#! @PYTHON@
# Copyright (C) 2001-2018 by the Free Software Foundation, Inc.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
# USA.
"""Primary start-up and shutdown script for Mailman's qrunner daemon.
This script starts, stops, and restarts the main Mailman queue runners, making
sure that the various long-running qrunners are still alive and kicking. It
does this by forking and exec'ing the qrunners and waiting on their pids.
When it detects a subprocess has exited, it may restart it.
The qrunners respond to SIGINT, SIGTERM, and SIGHUP. SIGINT and SIGTERM both
cause the qrunners to exit cleanly, but the master will only restart qrunners
that have exited due to a SIGINT. SIGHUP causes the master and the qrunners
to close their log files, and reopen then upon the next printed message.
The master also responds to SIGINT, SIGTERM, and SIGHUP, which it simply
passes on to the qrunners (note that the master will close and reopen its own
log files on receipt of a SIGHUP). The master also leaves its own process id
in the file data/master-qrunner.pid but you normally don't need to use this
pid directly. The `start', `stop', `restart', and `reopen' commands handle
everything for you.
Usage: %(PROGRAM)s [options] [ start | stop | restart | reopen ]
Options:
-n/--no-restart
Don't restart the qrunners when they exit because of an error or a
SIGINT. They are never restarted if they exit in response to a
SIGTERM. Use this only for debugging. Only useful if the `start'
command is given.
-u/--run-as-user
Normally, this script will refuse to run if the user id and group id
are not set to the `mailman' user and group (as defined when you
configured Mailman). If run as root, this script will change to this
user and group before the check is made.
This can be inconvenient for testing and debugging purposes, so the -u
flag means that the step that sets and checks the uid/gid is skipped,
and the program is run as the current user and group. This flag is
not recommended for normal production environments.
Note though, that if you run with -u and are not in the mailman group,
you may have permission problems, such as begin unable to delete a
list's archives through the web. Tough luck!
-s/--stale-lock-cleanup
If mailmanctl finds an existing master lock, it will normally exit
with an error message. With this option, mailmanctl will perform an
extra level of checking. If a process matching the host/pid described
in the lock file is running, mailmanctl will still exit, but if no
matching process is found, mailmanctl will remove the apparently stale
lock and make another attempt to claim the master lock.
-q/--quiet
Don't print status messages. Error messages are still printed to
standard error.
-h/--help
Print this message and exit.
Commands:
start - Start the master daemon and all qrunners. Prints a message and
exits if the master daemon is already running.
stop - Stops the master daemon and all qrunners. After stopping, no
more messages will be processed.
restart - Restarts the qrunners, but not the master process. Use this
whenever you upgrade or update Mailman so that the qrunners will
use the newly installed code.
reopen - This will close all log files, causing them to be re-opened the
next time a message is written to them
"""
import sys
import os
import time
import getopt
import signal
import errno
import pwd
import grp
import socket
import paths
from Mailman import mm_cfg
from Mailman import Utils
from Mailman import LockFile
from Mailman import Errors
from Mailman.MailList import MailList
from Mailman.i18n import C_
from Mailman.Logging.Syslog import syslog
from Mailman.Logging.Utils import LogStdErr
PROGRAM = sys.argv[0]
COMMASPACE = ', '
DOT = '.'
# Locking contantsa
LOCKFILE = os.path.join(mm_cfg.LOCK_DIR, mm_cfg.MASTER_LOCK_FILE)
# Since we wake up once per day and refresh the lock, the LOCK_LIFETIME
# needn't be (much) longer than SNOOZE. We pad it 6 hours just to be safe.
LOCK_LIFETIME = mm_cfg.days(1) + mm_cfg.hours(6)
SNOOZE = mm_cfg.days(1)
MAX_RESTARTS = 10
LogStdErr('error', 'mailmanctl', manual_reprime=0)
def usage(code, msg=''):
if code:
fd = sys.stderr
else:
fd = sys.stdout
print >> fd, C_(__doc__)
if msg:
print >> fd, msg
sys.exit(code)
def kill_watcher(sig):
try:
fp = open(mm_cfg.PIDFILE)
pidstr = fp.read()
fp.close()
pid = int(pidstr.strip())
except (IOError, ValueError), e:
# For i18n convenience
pidfile = mm_cfg.PIDFILE
print >> sys.stderr, C_('PID unreadable in: %(pidfile)s')
print >> sys.stderr, e
print >> sys.stderr, C_('Is qrunner even running?')
return
try:
os.kill(pid, sig)
except OSError, e:
if e.errno <> errno.ESRCH: raise
print >> sys.stderr, C_('No child with pid: %(pid)s')
print >> sys.stderr, e
print >> sys.stderr, C_('Stale pid file removed.')
os.unlink(mm_cfg.PIDFILE)
def get_lock_data():
# Return the hostname, pid, and tempfile
fp = open(LOCKFILE)
filename = os.path.split(fp.read().strip())[1]
fp.close()
parts = filename.split('.')
hostname = DOT.join(parts[1:-1])
pid = int(parts[-1])
return hostname, int(pid), filename
def qrunner_state():
# 1 if proc exists on host (but is it qrunner? ;)
# 0 if host matches but no proc
# hostname if hostname doesn't match
hostname, pid, tempfile = get_lock_data()
if hostname <> socket.gethostname():
return hostname
# Find out if the process exists by calling kill with a signal 0.
try:
os.kill(pid, 0)
except OSError, e:
if e.errno <> errno.ESRCH: raise
return 0
return 1
def acquire_lock_1(force):
# Be sure we can acquire the master qrunner lock. If not, it means some
# other master qrunner daemon is already going.
lock = LockFile.LockFile(LOCKFILE, LOCK_LIFETIME)
try:
lock.lock(0.1)
return lock
except LockFile.TimeOutError:
# If we're not forcing or the lock can't be determined to be stale.
if not force or qrunner_state():
raise
# Force removal of lock first
lock._disown()
hostname, pid, tempfile = get_lock_data()
os.unlink(LOCKFILE)
os.unlink(os.path.join(mm_cfg.LOCK_DIR, tempfile))
return acquire_lock_1(force=0)
def acquire_lock(force):
try:
lock = acquire_lock_1(force)
return lock
except LockFile.TimeOutError:
status = qrunner_state()
if status == 1:
# host matches and proc exists
print >> sys.stderr, C_("""\
The master qrunner lock could not be acquired because it appears as if another
master qrunner is already running.
""")
elif status == 0:
# host matches but no proc
print >> sys.stderr, C_("""\
The master qrunner lock could not be acquired. It appears as though there is
a stale master qrunner lock. Try re-running mailmanctl with the -s flag.
""")
else:
# host doesn't even match
print >> sys.stderr, C_("""\
The master qrunner lock could not be acquired, because it appears as if some
process on some other host may have acquired it. We can't test for stale
locks across host boundaries, so you'll have to do this manually. Or, if you
know the lock is stale, re-run mailmanctl with the -s flag.
Lock file: %(LOCKFILE)s
Lock host: %(status)s
Exiting.""")
def start_runner(qrname, slice, count):
pid = os.fork()
if pid:
# parent
return pid
# child
#
# Craft the command line arguments for the exec() call.
rswitch = '--runner=%s:%d:%d' % (qrname, slice, count)
exe = os.path.join(mm_cfg.BIN_DIR, 'qrunner')
# mm_cfg.PYTHON, which is the absolute path to the Python interpreter,
# must be given as argv[0] due to Python's library search algorithm.
os.execl(mm_cfg.PYTHON, mm_cfg.PYTHON, exe, rswitch, '-s')
# Should never get here
raise RuntimeError, 'os.execl() failed'
def start_all_runners():
kids = {}
for qrname, count in mm_cfg.QRUNNERS:
for slice in range(count):
# queue runner name, slice, numslices, restart count
info = (qrname, slice, count, 0)
pid = start_runner(qrname, slice, count)
kids[pid] = info
return kids
def check_for_site_list():
sitelistname = mm_cfg.MAILMAN_SITE_LIST
try:
sitelist = MailList(sitelistname, lock=0)
except Errors.MMUnknownListError:
print >> sys.stderr, C_('Site list is missing: %(sitelistname)s')
syslog('error', 'Site list is missing: %s', mm_cfg.MAILMAN_SITE_LIST)
sys.exit(1)
def check_privs():
# If we're running as root (uid == 0), coerce the uid and gid to that
# which Mailman was configured for, and refuse to run if we didn't coerce
# the uid/gid.
gid = grp.getgrnam(mm_cfg.MAILMAN_GROUP)[2]
uid = pwd.getpwnam(mm_cfg.MAILMAN_USER)[2]
myuid = os.geteuid()
if myuid == 0:
# Set the process's supplimental groups.
groups = [x[2] for x in grp.getgrall() if mm_cfg.MAILMAN_USER in x[3]]
groups.append(gid)
try:
os.setgroups(groups)
except AttributeError:
# Python 2.1 doesn't have setgroups
syslog('error', 'Warning: unable to setgroups(%s)' % groups)
os.setgid(gid)
os.setuid(uid)
elif myuid <> uid:
name = mm_cfg.MAILMAN_USER
usage(1, C_(
'Run this program as root or as the %(name)s user, or use -u.'))
