dante 0.2.0 → 0.3.0

data/lib/dante/runner.rb

@@ -17,6 +17,10 @@ This is a utility for setting up a binary executable for a service.
 module Dante
   class Runner
     MAX_START_TRIES = 5
+    # Seconds a new daemon must stay up before it counts as started.
+    # ceiling: a daemon that dies later than this is still reported as started; a
+    # readiness signal from the startup block would close that.
+    START_GRACE = 1
 
     attr_accessor :options, :name, :description, :verify_options_hook
 
@@ -59,16 +63,7 @@ module Dante
 
         # If a username, uid, groupname, or gid is passed,
         # drop privileges accordingly.
-
-        if options[:group]
-          gid = options[:group].is_a?(Integer) ? options[:group] : Etc.getgrnam(options[:group]).gid
-          Process::GID.change_privilege(gid)
-        end
-
-        if options[:user]
-          uid = options[:user].is_a?(Integer) ? options[:user] : Etc.getpwnam(options[:user]).uid
-          Process::UID.change_privilege(uid)
-        end
+        switch_user(options[:user], options[:group]) if options[:user] || options[:group]
 
         @startup_command = block if block_given?
         options[:daemonize] ? daemonize : start
@@ -82,19 +77,48 @@ module Dante
          options[:log_path] = "/var/log/#{@name}.log"
       end
 
-      # Start process
+      # Start process: a session leader forks the daemon, then exits with success only
+      # if the daemon is still running START_GRACE seconds later. As the daemon's parent
+      # it sees the daemon exit at once, where the pid file cannot tell.
       pid = fork do
-        exit if fork
-        Process.setsid
-        exit if fork
-        store_pid(Process.pid)
-        File.umask 0000
-        redirect_output!
-        start
+        started = false
+        begin
+          Process.setsid
+          daemon = fork do
+            # Handle INT and TERM before the pid file tells the caller we have started
+            trap_signals
+            store_pid(Process.pid)
+            redirect_output!
+            start
+          end
+          started = daemon_survives?(daemon)
+          remove_pid_file(daemon) unless started # the pid of a daemon that is gone
+        rescue Exception => e
+          warn "#{e.class}: #{e.message}"
+        ensure
+          # Like Process.daemon, leave without running the at_exit handlers inherited
+          # from the caller: they are the caller's, and one that exits or raises would
+          # replace this exit status.
+          exit!(started)
+        end
+      end
+      waited = false
+      started = begin
+        survived = Process.waitpid2(pid)[1].success?
+        waited = true
+        # Ensure process is running
+        survived && until_true(MAX_START_TRIES) { self.daemon_running? }
+      rescue Errno::ECHILD
+        # SIGCHLD is ignored, so the session leader's status is lost. It has exited, though,
+        # removing the pid file of a daemon that died, so one look at the pid file tells.
+        waited = true
+        self.daemon_running?
+      ensure
+        # Interrupted while the session leader runs: reap it in the background, or it
+        # lingers as a zombie.
+        Process.detach(pid) unless waited
       end
-      Process.waitpid pid
-      # Ensure process is running
-      if until_true(MAX_START_TRIES) { self.daemon_running? }
+      if started
         log "Daemon has started successfully"
         true
       else # Failed to start
@@ -110,15 +134,7 @@ module Dante
          redirect_output! 
       end
 
-      trap("INT") {
-        interrupt
-        exit
-      }
-
-      trap("TERM"){
-        log "Trying to stop #{@name}..."
-        exit
-      }
+      trap_signals
 
