git: 27b780cf30fd - main - security/dogtag-pki: bound the rc onestop call during pkidestroy
Jochen Neumeister <[email protected]>
| Newsgroups | gmane.os.freebsd.devel.cvs.ports |
|---|---|
| Message-ID | <[email protected]> |
The branch main has been updated by joneum: URL: https://cgit.FreeBSD.org/ports/commit/?id=27b780cf30fd1e4b7f2f2faa7371599baa311c93 commit 27b780cf30fd1e4b7f2f2faa7371599baa311c93 Author: Jochen Neumeister <[email protected]> AuthorDate: 2026-08-13 08:57:34 +0000 Commit: Jochen Neumeister <[email protected]> CommitDate: 2026-08-13 08:58:48 +0000 security/dogtag-pki: bound the rc onestop call during pkidestroy The Tomcat stop path called `service <instance> onestop` and blocked on rc.subr's wait_for_pids() indefinitely when the jsvc/JVM did not exit (e.g. a wedged webapp during pkidestroy). Bound the call with a timeout and fall back to SIGKILL so pkidestroy/uninstall can never hang. Sponsored by: Netzkommune GmbH --- security/dogtag-pki/Makefile | 2 +- ...h-base_server_python_pki_server_____init____.py | 70 +++++++++++++--------- 2 files changed, 43 insertions(+), 29 deletions(-) diff --git a/security/dogtag-pki/Makefile b/security/dogtag-pki/Makefile index 0f8a96dd5711..90ca09f6d05b 100644 --- a/security/dogtag-pki/Makefile +++ b/security/dogtag-pki/Makefile @@ -1,7 +1,7 @@ PORTNAME= dogtag-pki DISTVERSIONPREFIX= v DISTVERSION= 11.7.0 -PORTREVISION= 5 +PORTREVISION= 6 CATEGORIES= security java python MAINTAINER= [email protected] diff --git a/security/dogtag-pki/files/patch-base_server_python_pki_server_____init____.py b/security/dogtag-pki/files/patch-base_server_python_pki_server_____init____.py index 6287a1e98bc3..b6c3e1729ca6 100644 --- a/security/dogtag-pki/files/patch-base_server_python_pki_server_____init____.py +++ b/security/dogtag-pki/files/patch-base_server_python_pki_server_____init____.py @@ -137,7 +137,7 @@ @property def uid(self): return pwd.getpwnam(self.user).pw_uid -@@ -295,7 +347,7 @@ class PKIServer(object): +@@ -295,7 +349,7 @@ class PKIServer(object): raise pki.PKIException('Invalid instance: ' + self.name, None) def is_active(self): @@ -146,7 +146,7 @@ logger.debug('Command: %s', ' '.join(cmd)) rc = subprocess.call(cmd) return rc == 0 -@@ -362,13 +414,13 @@ class PKIServer(object): +@@ -362,13 +416,13 @@ class PKIServer(object): logger.info('Creating catalina.policy') # add "do not edit" warning @@ -162,7 +162,7 @@ logger.info('Appending %s', filename) with open(filename, 'r', encoding='utf-8') as f: content += f.read() -@@ -376,7 +428,7 @@ class PKIServer(object): +@@ -376,7 +430,7 @@ class PKIServer(object): content += '\n\n' # add PKI's default policy @@ -171,7 +171,7 @@ logger.info('Appending %s', filename) with open(filename, 'r', encoding='utf-8') as f: content += f.read() -@@ -450,7 +502,7 @@ grant codeBase "file:%s" { +@@ -450,7 +504,7 @@ grant codeBase "file:%s" { def start(self, wait=False, max_wait=60, timeout=None): @@ -180,7 +180,7 @@ logger.debug('Command: %s', ' '.join(cmd)) subprocess.check_call(cmd) -@@ -490,7 +542,11 @@ grant codeBase "file:%s" { +@@ -490,9 +544,24 @@ grant codeBase "file:%s" { def stop(self, wait=False, max_wait=60, timeout=None): @@ -191,9 +191,23 @@ + + cmd = ['/usr/sbin/service', self.rc_service_name, 'onestop'] logger.debug('Command: %s', ' '.join(cmd)) - subprocess.check_call(cmd) - -@@ -536,12 +592,17 @@ grant codeBase "file:%s" { +- subprocess.check_call(cmd) ++ # rc onestop relies on rc.subr wait_for_pids(), which blocks ++ # forever when the jsvc/JVM does not exit (e.g. a wedged webapp ++ # during pkidestroy). Bound it and fall back to SIGKILL so the ++ # caller never hangs indefinitely. ++ stop_timeout = timeout or max_wait ++ try: ++ subprocess.check_call(cmd, timeout=stop_timeout) ++ except subprocess.TimeoutExpired: ++ logger.warning( ++ '%s did not stop within %ss; sending SIGKILL', ++ self.rc_service_name, stop_timeout) ++ subprocess.call(['/bin/pkill', '-KILL', '-f', self.rc_service_name]) + + if not wait: + return +@@ -536,12 +605,17 @@ grant codeBase "file:%s" { self.start(wait=wait, max_wait=max_wait, timeout=timeout) def enable(self): @@ -213,7 +227,7 @@ logger.debug('Command: %s', ' '.join(cmd)) subprocess.check_call(cmd) -@@ -581,16 +642,20 @@ grant codeBase "file:%s" { +@@ -581,16 +655,20 @@ grant codeBase "file:%s" { for name in self.config: logger.debug('- %s: %s', name, self.config[name]) @@ -238,7 +252,7 @@ java_home = self.config.get('JAVA_HOME') java_opts = self.config.get('JAVA_OPTS') -@@ -599,12 +664,12 @@ grant codeBase "file:%s" { +@@ -599,12 +677,12 @@ grant codeBase "file:%s" { classpath = [ Tomcat.SHARE_DIR + '/bin/bootstrap.jar', Tomcat.SHARE_DIR + '/bin/tomcat-juli.jar', @@ -254,7 +268,7 @@ if with_valgrind: cmd.extend(['valgrind', '--trace-children=yes', '--tool=massif']) -@@ -618,7 +683,7 @@ grant codeBase "file:%s" { +@@ -618,7 +696,7 @@ grant codeBase "file:%s" { else: cmd.extend([java_home + '/bin/java']) @@ -263,7 +277,7 @@ cmd.extend([ '--add-opens', 'java.base/java.lang=ALL-UNNAMED', '--add-opens', 'java.base/java.io=ALL-UNNAMED', -@@ -661,7 +726,7 @@ grant codeBase "file:%s" { +@@ -661,7 +739,7 @@ grant codeBase "file:%s" { logger.debug('Command: %s', ' '.join(cmd)) @@ -272,7 +286,7 @@ def chown(self, path): -@@ -787,8 +852,8 @@ grant codeBase "file:%s" { +@@ -787,8 +865,8 @@ grant codeBase "file:%s" { self.create_logging_properties(exist_ok=True) self.create_web_xml(exist_ok=True) @@ -283,7 +297,7 @@ self.copy( Tomcat.TOMCAT_CONF, self.tomcat_conf, -@@ -798,7 +863,7 @@ grant codeBase "file:%s" { +@@ -798,7 +876,7 @@ grant codeBase "file:%s" { tomcat_conf = pki.PropertyFile(self.tomcat_conf, quote='"') tomcat_conf.read() @@ -292,7 +306,7 @@ java_home = os.getenv('JAVA_HOME') tomcat_conf.set('JAVA_HOME', java_home) -@@ -810,27 +875,21 @@ grant codeBase "file:%s" { +@@ -810,27 +888,21 @@ grant codeBase "file:%s" { tomcat_conf.write() @@ -324,7 +338,7 @@ self.makedirs(self.conf_dir, exist_ok=exist_ok) def create_logs_dir(self, exist_ok=False): -@@ -844,15 +903,15 @@ grant codeBase "file:%s" { +@@ -844,15 +916,15 @@ grant codeBase "file:%s" { backup_dir = os.path.join(self._logs_dir, 'backup') self.makedirs(backup_dir, exist_ok=exist_ok) @@ -343,7 +357,7 @@ backup_dir = os.path.join(self.logs_dir, 