From 06efc45019fd1122456f6071ac99b91c739d1338 Mon Sep 17 00:00:00 2001 From: Loic Dachary Date: Tue, 29 May 2018 11:33:02 +0200 Subject: [PATCH 1/2] journalist notifications: allow 30 minutes variance in reboot times The race condition goes as follows: - machine reboots - notification sent - machine reboots 24h later but reboots 1 minute faster than the previous day - notification is sent 23h59 minutes after the last one and suppressed The notification will be sent the next day but the information it contains will not reflect what happened in the past 24h because the cron job manage.py were-there-submissions-today updates it daily, one hour before the machine reboots. To resolve this race condition (or make it extremely unlikely) we allow for notifications to be sent at most every 23h30. Case 1: machine is slower to reboot the next day: - machine reboots - notification sent - machine reboots 24h later but reboots 5 minutes slower than the previous day - notification is processed 24h05 minutes after the last one, it is more tha 23h30 and therefore the notification is sent Case 2: machine is faster to reboot the next day: - machine reboots - notification sent - machine reboots 24h later but reboots 8 minutes faster than the previous day - notification is processed 23h52 minutes after the last one, it is more tha 23h30 and therefore the notification is sent --- .../roles/ossec/files/process_submissions_today.sh | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/install_files/ansible-base/roles/ossec/files/process_submissions_today.sh b/install_files/ansible-base/roles/ossec/files/process_submissions_today.sh index b55fb146fe..f335288db1 100755 --- a/install_files/ansible-base/roles/ossec/files/process_submissions_today.sh +++ b/install_files/ansible-base/roles/ossec/files/process_submissions_today.sh @@ -17,8 +17,18 @@ function main() { function modified_in_the_past_24h() { local stamp stamp="$1" + # + # 24h is 1440 minutes but we subtract 30min to avoid the following race condition + # + # - machine reboots + # - notification sent + # - machine reboots 24h later but reboots 1 minute faster than the previous day + # - notification is sent 23h59 minutes after the last one and suppressed + # + local one_day + one_day=1410 test -f "${stamp}" && \ - find "${stamp}" -mtime -1 | \ + find "${stamp}" -mmin "-${one_day}" | \ grep --quiet "${stamp}" } From 3ef83d5f33049ccf0f8d001f4938bcdd7fee82b4 Mon Sep 17 00:00:00 2001 From: Loic Dachary Date: Tue, 29 May 2018 11:55:12 +0200 Subject: [PATCH 2/2] journalist notifications: today's submissions count 1h before reboot If the sysadmin chose to: a) activate journalist notifications b) modify the reboot time It is possible that the submissions count is older than expected. For instance, if the submissions count is done at midnight and the machine reboots at 11pm, the journalist will receive a submission count that is about 24h old and does not include submissions received in the past 23h00. The information sent to the journalist is correct, only it is older than one would expect. The submissions count is updated one hour before the machine reboots time so it is no more than one hour old, regardless of the reboot time chosen by the admin. --- install_files/ansible-base/group_vars/staging.yml | 1 + install_files/ansible-base/roles/app/tasks/setup_cron.yml | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/install_files/ansible-base/group_vars/staging.yml b/install_files/ansible-base/group_vars/staging.yml index 1f2d934343..9914aa80c3 100644 --- a/install_files/ansible-base/group_vars/staging.yml +++ b/install_files/ansible-base/group_vars/staging.yml @@ -64,3 +64,4 @@ install_local_packages: true # the Apache service is configured correctly. securedrop_app_install_from_repo: False +daily_reboot_time: 4 # An integer between 0 and 23 diff --git a/install_files/ansible-base/roles/app/tasks/setup_cron.yml b/install_files/ansible-base/roles/app/tasks/setup_cron.yml index ced6fea7ce..37af128b00 100644 --- a/install_files/ansible-base/roles/app/tasks/setup_cron.yml +++ b/install_files/ansible-base/roles/app/tasks/setup_cron.yml @@ -20,6 +20,7 @@ cron: name: Update the number of submissions in the past 24h job: "{{ securedrop_code }}/manage.py were-there-submissions-today" - special_time: daily + # 0 -> 23, 1 -> 0, 2 -> 1, ... 23 -> 22 + hour: "{{ (daily_reboot_time + 23) % 24 }}" tags: - cron