On 07/23/2014 10:49 AM, Jan Cholasta wrote: > On 23.7.2014 10:38, Martin Kosek wrote: >> On 07/23/2014 10:33 AM, Jan Cholasta wrote: >>> On 23.7.2014 10:12, Martin Kosek wrote: >>>> On 07/23/2014 09:56 AM, David Kupka wrote: >>>>> While solving ticket #4280 I noticed that we are messing with certmonger's >>>>> files right under its hands. That can lead to some unpleasant race >>>>> condition >>>>> issues. >>>>> Is there any reason why not to call certmonger via DBus and ask it to stop >>>>> tracking the requests? >>>> >>>> +1 for using the dbus API. When I saw the hacky way of parsing certmonger >>>> internal configuration files in ipapython/certmonger.py, I suggested the >>>> dbus >>>> way as IMO it would not be difficult to implement, it would make us more >>>> future >>>> proof and it would remove intermittent problems like #4280. >>> >>> I have already started using the API, e.g. for adding/removing of the CA >>> helper >>> in cainstance. Word of warning, the API apparently does not exercised much >>> and >>> there might be bugs (I found one causing certmonger to segfault which Nalin >>> promptly fixed). >> >> Yup, this is the place where the inspiration came from :-) >> >>>> Certmonger API looked complete enough to pull this off: >>>> https://git.fedorahosted.org/cgit/certmonger.git/tree/doc/api.txt >>>> >>>> If I am wrong, please tell me. >>> >>> IIRC some of the properties in requests might not be accessible using the >>> API. >>> But I'm not sure if this is true or if it affects us. >> >> I did couple tests and it seems that getting properties works fine: >> >>>>> import dbus >>>>> bus = dbus.SystemBus() >>>>> obj = >> bus.get_object('org.fedorahosted.certmonger','/org/fedorahosted/certmonger') >>>>> iface = dbus.Interface(obj, 'org.fedorahosted.certmonger') >>>>> reqs = iface.get_requests() >>>>> req = bus.get_object('org.fedorahosted.certmonger', reqs[0]) >>>>> iface_request = dbus.Interface(req, 'org.fedorahosted.certmonger.request') >>>>> iface_request.get_nickname() >> dbus.String(u'20140723081859') >>>>> iface_request.get_status() >> (dbus.String(u'MONITORING'), dbus.Boolean(False)) >>>>> iface_request.get_key_storage_info() >> (dbus.String(u'NSSDB'), dbus.String(u'/etc/pki/pki-tomcat/alias'), >> dbus.String(u'auditSigningCert cert-pki-ca'), dbus.String(u'NSS Certificate >> DB')) >>>>> iface_request.get_cert_data() >> dbus.String(u'-----BEGIN >> CERTIFICATE-----\nMIIDZzCCAk+gAwIBAgIBBTANBgkqhkiG9w0BAQsFADA/MR0wGwYDVQQKDBRNS09T\r\nRUstRkVET1JBMjAuVEVTVDEeMBwGA1UEAwwVQ2VydGlmaWNhdGUgQXV0aG9yaXR5\r\nMB4XDTE0MDcyMzA4MTc1OVoXDTE2MDcxMjA4MTc1OVowMjEdMBsGA1UECgwUTUtP\r\nU0VLLUZFRE9SQTIwLlRFU1QxETAPBgNVBAMMCENBIEF1ZGl0MIIBIjANBgkqhkiG\r\n9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxHJ6iNEUOCLybjMsuC1X3ojJFDml91caAT6u\r\nvySSnz6S79Y2Z3CgpnS71p842SukEXtawkBH+4Vzv3EkiT2OEGFMIFPxtg0z6KJw\r\n64Kv7R6qP1N9iW091pSsui8CoypINtvOmdZtop6meqPEcbjqVzYqQxZ2nq4FI1Ed\r\ncPiirF33OkAJQ5CuvzJFotoZ7f7tAisTpUqghCBAr0kg5MtvcjtlB+hysdVWf+rf\r\nCpzsVA1DbXRNdwsZpOv07Lhm1EGIsJZ3/wZszBpycM1H+8mIuTa5mpNpluDHoDrG\r\ne51TzF5F/DQI7ctMoI6CGxPvyPGbammKcID/yDzyePx3XBnCaQIDAQABo3sweTAf\r\nBgNVHSMEGDAWgBQoqt6chwnASMhQa2DwaWvSF9C/GDAOBgNVHQ8BAf8EBAMCBsAw\r\nRgYIKwYBBQUHAQEEOjA4MDYGCCsGAQUFBzABhipodHRwOi8vaXBhLm1rb3Nlay1m\r\nZWRvcmEyMC50ZXN0OjgwL2NhL29jc3AwDQYJKoZIhvcNAQELBQADggEBAEDoy8AW\r\nJinIA4pYEDuTYG/mUBJvvaH+XR7a8pZtX0mnWOlS1mbI1gjlkCCBi7t//c2U3Nmx\r\nb+EiG8isXT0urowI! 3! >> > iB! >> jhOXyweJDF >> 7+Wa1kN57SRkMeJIhCTBWOVGEBYGA6nUUKb\r\nnULomV9XXE5Bj+yP3IRewe0AYL0Gyk5QnSNLCYUMA+u/oi4i+uloKv3yZd6On0Re\r\nuIVSvmwXNHMKgGPg2cKSu1fd9tZ7qvQo6Vblf/zYp17tg2Vgd/ESeqgclgJs8AaL\r\nRDED3RT0FaOR/6SCTrXTGymmRaAVA6gGCUScyWD+MaKldOu2qDBG32obPiSw9lm8\r\nnxQBR2IlqByyeDA=\n-----END >> >> CERTIFICATE-----\n\n') >> >> Martin >> > > When I said "some of the properties", I certainly did not mean the absolute > basics, but rather stuff like "cert-presave-command".
Ah, ok. Then I think this snippet will help: >>> properties_manager = dbus.Interface(req, 'org.freedesktop.DBus.Properties') >>> properties_manager.Get('org.fedorahosted.certmonger.request', 'cert-presave-command') dbus.String(u'/usr/lib64/ipa/certmonger/stop_pkicad') >>> properties_manager.Get('org.fedorahosted.certmonger.request', 'cert-postsave-command') dbus.String(u'/usr/lib64/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca"') Martin _______________________________________________ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel