T7709: use write_file_sync/atomic in vyos-save-config.py script

Config save is provided by the helper script in both CLI and
configsession (hence also in the http api).

Use utilities write_file_sync and write_file_atomic, in accordance with
permissions and location:

If the target is in /opt/vyatta/etc/config or /config, use
write_file_sync; if, moreover, the caller has permissions, use
write_file_atomic. Otherwise, fall back to util write_file.

2 files changed, 53 insertions, 9 deletions

diff --git a/python/vyos/component_version.py b/python/vyos/component_version.py
index 136bd36e8..13fb8333f 100644
--- a/python/vyos/component_version.py
+++ b/python/vyos/component_version.py
@@ -209,6 +209,16 @@ def version_info_prune_component(x: VersionInfo, y: VersionInfo) -> VersionInfo:
     x.component = {k: v for k, v in x.component.items() if k in y.component}
 
 
+def add_system_version_string(config_str: str = None) -> str:
+    """Wrap config string with system version and return string."""
+    version_info = version_info_from_system()
+    if config_str is not None:
+        version_info.update_config_body(config_str)
+    version_info.update_footer()
+
+    return version_info.write_string()
+
+
 def add_system_version(config_str: str = None, out_file: str = None):
     """Wrap config string with system version and write to out_file.
 
diff --git a/src/helpers/vyos-save-config.py b/src/helpers/vyos-save-config.py
index adf62b71d..208fb8ae8 100755
--- a/src/helpers/vyos-save-config.py
+++ b/src/helpers/vyos-save-config.py
@@ -23,15 +23,22 @@ from argparse import ArgumentParser
 
 from vyos.config import Config
 from vyos.remote import urlc
-from vyos.component_version import add_system_version
+from vyos.component_version import add_system_version_string
 from vyos.defaults import directories
+from vyos.utils.file import write_file
+from vyos.utils.file import write_file_sync
+from vyos.utils.file import write_file_atomic
+from vyos.utils.file import file_is_persistent
 
 DEFAULT_CONFIG_PATH = os.path.join(directories['config'], 'config.boot')
 remote_save = None
 
 parser = ArgumentParser(description='Save configuration')
 parser.add_argument('file', type=str, nargs='?', help='Save configuration to file')
-parser.add_argument('--write-json-file', type=str, help='Save JSON of configuration to file')
+parser.add_argument(
+    '--write-json-file', type=str, help='Save JSON of configuration to file'
+)
+
 args = parser.parse_args()
 file = args.file
 json_file = args.write_json_file
@@ -47,16 +54,43 @@ if re.match(r'\w+:/', save_file):
     except ValueError as e:
         sys.exit(e)
 
+
 config = Config()
 ct = config.get_config_tree(effective=True)
 
+# The effective config is None before boot configuration is complete.
+# Nothing to write, nor do we want to invite saving an empty string:
+# exit gracefully.
+if ct is None:
+    sys.exit()
+
+config_str = ct.to_string()
+versioned_config_str = add_system_version_string(config_str)
+
 # pylint: disable=consider-using-with
-write_file = save_file if remote_save is None else NamedTemporaryFile(delete=False).name
+file_to_write = (
+    save_file if remote_save is None else NamedTemporaryFile(delete=False).name
+)
 
-# config_tree is None before boot configuration is complete;
-# automated saves should check boot_configuration_complete
-config_str = None if ct is None else ct.to_string()
-add_system_version(config_str, write_file)
+if file_is_persistent(file_to_write):
+    if os.geteuid() == 0:
+        try:
+            write_file_atomic(file_to_write, versioned_config_str)
+        except OSError as e:
+            print(f'failed to write config file, write_file_atomic: {e}')
+            sys.exit(1)
+    else:
+        try:
+            write_file_sync(file_to_write, versioned_config_str)
+        except OSError as e:
+            print(f'failed to write config file, write_file_sync: {e}')
+            sys.exit(1)
+else:
+    try:
+        write_file(file_to_write, versioned_config_str)
+    except Exception as e:  # pylint: disable=broad-exception-caught
+        print(f'failed to write config file, write_file: {e}')
+        sys.exit(1)
 
 if json_file is not None and ct is not None:
     try:
@@ -67,6 +101,6 @@ if json_file is not None and ct is not None:
 
 if remote_save is not None:
     try:
-        remote_save.upload(write_file)
+        remote_save.upload(file_to_write)
     finally:
-        os.remove(write_file)
+        os.remove(file_to_write)