Get list of service from LDAP only at startup

We dump the list retriueved from LDAP at strstup in a temporary configuration
file and always use that file afterwards.
We check (possibly different) data from LDAP only at (re)start.
This way we always shutdown exactly the services we started even if the list
changed in the meanwhile (we avoid leaving a service running even if it was
removed from LDAP as the admin decided it should not be started in future).

This should also fix a problematic deadlock with systemd when we try to read
the list of service from LDAP at shutdown.

Simo.

3 files changed, 138 insertions, 38 deletions

diff --git a/freeipa.spec.in b/freeipa.spec.in
index 584577057..90f78905a 100644
--- a/freeipa.spec.in
+++ b/freeipa.spec.in
@@ -448,6 +448,7 @@ install -m 0644 init/systemd/ipa.conf.tmpfiles %{buildroot}%{_sysconfdir}/tmpfil
 
 mkdir -p %{buildroot}%{_localstatedir}/run/
 install -d -m 0700 %{buildroot}%{_localstatedir}/run/ipa_memcached/
+install -d -m 0700 %{buildroot}%{_localstatedir}/run/ipa/
 
 mkdir -p %{buildroot}%{_libdir}/krb5/plugins/libkrb5
 touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so
@@ -635,6 +636,7 @@ fi
 %{_sysconfdir}/cron.d/ipa-compliance
 %config(noreplace) %{_sysconfdir}/sysconfig/ipa_memcached
 %dir %attr(0700,apache,apache) %{_localstatedir}/run/ipa_memcached/
+%dir %attr(0700,root,root) %{_localstatedir}/run/ipa/
 %if 0%{?fedora} >= 15
 %config %{_sysconfdir}/tmpfiles.d/ipa.conf
 %endif
diff --git a/init/systemd/ipa.conf.tmpfiles b/init/systemd/ipa.conf.tmpfiles
index e4b679a55..1e7a896ed 100644
--- a/init/systemd/ipa.conf.tmpfiles
+++ b/init/systemd/ipa.conf.tmpfiles
@@ -1 +1,2 @@
 d /var/run/ipa_memcached 0700 apache apache
+d /var/run/ipa 0700 root root
diff --git a/install/tools/ipactl b/install/tools/ipactl
index d4b2c0878..39ccc346c 100755
--- a/install/tools/ipactl
+++ b/install/tools/ipactl
@@ -34,6 +34,7 @@ try:
     import ldap.sasl
     import ldapurl
     import socket
+    import json
 except ImportError:
     print >> sys.stderr, """\
 There was a problem importing one of the required Python modules. The
@@ -44,6 +45,7 @@ error was:
     sys.exit(1)
 
 SASL_EXTERNAL = ldap.sasl.sasl({}, 'EXTERNAL')
+SVC_LIST_FILE = "/var/run/ipa/services.list"
 
 class IpactlError(ScriptError):
     pass
@@ -162,10 +164,32 @@ def get_config(dirsrv):
         for p in entry[1]['ipaConfigString']:
             if p.startswith('startOrder '):
                 order = p.split()[1]
-        svc_list.append((order, name))
+        svc_list.append([order, name])
 
     return svc_list
 
+def get_config_from_file():
+
+    svc_list = []
+
+    try:
+        f = open(SVC_LIST_FILE, 'r')
+        svc_list = json.load(f)
+    except Exception, e:
+        raise IpactlError("Unknown error when retrieving list of services from file: " + str(e))
+
+    return svc_list
+
+def dump_config_to_file(svc_list):
+
+    try:
+        f = open(SVC_LIST_FILE, 'w')
+        json.dump(svc_list, f)
+        f.flush()
+        f.close()
+    except Exception, e:
+        raise IpactlError("Unknown error when saving list of services to file: " + str(e))
+
 def ipa_start(options):
     dirsrv = ipaservices.knownservices.dirsrv
     try:
@@ -194,6 +218,8 @@ def ipa_start(options):
         # no service to stop
         return
 
+    dump_config_to_file(svc_list)
+
     for (order, svc) in sorted(svc_list):
         svc_name = service.SERVICE_LIST[svc][0]
         svchandle = ipaservices.service(svc_name)
@@ -220,11 +246,10 @@ def ipa_stop(options):
     dirsrv = ipaservices.knownservices.dirsrv
     svc_list = []
     try:
-        svc_list = get_config(dirsrv)
+        svc_list = get_config_from_file()
     except Exception, e:
-        # ok if dirsrv died this may fail, so let's try to quickly restart it
-        # and see if we can get anything. If not throw our hands up and just
-        # exit
+        # Issue reading the file ? Let's try to get data from LDAP as a
+        # fallback
         try:
             dirsrv.start(capture_output=False)
             svc_list = get_config(dirsrv)
@@ -259,15 +284,9 @@ def ipa_stop(options):
 
 def ipa_restart(options):
     dirsrv = ipaservices.knownservices.dirsrv
+    new_svc_list = []
     try:
-        print "Restarting Directory Service"
-        dirsrv.restart(capture_output=get_capture_output('dirsrv', options.debug))
-    except Exception, e:
-        raise IpactlError("Failed to restart Directory Service: " + str(e))
-
-    svc_list = []
-    try:
-        svc_list = get_config(dirsrv)
+        new_svc_list = get_config(dirsrv)
     except Exception, e:
         emit_err("Failed to read data from Directory Service: " + str(e))
         emit_err("Shutting down")
@@ -281,33 +300,119 @@ def ipa_restart(options):
         else:
             raise IpactlError()
 