def main():
global quiet
try:
opts, args = getopt.getopt(sys.argv[1:], 'hnusq',
['help', 'no-start', 'run-as-user',
'stale-lock-cleanup', 'quiet'])
except getopt.error, msg:
usage(1, msg)
restart = 1
checkprivs = 1
force = 0
quiet = 0
for opt, arg in opts:
if opt in ('-h', '--help'):
usage(0)
elif opt in ('-n', '--no-restart'):
restart = 0
elif opt in ('-u', '--run-as-user'):
checkprivs = 0
elif opt in ('-s', '--stale-lock-cleanup'):
force = 1
elif opt in ('-q', '--quiet'):
quiet = 1
if len(args) < 1:
usage(1, C_('No command given.'))
elif len(args) > 1:
command = COMMASPACE.join(args)
usage(1, C_('Bad command: %(command)s'))
if checkprivs:
check_privs()
else:
print C_('Warning! You may encounter permission problems.')
# Handle the commands
command = args[0].lower()
if command == 'stop':
# Sent the master qrunner process a SIGINT, which is equivalent to
# giving cron/qrunner a ctrl-c or KeyboardInterrupt. This will
# effectively shut everything down.
if not quiet:
print C_("Shutting down Mailman's master qrunner")
kill_watcher(signal.SIGTERM)
elif command == 'restart':
# Sent the master qrunner process a SIGHUP. This will cause the
# master qrunner to kill and restart all the worker qrunners, and to
# close and re-open its log files.
if not quiet:
print C_("Restarting Mailman's master qrunner")
kill_watcher(signal.SIGINT)
elif command == 'reopen':
if not quiet:
print C_('Re-opening all log files')
kill_watcher(signal.SIGHUP)
elif command == 'start':
# First, complain loudly if there's no site list.
check_for_site_list()
# Here's the scoop on the processes we're about to create. We'll need
# one for each qrunner, and one for a master child process watcher /
# lock refresher process.
#
# The child watcher process simply waits on the pids of the children
# qrunners. Unless explicitly disabled by a mailmanctl switch (or the
# children are killed with SIGTERM instead of SIGINT), the watcher
# will automatically restart any child process that exits. This
# allows us to be more robust, and also to implement restart by simply
# SIGINT'ing the qrunner children, and letting the watcher restart
# them.
#
# Under normal operation, we have a child per queue. This lets us get
# the most out of the available resources, since a qrunner with no
# files in its queue directory is pretty cheap, but having a separate
# runner process per queue allows for a very responsive system. Some
# people want a more traditional (i.e. MM2.0.x) cron-invoked qrunner.
# No problem, but using mailmanctl isn't the answer. So while
# mailmanctl hard codes some things, others, such as the number of
# qrunners per queue, is configurable in mm_cfg.py.
#
# First, acquire the master mailmanctl lock
lock = acquire_lock(force)
if not lock:
return
# Daemon process startup according to Stevens, Advanced Programming in
# the UNIX Environment, Chapter 13.
pid = os.fork()
if pid:
# parent
if not quiet:
print C_("Starting Mailman's master qrunner.")
# Give up the lock "ownership". This just means the foreground
# process won't close/unlock the lock when it finalizes this lock
# instance. We'll let the mater watcher subproc own the lock.
lock._transfer_to(pid)
return
# child
lock._take_possession()
# First, save our pid in a file for "mailmanctl stop" rendezvous. We
# want the perms on the .pid file to be rw-rw----
omask = os.umask(6)
try:
fp = open(mm_cfg.PIDFILE, 'w')
print >> fp, os.getpid()
fp.close()
finally:
os.umask(omask)
# Create a new session and become the session leader, but since we
# won't be opening any terminal devices, don't do the ultra-paranoid
# suggestion of doing a second fork after the setsid() call.
os.setsid()
# Be sure to close any open std{in,out,err}
devnull = os.open('/dev/null', 0)
os.dup2(devnull, 0)
os.dup2(devnull, 1)
os.dup2(devnull, 2)
# Instead of cd'ing to root, cd to the Mailman installation home
os.chdir(mm_cfg.PREFIX)
# Set our file mode creation umask
os.umask(007)
