Merge pull request #1182 from dbungert/log-visibility

Log and config file generation as 0640 root:adm

subiquity/models/subiquity.py

@@ -315,10 +315,10 @@ def _cloud_init_files(self):
         return files
 
     def configure_cloud_init(self):
-        for path, content, mode in self._cloud_init_files():
+        for path, content, cmode in self._cloud_init_files():
             path = os.path.join(self.target, path)
             os.makedirs(os.path.dirname(path), exist_ok=True)
-            write_file(path, content, mode, omode="w")
+            write_file(path, content, cmode=cmode)
 
     def _media_info(self):
         if os.path.exists('/cdrom/.disk/info'):

subiquity/server/apt.py

@@ -13,18 +13,15 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import datetime
 import functools
 import logging
 import os
 import shutil
 import tempfile
 
 from curtin.config import merge_config
-from curtin.util import write_file
-
-import yaml
 
+from subiquitycore.file_util import write_file, generate_config_yaml
 from subiquitycore.lsb_release import lsb_release
 from subiquitycore.utils import arun_command
 
@@ -180,11 +177,7 @@ async def apply_apt_config(self, context):
 
         config_location = os.path.join(
             self.app.root, 'var/log/installer/subiquity-curtin-apt.conf')
-
-        datestr = '# Autogenerated by Subiquity: {} UTC\n'.format(
-            str(datetime.datetime.utcnow()))
-        write_file(config_location, datestr + yaml.dump(self.apt_config()))
-
+        generate_config_yaml(config_location, self.apt_config())
         self.app.note_data_for_apport("CurtinAptConfig", config_location)
 
         await run_curtin_command(

subiquity/server/controllers/install.py

@@ -13,7 +13,6 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import datetime
 import logging
 import os
 import re
@@ -23,14 +22,14 @@
     ERROR_TARFILE,
     INSTALL_LOG,
     )
-from curtin.util import write_file
 
 import yaml
 
 from subiquitycore.async_helpers import (
     run_in_thread,
     )
 from subiquitycore.context import with_context
+from subiquitycore.file_util import write_file, generate_config_yaml
 
 from subiquity.common.errorreport import ErrorReportKind
 from subiquity.common.types import (
@@ -107,11 +106,7 @@ def write_config(self):
             log_location = self.app.opts.output_base + INSTALL_LOG
         os.makedirs(os.path.dirname(config_location), exist_ok=True)
         os.makedirs(os.path.dirname(log_location), exist_ok=True)
-        with open(config_location, 'w') as conf:
-            datestr = '# Autogenerated by Subiquity: {} UTC\n'.format(
-                str(datetime.datetime.utcnow()))
-            conf.write(datestr)
-            conf.write(yaml.dump(config))
+        generate_config_yaml(config_location, config)
         self.app.note_file_for_apport("CurtinConfig", config_location)
         self.app.note_file_for_apport("CurtinErrors", ERROR_TARFILE)
         self.app.note_file_for_apport("CurtinLog", log_location)
@@ -190,7 +185,7 @@ async def postinstall(self, *, context):
             self.app.root, 'var/log/installer/autoinstall-user-data')
         autoinstall_config = "#cloud-config\n" + yaml.dump(
             {"autoinstall": self.app.make_autoinstall()})
-        write_file(autoinstall_path, autoinstall_config, mode=0o600)
+        write_file(autoinstall_path, autoinstall_config)
         await self.configure_cloud_init(context=context)
         packages = await self.get_target_packages(context=context)
         for package in packages:

subiquity/server/controllers/shutdown.py

@@ -19,6 +19,7 @@
 import platform
 import subprocess
 
+from subiquitycore.file_util import open_perms
 from subiquitycore.context import with_context
 from subiquitycore.utils import arun_command, run_command
 
@@ -99,7 +100,7 @@ async def copy_logs_to_target(self, context):
                 ['cp', '-aT', '/var/log/installer', target_logs])
         journal_txt = os.path.join(target_logs, 'installer-journal.txt')
         try:
-            with open(journal_txt, 'w') as output:
+            with open_perms(journal_txt) as output:
                 await arun_command(
                     ['journalctl', '-b'],
                     stdout=output, stderr=subprocess.STDOUT)

subiquity/server/server.py

@@ -23,7 +23,7 @@
 
 from aiohttp import web
 
-from cloudinit import atomic_helper, safeyaml, stages
+from cloudinit import safeyaml, stages
 from cloudinit.config.cc_set_passwords import rand_user_password
 from cloudinit.distros import ug_util
 
