Move sonic-host-services-data from sonic-buildimage into this repo

This repo's tests depends on files that are in
src/sonic-host-services-data in sonic-buildimage. Due to PR check
requirements, this creates a cyclical dependency when needing to update
the templates and the sample output files.

To fix that cyclical dependency, move that directory into this repo.
That way, both the templates and the sample output files can be updated
in a single commit.

Signed-off-by: Saikrishna Arcot <sarcot@microsoft.com>

azure-pipelines.yml

@@ -7,13 +7,6 @@ trigger:
 - master
 - 202???
 
-resources:
-  repositories:
-  - repository: sonic-buildimage
-    type: github
-    name: sonic-net/sonic-buildimage
-    endpoint: build
-
 variables:
   - name: BUILD_BRANCH
     ${{ if eq(variables['Build.Reason'], 'PullRequest') }}:
@@ -42,16 +35,6 @@ stages:
       clean: true
       submodules: recursive
       displayName: 'Checkout code'
-
-    - checkout: sonic-buildimage
-      clean: true
-      displayName: 'Checkout code'
-
-    - task: CopyFiles@2
-      inputs:
-        SourceFolder: '$(System.DefaultWorkingDirectory)/sonic-buildimage/src/sonic-host-services-data/'
-        contents: '**'
-        targetFolder: $(System.DefaultWorkingDirectory)/sonic-host-services-data/
 
     - task: DownloadPipelineArtifact@2
       inputs:
@@ -102,8 +85,6 @@ stages:
       displayName: "Install .NET CORE"
 
     - script: |
-        pushd sonic-host-services
-
         python3 setup.py test
       displayName: 'Test Python 3'
 
@@ -124,7 +105,6 @@ stages:
 
     - script: |
         set -e
-        pushd sonic-host-services
         python3 setup.py bdist_wheel
       displayName: 'Build Python 3 wheel'
 

data/.gitignore

@@ -0,0 +1,6 @@
+debian/*.debhelper
+debian/debhelper-build-stamp
+debian/sonic-host-services-data/
+sonic-host-services-data_*.buildinfo
+sonic-host-services-data_*.changes
+sonic-host-services-data_*.deb

data/MAINTAINERS

@@ -0,0 +1,7 @@
+# This file describes the maintainers for sonic-host-services-data
+# See the SONiC project governance document for more information
+
+Name = "Joe LeVeque"
+Email = "jolevequ@microsoft.com"
+Github = jleveque
+Mailinglist = sonicproject@googlegroups.com

data/README.md

@@ -0,0 +1,19 @@
+# sonic-host-services-data
+Data files required for SONiC host services
+
+
+## To build
+
+```
+dpkg-buildpackage -rfakeroot -b -us -uc
+```
+
+## To clean
+
+```
+dpkg-buildpackage -rfakeroot -Tclean
+```
+
+---
+
+See the [SONiC Website](https://sonic-net.github.io/SONiC/) for more information about the SONiC project.

data/debian/changelog

@@ -0,0 +1,5 @@
+sonic-host-services-data (1.0-1) UNRELEASED; urgency=low
+
+  * Initial release
+
+ -- Joe LeVeque <jolevequ@microsoft.com>  Tue, 20 Oct 2020 02:35:43 +0000

data/debian/compat

@@ -0,0 +1 @@
+11

data/debian/control

@@ -0,0 +1,11 @@
+Source: sonic-host-services-data
+Maintainer: Joe LeVeque <jolevequ@microsoft.com>
+Section: misc
+Priority: optional
+Standards-Version: 0.1
+Build-Depends: debhelper (>=11)
+
+Package: sonic-host-services-data
+Architecture: all
+Depends: ${misc:Depends}
+Description: Data files required for SONiC host services

data/debian/install

@@ -0,0 +1,2 @@
+templates/*.j2    /usr/share/sonic/templates/
+org.sonic.hostservice.conf /etc/dbus-1/system.d