# I don't think we have any unneeded file descriptors.
#
# Now start all the qrunners. This returns a dictionary where the
# keys are qrunner pids and the values are tuples of the following
# form: (qrname, slice, count). This does its own fork and exec, and
# sets up its own signal handlers.
kids = start_all_runners()
# Set up a SIGALRM handler to refresh the lock once per day. The lock
# lifetime is 1day+6hours so this should be plenty.
def sigalrm_handler(signum, frame, lock=lock):
lock.refresh()
signal.alarm(mm_cfg.days(1))
signal.signal(signal.SIGALRM, sigalrm_handler)
signal.alarm(mm_cfg.days(1))
# Set up a SIGHUP handler so that if we get one, we'll pass it along
# to all the qrunner children. This will tell them to close and
# reopen their log files
def sighup_handler(signum, frame, kids=kids):
# Closing our syslog will cause it to be re-opened at the next log
# print output.
syslog.close()
for pid in kids.keys():
os.kill(pid, signal.SIGHUP)
# And just to tweak things...
syslog('qrunner',
'Master watcher caught SIGHUP. Re-opening log files.')
signal.signal(signal.SIGHUP, sighup_handler)
# We also need to install a SIGTERM handler because that's what init
# will kill this process with when changing run levels.
def sigterm_handler(signum, frame, kids=kids):
for pid in kids.keys():
try:
os.kill(pid, signal.SIGTERM)
except OSError, e:
if e.errno <> errno.ESRCH: raise
syslog('qrunner', 'Master watcher caught SIGTERM. Exiting.')
signal.signal(signal.SIGTERM, sigterm_handler)
# Finally, we need a SIGINT handler which will cause the sub-qrunners
# to exit, but the master will restart SIGINT'd sub-processes unless
# the -n flag was given.
def sigint_handler(signum, frame, kids=kids):
for pid in kids.keys():
os.kill(pid, signal.SIGINT)
syslog('qrunner', 'Master watcher caught SIGINT. Restarting.')
signal.signal(signal.SIGINT, sigint_handler)
# Now we're ready to simply do our wait/restart loop. This is the
# master qrunner watcher.
try:
while 1:
try:
pid, status = os.wait()
except OSError, e:
# No children? We're done
if e.errno == errno.ECHILD:
break
# If the system call got interrupted, just restart it.
elif e.errno <> errno.EINTR:
raise
continue
killsig = exitstatus = None
if os.WIFSIGNALED(status):
killsig = os.WTERMSIG(status)
if os.WIFEXITED(status):
exitstatus = os.WEXITSTATUS(status)
# We'll restart the process unless we were given the
# "no-restart" switch, or if the process was SIGTERM'd or
# exitted with a SIGTERM exit status. This lets us better
# handle runaway restarts (say, if the subproc had a syntax
# error!)
restarting = ''
if restart:
if (exitstatus == None and killsig <> signal.SIGTERM) or \
(killsig == None and exitstatus <> signal.SIGTERM):
# Then
restarting = '[restarting]'
qrname, slice, count, restarts = kids[pid]
del kids[pid]
syslog('qrunner', """\
Master qrunner detected subprocess exit
(pid: %d, sig: %s, sts: %s, class: %s, slice: %d/%d) %s""",
pid, killsig, exitstatus, qrname,
slice+1, count, restarting)
# See if we've reached the maximum number of allowable restarts
if exitstatus <> signal.SIGINT:
restarts += 1
if restarts > MAX_RESTARTS:
syslog('qrunner', """\
Qrunner %s reached maximum restart limit of %d, not restarting.""",
qrname, MAX_RESTARTS)
restarting = ''
# Now perhaps restart the process unless it exited with a
# SIGTERM or we aren't restarting.
if restarting:
newpid = start_runner(qrname, slice, count)
kids[newpid] = (qrname, slice, count, restarts)
finally:
# Should we leave the main loop for any reason, we want to be sure
# all of our children are exited cleanly. Send SIGTERMs to all
# the child processes and wait for them all to exit.
for pid in kids.keys():
try:
os.kill(pid, signal.SIGTERM)
except OSError, e:
if e.errno == errno.ESRCH:
# The child has already exited
syslog('qrunner', 'ESRCH on pid: %d', pid)
del kids[pid]
# Wait for all the children to go away
while 1:
try:
pid, status = os.wait()
except OSError, e:
if e.errno == errno.ECHILD:
break
elif e.errno <> errno.EINTR:
raise
continue
# Finally, give up the lock
lock.unlock(unconditionally=1)
os._exit(0)
if __name__ == '__main__':
main()
