[25637] | 1 | #!/usr/bin/perl -w |
---|
| 2 | # |
---|
| 3 | # Workstation "verification" script |
---|
| 4 | # |
---|
| 5 | |
---|
| 6 | use strict; |
---|
| 7 | use Getopt::Std; |
---|
| 8 | use File::Basename; |
---|
| 9 | use AptPkg::Config '$_config'; |
---|
| 10 | use AptPkg::Cache; |
---|
| 11 | |
---|
| 12 | my $logfile = "/var/log/verify_ws.log"; |
---|
| 13 | my $verify_dir = "/afs/athena.mit.edu/system/athena10/verify"; |
---|
| 14 | |
---|
[25640] | 15 | ($> == 0) || die "You must be root to run this.\n"; |
---|
[25637] | 16 | |
---|
| 17 | our ($opt_d,$opt_s) = (0,''); |
---|
| 18 | |
---|
| 19 | getopts('ds:') || die "Usage: $0 [-d]\n"; |
---|
| 20 | |
---|
| 21 | if ($opt_d) { |
---|
| 22 | open(LOG, ">&STDOUT") || die "Can't dup stdout"; |
---|
| 23 | } else { |
---|
| 24 | open(LOG, ">>$logfile") || die "Cannot append to logfile: $!"; |
---|
| 25 | } |
---|
| 26 | |
---|
| 27 | my %MIRRORS_OK = (); |
---|
| 28 | my %COMPONENTS_OK = (); |
---|
| 29 | my %SUITES_OK = (); |
---|
| 30 | my %DA_MIRRORS_OK = (); |
---|
| 31 | my %DA_COMPONENTS_OK = (); |
---|
| 32 | my %DA_SUITES_OK = (); |
---|
| 33 | my %APTKEYS_OK = (); |
---|
| 34 | my %DEBSUMS_MISSING_PKG_OK = (); |
---|
| 35 | my %DEBSUMS_MISSING_FILE_OK = (); |
---|
| 36 | my %DEBSUMS_CHANGED_FILE_OK = (); |
---|
| 37 | |
---|
| 38 | my $errors = 0; |
---|
| 39 | my $warns = 0; |
---|
| 40 | my %checks = ('sources' => 1, |
---|
| 41 | 'keys' => 1, |
---|
| 42 | 'debsums' => 1, |
---|
| 43 | 'policy', => 1 ); |
---|
| 44 | |
---|
| 45 | |
---|
| 46 | # Initialize the APT configuration |
---|
| 47 | $_config->init; |
---|
| 48 | my $cache = AptPkg::Cache->new; |
---|
| 49 | my $policy = $cache->policy; |
---|
| 50 | |
---|
| 51 | # Basic setup |
---|
| 52 | my $codename = `/usr/bin/lsb_release -sc`; |
---|
| 53 | die "Can't determine codename" unless ($? == 0); |
---|
| 54 | chomp($codename); |
---|
| 55 | |
---|
| 56 | if ($opt_s) { |
---|
| 57 | foreach my $skip (split(',', $opt_s)) { |
---|
| 58 | die "Can't skip unknown check '$skip'" unless exists($checks{$skip}); |
---|
| 59 | warn("Skipping check '$skip'"); |
---|
| 60 | $checks{$skip} = 0; |
---|
| 61 | } |
---|
| 62 | } |
---|
| 63 | |
---|
| 64 | sub debug { |
---|
| 65 | $opt_d && print LOG "DEBUG: ", @_, "\n"; |
---|
| 66 | } |
---|
| 67 | |
---|
| 68 | sub error { |
---|
| 69 | $errors = 1; |
---|
| 70 | print LOG "ERROR: ", @_, "\n"; |
---|
| 71 | } |
---|
| 72 | |
---|
| 73 | sub wank { |
---|
| 74 | $warns = 1; |
---|
| 75 | print LOG "WARNING: ", @_, "\n"; |
---|
| 76 | } |
---|
| 77 | |
---|
| 78 | sub loadConfigFile { |
---|
| 79 | my ($filename, $hashref) = @_; |
---|
| 80 | open(F, join('/', $verify_dir, $codename, $filename)) || |
---|
| 81 | die "Can't open '$filename' file: $!"; |
---|
| 82 | foreach my $line (<F>) { |
---|
| 83 | next if ($line =~ /^#/); |
---|
| 84 | next unless ($line =~ /\w/); |
