[pkgsrc/trunk]: pkgsrc/net/bind910/files/smf Update SMF manifest and method t...

[hans <hans%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/b68737fe7de1
branches:  trunk
changeset: 355978:b68737fe7de1
user:      hans <hans%pkgsrc.org@localhost>
date:      Fri Dec 16 15:37:28 2016 +0000

description:
Update SMF manifest and method to whats in OpenIndiana. This fixes
chroot support.

Also, don't look for named.conf in PKG_SYSCONFDIR as the package is
configured to always use /etc.

diffstat:

 net/bind910/files/smf/manifest.xml |   30 ++--
 net/bind910/files/smf/named.sh     |  258 ++++++++++++++++++++++++++++--------
 2 files changed, 214 insertions(+), 74 deletions(-)

diffs (truncated from 351 to 300 lines):

diff -r 61f325c8dd0c -r b68737fe7de1 net/bind910/files/smf/manifest.xml
--- a/net/bind910/files/smf/manifest.xml        Fri Dec 16 15:25:17 2016 +0000
+++ b/net/bind910/files/smf/manifest.xml        Fri Dec 16 15:37:28 2016 +0000
@@ -39,9 +39,8 @@
       <service_fmri value='svc:/milestone/network' />
     </dependency>
     <dependency name='config-files' grouping='require_any' restart_on='refresh' type='path'>
-      <service_fmri value='file://localhost@PKG_SYSCONFDIR@/named.conf' />
+      <service_fmri value='file://localhost/etc/named.conf' />
     </dependency>
-    <exec_method type='method' name='stop' exec=':kill' timeout_seconds='60' />
     <!--
         In order to run multiple named(1M) processes with their own
         configuration file or properties each must have a unique
@@ -50,22 +49,15 @@
     <instance name='default' enabled='false'>
       <exec_method type='method' name='start' exec='@PREFIX@/@SMF_METHOD_FILE.named@ %m %i' timeout_seconds='60'>
         <method_context>
-          <!--
-                privileges: (see privileges(5) and /etc/security/priv_names)
-                file_dac_read, file_dac_search:
-                        Necessary for reading the configuration file
-                        even it is restricted by the file permission.
-                net_privaddr:
-                        Bind to a privileged port number.
-                sys_resource:
-                        Permit the setting of resource limits (eg. stack
-                        size).
-                proc_chroot:
-                        Permit use of chroot(2).
-          -->
-          <method_credential user='root' group='root' privileges='basic,!proc_session,!proc_info,!file_link_any,net_privaddr,file_dac_read,file_dac_search,sys_resource,proc_chroot' />
+          <method_credential user='root' group='root' />
         </method_context>
       </exec_method>
+      <exec_method type='method' name='stop' exec='@PREFIX@/@SMF_METHOD_FILE.named@ %m %i %{restarter/contract}' timeout_seconds='60'>
+        <method_context>
+          <method_credential user='root' group='root' />
+        </method_context>
+
+      </exec_method>
       <!--
               SIGHUP causes named to reread its configuration file, but not any
               of the properties below.
@@ -126,6 +118,12 @@
                 Equivalent command line option '-t <pathname>'.
         -->
         <propval name='chroot_dir' type='astring' value='' />
+       <!--
+               user: Change the user id after processing command line
+               arguments, but before reading the configuration file.
+               Equivalent command line option '-u <user>'.
+       -->
+        <propval name='user' type='astring' value='named' />
       </property_group>
     </instance>
     <template>
diff -r 61f325c8dd0c -r b68737fe7de1 net/bind910/files/smf/named.sh
--- a/net/bind910/files/smf/named.sh    Fri Dec 16 15:25:17 2016 +0000
+++ b/net/bind910/files/smf/named.sh    Fri Dec 16 15:37:28 2016 +0000
@@ -28,90 +28,232 @@
 
