PIDFILE \
- --exec $DAEMON
- sleep 1
- start-stop-daemon --start --quiet \
- --pidfile $PIDFILE --exec $DAEMON -- $DAEMON_OPTS
- echo "$NAME."
+ prepare_environment
+
+ log_daemon_msg "Restarting $DESC" "$NAME"
+ do_stop
+ case "$?" in
+ 0|1)
+ do_start
+ case "$?" in
+ 0) log_end_msg 0 ;;
+ 1) log_end_msg 1 ;; # Old process is still running
+ *) log_end_msg 1 ;; # Failed to start
+ esac
+ ;;
+ *)
+ # Failed to stop
+ log_end_msg 1
+ ;;
+ esac
+ ;;
+status)
+ status_of_proc -p "$PIDFILE" "$DAEMON" "$NAME" && exit 0 || exit $?
;;
*)
- echo "Usage: $SCRIPTNAME {start|stop|restart|force-reload}" >&2
+ echo "Usage: $SCRIPTNAME {start|stop|restart|force-reload|status}" >&2
exit 1
;;
esac
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list