X-Git-Url: https://git.hcoop.net/hcoop/domtool2.git/blobdiff_plain/e7905534fc80fd5eeee68f33cbdc15572c858b05..86e132be99dcdbf2271119267cea6b91eb8207c3:/src/main.sml diff --git a/src/main.sml b/src/main.sml index 2e350cc..f32fa2d 100644 --- a/src/main.sml +++ b/src/main.sml @@ -96,7 +96,24 @@ fun notTmp s = String.sub (s, 0) <> #"." andalso CharVector.all (fn ch => Char.isAlphaNum ch orelse ch = #"." orelse ch = #"_" orelse ch = #"-") s -fun checkDir dname = +fun setupUser () = + let + val user = + case Posix.ProcEnv.getenv "DOMTOOL_USER" of + NONE => + let + val uid = Posix.ProcEnv.getuid () + in + Posix.SysDB.Passwd.name (Posix.SysDB.getpwuid uid) + end + | SOME user => user + in + Acl.read Config.aclFile; + Domain.setUser user; + user + end + +fun checkDir' dname = let val b = basis () @@ -127,6 +144,10 @@ fun checkDir dname = ()) end +fun checkDir dname = + (setupUser (); + checkDir' dname) + fun reduce fname = let val (G, body) = check fname @@ -176,26 +197,10 @@ fun context x = (OpenSSL.context false x) handle e as OpenSSL.OpenSSL s => (print "Couldn't find your certificate.\nYou probably haven't been given any Domtool privileges.\n"; + print ("I looked in: " ^ #1 x ^ "\n"); print ("Additional information: " ^ s ^ "\n"); raise e) -fun setupUser () = - let - val user = - case Posix.ProcEnv.getenv "DOMTOOL_USER" of - NONE => - let - val uid = Posix.ProcEnv.getuid () - in - Posix.SysDB.Passwd.name (Posix.SysDB.getpwuid uid) - end - | SOME user => user - in - Acl.read Config.aclFile; - Domain.setUser user; - user - end - fun requestContext f = let val user = setupUser () @@ -261,7 +266,7 @@ fun requestDir dname = val _ = ErrorMsg.reset () - val (user, bio) = requestBio (fn () => checkDir dname) + val (user, bio) = requestBio (fn () => checkDir' dname) val b = basis () @@ -523,7 +528,7 @@ fun requestDbTable p = let val (user, bio) = requestBio (fn () => ()) in - Msg.send (bio, MsgCreateDbTable p); + Msg.send (bio, MsgCreateDb p); case Msg.recv bio of NONE => print "Server closed connection unexpectedly.\n" | SOME m => @@ -549,6 +554,21 @@ fun requestDbDrop p = OpenSSL.close bio end +fun requestDbGrant p = + let + val (user, bio) = requestBio (fn () => ()) + in + Msg.send (bio, MsgGrantDb p); + case Msg.recv bio of + NONE => print "Server closed connection unexpectedly.\n" + | SOME m => + case m of + MsgOk => print ("You've been granted all allowed privileges to database " ^ user ^ "_" ^ #dbname p ^ ".\n") + | MsgError s => print ("Grant failed: " ^ s ^ "\n") + | _ => print "Unexpected server reply.\n"; + OpenSSL.close bio + end + fun requestListMailboxes domain = let val (_, bio) = requestBio (fn () => ()) @@ -560,7 +580,7 @@ fun requestListMailboxes domain = case m of MsgMailboxes users => (Msg.send (bio, MsgOk); Vmail.Listing users) - | MsgError s => Vmail.Error ("Creation failed: " ^ s) + | MsgError s => Vmail.Error ("Listing failed: " ^ s) | _ => Vmail.Error "Unexpected server reply.") before OpenSSL.close bio end @@ -664,6 +684,21 @@ fun requestSmtpLog domain = OpenSSL.close bio end +fun requestMysqlFixperms () = + let + val (_, bio) = requestBio (fn () => ()) + in + Msg.send (bio, MsgMysqlFixperms); + case Msg.recv bio of + NONE => print "Server closed connection unexpectedly.\n" + | SOME m => + case m of + MsgOk => print "Permissions granted.\n" + | MsgError s => print ("Failed: " ^ s ^ "\n") + | _ => print "Unexpected server reply.\n"; + OpenSSL.close bio + end + fun requestApt {node, pkg} = let val (user, context) = requestContext (fn () => ()) @@ -838,14 +873,20 @@ fun requestFirewall {node, uname} = before OpenSSL.close bio end -fun regenerate context = +fun regenerateEither tc checker context = let + fun ifReal f = + if tc then + () + else + f () + val _ = ErrorMsg.reset () val b = basis () val () = Tycheck.disallowExterns () - val () = Domain.resetGlobal () + val () = ifReal Domain.resetGlobal val ok = ref true @@ -903,83 +944,31 @@ fun regenerate context = (ErrorMsg.reset (); print ("User " ^ user ^ "'s configuration has errors!