data/debian/rules

@@ -0,0 +1,24 @@
+#!/usr/bin/make -f
+
+ifeq (${ENABLE_HOST_SERVICE_ON_START}, y)
+	HOST_SERVICE_OPTS := --no-start
+else
+	HOST_SERVICE_OPTS := --no-start --no-enable
+endif
+
+
+build:
+
+%:
+	dh $@
+
+override_dh_installsystemd:
+	dh_installsystemd --no-start --name=caclmgrd
+	dh_installsystemd --no-start --name=hostcfgd
+	dh_installsystemd --no-start --name=featured
+	dh_installsystemd --no-start --name=aaastatsd
+	dh_installsystemd --no-start --name=procdockerstatsd
+	dh_installsystemd --no-start --name=determine-reboot-cause
+	dh_installsystemd --no-start --name=process-reboot-cause
+	dh_installsystemd $(HOST_SERVICE_OPTS) --name=sonic-hostservice
+

data/debian/sonic-host-services-data.aaastatsd.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=AAA Statistics Collection daemon
+Requires=hostcfgd.service
+After=hostcfgd.service updategraph.service
+BindsTo=sonic.target
+After=sonic.target
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/aaastatsd
+Restart=on-failure
+RestartSec=10
+TimeoutStopSec=3
+

data/debian/sonic-host-services-data.aaastatsd.timer

@@ -0,0 +1,12 @@
+[Unit]
+Description=Delays aaastatsd daemon until SONiC has started
+PartOf=aaastatsd.service
+
+[Timer]
+OnUnitActiveSec=0 sec
+OnBootSec=1min 30 sec
+Unit=aaastatsd.service
+
+[Install]
+WantedBy=timers.target sonic.target
+

data/debian/sonic-host-services-data.caclmgrd.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=Control Plane ACL configuration daemon
+Requires=updategraph.service
+After=updategraph.service
+BindsTo=sonic.target
+After=sonic.target
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/caclmgrd
+Restart=always
+RestartSec=30
+
+[Install]
+WantedBy=sonic.target

data/debian/sonic-host-services-data.determine-reboot-cause.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Reboot cause determination service
+Requires=rc-local.service database.service
+After=rc-local.service database.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/local/bin/determine-reboot-cause
+
+[Install]
+WantedBy=multi-user.target

data/debian/sonic-host-services-data.featured.service

@@ -0,0 +1,10 @@
+[Unit]
+Description=Feature configuration daemon
+Requires=updategraph.service
+After=updategraph.service
+BindsTo=sonic.target
+After=sonic.target
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/featured

data/debian/sonic-host-services-data.featured.timer

@@ -0,0 +1,12 @@
+[Unit]
+Description=Delays feature daemon until SONiC has started
+PartOf=featured.service
+
+[Timer]
+OnUnitActiveSec=0 sec
+OnBootSec=1min 30 sec
+Unit=featured.service
+
+[Install]
+WantedBy=timers.target sonic.target
+

data/debian/sonic-host-services-data.hostcfgd.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=Host config enforcer daemon
+Requires=updategraph.service
+After=updategraph.service
+BindsTo=sonic.target
+After=sonic.target
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/hostcfgd
+

data/debian/sonic-host-services-data.hostcfgd.timer

@@ -0,0 +1,12 @@
+[Unit]
+Description=Delays hostcfgd daemon until SONiC has started
+PartOf=hostcfgd.service
+
+[Timer]
+OnUnitActiveSec=0 sec
+OnBootSec=1min 30 sec
+Unit=hostcfgd.service
+
+[Install]
+WantedBy=timers.target sonic.target
+

data/debian/sonic-host-services-data.procdockerstatsd.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Process and docker CPU/memory utilization data export daemon
+Requires=database.service updategraph.service
+After=database.service updategraph.service
+BindsTo=sonic.target
+After=sonic.target
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/procdockerstatsd
+Restart=always
+
+[Install]
+WantedBy=sonic.target

data/debian/sonic-host-services-data.process-reboot-cause.service

@@ -0,0 +1,8 @@
+[Unit]
+Description=Retrieve the reboot cause from the history files and save them to StateDB
+Requires=database.service determine-reboot-cause.service
+After=database.service determine-reboot-cause.service
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/process-reboot-cause

data/debian/sonic-host-services-data.process-reboot-cause.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=Delays process-reboot-cause until network is stably connected
+
+[Timer]
+OnBootSec=1min 30 sec
+Unit=process-reboot-cause.service
+
+[Install]
+WantedBy=timers.target

