tyler/proxmox-backup
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

use new atomic_open_or_create_file

Browse Source 
Factor out open_backup_lockfile() method to acquire locks owned by
user backup with permission 0660.

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This commit is contained in:
Dietmar Maurer
2021-07-20 13:51:54 +02:00
committed by Thomas Lamprecht
parent a00888e93f
commit 7526d86419
29 changed files with 161 additions and 270 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/config/acme/plugin.rs
View File

@ -12,6 +12,7 @@ use proxmox::api::{
use proxmox::tools::{fs::replace_file, fs::CreateOptions};
use crate::api2::types::PROXMOX_SAFE_ID_FORMAT;
use crate::backup::{open_backup_lockfile, BackupLockGuard};
pub const PLUGIN_ID_SCHEMA: Schema = StringSchema::new("ACME Challenge Plugin ID.")
.format(&PROXMOX_SAFE_ID_FORMAT)
@ -142,11 +143,10 @@ fn init() -> SectionConfig {
const ACME_PLUGIN_CFG_FILENAME: &str = pbs_buildcfg::configdir!("/acme/plugins.cfg");
const ACME_PLUGIN_CFG_LOCKFILE: &str = pbs_buildcfg::configdir!("/acme/.plugins.lck");
const LOCK_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(10);
pub fn lock() -> Result<std::fs::File, Error> {
pub fn lock() -> Result<BackupLockGuard, Error> {
super::make_acme_dir()?;
proxmox::tools::fs::open_file_locked(ACME_PLUGIN_CFG_LOCKFILE, LOCK_TIMEOUT, true)
open_backup_lockfile(ACME_PLUGIN_CFG_LOCKFILE, None, true)
}
pub fn config() -> Result<(PluginData, [u8; 32]), Error> {

6
src/config/datastore.rs
View File

@ -14,12 +14,12 @@ use proxmox::api::{
};
use proxmox::tools::fs::{
open_file_locked,
replace_file,
CreateOptions,
};
use crate::api2::types::*;
use crate::backup::{open_backup_lockfile, BackupLockGuard};
lazy_static! {
pub static ref CONFIG: SectionConfig = init();
@ -138,8 +138,8 @@ pub const DATASTORE_CFG_FILENAME: &str = "/etc/proxmox-backup/datastore.cfg";
pub const DATASTORE_CFG_LOCKFILE: &str = "/etc/proxmox-backup/.datastore.lck";
/// Get exclusive lock
pub fn lock_config() -> Result<std::fs::File, Error> {
open_file_locked(DATASTORE_CFG_LOCKFILE, std::time::Duration::new(10, 0), true)
pub fn lock_config() -> Result<BackupLockGuard, Error> {
open_backup_lockfile(DATASTORE_CFG_LOCKFILE, None, true)
}
pub fn config() -> Result<(SectionConfigData, [u8;32]), Error> {

6
src/config/domains.rs
View File

@ -14,12 +14,12 @@ use proxmox::api::{
};
use proxmox::tools::fs::{
open_file_locked,
replace_file,
CreateOptions,
};
use crate::api2::types::*;
use crate::backup::{open_backup_lockfile, BackupLockGuard};
lazy_static! {
pub static ref CONFIG: SectionConfig = init();
@ -110,8 +110,8 @@ pub const DOMAINS_CFG_FILENAME: &str = "/etc/proxmox-backup/domains.cfg";
pub const DOMAINS_CFG_LOCKFILE: &str = "/etc/proxmox-backup/.domains.lck";
/// Get exclusive lock
pub fn lock_config() -> Result<std::fs::File, Error> {
open_file_locked(DOMAINS_CFG_LOCKFILE, std::time::Duration::new(10, 0), true)
pub fn lock_config() -> Result<BackupLockGuard, Error> {
open_backup_lockfile(DOMAINS_CFG_LOCKFILE, None, true)
}
pub fn config() -> Result<(SectionConfigData, [u8;32]), Error> {

6
src/config/drive.rs
View File

@ -26,13 +26,13 @@ use proxmox::{
},
},
tools::fs::{
open_file_locked,
replace_file,
CreateOptions,
},
};
use crate::{
backup::{open_backup_lockfile, BackupLockGuard},
api2::types::{
DRIVE_NAME_SCHEMA,
VirtualTapeDrive,
@ -79,8 +79,8 @@ pub const DRIVE_CFG_FILENAME: &str = "/etc/proxmox-backup/tape.cfg";
pub const DRIVE_CFG_LOCKFILE: &str = "/etc/proxmox-backup/.tape.lck";
/// Get exclusive lock
pub fn lock() -> Result<std::fs::File, Error> {
open_file_locked(DRIVE_CFG_LOCKFILE, std::time::Duration::new(10, 0), true)
pub fn lock() -> Result<BackupLockGuard, Error> {
open_backup_lockfile(DRIVE_CFG_LOCKFILE, None, true)
}
/// Read and parse the configuration file

6
src/config/media_pool.rs
View File

@ -21,13 +21,13 @@ use proxmox::{
}
},
tools::fs::{
open_file_locked,
replace_file,
CreateOptions,
},
};
use crate::{
backup::{open_backup_lockfile, BackupLockGuard},
api2::types::{
MEDIA_POOL_NAME_SCHEMA,
MediaPoolConfig,
@ -59,8 +59,8 @@ pub const MEDIA_POOL_CFG_LOCKFILE: &str = "/etc/proxmox-backup/.media-pool.lck";
/// Get exclusive lock
pub fn lock() -> Result<std::fs::File, Error> {
open_file_locked(MEDIA_POOL_CFG_LOCKFILE, std::time::Duration::new(10, 0), true)
pub fn lock() -> Result<BackupLockGuard, Error> {
open_backup_lockfile(MEDIA_POOL_CFG_LOCKFILE, None, true)
}
/// Read and parse the configuration file