 . /lib/svc/share/smf_include.sh
 
+mount_chroot ()
+{
+    c=$1
+    shift
+    for f in $*; do
+        if [ -z "${f}" -o ! -f "${f}" -o \
+             -z "${c}" -o ! -d "${c}" ]; then
+             exit ${SMF_EXIT_ERR_CONFIG}
+        fi
+
+        umount ${c}/${f} >/dev/null 2>&1
+        mkdir -p `dirname ${c}/${f}`
+        touch ${c}/${f}
+        mount -Flofs ${f} ${c}/${f}
+    done
+}
+
+umount_chroot ()
+{
+    c=$1
+    shift
+    for f in $*; do
+        umount ${c}/${f} >/dev/null 2>&1
+    done
+}
+
+get_config ()
+{   
+    configuration_file=/etc/named.conf
+    rndc_config_file=/etc/rndc.conf
+    rndc_key_file=/etc/rndc.key
+    rndc_cmd_opts="-a"
+    libraries="/usr/pkg/lib/engines/libgost.so"
+    cmdopts=""
+    checkopts=""
+    properties="debug_level ip_interfaces listen_on_port
+        threads chroot_dir configuration_file server user"
+
+    for prop in $properties
+    do
+        value=`/usr/bin/svcprop -p options/${prop} ${SMF_FMRI}`
+        if [ -z "${value}" -o "${value}" = '""' ]; then
+            continue;
+        fi
+
+        case $prop in
+        'debug_level')
+            if [ ${value} -gt 0 ]; then
+                cmdopts="${cmdopts} -d ${value}"
+            fi
+            ;;
+        'ip_interfaces')
+            case ${value} in
+                'IPv4')
+                    cmdopts="${cmdopts} -4";;
+                'IPv6')
+                    cmdopts="${cmdopts} -6";;
+                'all')
+                    :   # Default is all, therefore ignore.
+                    ;;
+                *)  
+                    echo "$I: Unrecognised value in service instance property" >&2
+                    echo "$I: options/${prop} : ${value}" >&2
+                    ;;
+            esac
+            ;;
+        'listen_on_port')
+            if [ ${value} -gt 0 ]; then
+                cmdopts="${cmdopts} -p ${value}"
+            fi
+            ;;
+        'threads')
+            if [ ${value} -gt 0 ]; then
+                cmdopts="${cmdopts} -n ${value}"
+            fi
+            ;;
+        'chroot_dir')
+            cmdopts="${cmdopts} -t ${value}"
+            checkopts="${checkopts} -t ${value}"
+            chroot_dir=${value};
+            ;;
+        'configuration_file')
+            cmdopts="${cmdopts} -c ${value}"
+            checkopts="${checkopts} -t ${value}"
+            configuration_file=${value};
+            ;;
+        'server')
+            set -- `echo ${value} | /usr/bin/sed -e  's/\\\\//g'`
+            server=$@
+            ;;
+        'user')
+            cmdopts="${cmdopts} -u ${value}"
+            cmduser=${value};
+            ;;
+        esac
+    done
+
+    configuration_dir=$(sed -n -e 's,^[[:space:]]*directory.*"\(.*\)";,\1,p' \
+        ${configuration_file})
+    [ "${configuration_dir}" == "" ] && configuration_dir=/etc/namedb
+
+    configuration_files=$(sed -n -e \
+        "s,^[[:space:]]*file.*\"\(.*\)\";,${configuration_dir}/\1,p" \
+        ${configuration_file} | sort -u)
+    configuration_files="${configuration_files} ${configuration_file}"    
+}
+
 result=${SMF_EXIT_OK}
 
 # Read command line arguments
 method="$1"            # %m
 instance="$2"          # %i
+contract="$3"          # %{restarter/contract}
 
 # Set defaults; SMF_FMRI should have been set, but just in case.
 if [ -z "$SMF_FMRI" ]; then
     SMF_FMRI="svc:/@SMF_PREFIX@/@SMF_NAME@:${instance}"
 fi
 server="@PREFIX@/sbin/named"
+checkconf="@PREFIX@/sbin/named-checkconf"
 I=`/usr/bin/basename $0`
 
 case "$method" in
 'start')
-    cmdopts=""
-    properties="debug_level ip_interfaces listen_on_port
-       threads chroot_dir configuration_file server"
+    get_config
+
+    # If chroot option is set, note zones(5) are preferred, then
+    # configuration file lives under chroot directory.
+    if [ "${chroot_dir}" != "" ]; then
+        if [ "${chroot_dir}" = "/" ]; then
+            msg="$I: chroot_dir must not be /"
+            echo ${msg} >&2
+            /usr/bin/logger -p daemon.error ${msg}
+            # dns-server should be placed in maintenance state.
+            exit ${SMF_EXIT_ERR_CONFIG}
+        fi
 