@@ -36,6 +36,7 @@
 from subiquitycore.async_helpers import run_in_thread
 from subiquitycore.context import with_context
 from subiquitycore.core import Application
+from subiquitycore.file_util import write_file
 from subiquitycore.prober import Prober
 from subiquitycore.ssh import (
     host_key_fingerprints,
@@ -379,8 +380,7 @@ def state(self):
 
     def update_state(self, state):
         self._state = state
-        atomic_helper.write_file(
-            self.state_path("server-state"), state.name, omode='w')
+        write_file(self.state_path("server-state"), state.name)
         self.state_event.set()
         self.state_event.clear()
 
@@ -525,11 +525,8 @@ async def wait_for_cloudinit(self):
                 autoinstall_path = '/autoinstall.yaml'
                 if 'autoinstall' in self.cloud.cfg:
                     if not os.path.exists(autoinstall_path):
-                        atomic_helper.write_file(
-                            autoinstall_path,
-                            safeyaml.dumps(
-                                self.cloud.cfg['autoinstall']).encode('utf-8'),
-                            mode=0o600)
+                        cfg = self.cloud.cfg['autoinstall']
+                        write_file(autoinstall_path, safeyaml.dumps(cfg))
                 if os.path.exists(autoinstall_path):
                     self.opts.autoinstall = autoinstall_path
         else:

subiquitycore/controllers/network.py

@@ -245,10 +245,7 @@ def _write_config(self):
                 continue
             os.rename(p, p + ".dist-" + self.opts.project)
 
-        write_file(
-            self.netplan_path,
-            self.model.stringify_config(config),
-            omode="w")
+        write_file(self.netplan_path, self.model.stringify_config(config))
 
         self.parse_netplan_configs()
 

subiquitycore/file_util.py

@@ -1,32 +1,59 @@
+# Copyright 2018-2022 Canonical, Ltd.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import contextlib
+import datetime
+import grp
 import os
-import stat
 import tempfile
 
-_DEF_PERMS = 0o644
+import yaml
+
+_DEF_PERMS = 0o640
+_DEF_GROUP = 'adm'
 
 
-def write_file(filename, content, mode=None, omode="wb", copy_mode=False):
-    """Atomically write filename.
-    open filename in mode 'omode', write content, chmod to 'mode'.
-    """
-    if mode is None:
-        mode = _DEF_PERMS
-    if copy_mode:
-        try:
-            file_stat = os.stat(filename)
-            mode = stat.S_IMODE(file_stat.st_mode)
-        except OSError:
-            pass
+@contextlib.contextmanager
+def open_perms(filename, *, cmode=None):
+    if cmode is None:
+        cmode = _DEF_PERMS
 
     tf = None
     try:
-        tf = tempfile.NamedTemporaryFile(dir=os.path.dirname(filename),
-                                         delete=False, mode=omode)
-        tf.write(content)
+        dirname = os.path.dirname(filename)
+        os.makedirs(dirname, exist_ok=True)
+        tf = tempfile.NamedTemporaryFile(dir=dirname, delete=False, mode='w')
+        yield tf
         tf.close()
-        os.chmod(tf.name, mode)
+        os.chmod(tf.name, cmode)
+        if os.getuid() == 0:
+            os.chown(tf.name, -1, grp.getgrnam(_DEF_GROUP).gr_gid)
         os.rename(tf.name, filename)
     except OSError as e:
         if tf is not None:
             os.unlink(tf.name)
         raise e
+
+
+def write_file(filename, content, **kwargs):
+    with open_perms(filename, **kwargs) as tf:
+        tf.write(content)
+
+
+def generate_config_yaml(filename, content, **kwargs):
+    with open_perms(filename, **kwargs) as tf:
+        now = datetime.datetime.utcnow()
+        tf.write(f'# Autogenerated by Subiquity: {now} UTC\n')
+        tf.write(yaml.dump(content))

subiquitycore/log.py

@@ -17,12 +17,14 @@
 import logging
 import os
 
+from subiquitycore.file_util import _DEF_PERMS, _DEF_GROUP
+
 
 def setup_logger(dir, base='subiquity'):
     os.makedirs(dir, exist_ok=True)
     if os.getuid() == 0:
-        os.chmod(dir, 0o775)
-        os.chown(dir, -1, grp.getgrnam('adm').gr_gid)
+        os.chmod(dir, 0o750)
+        os.chown(dir, -1, grp.getgrnam(_DEF_GROUP).gr_gid)
 
     logger = logging.getLogger("")
     logger.setLevel(logging.DEBUG)
@@ -33,6 +35,9 @@ def setup_logger(dir, base='subiquity'):
         nopid_file = os.path.join(dir, "{}-{}.log".format(base, level))
         logfile = "{}.{}".format(nopid_file, os.getpid())
         handler = logging.FileHandler(logfile)
+        os.chmod(logfile, _DEF_PERMS)
+        if os.getuid() == 0:
+            os.chown(logfile, -1, grp.getgrnam(_DEF_GROUP).gr_gid)
         # os.symlink cannot replace an existing file or symlink so create
         # it and then rename it over.
         tmplink = logfile + ".link"