8
src/config/node.rs
View File

@ -1,6 +1,4 @@
use std::collections::HashSet;
use std::fs::File;
use std::time::Duration;
use anyhow::{bail, Error};
use nix::sys::stat::Mode;
@ -14,6 +12,7 @@ use proxmox_http::ProxyConfig;
use pbs_buildcfg::configdir;
use crate::backup::{open_backup_lockfile, BackupLockGuard};
use crate::acme::AcmeClient;
use crate::api2::types::{
AcmeAccountName, AcmeDomain, ACME_DOMAIN_PROPERTY_SCHEMA, HTTP_PROXY_SCHEMA,
@ -21,10 +20,9 @@ use crate::api2::types::{
const CONF_FILE: &str = configdir!("/node.cfg");
const LOCK_FILE: &str = configdir!("/.node.lck");
const LOCK_TIMEOUT: Duration = Duration::from_secs(10);
pub fn lock() -> Result<File, Error> {
proxmox::tools::fs::open_file_locked(LOCK_FILE, LOCK_TIMEOUT, true)
pub fn lock() -> Result<BackupLockGuard, Error> {
open_backup_lockfile(LOCK_FILE, None, true)
}
/// Read the Node Config.

8
src/config/tape_encryption_keys.rs
View File

@ -18,12 +18,12 @@ use serde::{Deserialize, Serialize};
use proxmox::tools::fs::{
file_read_optional_string,
replace_file,
open_file_locked,
CreateOptions,
};
use crate::{
backup::{
open_backup_lockfile,
Fingerprint,
KeyConfig,
},
@ -187,11 +187,7 @@ pub fn save_key_configs(map: HashMap<Fingerprint, KeyConfig>) -> Result<(), Erro
/// Get the lock, load both files, insert the new key, store files.
pub fn insert_key(key: [u8;32], key_config: KeyConfig, force: bool) -> Result<(), Error> {
let _lock = open_file_locked(
TAPE_KEYS_LOCKFILE,
std::time::Duration::new(10, 0),
true,
)?;
let _lock = open_backup_lockfile(TAPE_KEYS_LOCKFILE, None, true)?;
let (mut key_map, _) = load_keys()?;
let (mut config_map, _) = load_key_configs()?;

11
src/config/tfa.rs
View File

@ -4,7 +4,6 @@ use std::io::{self, Read, Seek, SeekFrom};
use std::os::unix::fs::OpenOptionsExt;
use std::os::unix::io::AsRawFd;
use std::path::PathBuf;
use std::time::Duration;
use anyhow::{bail, format_err, Error};
use nix::sys::stat::Mode;
@ -29,25 +28,25 @@ use proxmox::tools::AsHex;
use pbs_buildcfg::configdir;
use crate::api2::types::Userid;
use crate::backup::{open_backup_lockfile, BackupLockGuard};
/// Mapping of userid to TFA entry.
pub type TfaUsers = HashMap<Userid, TfaUserData>;
const CONF_FILE: &str = configdir!("/tfa.json");
const LOCK_FILE: &str = configdir!("/tfa.json.lock");
const LOCK_TIMEOUT: Duration = Duration::from_secs(5);
const CHALLENGE_DATA_PATH: &str = pbs_buildcfg::rundir!("/tfa/challenges");
/// U2F registration challenges time out after 2 minutes.
const CHALLENGE_TIMEOUT: i64 = 2 * 60;
pub fn read_lock() -> Result<File, Error> {
proxmox::tools::fs::open_file_locked(LOCK_FILE, LOCK_TIMEOUT, false)
pub fn read_lock() -> Result<BackupLockGuard, Error> {
open_backup_lockfile(LOCK_FILE, None, false)
}
pub fn write_lock() -> Result<File, Error> {
proxmox::tools::fs::open_file_locked(LOCK_FILE, LOCK_TIMEOUT, true)
pub fn write_lock() -> Result<BackupLockGuard, Error> {
open_backup_lockfile(LOCK_FILE, None, true)
}
/// Read the TFA entries.

9
src/config/token_shadow.rs
View File

@ -1,18 +1,17 @@
use std::collections::HashMap;
use std::time::Duration;
use anyhow::{bail, format_err, Error};
use serde::{Serialize, Deserialize};
use serde_json::{from_value, Value};
use proxmox::tools::fs::{open_file_locked, CreateOptions};
use proxmox::tools::fs::CreateOptions;
use crate::api2::types::Authid;
use crate::auth;
use crate::backup::open_backup_lockfile;
const LOCK_FILE: &str = pbs_buildcfg::configdir!("/token.shadow.lock");
const CONF_FILE: &str = pbs_buildcfg::configdir!("/token.shadow");
const LOCK_TIMEOUT: Duration = Duration::from_secs(5);
#[derive(Serialize, Deserialize)]
#[serde(rename_all="kebab-case")]
@ -65,7 +64,7 @@ pub fn set_secret(tokenid: &Authid, secret: &str) -> Result<(), Error> {
bail!("not an API token ID");
}
let _guard = open_file_locked(LOCK_FILE, LOCK_TIMEOUT, true)?;
let _guard = open_backup_lockfile(LOCK_FILE, None, true)?;
let mut data = read_file()?;
let hashed_secret = auth::encrypt_pw(secret)?;
@ -81,7 +80,7 @@ pub fn delete_secret(tokenid: &Authid) -> Result<(), Error> {
bail!("not an API token ID");
}
let _guard = open_file_locked(LOCK_FILE, LOCK_TIMEOUT, true)?;
let _guard = open_backup_lockfile(LOCK_FILE, None, true)?;
let mut data = read_file()?;
data.remove(tokenid);