T7709: use write_file_sync/atomic in vyos-save-config.py script

Config save is provided by the helper script in both CLI and
configsession (hence also in the http api).

Use utilities write_file_sync and write_file_atomic, in accordance with
permissions and location:

If the target is in /opt/vyatta/etc/config or /config, use
write_file_sync; if, moreover, the caller has permissions, use
write_file_atomic. Otherwise, fall back to util write_file.

1 files changed, 43 insertions, 9 deletions

diff --git a/src/helpers/vyos-save-config.py b/src/helpers/vyos-save-config.py
index adf62b71d..208fb8ae8 100755
--- a/src/helpers/vyos-save-config.py
+++ b/src/helpers/vyos-save-config.py
@@ -23,15 +23,22 @@ from argparse import ArgumentParser
 
 from vyos.config import Config
 from vyos.remote import urlc
-from vyos.component_version import add_system_version
+from vyos.component_version import add_system_version_string
 from vyos.defaults import directories
+from vyos.utils.file import write_file
+from vyos.utils.file import write_file_sync
+from vyos.utils.file import write_file_atomic
+from vyos.utils.file import file_is_persistent
 
 DEFAULT_CONFIG_PATH = os.path.join(directories['config'], 'config.boot')
 remote_save = None
 
 parser = ArgumentParser(description='Save configuration')
 parser.add_argument('file', type=str, nargs='?', help='Save configuration to file')
-parser.add_argument('--write-json-file', type=str, help='Save JSON of configuration to file')
+parser.add_argument(
+    '--write-json-file', type=str, help='Save JSON of configuration to file'
+)
+
 args = parser.parse_args()
 file = args.file
 json_file = args.write_json_file
@@ -47,16 +54,43 @@ if re.match(r'\w+:/', save_file):
     except ValueError as e:
         sys.exit(e)
 
+
 config = Config()
 ct = config.get_config_tree(effective=True)
 
+# The effective config is None before boot configuration is complete.
+# Nothing to write, nor do we want to invite saving an empty string:
+# exit gracefully.
+if ct is None:
+    sys.exit()
+
+config_str = ct.to_string()
+versioned_config_str = add_system_version_string(config_str)
+
 # pylint: disable=consider-using-with
-write_file = save_file if remote_save is None else NamedTemporaryFile(delete=False).name
+file_to_write = (
+    save_file if remote_save is None else NamedTemporaryFile(delete=False).name
+)
 
-# config_tree is None before boot configuration is complete;
-# automated saves should check boot_configuration_complete
-config_str = None if ct is None else ct.to_string()
-add_system_version(config_str, write_file)
+if file_is_persistent(file_to_write):
+    if os.geteuid() == 0:
+        try:
+            write_file_atomic(file_to_write, versioned_config_str)
+        except OSError as e:
+            print(f'failed to write config file, write_file_atomic: {e}')
+            sys.exit(1)
+    else:
+        try:
+            write_file_sync(file_to_write, versioned_config_str)
+        except OSError as e:
+            print(f'failed to write config file, write_file_sync: {e}')
+            sys.exit(1)
+else:
+    try:
+        write_file(file_to_write, versioned_config_str)
+    except Exception as e:  # pylint: disable=broad-exception-caught
+        print(f'failed to write config file, write_file: {e}')
+        sys.exit(1)
 
 if json_file is not None and ct is not None:
     try:
@@ -67,6 +101,6 @@ if json_file is not None and ct is not None:
 
 if remote_save is not None:
     try:
-        remote_save.upload(write_file)
+        remote_save.upload(file_to_write)
     finally:
-        os.remove(write_file)
+        os.remove(file_to_write)