#! /usr/bin/python

import errno
import grp
import os
import pwd
import shutil
import subprocess
import sys

from syslog import syslog, LOG_ERR, LOG_NOTICE, LOG_INFO, LOG_DEBUG

from isi.misc import sysctlbyname

compliance_paths = {
    # bug 98769
    '/ifs/home/' :                          [ 0775, 'root', 'wheel' ],
    # bug 99784
    '/var/log' :                            [ 0775, 'root', 'wheel' ],
}

# Taken from mavericks-perm-harden

def chmod_chown(filename, permInfo):
    try:
        syslog(LOG_DEBUG,
                "mavericks-compliance-upgrade: " + \
                "changing permissions on %s to 0%o" % \
                (filename, permInfo[0]))
        os.chmod(filename, permInfo[0])

        uid = pwd.getpwnam(permInfo[1]).pw_uid
        gid = grp.getgrnam(permInfo[2]).gr_gid

        syslog(LOG_DEBUG,
                "mavericks-compliance-upgrade: " + \
                "changing ownership/group on %s to %s:%s (%d:%d)" %
                (filename, permInfo[1], permInfo[2], uid, gid))
        os.chown(filename, uid, gid)
    except OSError, e:
        # not all files are necessarily present, so don't treat ENOENT as
        # an error
        if e.errno != errno.ENOENT:
            syslog(LOG_ERR, "mavericks-compliance-upgrade: " + \
                    str(e))
            return 1
    except KeyError, e:
        syslog(LOG_ERR,
                "mavericks-compliance-upgrade: " + \
                "unknown user or group name (%s/%s) for %s" %
                (permInfo[1], permInfo[2], file))
        return 1
    except Exception, e:
        syslog(LOG_ERR, "mavericks-compliance-upgrade: unexpected error: " + \
                str(e))
        raise

    return 0

# Fix various permissions issues for compliance clusters.

def do_compliance_chmod_chown():
     if sysctlbyname('isi.compliance') == 1:
        for path, permInfo in compliance_paths.iteritems():
            chmod_chown(path, permInfo)

# Bug 99784. Allow compadmin to modify contents of /var/crash.

def add_compadmin_to_daemon_group():

    try:
        compadmin_uid = pwd.getpwnam('compadmin').pw_uid
    except KeyError, e:
        syslog(LOG_ERR, 'compadmin user does not exist.')
        return

    try:
        daemon_gid = grp.getgrnam('daemon').gr_gid
    except KeyError, e:
        syslog(LOG_ERR, 'daemon group does not exist.')
        return

    subprocess.call('/usr/sbin/pw groupmod daemon -m ' + str(compadmin_uid),
            shell = True)

# Bug 99153 and Bug 99154: Update sudoers on upgrades.

def update_sudoers():
    if sysctlbyname('isi.compliance') == 1:
        SUDOERS_NEW = '/etc/mcp/defaults/comp_sudoers'
        SUDOERS = '/usr/local/etc/sudoers'

        # Copy the new sudoers into place:
        try:
            shutil.copy(SUDOERS_NEW, SUDOERS)
        except Exception, e:
            syslog(LOG_ERR,
                   "mavericks-compliance-upgrade: error copying updated sudoers: " + \
                   str(e))
            return

        # If the QA environment is installed, re-apply the QA patch to sudoers
        # (As seen in qa/tests/worm/makecompliance.py):
        QA_PATH = '/var/crash/local_qa/bin'
        if os.path.exists(QA_PATH):
            SUDOERS_QA_PATCH = '/var/crash/local_qa/bin/worm/qa-sudoers'
            try:
                os.system('cat %s >> %s' % (SUDOERS_QA_PATCH, SUDOERS))
            except Exception, e:
                syslog(LOG_ERR,
                       "mavericks-compliance-upgrade: error applying QA-environment" \
                       " sudoers patch: " + str(e) + ". Granting all privileges to" \
                       " compadmin.")
                os.system('echo "compadmin ALL=(ALL) NOPASSWD: ALL" >> %s' % SUDOERS)
                return

def main():

    do_compliance_chmod_chown()
    add_compadmin_to_daemon_group()
    update_sudoers()

    syslog(LOG_NOTICE, 'mavericks-compliance-upgrade: complete.')

if __name__ == '__main__':
    main()