'backup') self.makedirs(backup_dir, exist_ok=exist_ok) -@@ -868,8 +927,8 @@ grant codeBase "file:%s" { +@@ -868,8 +940,8 @@ grant codeBase "file:%s" { def create_catalina_properties(self, exist_ok=False): @@ -354,7 +368,7 @@ catalina_properties = os.path.join( PKIServer.SHARE_DIR, 'server', 'conf', 'catalina.properties') -@@ -877,16 +936,16 @@ grant codeBase "file:%s" { +@@ -877,16 +949,16 @@ grant codeBase "file:%s" { def create_context_xml(self, exist_ok=False): @@ -375,7 +389,7 @@ logging_properties = os.path.join(Tomcat.CONF_DIR, 'logging.properties') self.copy( -@@ -896,7 +955,7 @@ grant codeBase "file:%s" { +@@ -896,7 +968,7 @@ grant codeBase "file:%s" { def create_server_xml(self, exist_ok=False): @@ -384,7 +398,7 @@ self.copy( pki.server.Tomcat.SERVER_XML, -@@ -973,7 +1032,7 @@ grant codeBase "file:%s" { +@@ -973,7 +1045,7 @@ grant codeBase "file:%s" { self.makedirs(host_dir, exist_ok=exist_ok) # Link <instance>/conf/<engine>/<host>/rewrite.config @@ -393,7 +407,7 @@ link = os.path.join(host_dir, 'rewrite.config') self.symlink(target, link, exist_ok=exist_ok) -@@ -982,8 +1041,8 @@ grant codeBase "file:%s" { +@@ -982,8 +1054,8 @@ grant codeBase "file:%s" { def create_web_xml(self, exist_ok=False): @@ -404,7 +418,7 @@ self.symlink( os.path.join(Tomcat.CONF_DIR, 'web.xml'), -@@ -1304,8 +1363,7 @@ grant codeBase "file:%s" { +@@ -1304,8 +1376,7 @@ grant codeBase "file:%s" { def remove(self, remove_conf=False, remove_logs=False, force=False): @@ -414,7 +428,7 @@ logger.info('Removing %s', self.work_dir) pki.util.rmtree(self.work_dir, force=force) -@@ -1327,7 +1385,7 @@ grant codeBase "file:%s" { +@@ -1327,7 +1398,7 @@ grant codeBase "file:%s" { logger.info('Removing %s', self.bin_dir) pki.util.unlink(self.bin_dir, force=force) @@ -423,7 +437,7 @@ if os.path.islink(self.nssdb_link): logger.info('Removing %s', self.nssdb_link) pki.util.unlink(self.nssdb_link) -@@ -1356,7 +1414,7 @@ grant codeBase "file:%s" { +@@ -1356,7 +1427,7 @@ grant codeBase "file:%s" { # Get the actual folder in case it has changed _logs_dir = os.readlink(self.logs_dir) @@ -432,7 +446,7 @@ logger.info('Removing %s', self.logs_dir) pki.util.unlink(self.logs_dir, force=force) -@@ -1366,7 +1424,7 @@ grant codeBase "file:%s" { +@@ -1366,7 +1437,7 @@ grant codeBase "file:%s" { return @@ -441,7 +455,7 @@ logger.info('Removing %s', self.logs_dir) pki.util.rmtree(self.logs_dir, force=force) -@@ -1377,17 +1435,17 @@ grant codeBase "file:%s" { +@@ -1377,17 +1448,17 @@ grant codeBase "file:%s" { # Get the actual folder in case it has changed _conf_dir = os.readlink(self.conf_dir) @@ -462,7 +476,7 @@ logger.info('Removing %s', self.conf_dir) pki.util.rmtree(self.conf_dir, force=force) -@@ -1468,11 +1526,11 @@ grant codeBase "file:%s" { +@@ -1468,11 +1539,11 @@ grant codeBase "file:%s" { subsystem_dir = os.path.join(self.base_dir, subsystem_name) @@ -476,7 +490,7 @@ # https://issues.redhat.com/browse/RHEL-21568 if not os.listdir(subsystem_dir): # Directory exists but it is empty -@@ -2398,7 +2456,11 @@ class PKIServerFactory(object): +@@ -2398,7 +2469,11 @@ class PKIServerFactory(object): instance_type = parts[0] instance_name = parts[1]