---|
| 85 | chomp $line; |
---|
| 86 | $hashref->{$line} = 1; |
---|
| 87 | } |
---|
| 88 | close(F); |
---|
| 89 | } |
---|
| 90 | |
---|
| 91 | sub checkSourcesList { |
---|
| 92 | my ($filename, $mirrorsok, $suitesok, $componentsok) = @_; |
---|
| 93 | if (open(SLIST, $filename)) { |
---|
| 94 | while (<SLIST>) { |
---|
| 95 | next if /^#/; |
---|
| 96 | next unless /\w/; |
---|
| 97 | my ($type, $mirror, $suite, @components) = split(' ', $_); |
---|
| 98 | error($filename, ":", $., " Unknown first field ($type)") unless |
---|
| 99 | ($type =~ /^deb(-src){0,1}$/); |
---|
| 100 | $mirror =~ s|/+$||g; |
---|
| 101 | error($filename, ":", $., " Unknown mirror ($mirror)") unless |
---|
| 102 | exists($mirrorsok->{$mirror}); |
---|
| 103 | error($filename, ":", $., " Unknown suite ($suite)") unless |
---|
| 104 | exists($suitesok->{$suite}); |
---|
| 105 | foreach my $c (@components) { |
---|
| 106 | error($filename, ":", $., " Unknown component ($c)") unless |
---|
| 107 | exists($componentsok->{$c}); |
---|
| 108 | } |
---|
| 109 | } |
---|
| 110 | close(SLIST); |
---|
| 111 | } else { |
---|
| 112 | error("Couldn't open file ($filename): $!"); |
---|
| 113 | } |
---|
| 114 | } |
---|
| 115 | |
---|
| 116 | sub checkAptSources { |
---|
| 117 | my $sourceslist = join('', $_config->get('Dir'), |
---|
| 118 | $_config->get('Dir::Etc'), |
---|
| 119 | $_config->get('Dir::Etc::sourcelist')); |
---|
| 120 | |
---|
| 121 | wank("sources.list ($sourceslist) looks funny") unless |
---|
| 122 | ((-f $sourceslist) && ($sourceslist eq "/etc/apt/sources.list")); |
---|
| 123 | |
---|
| 124 | |
---|
| 125 | my $sourceslistd = join('', $_config->get('Dir'), |
---|
| 126 | $_config->get('Dir::Etc'), |
---|
| 127 | $_config->get('Dir::Etc::sourceparts')); |
---|
| 128 | |
---|
| 129 | wank("sources.list.d ($sourceslistd) looks funny") unless |
---|
| 130 | ((-d $sourceslistd ) && ($sourceslistd eq "/etc/apt/sources.list.d")); |
---|
| 131 | |
---|
| 132 | debug("Looking at sources.list ($sourceslist)"); |
---|
| 133 | checkSourcesList($sourceslist, \%MIRRORS_OK, \%SUITES_OK, \%COMPONENTS_OK); |
---|
| 134 | |
---|
| 135 | foreach my $file (glob '/etc/apt/sources.list.d/*.list') { |
---|
| 136 | debug("Looking at $file"); |
---|
| 137 | if (basename($file) eq "debathena.list") { |
---|
| 138 | checkSourcesList($file, |
---|
| 139 | \%DA_MIRRORS_OK, |
---|
| 140 | { $codename => 1 }, |
---|
| 141 | \%DA_COMPONENTS_OK); |
---|
| 142 | } elsif (basename($file) eq "debathena.clusterinfo.list") { |
---|
| 143 | checkSourcesList($file, |
---|
| 144 | \%DA_MIRRORS_OK, |
---|
| 145 | \%DA_SUITES_OK, |
---|
| 146 | \%DA_COMPONENTS_OK); |
---|
| 147 | } else { |
---|
| 148 | error("Unknown additional sources.list file ($file)"); |
---|
| 149 | } |
---|
| 150 | } |
---|
| 151 | } |
---|
| 152 | |
---|
| 153 | sub checkAptKeys { |
---|
| 154 | debug("Checking apt keys..."); |
