Merge pull request #4657 from jestabro/sync-config-on-save

T7709: add explicit sync and atomic write on config file save

3 files changed, 59 insertions, 3 deletions

diff --git a/python/vyos/component_version.py b/python/vyos/component_version.py
index 136bd36e8..13fb8333f 100644
--- a/python/vyos/component_version.py
+++ b/python/vyos/component_version.py
@@ -209,6 +209,16 @@ def version_info_prune_component(x: VersionInfo, y: VersionInfo) -> VersionInfo:
     x.component = {k: v for k, v in x.component.items() if k in y.component}
 
 
+def add_system_version_string(config_str: str = None) -> str:
+    """Wrap config string with system version and return string."""
+    version_info = version_info_from_system()
+    if config_str is not None:
+        version_info.update_config_body(config_str)
+    version_info.update_footer()
+
+    return version_info.write_string()
+
+
 def add_system_version(config_str: str = None, out_file: str = None):
     """Wrap config string with system version and write to out_file.
 
diff --git a/python/vyos/utils/file.py b/python/vyos/utils/file.py
index 1e2de2b39..c363b5bdc 100644
--- a/python/vyos/utils/file.py
+++ b/python/vyos/utils/file.py
@@ -14,6 +14,9 @@
 # License along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 import os
+import tempfile
+from contextlib import contextmanager
+
 from vyos.utils.permission import chown
 
 def makedir(path, user=None, group=None):
@@ -185,3 +188,36 @@ def wait_for_file_write_complete(file_path, pre_hook=None, timeout=None, sleep_i
     """ Waits for a process to close a file after opening it in write mode. """
     wait_for_inotify(file_path,
       event_type='IN_CLOSE_WRITE', pre_hook=pre_hook, timeout=timeout, sleep_interval=sleep_interval)
+
+def copy_chown(source, target):
+    import shutil
+    import stat
+
+    shutil.copy2(source, target)
+    st = os.stat(source)
+    os.chown(target, st[stat.ST_UID], st[stat.ST_GID])
+
+
+@contextmanager
+def write_file_atomic(file_path, mode='w'):
+    with open(file_path, mode) as _:
+        pass
+    temp_file = tempfile.NamedTemporaryFile(
+        delete=False, dir=os.path.dirname(file_path)
+    )
+    if os.path.exists(file_path):
+        copy_chown(file_path, temp_file.name)
+
+    file = open(temp_file.name, mode)
+    try:
+        yield file
+    finally:
+        file.flush()
+        os.fsync(file.fileno())
+        file.close()
+        os.replace(temp_file.name, file_path)
+        if os.path.exists(temp_file.name):
+            try:
+                os.unlink(temp_file.name)
+            except Exception:
+                pass
diff --git a/src/helpers/vyos-save-config.py b/src/helpers/vyos-save-config.py
index adf62b71d..fa1f5625d 100755
--- a/src/helpers/vyos-save-config.py
+++ b/src/helpers/vyos-save-config.py
@@ -23,15 +23,18 @@ from argparse import ArgumentParser
 
 from vyos.config import Config
 from vyos.remote import urlc
-from vyos.component_version import add_system_version
+from vyos.component_version import add_system_version_string
 from vyos.defaults import directories
+from vyos.utils.file import write_file_atomic
 
 DEFAULT_CONFIG_PATH = os.path.join(directories['config'], 'config.boot')
 remote_save = None
 
 parser = ArgumentParser(description='Save configuration')
 parser.add_argument('file', type=str, nargs='?', help='Save configuration to file')
-parser.add_argument('--write-json-file', type=str, help='Save JSON of configuration to file')
+parser.add_argument(
+    '--write-json-file', type=str, help='Save JSON of configuration to file'
+)
 args = parser.parse_args()
 file = args.file
 json_file = args.write_json_file
@@ -56,7 +59,14 @@ write_file = save_file if remote_save is None else NamedTemporaryFile(delete=Fal
 # config_tree is None before boot configuration is complete;
 # automated saves should check boot_configuration_complete
 config_str = None if ct is None else ct.to_string()
-add_system_version(config_str, write_file)
+versioned_config_str = add_system_version_string(config_str)
+
+try:
+    with write_file_atomic(write_file) as f:
+        f.write(versioned_config_str)
+except OSError as e:
+    print(f'failed to write config file: {e}')
+    sys.exit(1)
 
 if json_file is not None and ct is not None:
     try: