From 2f092ea9dbe46d1bebe1576cd7626bf325fe82e5 Mon Sep 17 00:00:00 2001 From: Kali Kaneko Date: Tue, 10 Jun 2014 15:22:56 -0500 Subject: Install missing stuff into /usr/local/sbin. Closes: #$741 --- changes/feature-install-local-path | 1 + pkg/linux/polkit/se.leap.bitmask.bundle.policy | 23 +++++++ src/leap/bitmask/backend.py | 4 +- src/leap/bitmask/platform_init/initializers.py | 18 +++--- src/leap/bitmask/services/eip/linuxvpnlauncher.py | 74 +++++++++++++---------- src/leap/bitmask/services/eip/vpnlauncher.py | 13 ++-- src/leap/bitmask/services/eip/vpnprocess.py | 8 +-- src/leap/bitmask/util/__init__.py | 19 ++++++ src/leap/bitmask/util/privilege_policies.py | 10 ++- 9 files changed, 119 insertions(+), 51 deletions(-) create mode 100644 changes/feature-install-local-path create mode 100644 pkg/linux/polkit/se.leap.bitmask.bundle.policy diff --git a/changes/feature-install-local-path b/changes/feature-install-local-path new file mode 100644 index 00000000..17e1d2d7 --- /dev/null +++ b/changes/feature-install-local-path @@ -0,0 +1 @@ +- Install helpers to /usr/local for bundle. Closes: #5741 diff --git a/pkg/linux/polkit/se.leap.bitmask.bundle.policy b/pkg/linux/polkit/se.leap.bitmask.bundle.policy new file mode 100644 index 00000000..58fcaaa8 --- /dev/null +++ b/pkg/linux/polkit/se.leap.bitmask.bundle.policy @@ -0,0 +1,23 @@ + + + + + LEAP Project + http://leap.se/ + + + Runs bitmask helper to launch firewall and openvpn (bundle version) + Ejecuta el asistente de bitmask para lanzar el firewall y openvpn (version bundle) + Bitmask needs that you authenticate to start + Bitmask necesita autorizacion para comenzar + package-x-generic + + yes + yes + yes + + /usr/local/sbin/bitmask-root + + diff --git a/src/leap/bitmask/backend.py b/src/leap/bitmask/backend.py index 7ebe7f97..f7200dd7 100644 --- a/src/leap/bitmask/backend.py +++ b/src/leap/bitmask/backend.py @@ -54,6 +54,7 @@ from leap.bitmask.services.mail.smtpconfig import SMTPConfig from leap.bitmask.services.soledad.soledadbootstrapper import \ SoledadBootstrapper +from leap.bitmask.util import force_eval from leap.common import certs as leap_certs @@ -609,7 +610,8 @@ class EIP(object): eip_loaded = eip_config.load(eipconfig.get_eipconfig_path(domain)) launcher = get_vpn_launcher() - if not os.path.isfile(launcher.OPENVPN_BIN_PATH): + ovpn_path = force_eval(launcher.OPENVPN_BIN_PATH) + if not os.path.isfile(ovpn_path): logger.error("Cannot start OpenVPN, binary not found") return False diff --git a/src/leap/bitmask/platform_init/initializers.py b/src/leap/bitmask/platform_init/initializers.py index b282a229..79fdd554 100644 --- a/src/leap/bitmask/platform_init/initializers.py +++ b/src/leap/bitmask/platform_init/initializers.py @@ -70,10 +70,10 @@ NOTFOUND_MSG = ("Tried to install %s, but %s " BADEXEC_MSG = ("Tried to install %s, but %s " "failed to %s.") -UPDOWN_NOTFOUND_MSG = NOTFOUND_MSG % ( - "updown scripts", "those were") -UPDOWN_BADEXEC_MSG = BADEXEC_MSG % ( - "updown scripts", "they", "be copied") +HELPERS_NOTFOUND_MSG = NOTFOUND_MSG % ( + "helper files", "those were") +HELPERS_BADEXEC_MSG = BADEXEC_MSG % ( + "helper files", "they", "be copied") def get_missing_updown_dialog(): @@ -88,7 +88,7 @@ def get_missing_updown_dialog(): "to