Re: [devel] [PATCH hasher-priv v1 2/3] Add systemd and sysvinit service files

[Alexey Gladkov <legion@altlinux.ru>]

On Thu, Jun 18, 2020 at 01:31:38AM +0300, Mikhail Novosyolov wrote:
> 13.12.2019 14:42, Alex Gladkov пишет:
> > From: Alexey Gladkov <legion@altlinux.org>
> >
> > Signed-off-by: Alexey Gladkov <legion@altlinux.org>
> > ---
> >  hasher-priv/Makefile              |  4 ++
> >  hasher-priv/hasher-privd.service  | 11 ++++
> >  hasher-priv/hasher-privd.sysvinit | 86 +++++++++++++++++++++++++++++++
> >  3 files changed, 101 insertions(+)
> >  create mode 100644 hasher-priv/hasher-privd.service
> >  create mode 100755 hasher-priv/hasher-privd.sysvinit
> >
> > diff --git a/hasher-priv/Makefile b/hasher-priv/Makefile
> > index 82aa385..c73216f 100644
> > --- a/hasher-priv/Makefile
> > +++ b/hasher-priv/Makefile
> > @@ -14,6 +14,8 @@ MAN8PAGES = $(PROJECT).8 hasher-useradd.8
> >  TARGETS = $(PROJECT) hasher-privd hasher-useradd $(HELPERS) $(MAN5PAGES) $(MAN8PAGES)
> >  
> >  sysconfdir = /etc
> > +initdir=$(sysconfdir)/rc.d/init.d
> > +systemd_unitdir=/lib/systemd/system
> >  libexecdir = /usr/lib
> >  sbindir = /usr/sbin
> >  mandir = /usr/share/man
> > @@ -72,6 +74,8 @@ install: all
> >  	$(MKDIR_P) -m750 $(DESTDIR)$(helperdir)
> >  	$(INSTALL) -p -m700 $(PROJECT) $(DESTDIR)$(helperdir)/
> >  	$(INSTALL) -p -m755 $(HELPERS) $(DESTDIR)$(helperdir)/
> > +	$(MKDIR_P) -m755 $(DESTDIR)$(initdir)
> > +	$(INSTALL) -p -m755 hasher-privd.sysvinit $(DESTDIR)$(initdir)/hasher-privd
> >  	$(MKDIR_P) -m755 $(DESTDIR)$(sbindir)
> >  	$(INSTALL) -p -m755 hasher-privd $(DESTDIR)$(sbindir)/
> >  	$(INSTALL) -p -m755 hasher-useradd $(DESTDIR)$(sbindir)/
> > diff --git a/hasher-priv/hasher-privd.service b/hasher-priv/hasher-privd.service
> > new file mode 100644
> > index 0000000..e5ed9ac
> > --- /dev/null
> > +++ b/hasher-priv/hasher-privd.service
> > @@ -0,0 +1,11 @@
> > +[Unit]
> > +Description=A privileged helper for the hasher project
> > +ConditionVirtualization=!container
> А если контейнеру выданы нужные привелегии/capabilities, то почему нельзя? Может, лучше ConditionCapability=?

Я не специалист в systemd. Я не смогу написать ConditionCapability
правильно. Я брал за основу какой-то другой сервис. Если вы считаете, что
это критично, то могу убрать этот сервис вообще.

> > +Documentation=man:hasher-priv(8)
> > +
> > +[Service]
> > +ExecStart=/usr/sbin/hasher-privd
> > +Restart=on-failure
> > +
> > +[Install]
> > +WantedBy=multi-user.target
> > diff --git a/hasher-priv/hasher-privd.sysvinit b/hasher-priv/hasher-privd.sysvinit
> > new file mode 100755
> > index 0000000..914fb53
> > --- /dev/null
> > +++ b/hasher-priv/hasher-privd.sysvinit
> > @@ -0,0 +1,86 @@
> > +#! /bin/sh
> > +
> > +### BEGIN INIT INFO
> > +# Short-Description:    A privileged helper for the hasher project
> > +# Description:          A privileged helper for the hasher project
> > +# Provides:             hasher-priv
> > +# Required-Start:       $remote_fs
> > +# Required-Stop:        $remote_fs
> > +# Default-Start:        2 3 4 5
> > +# Default-Stop:         0 1 6
> > +### END INIT INFO
> > +
> > +WITHOUT_RC_COMPAT=1
> > +
> > +# Source function library.
> > +. /etc/init.d/functions
> > +
> > +NAME=hasher-privd
> > +PIDFILE="/var/run/$NAME.pid"
> > +LOCKFILE="/var/lock/subsys/$NAME"
> > +RETVAL=0
> > +
> > +start()
> > +{
> > +	start_daemon --pidfile "$PIDFILE" --lockfile "$LOCKFILE" -- "$NAME"
> > +	RETVAL=$?
> > +	return $RETVAL
> > +}
> > +
> > +stop()
> > +{
> > +	stop_daemon --pidfile "$PIDFILE" --lockfile "$LOCKFILE" "$NAME"
> > +	RETVAL=$?
> > +	return $RETVAL
> > +}
> > +
> > +restart()
> > +{
> > +	stop
> > +	start
> > +}
> > +
> > +# See how we were called.
> > +case "$1" in
> > +	start)
> > +		start
> > +		;;
> > +	stop)
> > +		stop
> > +		;;
> > +	status)
> > +		status --pidfile "$PIDFILE" "$NAME"
> > +		RETVAL=$?
> > +		;;
> > +	restart)
> > +		restart
> > +		;;
> > +	reload)
> > +		restart
> > +		;;
> > +	condstart)
> > +		if [ ! -e "$LOCKFILE" ]; then
> > +			start
> > +		fi
> > +		;;
> > +	condstop)
> > +		if [ -e "$LOCKFILE" ]; then
> > +			stop
> > +		fi
> > +		;;
> > +	condrestart)
> > +		if [ -e "$LOCKFILE" ]; then
> > +			restart
> > +		fi
> > +		;;
> > +	condreload)
> > +		if [ -e "$LOCKFILE" ]; then
> > +			reload
> > +		fi
> > +		;;
> > +	*)
> > +		msg_usage "${0##*/} {start|stop|status|restart|reload|condstart|condstop|condrestart|condreload}"
> > +		RETVAL=1
> > +esac
> > +
> > +exit $RETVAL
> 

-- 
Rgrds, legion