\n")) else - app eval' files + app checker files end else () end - handle IO.Io _ => () - | OS.SysErr (s, _) => (print ("System error processing user " ^ user ^ ": " ^ s ^ "\n"); - ok := false) + handle IO.Io {name, function, ...} => + (print ("IO error processing user " ^ user ^ ": " ^ function ^ ": " ^ name ^ "\n"); + ok := false) + | exn as OS.SysErr (s, _) => (print ("System error processing user " ^ user ^ ": " ^ s ^ "\n"); + ok := false) | ErrorMsg.Error => (ErrorMsg.reset (); print ("User " ^ user ^ " had a compilation error.\n"); ok := false) | _ => (print "Unknown exception during regeneration!\n"; ok := false) in - app contactNode Config.nodeIps; - Env.pre (); + ifReal (fn () => (app contactNode Config.nodeIps; + Env.pre ())); app doUser (Acl.users ()); - Env.post (); + ifReal Env.post; !ok end -fun regenerateTc context = - let - val _ = ErrorMsg.reset () - - val b = basis () - val () = Tycheck.disallowExterns () - - val () = Domain.resetGlobal () - - val ok = ref true - - fun doUser user = - let - val _ = Domain.setUser user - val _ = ErrorMsg.reset () - - val dname = Config.domtoolDir user - in - if Posix.FileSys.access (dname, []) then - let - val dir = Posix.FileSys.opendir dname - - fun loop files = - case Posix.FileSys.readdir dir of - NONE => (Posix.FileSys.closedir dir; - files) - | SOME fname => - if notTmp fname then - loop (OS.Path.joinDirFile {dir = dname, - file = fname} - :: files) - else - loop files - - val files = loop [] - val (_, files) = Order.order (SOME b) files - in - if !ErrorMsg.anyErrors then - (ErrorMsg.reset (); - print ("User " ^ user ^ "'s configuration has errors!\n"); - ok := false) - else - app (ignore o check) files - end - else - () - end - handle IO.Io _ => () - | OS.SysErr (s, _) => print ("System error processing user " ^ user ^ ": " ^ s ^ "\n") - | ErrorMsg.Error => (ErrorMsg.reset (); - print ("User " ^ user ^ " had a compilation error.\n")) - | _ => print "Unknown exception during -tc regeneration!\n" - in - app doUser (Acl.users ()); - !ok - end +val regenerate = regenerateEither false eval' +val regenerateTc = regenerateEither true (ignore o check) fun rmuser user = let @@ -1252,7 +1241,7 @@ fun service () = SOME ("Error adding user: " ^ msg))) (fn () => ()) - | MsgCreateDbTable {dbtype, dbname} => + | MsgCreateDb {dbtype, dbname} => doIt (fn () => if Dbms.validDbname dbname then case Dbms.lookup dbtype of @@ -1286,6 +1275,23 @@ fun service () = SOME ("Invalid database name " ^ dbname))) (fn () => ()) + | MsgGrantDb {dbtype, dbname} => + doIt (fn () => + if Dbms.validDbname dbname then + case Dbms.lookup dbtype of + NONE => ("Database drop request with unknown datatype type " ^ dbtype, + SOME ("Unknown database type " ^ dbtype)) + | SOME handler => + case #grant handler {user = user, dbname = dbname} of + NONE => ("Grant permissions to database " ^ user ^ "_" ^ dbname ^ ".", + NONE) + | SOME msg => ("Error granting permissions to database " ^ user ^ "_" ^ dbname ^ ": " ^ msg, + SOME ("Error granting permissions to database: " ^ msg)) + else + ("Invalid database name " ^ user ^ "_" ^ dbname, + SOME ("Invalid database name " ^ dbname))) + (fn () => ()) + | MsgListMailboxes domain => doIt (fn () => if not (Domain.yourDomain domain) then @@ -1313,7 +1319,8 @@ fun service () = SOME "Invalid password; may only contain printable, non-space characters") else if not (Domain.yourPath mailbox) then ("User wasn't authorized to add a mailbox at " ^ mailbox, - SOME "You're not authorized to use that mailbox location.") + SOME ("You're not authorized to use that mailbox location. (" + ^ mailbox ^ ")")) else case Vmail.add {requester = user, domain = domain, user = emailUser, @@ -1400,6 +1407,16 @@ fun service () = NONE))) (fn () => ()) + | MsgMysqlFixperms => + doIt (fn () => if OS.Process.isSuccess + (OS.Process.system "/usr/bin/sudo -H /afs/hcoop.net/common/etc/scripts/mysql-grant-table-drop") then + ("Requested mysql-fixperms", + NONE) + else + ("Requested mysql-fixperms, but execution failed!", + SOME "Script execution failed.")) + (fn () => ()) + | _ => doIt (fn () => ("Unexpected command", SOME "Unexpected command"))