---|
| 155 | my $apt_keys = qx'/usr/bin/apt-key finger'; |
---|
| 156 | die "Can't run apt-key" unless ($? == 0); |
---|
| 157 | $apt_keys =~ s/^.*?\n(?=pub)//s; |
---|
| 158 | foreach my $k (split(/\n\n/, $apt_keys)) { |
---|
| 159 | if ($k =~ /^\s+Key fingerprint = (.*)\nuid\s+(\S.*)$/m) { |
---|
| 160 | error("Unknown fingerprint ($1) for key ($2)") unless exists($APTKEYS_OK{$1}); |
---|
| 161 | } |
---|
| 162 | } |
---|
| 163 | } |
---|
| 164 | |
---|
| 165 | sub debsums { |
---|
| 166 | debug("Running debsums"); |
---|
| 167 | # Bad-ideas: Since debsums is itself written in Perl... |
---|
| 168 | open(DEBSUMS, "/usr/bin/debsums -as 2>&1 |") || die "Can't run debsums"; |
---|
| 169 | foreach my $sum (<DEBSUMS>) { |
---|
| 170 | chomp $sum; |
---|
| 171 | if ($sum =~ /^debsums: no md5sums for (\S+)/) { |
---|
| 172 | error("$sum") unless exists($DEBSUMS_MISSING_PKG_OK{$1}); |
---|
| 173 | } elsif ($sum =~ /^debsums: changed file (\S+)/) { |
---|
| 174 | error("$sum") unless exists($DEBSUMS_CHANGED_FILE_OK{$1}); |
---|
| 175 | } elsif ($sum =~ /^debsums: missing file (\S+)/) { |
---|
| 176 | error("$sum") unless exists($DEBSUMS_MISSING_FILE_OK{$1}); |
---|
| 177 | } else { |
---|
| 178 | error("Unexpected debsums output: $sum"); |
---|
| 179 | } |
---|
| 180 | } |
---|
| 181 | close(DEBSUMS); |
---|
| 182 | } |
---|
| 183 | |
---|
| 184 | sub checkPackage { |
---|
| 185 | my $pkgname = shift; |
---|
| 186 | debug("Checking package $pkgname"); |
---|
| 187 | my $pkg = $cache->{$pkgname}; |
---|
| 188 | unless ($pkg) { |
---|
| 189 | error("Can't find $pkgname in cache"); |
---|
| 190 | return 0; |
---|
| 191 | } |
---|
| 192 | # use Data::Dumper; |
---|
| 193 | # $Data::Dumper::Maxdepth = 2; |
---|
| 194 | # print Dumper($pkg); |
---|
| 195 | # exit; |
---|
| 196 | if ($pkg->{CurrentState} ne 'Installed') { |
---|
| 197 | if ($pkg->{CurrentState} eq 'ConfigFiles') { |
---|
| 198 | wank("Package $pkgname still has config files"); |
---|
| 199 | } elsif ($pkg->{CurrentState} eq 'NotInstalled') { |
---|
| 200 | wank("Package $pkgname should have been autoremoved."); |
---|
| 201 | } else { |
---|
| 202 | error("Package $pkgname in weird state " . $pkg->{CurrentState}); |
---|
| 203 | } |
---|
| 204 | return 0; |
---|
| 205 | } |
---|
| 206 | my $currver = ''; |
---|
| 207 | if ($pkg->{CurrentVer}) { |
---|
| 208 | $currver = $pkg->{CurrentVer}{VerStr}; |
---|
| 209 | } |
---|
| 210 | my $fromrepo = 0; |
---|
| 211 | foreach my $file (@{$pkg->{CurrentVer}{FileList}}) { |
---|
| 212 | next if ($file->{File}->{IndexType} ne 'Debian Package Index'); |
---|
| 213 | if ($file->{File}->{Origin} =~ /^(Ubuntu|Debathena)$/) { |
---|
| 214 | $fromrepo = 1; |
---|
| 215 | } |
---|
| 216 | } |
---|
| 217 | if ($pkgname =~ /^linux-(headers|image)-/) { |
---|
| 218 | wank("Old kernel package ($pkgname) needs cleanup!"); |
---|
| 219 | } else { |
---|