data/debian/sonic-host-services-data.sonic-hostservice.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=SONiC Host Service
+
+[Service]
+Type=dbus
+BusName=org.SONiC.HostService
+
+ExecStart=/usr/bin/python3 -u /usr/local/bin/sonic-host-server
+
+Restart=on-failure
+RestartSec=10
+TimeoutStopSec=3
+
+[Install]
+WantedBy=mgmt-framework.service telemetry.service
+

data/org.sonic.hostservice.conf

@@ -0,0 +1,18 @@
+<!DOCTYPE busconfig PUBLIC
+ "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+<busconfig>
+
+  <!-- Only root can own the bus -->
+
+  <policy user="root">
+    <allow own_prefix="org.SONiC.HostService"/>
+  </policy>
+
+  <!-- Allow user "root" to invoke methods on the bus -->
+  <policy user="root">
+    <allow send_destination="org.SONiC.HostService"/>
+    <allow receive_sender="org.SONiC.HostService"/>
+  </policy>
+
+</busconfig>

data/templates/common-auth-sonic.j2

@@ -0,0 +1,83 @@
+#THIS IS AN AUTO-GENERATED FILE
+#
+# /etc/pam.d/common-auth- authentication settings common to all services
+# This file is included from other service-specific PAM config files,
+# and should contain a list of the authentication modules that define
+# the central authentication scheme for use on the system
+# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
+# traditional Unix authentication mechanisms.
+#
+# here are the per-package modules (the "Primary" block)
+
+{% if auth['login'] == 'local' %}
+auth	[success=1 default=ignore]	pam_unix.so nullok try_first_pass
+
+{% elif auth['login'] == 'local,tacacs+' %}
+auth	[success=done new_authtok_reqd=done default=ignore{{ ' auth_err=die' if not auth['failthrough'] }}]	pam_unix.so nullok try_first_pass
+{% for server in servers | sub(0, -1) %}
+auth	[success=done new_authtok_reqd=done default=ignore{{ ' auth_err=die' if not auth['failthrough'] }}]	pam_tacplus.so server={{ server.ip }}:{{ server.tcp_port }} secret={{ server.passkey }} login={{ server.auth_type }} timeout={{ server.timeout }} {% if server.vrf %} vrf={{ server.vrf }} {% endif %} {{ 'source_ip=%s' % src_ip if src_ip }} try_first_pass
+{% endfor %}
+{% if servers | count %}
+{% set last_server = servers | last %}
+auth	[success=1 default=ignore]	pam_tacplus.so server={{ last_server.ip }}:{{ last_server.tcp_port }} secret={{ last_server.passkey }} login={{ last_server.auth_type }} timeout={{ last_server.timeout }} {% if last_server.vrf %} vrf={{ last_server.vrf }} {% endif %} {{ 'source_ip=%s' % src_ip if src_ip }} try_first_pass
+
+{% endif %}
+{% elif auth['login'] == 'tacacs+' or auth['login'] == 'tacacs+,local' %}
+{% for server in servers %}
+auth	[success=done new_authtok_reqd=done default=ignore{{ ' auth_err=die' if not auth['failthrough'] }}]	pam_tacplus.so server={{ server.ip }}:{{ server.tcp_port }} secret={{ server.passkey }} login={{ server.auth_type }} timeout={{ server.timeout }} {%if server.vrf %} vrf={{ server.vrf }} {% endif %} {{ 'source_ip=%s' % src_ip if src_ip }} try_first_pass
+{% endfor %}
+auth	[success=1 default=ignore]	pam_unix.so nullok try_first_pass
+
+{% elif auth['login'] == 'local,radius' %}
+auth	[success=done new_authtok_reqd=done default=ignore{{ ' auth_err=die maxtries=die' if not auth['failthrough'] }}]	pam_unix.so nullok try_first_pass
+# For the RADIUS servers, on success jump to the cacheing the MPL(Privilege)
+{% for server in servers %}