       @startup_command.call(self.options) if @startup_command
     end
@@ -126,8 +142,18 @@ module Dante
     # Stops a daemonized process
     def stop(kill_arg=nil)
       if self.daemon_running?
-        kill_pid(kill_arg || options[:kill])
-        until_true(MAX_START_TRIES) { self.daemon_stopped? }
+        if wait_for_stop(kill_pid(kill_arg || options[:kill]))
+          FileUtils.rm options[:pid_path] # Only kill if we stopped the daemon
+          log "Daemonized process killed after term."
+        else
+          log "Failed to kill daemonized process"
+          if options[:force]
+            if wait_for_stop(kill_pid(kill_arg || options[:kill], 'KILL'))
+              FileUtils.rm options[:pid_path] # Only kill if we stopped the daemon
+              log "Daemonized process killed after kill."
+            end
+          end
+        end
       else # not running
         log "No #{@name} processes are running"
         false
@@ -157,7 +183,10 @@ module Dante
     # self.daemon_running?
     def daemon_running?
       return false unless File.exist?(options[:pid_path])
-      Process.kill 0, File.read(options[:pid_path]).to_i
+      return false unless pid = read_pid(options[:pid_path])
+      Process.kill 0, pid
+      true
+    rescue Errno::EPERM # the process exists but belongs to another user
       true
     rescue Errno::ESRCH
       false
@@ -170,7 +199,7 @@ module Dante
       OptionParser.new do |opts|
         opts.summary_width = 25
         opts.banner = [headline, "\n\n",
-                     "Usage: #{@name} [-p port] [-P file] [-d] [-k]\n",
+                     "Usage: #{@name} [-p port] [-P file] [-d] [-k] [-f]\n",
                      "       #{@name} --help\n"].compact.join("")
         opts.separator ""
 
@@ -202,33 +231,127 @@ module Dante
           options[:group] = group
         end
 
+        opts.on("-f", "--force", String, "Force kill if SIGTERM fails") do |v|
+          options[:force] = true
+        end
+
         opts.on_tail("-?", "--help", "Display this usage information.") do
           puts "#{opts}\n"
           exit
         end
-
+        
         # Load options specified through 'with_options'
         instance_exec(opts, &@with_options) if @with_options
       end.parse!
       options
     end
 
+    # Switches the process to user (a name or uid) and group (a name or gid). When running
+    # as root the group defaults to the user's primary group, and the supplementary groups
+    # (which changing the uid and gid leaves as they were) are set too: to the user's own
+    # groups, or to just the process's group for a group alone or a uid with no passwd
+    # entry. Otherwise only what was given changes. Everything is looked up before
+    # anything is changed.
+    def switch_user(user, group)
+      root = Process.euid == 0
+      passwd = if user.is_a?(Integer)
+                 begin
+                   Etc.getpwuid(user)
+                 rescue ArgumentError # a uid with no passwd entry
+                   nil
+                 end
+               elsif user
+                 Etc.getpwnam(user)
+               end
+      uid = passwd ? passwd.uid : user
+      gid = if group
+              group.is_a?(Integer) ? group : Etc.getgrnam(group).gid
+            elsif passwd && root
+              passwd.gid
+            end
+
+      if root
+        if passwd
+          Process.initgroups(passwd.name, gid)
+        else
+          Process.groups = [gid || Process.egid]
+        end
+      end
+      Process::GID.change_privilege(gid) if gid
+      Process::UID.change_privilege(uid) if uid
+    end
+
+    def trap_signals
+      trap("INT") {
+        interrupt
+        exit
+      }
+
+      trap("TERM"){
+        log "Trying to stop #{@name}..."
+        exit
+      }
+    end
+
     def store_pid(pid)
       FileUtils.mkdir_p(File.dirname(options[:pid_path]))
       File.open(options[:pid_path], 'w'){|f| f.write("#{pid}\n")}
     end
 
-    def kill_pid(k='*')
-      Dir[options[:pid_path]].each do |f|
+    # Whether daemon, a child of this process, is still running START_GRACE seconds after
+    # it was forked. When the caller's SIGCHLD handling reaps children itself (SIGCHLD
+    # ignored, or a handler that waits for them), waitpid cannot see the daemon, and
+    # signal 0 at the end of the grace period tells instead.
+    def daemon_survives?(daemon)
+      deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + START_GRACE
+      while Process.clock_gettime(Process::CLOCK_MONOTONIC) < deadline
+        return false if Process.waitpid(daemon, Process::WNOHANG)
+        sleep 0.1
+      end
+      true
+    rescue Errno::ECHILD
+      sleep [deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC), 0].max
+      begin
+        Process.kill(0, daemon)
+        true
+      rescue Errno::ESRCH
+        false
+      end
+    end
+
+    # Removes the pid file if it still holds pid (another start may have replaced it).
+    def remove_pid_file(pid)
+      File.delete(options[:pid_path]) if read_pid(options[:pid_path]) == pid
+    rescue Errno::ENOENT
+    end
+
+    # The pid in pid_file, or nil when it holds none: a pid file left empty by a crash
+    # between creating and writing it names no process (and pid 0 or a negative pid would
+    # signal a whole process group), nor does a number too large for a pid_t.
+    def read_pid(pid_file)
+      pid = File.read(pid_file).to_i
+      pid if pid > 0 && pid < 2**31
+    end
+
+    # Sends sig to the daemons, and returns whether it reached any of them.
+    def kill_pid(k='*', sig='TERM')
+      Dir[options[:pid_path]].count do |f|
         begin
-          pid = IO.read(f).chomp.to_i
-          FileUtils.rm f
-          Process.kill('TERM', pid)
-          log "Stopped PID: #{pid} at #{f}"
+          next false unless pid = read_pid(f)
+          Process.kill(sig, pid)
+          log "Sent SIG#{sig} to PID: #{pid} at #{f}"
+          true
         rescue => e
           log "Failed to stop! #{k}: #{e}"
+          false
         end
-      end
+      end > 0
+    end
+
+    # Waits for the daemon to stop once a signal reached it. When none did (the daemon
+    # belongs to another user), it cannot stop, so this only checks once.
+    def wait_for_stop(signalled)
+      signalled ? until_true(MAX_START_TRIES) { self.daemon_stopped? } : self.daemon_stopped?
     end
 
     # Redirect output based on log settings (reopens stdout/stderr to specified logfile)
@@ -242,20 +365,27 @@ module Dante
         # Set permissions on the log file
         File.chmod(0644, log_path)
         # Reopen $stdout (NOT +STDOUT+) to start writing to the log file
-        $stdout.reopen(log_path, 'a')
+        reopen_stream($stdout, log_path, 'a')
         # Redirect $stderr to $stdout
         $stderr.reopen $stdout
         $stdout.sync = true
       else # redirect to /dev/null
         # We're not bothering to sync if we're dumping to /dev/null
         # because /dev/null doesn't care about buffered output
-        $stdin.reopen '/dev/null'
-        $stdout.reopen '/dev/null', 'a'
+        reopen_stream($stdin, '/dev/null', 'r')
+        reopen_stream($stdout, '/dev/null', 'a')
         $stderr.reopen $stdout
       end
       log_path = options[:log_path] ? options[:log_path] : '/dev/null'
     end
 
+    # Reopens stream onto path, opened with mode. Reopening onto an open File rather
+    # than a path works whatever mode the stream itself was opened with (a socket, for
+    # one, when run under Spring or Zeus).
+    def reopen_stream(stream, path, mode)
+      File.open(path, mode) { |file| stream.reopen(file) }
+    end
+
     # Runs until the block condition is met or the timeout_seconds is exceeded
     # until_true(10) { ...return_condition... }
     def until_true(timeout_seconds, interval=1, &block)

data/lib/dante/version.rb

@@ -1,3 +1,3 @@
 module Dante
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 end

data/test/dante_test.rb

@@ -2,7 +2,7 @@ require File.expand_path('../test_helper', __FILE__)
 
 describe "dante module" do
   before do
-    @process = TestingProcess.new('a')
+    @process = TestingProcess.new('a', @tmpdir)
   end
 
   it "can run jobs using #run method" do
@@ -10,7 +10,7 @@ describe "dante module" do
       Dante.run('test-process') { @process.run_a! }
     end
     @output = File.read(@process.tmp_path)
-    assert_match /Started/, @output
+    assert_match(/Started/, @output)
   end
 
-end
+end