From 65d38af9e27f894ec8260b9d8d7bcbdcb79b5c0f Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Wed, 4 Sep 2019 13:32:56 -0400 Subject: [PATCH] Skip lock and fork in ipa-server-guard on unsupported ops On startup certmonger performs a number of options on the configured CA (IPA, not to be confused with the real dogtag CA) and the tracking requests. Break early for operations that are not supported by ipa-submit. This will save both a fork and a lock call. https://bugzilla.redhat.com/show_bug.cgi?id=1656519 Reviewed-By: Fraser Tweedale --- install/certmonger/ipa-server-guard.in | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/install/certmonger/ipa-server-guard.in b/install/certmonger/ipa-server-guard.in index db6a1157e..265f78adf 100644 --- a/install/certmonger/ipa-server-guard.in +++ b/install/certmonger/ipa-server-guard.in @@ -35,11 +35,24 @@ import six from ipapython import ipautil from ipaserver.install import certs +# Return codes. Names of the constants are taken from +# https://git.fedorahosted.org/cgit/certmonger.git/tree/src/submit-e.h +OPERATION_NOT_SUPPORTED_BY_HELPER = 6 + def main(): if len(sys.argv) < 2: raise RuntimeError("Not enough arguments") + # Avoid the lock if the operation is unsupported by ipa-submit + operation = os.environ.get('CERTMONGER_OPERATION') + if operation not in ('IDENTIFY', + 'FETCH-ROOTS', + 'GET-NEW-REQUEST-REQUIREMENTS', + 'SUBMIT', + 'POLL'): + return OPERATION_NOT_SUPPORTED_BY_HELPER + with certs.renewal_lock: result = ipautil.run(sys.argv[1:], raiseonerr=False, env=os.environ) if six.PY2: