add tfa.json and its lock methods

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

diff --git a/src/PMG/Cluster.pm b/src/PMG/Cluster.pm
index d82a39275233f137716d5faab3e1ed65abf70310..31384b217d7e1ec524a27c844c110f05391c8b50 100644 (file)
--- a/src/PMG/Cluster.pm
+++ b/src/PMG/Cluster.pm
@@ -459,6 +459,7 @@ sub sync_config_from_master {
        'pmg-csrf.key',
        'ldap.conf',
        'user.conf',
+       'tfa.json',
        'domains',
        'mynetworks',
        'transport',

diff --git a/src/PMG/UserConfig.pm b/src/PMG/UserConfig.pm
index 42a7d207d274c816e5725dedbc98b7c0b5c5b62a..b9a83a768f5ddfaf9f85762abc95844028e6e636 100644 (file)
--- a/src/PMG/UserConfig.pm
+++ b/src/PMG/UserConfig.pm
@@ -2,8 +2,9 @@ package PMG::UserConfig;
 
 use strict;
 use warnings;
-use Data::Dumper;
+
 use Clone 'clone';
+use Scalar::Util 'weaken';
 
 use PVE::Tools;
 use PVE::INotify;
@@ -15,6 +16,9 @@ use PMG::Utils;
 my $inotify_file_id = 'pmg-user.conf';
 my $config_filename = '/etc/pmg/user.conf';
 
+my $tfa_inotify_file_id = 'pmg-tfa.json';
+my $tfa_config_filename = '/etc/pmg/tfa.json';
+
 sub new {
     my ($type) = @_;
 
@@ -32,14 +36,40 @@ sub write {
 }
 
 my $lockfile = "/var/lock/pmguser.lck";
+my $tfa_lockfile = "/var/lock/pmgtfa.lck";
 
+# Locking both config files together is only ever allowed in one order:
+#  1) tfa config
+#  2) user config
+# If we permit the other way round, too, we might end up deadlocking!
+my $user_config_locked;
 sub lock_config {
     my ($code, $errmsg) = @_;
 
+    my $locked = 1;
+    $user_config_locked = \$locked;
+    weaken $user_config_locked; # make this scope guard signal safe...
+
     my $p = PVE::Tools::lock_file($lockfile, undef, $code);
+    $user_config_locked = undef;
+    if (my $err = $@) {
+       $errmsg ? die "$errmsg: $err" : die $err;
+    }
+}
+
+# This lives here in order to enforce lock order.
+sub lock_tfa_config {
+    my ($code, $errmsg) = @_;
+
+    die "tfa config lock cannot be acquired while holding user config lock\n"
+       if ($user_config_locked && $$user_config_locked);
+
+    my $res = PVE::Tools::lock_file($tfa_lockfile, undef, $code);
     if (my $err = $@) {
        $errmsg ? die "$errmsg: $err" : die $err;
     }
+
+    return $res;
 }
 
 my $schema = {