install helper files. " "Do you want to proceed?") msg = QtGui.QMessageBox() - msg.setWindowTitle(msg.tr("Missing up/down scripts")) + msg.setWindowTitle(msg.tr("Missing helper files")) msg.setText(msg.tr(WE_NEED_POWERS)) # but maybe the user really deserve to know more #msg.setInformativeText(msg.tr(BECAUSE)) @@ -123,8 +123,10 @@ def check_missing(): "Installer not found for platform %s." % (_system,)) return + print "INSTALL FUN", install_missing_fun + # XXX maybe move constants to fun - ok = install_missing_fun(UPDOWN_BADEXEC_MSG, UPDOWN_NOTFOUND_MSG) + ok = install_missing_fun(HELPERS_BADEXEC_MSG, HELPERS_NOTFOUND_MSG) if not ok: msg = QtGui.QMessageBox() msg.setWindowTitle(msg.tr("Problem installing files")) @@ -385,7 +387,7 @@ def _linux_check_resolvconf(): def _linux_install_missing_scripts(badexec, notfound): """ - Try to install the missing up/down scripts. + Try to install the missing helper files. :param badexec: error for notifying execution error during command. :type badexec: str @@ -405,6 +407,7 @@ def _linux_install_missing_scripts(badexec, notfound): polfd, pol_tempfile = tempfile.mkstemp(prefix="leap_installer-") try: pkexec = first(launcher.maybe_pkexec()) + scriptlines = launcher.cmd_for_missing_scripts(installer_path) with os.fdopen(fd, 'w') as f: f.write(scriptlines) @@ -413,6 +416,7 @@ def _linux_install_missing_scripts(badexec, notfound): os.chmod(tempscript, st.st_mode | stat.S_IEXEC | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH) cmdline = ["%s %s" % (pkexec, tempscript)] + ret = subprocess.call( cmdline, stdout=subprocess.PIPE, shell=True) diff --git a/src/leap/bitmask/services/eip/linuxvpnlauncher.py b/src/leap/bitmask/services/eip/linuxvpnlauncher.py index 955768d1..8ec0c050 100644 --- a/src/leap/bitmask/services/eip/linuxvpnlauncher.py +++ b/src/leap/bitmask/services/eip/linuxvpnlauncher.py @@ -29,7 +29,7 @@ from leap.bitmask.util.privilege_policies import LinuxPolicyChecker from leap.common.files import which from leap.bitmask.services.eip.vpnlauncher import VPNLauncher from leap.bitmask.services.eip.vpnlauncher import VPNLauncherException -from leap.bitmask.util import get_path_prefix +from leap.bitmask.util import get_path_prefix, force_eval from leap.common.check import leap_assert from leap.bitmask.util import first @@ -105,26 +105,34 @@ leapfile = lambda f: "%s/%s" % (SYSTEM_CONFIG, f) class LinuxVPNLauncher(VPNLauncher): PKEXEC_BIN = 'pkexec' - BITMASK_ROOT = "/usr/sbin/bitmask-root" - # We assume this is there by our openvpn dependency, and - # we will put it there on the bundle too. - if flags.STANDALONE: - OPENVPN_BIN_PATH = "/usr/sbin/leap-openvpn" - else: - OPENVPN_BIN_PATH = "/usr/sbin/openvpn" - - POLKIT_PATH = LinuxPolicyChecker.get_polkit_path() - - if flags.STANDALONE: - RESOLVCONF_BIN_PATH = "/usr/local/sbin/leap-resolvconf" - else: + # The following classes depend on force_eval to be called against + # the classes, to get the evaluation of the standalone flag on runtine. + # If we keep extending this kind of classes, we should abstract the + # handling of the STANDALONE flag in a base class + + class BITMASK_ROOT(object): + def __call__(self): + return ("/usr/local/sbin/bitmask-root" if flags.STANDALONE else + "/usr/sbin/bitmask-root") + + class OPENVPN_BIN_PATH(object): + def __call__(self): + return ("/usr/local/sbin/leap-openvpn" if flags.STANDALONE else + "/usr/sbin/openvpn") + + class POLKIT_PATH(object): + def __call__(self): + # LinuxPolicyChecker will give us the right path if standalone. + return LinuxPolicyChecker.get_polkit_path() + + class RESOLVCONF_BIN_PATH(object): + def __call__(self): + return ("/usr/local/sbin/leap-resolvconf" if flags.STANDALONE else + "/sbin/resolvconf") # this only will work with debian/ubuntu distros. - RESOLVCONF_BIN_PATH = "/sbin/resolvconf" - # XXX openvpn binary TOO - OTHER_FILES = (POLKIT_PATH, BITMASK_ROOT, OPENVPN_BIN_PATH, - RESOLVCONF_BIN_PATH) + OTHER_FILES = (POLKIT_PATH, BITMASK_ROOT, OPENVPN_BIN_PATH) @classmethod def maybe_pkexec(kls): @@ -187,7 +195,7 @@ class LinuxVPNLauncher(VPNLauncher): command = super(LinuxVPNLauncher, kls).get_vpn_command( eipconfig, providerconfig, socket_host, socket_port, openvpn_verb) - command.insert(0, kls.BITMASK_ROOT) + command.insert(0, force_eval(kls.BITMASK_ROOT)) command.insert(1, "openvpn") command.insert(2, "start") @@ -207,35 +215,37 @@ class LinuxVPNLauncher(VPNLauncher): :rtype: str """ + bin_paths = force_eval( + (LinuxVPNLauncher.POLKIT_PATH, + LinuxVPNLauncher.OPENVPN_BIN_PATH, + LinuxVPNLauncher.BITMASK_ROOT)) + + polkit_path, openvpn_bin_path, bitmask_root = bin_paths + # no system config for now # sys_config = kls.SYSTEM_CONFIG (polkit_file, openvpn_bin_file, - bitmask_root_file, resolvconf_bin_file) = map( + bitmask_root_file) = map( lambda p: os.path.split(p)[-1], - (kls.POLKIT_PATH, kls.OPENVPN_BIN_PATH, - kls.BITMASK_ROOT, kls.RESOLVCONF_BIN_PATH)) + bin_paths) cmd = '#!/bin/sh\n' cmd += 'mkdir -p /usr/local/sbin\n' cmd += 'cp "%s" "%s"\n' % (os.path.join(frompath, polkit_file), - kls.POLKIT_PATH) - cmd += 'chmod 644 "%s"\n' % (kls.POLKIT_PATH, ) + polkit_path) + cmd += 'chmod 644 "%s"\n' % (polkit_path, ) cmd += 'cp "%s" "%s"\n' % (os.path.join(frompath, bitmask_root_file), - kls.BITMASK_ROOT) - cmd += 'chmod 744 "%s"\n' % (kls.BITMASK_ROOT, ) + bitmask_root) + cmd += 'chmod 744 "%s"\n' % (bitmask_root, ) if flags.STANDALONE: cmd += 'cp "%s" "%s"\n' % ( os.path.join(frompath, openvpn_bin_file), - kls.OPENVPN_BIN_PATH) - cmd += 'chmod 744 "%s"\n' % (kls.POLKIT_PATH, ) + openvpn_bin_path) + cmd += 'chmod 744 "%s"\n' % (openvpn_bin_path, ) - cmd += 'cp "%s" "%s"\n' % ( - os.path.join(frompath, resolvconf_bin_file), - kls.RESOLVCONF_BIN_PATH) - cmd += 'chmod 744 "%s"\n' % (kls.POLKIT_PATH, ) return cmd @classmethod diff --git a/src/leap/bitmask/services/eip/vpnlauncher.py b/src/leap/bitmask/services/eip/vpnlauncher.py index 9629afae..58ca0c33 100644 --- a/src/leap/bitmask/services/eip/vpnlauncher.py +++ b/src/leap/bitmask/services/eip/vpnlauncher.py @@ -30,6 +30,7 @@ from leap.bitmask.config.leapsettings import LeapSettings from leap.bitmask.config.providerconfig import ProviderConfig from leap.bitmask.platform_init import IS_LINUX from leap.bitmask.services.eip.eipconfig import EIPConfig, VPNGatewaySelector +from leap.bitmask.util import force_eval from leap.common.check import leap_assert, leap_assert_type @@ -179,12 +180,13 @@ class VPNLauncher(object): #raise OpenVPNNotFoundException() #openvpn = first(openvpn_possibilities) # ----------------------------------------- - if not os.path.isfile(kls.OPENVPN_BIN_PATH): + openvpn_path = force_eval(kls.OPENVPN_BIN_PATH) + + if not os.path.isfile(openvpn_path): logger.warning("Could not find openvpn bin in path %s" % ( - kls.OPENVPN_BIN_PATH)) + openvpn_path)) raise OpenVPNNotFoundException() - openvpn = kls.OPENVPN_BIN_PATH args = [] args += [ @@ -248,7 +250,7 @@ class VPNLauncher(object): '--ping', '10', '--ping-restart', '30'] - command_and_args = [openvpn] + args + command_and_args = [openvpn_path] + args return command_and_args @classmethod @@ -293,7 +295,8 @@ class VPNLauncher(object): leap_assert(kls.OTHER_FILES is not None, "Need to define OTHER_FILES for this particular " "auncher before calling this method") + other = force_eval(kls.OTHER_FILES) file_exist = partial(_has_other_files, warn=False) - zipped = zip(kls.OTHER_FILES, map(file_exist, kls.OTHER_FILES)) + zipped = zip(other, map(file_exist, other)) missing = filter(lambda (path, exists): exists is False, zipped) return [path for path, exists in missing] diff --git a/src/leap/bitmask/services/eip/vpnprocess.py b/src/leap/bitmask/services/eip/vpnprocess.py index f56d464e..b54f2925 100644 --- a/src/leap/bitmask/services/eip/vpnprocess.py +++ b/src/leap/bitmask/services/eip/vpnprocess.py @@ -43,7 +43,7 @@ from leap.bitmask.services.eip import get_vpn_launcher from leap.bitmask.services.eip import linuxvpnlauncher from leap.bitmask.services.eip.eipconfig import EIPConfig from leap.bitmask.services.eip.udstelnet import UDSTelnet -from leap.bitmask.util import first +from leap.bitmask.util import first, force_eval from leap.bitmask.platform_init import IS_MAC, IS_LINUX from leap.common.check import leap_assert, leap_assert_type @@ -233,7 +233,7 @@ class VPN(object): # XXX could check for wrapper existence, check it's root owned etc. # XXX could check that the iptables rules are in place. - BM_ROOT = linuxvpnlauncher.LinuxVPNLauncher.BITMASK_ROOT + BM_ROOT = force_eval(linuxvpnlauncher.LinuxVPNLauncher.BITMASK_ROOT) cmd = ["pkexec", BM_ROOT, "firewall", "start"] if restart: cmd.append("restart") @@ -246,7 +246,7 @@ class VPN(object): :rtype: bool """ - BM_ROOT = linuxvpnlauncher.LinuxVPNLauncher.BITMASK_ROOT + BM_ROOT = force_eval(linuxvpnlauncher.LinuxVPNLauncher.BITMASK_ROOT) fw_up_cmd = "pkexec {0} firewall isup".format(BM_ROOT) fw_is_down = lambda: commands.getstatusoutput(fw_up_cmd)[0] == 256 return fw_is_down() @@ -255,7 +255,7 @@ class VPN(object): """ Tear the firewall down using the privileged wrapper. """ - BM_ROOT = linuxvpnlauncher.LinuxVPNLauncher.BITMASK_ROOT + BM_ROOT = force_eval(linuxvpnlauncher.LinuxVPNLauncher.BITMASK_ROOT) exitCode = subprocess.call(["pkexec", BM_ROOT, "firewall", "stop"]) return True if exitCode is 0 else False diff --git a/src/leap/bitmask/util/__init__.py b/src/leap/bitmask/util/__init__.py index c35be99e..25b86874 100644 --- a/src/leap/bitmask/util/__init__.py +++ b/src/leap/bitmask/util/__init__.py @@ -110,3 +110,22 @@ def make_address(user, provider): :type provider: basestring """ return "%s@%s" % (user, provider) + + +def force_eval(items): + """ + Return a sequence that evaluates any callable in the sequence, + instantiating