-    if len(svc_list) == 0:
-        # no service to stop
-        return
+    old_svc_list = []
+    try:
+        old_svc_list = get_config_from_file()
+    except Exception, e:
+        emit_err("Failed to get service list from file: " + str(e))
+        # fallback to what's in LDAP
+        old_svc_list = new_svc_list
 
-    for (order, svc) in sorted(svc_list):
-        svc_name = service.SERVICE_LIST[svc][0]
-        svchandle = ipaservices.service(svc_name)
+    if len(new_svc_list) != 0:
+        dump_config_to_file(new_svc_list)
+
+    # match service to start/stop
+    svc_list = []
+    for s in new_svc_list:
+        if s in old_svc_list:
+            svc_list.append(s)
+
+    #remove commons
+    for s in svc_list:
+        if s in old_svc_list:
+            old_svc_list.remove(s)
+    for s in svc_list:
+        if s in new_svc_list:
+            new_svc_list.remove(s)
+
+    if len(old_svc_list) != 0:
+        # we need to definitely stop some services
+        for (order, svc) in sorted(old_svc_list, reverse=True):
+            svc_name = service.SERVICE_LIST[svc][0]
+            svchandle = ipaservices.service(svc_name)
+            try:
+                print "Stopping %s Service" % svc
+                svchandle.stop(capture_output=False)
+            except:
+                emit_err("Failed to stop %s Service" % svc)
+
+    try:
+        print "Restarting Directory Service"
+        dirsrv.restart(capture_output=get_capture_output('dirsrv', options.debug))
+    except Exception, e:
+        emit_err("Failed to restart Directory Service: " + str(e))
+        emit_err("Shutting down")
+        for (order, svc) in sorted(svc_list):
+            svc_name = service.SERVICE_LIST[svc][0]
+            svc_off = ipaservices.service(svc_name)
+            try:
+                svc_off.stop(capture_output=False)
+            except:
+                pass
         try:
-            print "Restarting %s Service" % svc
-            svchandle.restart(capture_output=get_capture_output(svc_name, options.debug))
+            dirsrv.stop(capture_output=False)
         except:
-            emit_err("Failed to restart %s Service" % svc)
-            emit_err("Shutting down")
-            for (order, svc) in sorted(svc_list):
-                svc_name = service.SERVICE_LIST[svc][0]
-                svc_off = ipaservices.service(svc_name)
+            pass
+        raise IpactlError("Aborting ipactl")
+
+    if len(svc_list) != 0:
+        # there are services to restart
+
+        for (order, svc) in sorted(svc_list):
+            svc_name = service.SERVICE_LIST[svc][0]
+            svchandle = ipaservices.service(svc_name)
+            try:
+                print "Restarting %s Service" % svc
+                svchandle.restart(capture_output=get_capture_output(svc_name, options.debug))
+            except:
+                emit_err("Failed to restart %s Service" % svc)
+                emit_err("Shutting down")
+                for (order, svc) in sorted(svc_list):
+                    svc_name = service.SERVICE_LIST[svc][0]
+                    svc_off = ipaservices.service(svc_name)
+                    try:
+                        svc_off.stop(capture_output=False)
+                    except:
+                        pass
                 try:
-                    svc_off.stop(capture_output=False)
+                    dirsrv.stop(capture_output=False)
                 except:
                     pass
+                raise IpactlError("Aborting ipactl")
+
+    if len(new_svc_list) != 0:
+        # we still need to start some services
+        for (order, svc) in sorted(new_svc_list):
+            svc_name = service.SERVICE_LIST[svc][0]
+            svchandle = ipaservices.service(svc_name)
             try:
-                dirsrv.stop(capture_output=False)
+                print "Starting %s Service" % svc
+                svchandle.start(capture_output=get_capture_output(svc_name, options.debug))
             except:
-                pass
-            raise IpactlError("Aborting ipactl")
+                emit_err("Failed to start %s Service" % svc)
+                emit_err("Shutting down")
+                for (order, svc) in sorted(svc_list):
+                    svc_name = service.SERVICE_LIST[svc][0]
+                    svc_off = ipaservices.service(svc_name)
+                    try:
+                        svc_off.stop(capture_output=False)
+                    except:
+                        pass
+                try:
+                    dirsrv.stop(capture_output=False)
+                except:
+                    pass
+                raise IpactlError("Aborting ipactl")
 
 def ipa_status(options):
+
+    try:
+        svc_list = get_config_from_file()
+    except IpactlError, e:
+        raise e
+    except Exception, e:
+        raise IpactlError("Failed to get list of services to probe status: " + str(e))
+
     dirsrv = ipaservices.knownservices.dirsrv
     try:
         if dirsrv.is_running():
@@ -317,14 +422,6 @@ def ipa_status(options):
     except:
         raise IpactlError("Failed to get Directory Service status")
 
-    svc_list = []
-    try:
-        svc_list = get_config(dirsrv)
-    except IpactlError, e:
-        raise e
-    except Exception, e:
-        raise IpactlError("Failed to get list of services to probe status: " + str(e))
-
     if len(svc_list) == 0:
         return