| 220 | error("$pkgname ($currver) cannot be installed from a repository!") unless ($fromrepo); |
---|
| 221 | } |
---|
| 222 | } |
---|
| 223 | |
---|
| 224 | sub checkInstallability { |
---|
| 225 | debug("Checking installability of installed packages"); |
---|
| 226 | # Todo: multiarch |
---|
| 227 | my %seen = (); |
---|
| 228 | # Seriously, why can't I do this natively? |
---|
| 229 | open(PKGLIST, '/usr/bin/dpkg-query -W -f \'${Package}\n\' |') || die "Can't run dpkg-query"; |
---|
| 230 | while (<PKGLIST>) { |
---|
| 231 | chomp; |
---|
| 232 | next if exists($seen{$_}); |
---|
| 233 | $seen{$_} = 1; |
---|
| 234 | checkPackage($_); |
---|
| 235 | } |
---|
| 236 | close(PKGLIST); |
---|
| 237 | } |
---|
| 238 | |
---|
| 239 | # __main__ |
---|
| 240 | |
---|
| 241 | defined($ENV{'APT_CONFIG'}) && wank("APT_CONFIG is defined and shouldn't be"); |
---|
| 242 | |
---|
| 243 | print LOG "Workstation verification beginning at ", |
---|
| 244 | scalar(localtime()), "\n"; |
---|
| 245 | |
---|
| 246 | # Load configuration from AFS |
---|
| 247 | foreach ('', '-updates', '-security') { |
---|
| 248 | $SUITES_OK{join('', $codename, $_)} = 1; |
---|
| 249 | } |
---|
| 250 | $DA_SUITES_OK{$codename} = 1; |
---|
| 251 | if (-s "/var/run/athena-clusterinfo.sh") { |
---|
| 252 | my $apt_release = qx'. /var/run/athena-clusterinfo.sh && echo -n $APT_RELEASE'; |
---|
| 253 | if ($apt_release !~ /^(production|proposed|development)$/) { |
---|
| 254 | error("Unknown APT_RELEASE value ($apt_release)"); |
---|
| 255 | } elsif ($apt_release ne "production") { |
---|
| 256 | $DA_SUITES_OK{join('', $codename, '-', $apt_release)} = 1; |
---|
| 257 | if ($apt_release eq "development") { |
---|
| 258 | $DA_SUITES_OK{join('', $codename, '-', 'proposed')} = 1; |
---|
| 259 | } |
---|
| 260 | } |
---|
| 261 | } else { |
---|
| 262 | warn("No clusterinfo!"); |
---|
| 263 | } |
---|
| 264 | loadConfigFile('mirrors', \%MIRRORS_OK); |
---|
| 265 | loadConfigFile('components', \%COMPONENTS_OK); |
---|
| 266 | loadConfigFile('debathena-mirrors', \%DA_MIRRORS_OK); |
---|
| 267 | loadConfigFile('debathena-components', \%DA_COMPONENTS_OK); |
---|
| 268 | loadConfigFile('aptkeys', \%APTKEYS_OK); |
---|
| 269 | loadConfigFile('debsums-missing-packages', \%DEBSUMS_MISSING_PKG_OK); |
---|
| 270 | loadConfigFile('debsums-missing-files', \%DEBSUMS_MISSING_FILE_OK); |
---|
| 271 | loadConfigFile('debsums-changed-files', \%DEBSUMS_CHANGED_FILE_OK); |
---|
| 272 | |
---|
| 273 | $checks{'keys'} && checkAptKeys(); |
---|
| 274 | $checks{'sources'} && checkAptSources(); |
---|
[25701] | 275 | $checks{'debsums'} && debsums(); |
---|
[25637] | 276 | $checks{'policy'} && checkInstallability(); |
---|
| 277 | close(LOG); |
---|
| 278 | if ($errors) { |
---|
| 279 | exit 1; |
---|
| 280 | } |
---|
| 281 | if ($warns) { |
---|
| 282 | exit 2; |
---|
| 283 | } |
---|
| 284 | exit 0; |
---|