-    for prop in $properties
-    do
-       value=`/usr/bin/svcprop -p options/${prop} ${SMF_FMRI}`
-       if [ -z "${value}" -o "${value}" = '""' ]; then
-           continue;
-       fi
+        server="env LD_NOLAZYLOAD=1 ${server}"
+        checkconf="env LD_NOLAZYLOAD=1 ${checkconf}"
+
+        mkdir -p ${chroot_dir}
 
-       case $prop in
-       'debug_level')
-           if [ ${value} -gt 0 ]; then
-               cmdopts="${cmdopts} -d ${value}"
+        if [ "${SMF_ZONENAME}" = "global" ]; then
+            for dev in crypto log null poll random urandom; do
+                rm -f ${chroot_dir}/dev/${dev}
+                pax -rw -H -pe /dev/${dev} ${chroot_dir}
+            done
+        fi
+
+       missing=""
+        for dev in crypto null poll random urandom; do
+           if [ ! -e "${chroot_dir}/dev/${dev}" ]; then
+               missing="${missing} ${dev}"
            fi
-           ;;
-       'ip_interfaces')
-           case ${value} in
-               'IPv4')
-                   cmdopts="${cmdopts} -4";;
-               'IPv6')
-                   cmdopts="${cmdopts} -6";;
-               'all')
-                   :   # Default is all, therefore ignore.
-                   ;;
-               *)
-                   echo "$I: Unrecognised value in service instance property" >&2
-                   echo "$I: options/${prop} : ${value}" >&2
-                   ;;
-           esac
-           ;;
-       'listen_on_port')
-           if [ ${value} -gt 0 ]; then
-               cmdopts="${cmdopts} -p ${value}"
-           fi
-           ;;
-       'threads')
-           if [ ${value} -gt 0 ]; then
-               cmdopts="${cmdopts} -n ${value}"
-           fi
-           ;;
-       'chroot_dir')
-           cmdopts="${cmdopts} -t ${value}"
-           ;;
-       'configuration_file')
-           cmdopts="${cmdopts} -c ${value}"
-           ;;
-       'server')
-           set -- `echo ${value} | /usr/bin/sed -e  's/\\\\//g'`
-           server=$@
-           ;;
-       esac
-    done
+        done
+
+        if [ ! -z "${missing}" ]; then
+            msg="$I: missing device nodes in ${chroot_dir}: ${missing}"
+            echo ${msg} >&2
+            /usr/bin/logger -p daemon.err ${msg}
+            # dns-server should be placed in maintenance state.
+            exit ${SMF_EXIT_ERR_CONFIG}
+        fi
+
+        mount_chroot ${chroot_dir} ${configuration_files} ${libraries}
+
+        mkdir -p ${chroot_dir}/var/run/named
+        chown ${cmduser}:${cmduser} ${chroot_dir}/var/run/named
+
+        configuration_file=${chroot_dir}${configuration_file}
+        rndc_config_file=${chroot_dir}${rndc_config_file}
+        rndc_key_file=${chroot_dir}${rndc_key_file}
+        rndc_cmd_opts="${rndc_cmd_opts} -t ${chroot_dir}"
+    fi
+
+    # Check if the rndc config file exists.
+    if [ ! -f ${rndc_config_file} ]; then
+        # If not, check if the default rndc key file exists.
+        if [ ! -f ${rndc_key_file} ]; then
+            echo "$I: Creating default rndc key file: ${rndc_key_file}." >&2
+            /usr/sbin/rndc-confgen ${rndc_cmd_opts}
+            if [ $? -ne 0 ]; then
+                echo "$I : Warning: rndc configuration failed! Use of 'rndc' to" \
+                    "control 'named' may fail and 'named' may report further error" \
+                    "messages to the system log. This is not fatal. For more" \