it beforehand if the item is a class, and + leaves the non-callable items without change. + """ + def do_eval(thing): + if isinstance(thing, type): + return thing()() + if callable(thing): + return thing() + return thing + + if isinstance(items, (list, tuple)): + return map(do_eval, items) + else: + return do_eval(items) diff --git a/src/leap/bitmask/util/privilege_policies.py b/src/leap/bitmask/util/privilege_policies.py index 9d1e2c9a..adc3503f 100644 --- a/src/leap/bitmask/util/privilege_policies.py +++ b/src/leap/bitmask/util/privilege_policies.py @@ -24,6 +24,8 @@ import platform from abc import ABCMeta, abstractmethod +from leap.bitmask.config import flags + logger = logging.getLogger(__name__) @@ -71,6 +73,8 @@ class LinuxPolicyChecker(PolicyChecker): """ LINUX_POLKIT_FILE = ("/usr/share/polkit-1/actions/" "se.leap.bitmask.policy") + LINUX_POLKIT_FILE_BUNDLE = ("/usr/share/polkit-1/actions/" + "se.leap.bitmask.bundle.policy") @classmethod def get_polkit_path(self): @@ -79,7 +83,8 @@ class LinuxPolicyChecker(PolicyChecker): :rtype: str """ - return self.LINUX_POLKIT_FILE + return (self.LINUX_POLKIT_FILE_BUNDLE if flags.STANDALONE + else self.LINUX_POLKIT_FILE) def is_missing_policy_permissions(self): # FIXME this name is quite confusing, it does not have anything to do with @@ -90,4 +95,5 @@ class LinuxPolicyChecker(PolicyChecker): :rtype: bool """ - return not os.path.isfile(self.LINUX_POLKIT_FILE) + path = self.get_polkit_path() + return not os.path.isfile(path) -- cgit v1.2.3 From 28db1cf111efa1eab32d79a19528384a6be1ba96 Mon Sep 17 00:00:00 2001 From: Kali Kaneko Date: Wed, 11 Jun 2014 15:14:51 -0500 Subject: fix namespace typo --- src/leap/bitmask/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/leap/bitmask/__init__.py b/src/leap/bitmask/__init__.py index c844beb1..0f733f26 100644 --- a/src/leap/bitmask/__init__.py +++ b/src/leap/bitmask/__init__.py @@ -66,7 +66,7 @@ except ImportError: __appname__ = "unknown" try: - from leap._appname import __appname__ + from leap.bitmask._appname import __appname__ except ImportError: #running on a tree that has not run #the setup.py setver -- cgit v1.2.3 From 09bcc1f3deec4db821d1ad8865d3aa09eb17f341 Mon Sep 17 00:00:00 2001 From: Kali Kaneko Date: Wed, 11 Jun 2014 15:59:40 -0500 Subject: add function to hash bundle binaries --- setup.py | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 60 insertions(+), 1 deletion(-) diff --git a/setup.py b/setup.py index 3d12db64..bb1937cc 100755 --- a/setup.py +++ b/setup.py @@ -20,7 +20,9 @@ Setup file for bitmask. """ from __future__ import print_function +import hashlib import sys +import os import re if not sys.version_info[0] == 2: @@ -34,7 +36,6 @@ except ImportError: from pkg import distribute_setup distribute_setup.use_setuptools() from setuptools import setup, find_packages -import os from pkg import utils @@ -168,6 +169,64 @@ class cmd_develop(_develop): cmdclass["develop"] = cmd_develop + +class cmd_binary_hash(Command): + """ + Update the _binaries.py file with hashes for the different helpers. + This is used from within the bundle. + """ + + user_options = [] + + def initialize_options(self): + pass + + def finalize_options(self): + pass + + def run(self, *args): + + OPENVPN_BIN = os.environ.get('OPENVPN_BIN', None) + BITMASK_ROOT = os.environ.get('BITMASK_ROOT', None) + + def exit(): + print("Please set environment variables " + "OPENVPN_BIN and BITMASK_ROOT pointing to the right path " + "to use this command") + sys.exit(1) + + bin_paths = OPENVPN_BIN, BITMASK_ROOT + if not all(bin_paths): + exit() + + if not all(map(os.path.isfile, bin_paths)): + exit() + + openvpn_bin_hash, bitmask_root_hash = map( + lambda path: hashlib.sha256(open(path).read()).hexdigest(), + bin_paths) + + template = r""" +# Hashes for binaries used in Bitmask Bundle. +# This file has been automatically generated by `setup.py hash_binaries` +# DO NOT modify it manually. + +OPENVPN_BIN = "{openvpn}" +BITMASK_ROOT = "{bitmask}" +""" + subst_template = template.format( + openvpn=openvpn_bin_hash, + bitmask=bitmask_root_hash) + + bin_hash_path = os.path.join('src', 'leap', 'bitmask', '_binaries.py') + with open(bin_hash_path, 'w') as f: + f.write(subst_template) + print("Binaries hash file %s has been updated!" % (bin_hash_path,)) + + +cmdclass["hash_binaries"] = cmd_binary_hash + + # next two classes need to augment the versioneer modified ones versioneer_build = cmdclass['build'] -- cgit v1.2.3 From 436edaa3700e43db6ae400a51af018348baf0cf5 Mon Sep 17 00:00:00 2001 From: Kali Kaneko Date: Wed, 11 Jun 2014 15:59:59 -0500 Subject: add _binaries to .gitignore --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index 0e5bb658..23bfbfe8 100644 --- a/.gitignore +++ b/.gitignore @@ -28,6 +28,7 @@ pkg/osx/build src/*.egg-info src/pysqlcipher +src/leap/bitmask/_binaries.py src/leap/bitmask/util/reqs.txt MANIFEST _trial_temp* -- cgit v1.2.3 From d2fc367cc284a87d60bfdc96fcd87e257296ee02 Mon Sep 17 00:00:00 2001 From: Kali Kaneko Date: Thu, 12 Jun 2014 10:32:17 -0500 Subject: Update README with the latest changes to paths, and hashing info. --- pkg/linux/README.rst | 31 ++++++++++++++++++++++++++++--- 1 file changed, 28 insertions(+), 3 deletions(-) diff --git a/pkg/linux/README.rst b/pkg/linux/README.rst index 220565ff..249c721f 100644 --- a/pkg/linux/README.rst +++ b/pkg/linux/README.rst @@ -3,8 +3,33 @@ Files In GNU/Linux, we expect these files to be in place:: - update-resolv-conf -> /etc/leap/update-resolv-conf - resolv-update -> /etc/leap/resolv-update - bitmask-root -> /usr/sbin/bitmask-root polkit/se.leap.bitmask.policy -> /usr/share/polkit-1/actions/se.leap.bitmask.policy + +Bundle +====== + +The bundle will ask for permission to install to a different path. This search +path will be used if the flag ``--standalone`` is set:: + + bitmask-root -> /usr/local/sbin/bitmask-root + polkit/se.leap.bitmask.bundle.policy -> /usr/share/polkit-1/actions/se.leap.bitmask.bundle.policy + +You will also have to place an openvpn binary in the following path:: + + leap-openvpn -> /usr/local/sbin/leap-openvpn + + +Binary hashing +============== + +To be able to update the binaries when needed, the bundles distribute with the +sha256 hash of the packaged binaries for each release. This info can be found +in:: + + src/leap/bitmask/_binaries.py + +That file is generated during the bundling process, by issuing the following +command from the root folder:: + + python setup.py hash_binaries -- cgit v1.2.3