+auth	[success={{ (servers | count) - loop.index0 }} new_authtok_reqd=done default=ignore{{ ' auth_err=die' if not auth['failthrough'] }}]	pam_radius_auth.so conf=/etc/pam_radius_auth.d/{{ server.ip }}_{{ server.auth_port }}.conf privilege_level protocol={{ server.auth_type }} retry={{ server.retransmit }}{% if server.nas_ip is defined %} nas_ip_address={{ server.nas_ip }}{% endif %}{% if server.nas_id is defined %} client_id={{ server.nas_id }}{% endif %}{% if debug %} debug{% endif %}{% if trace %} trace{% endif %}{% if server.statistics %} statistics={{ server.ip }}{% endif %} try_first_pass
+{% endfor %}
+auth	requisite	pam_deny.so
+# Cache MPL(Privilege)
+auth	[success=1 default=ignore]	pam_exec.so /usr/sbin/cache_radius
+
+{% elif auth['login'] == 'radius,local' %}
+# root user can only be authenticated locally. Jump to local.
+{% if servers | count %}
+auth	[success={{ (servers | count) }} default=ignore]	pam_succeed_if.so user = root
+{% else %}
+auth	[success=ok default=ignore]	pam_succeed_if.so user = root
+{% endif %}
+# For the RADIUS servers, on success jump to the cache the MPL(Privilege)
+{% for server in servers %}
+auth	[success={{ (servers | count) + 1 - loop.index0 }} new_authtok_reqd=done default=ignore{{ ' auth_err=die' if not auth['failthrough'] }}]	pam_radius_auth.so conf=/etc/pam_radius_auth.d/{{ server.ip }}_{{ server.auth_port }}.conf privilege_level protocol={{ server.auth_type }} retry={{ server.retransmit }}{% if server.nas_ip is defined %} nas_ip_address={{ server.nas_ip }}{% endif %}{% if server.nas_id is defined %} client_id={{ server.nas_id }}{% endif %}{% if debug %} debug{% endif %}{% if trace %} trace{% endif %}{% if server.statistics %} statistics={{ server.ip }}{% endif %} try_first_pass
+{% endfor %}
+# Local
+auth	[success=done new_authtok_reqd=done default=ignore{{ ' auth_err=die maxtries=die' if not auth['failthrough'] }}]	pam_unix.so nullok try_first_pass
+auth	requisite	pam_deny.so
+# Cache MPL(Privilege)
+auth	[success=1 default=ignore]	pam_exec.so /usr/sbin/cache_radius
+
+{% elif auth['login'] == 'radius' %}
+# root user can only be authenticated locally. Jump to local.
+auth	[success={{ (servers | count) + 2 }} default=ignore]	pam_succeed_if.so user = root
+# For the RADIUS servers, on success jump to the cache the MPL(Privilege)
+{% for server in servers %}
+auth	[success={{ (servers | count) - loop.index0 }} new_authtok_reqd=done default=ignore{{ ' auth_err=die' if not auth['failthrough'] }}]	pam_radius_auth.so conf=/etc/pam_radius_auth.d/{{ server.ip }}_{{ server.auth_port }}.conf privilege_level protocol={{ server.auth_type }} retry={{ server.retransmit }}{% if server.nas_ip is defined %} nas_ip_address={{ server.nas_ip }}{% endif %}{% if server.nas_id is defined %} client_id={{ server.nas_id }}{% endif %}{% if debug %} debug{% endif %}{% if trace %} trace{% endif %}{% if server.statistics %} statistics={{ server.ip }}{% endif %} try_first_pass
+{% endfor %}
+auth	requisite	pam_deny.so
+# Cache MPL(Privilege)
+auth	[success=2 default=ignore]	pam_exec.so /usr/sbin/cache_radius
+# Local
+auth	[success=done new_authtok_reqd=done default=ignore{{ ' auth_err=die maxtries=die' if not auth['failthrough'] }}]	pam_unix.so nullok try_first_pass
+
+{% else %}
+auth	[success=1 default=ignore]	pam_unix.so nullok try_first_pass
+
+{% endif %}
+#
+# here's the fallback if no module succeeds
+auth    requisite                       pam_deny.so
+# prime the stack with a positive return value if there isn't one already;
+# this avoids us returning an error just because nothing sets a success code
+# since the modules above will each just jump around
+auth    required                        pam_permit.so
+# and here are more per-package modules (the "Additional" block)
+