SMF Manifests for Apache & MySQL

Question

I recently started checking up on SMF since the need for service control became bigger. That and the options for added security when it comes to the privilege system. I dug up a manifest for apache somewhere but simply disliked it because it used the root account. So one thing led to another and you can understand the rest yourself.
This works for me, adds a little extra security, and I hope it also works for some of you. I tend to dump these in /var/svc/manifest/application/local and as you can see they all reside in svc:/application/local as well. Naturally this boils down to personal taste.
apache.xml manifest
<?xml version="1.0"?>
<service_bundle type='manifest' name='Apache'>
<service name='application/local/apache' type='service' version='1'>
<single_instance />
<dependency
name='filesystem_and_network'
grouping='require_all'
restart_on='none'
type='service'>
<service_fmri value='svc:/milestone/local-env' />
</dependency>
<dependency
name='configuration'
grouping='require_all'
restart_on='none'
type='path'>
<service_fmri value='file://localhost/etc/apache/httpd.conf' />
</dependency>
<exec_method
type='method'
name='start'
exec='/usr/apache/bin/apachectl start'
timeout_seconds='60' >
<method_context>
<method_credential
user='webservd'
group='webservd'
privileges='basic,net_privaddr,!proc_info'
limit_privileges='basic,net_privaddr,proc_chroot,proc_setid' />
</method_context>
</exec_method>
<exec_method
type='method'
name='stop'
exec='/usr/apache/bin/apachectl stop'
timeout_seconds='60' />
<exec_method
type='method'
name='restart'
exec='/usr/apache/bin/apachectl restart'
timeout_seconds='60' />
<instance name='default' enabled='false' />
<stability value='Evolving' />
</service>
</service_bundle>
--= EOT =--
And now for MySQL (note; this doesn't work for 5.x, I already have a test version but it still needs some work).
mysql.xml manifest
<?xml version="1.0"?>
<!--
Copyright 2005 Sun Microsystems, Inc. All rights reserved.
Use is subject to license terms.
MySQL.xml : MySQL manifest, Scott Fehrman, Systems Engineer
updated: 2005-09-16
-->
<service_bundle type='manifest' name='MySQL'>
<service name='application/local/mysql' type='service' version='1'>
<single_instance />
<dependency
name='filesystem'
grouping='require_all'
restart_on='none'
type='service'>
<service_fmri value='svc:/milestone/local-env' />
</dependency>
<dependency
name='configuration'
grouping='require_all'
restart_on='none'
type='path'>
<service_fmri value='file://localhost/etc/my.cnf' />
</dependency>
<exec_method
type='method'
name='start'
exec='/etc/sfw/mysql/mysql.server start'
timeout_seconds='120' >
<method_context>
<method_credential
user='mysql'
group='mysql'
privileges='basic,!file_link_any,!proc_info,!proc_session'
limit_privileges='basic,proc_chroot,proc_setid' />
</method_context>
</exec_method>
<exec_method
type='method'
name='stop'
exec='/etc/sfw/mysql/mysql.server stop'
timeout_seconds='120' />
<instance name='default' enabled='false' />
<stability value='Unstable' />
<template>
<common_name>
<loctext xml:lang='C'>MySQL RDBMS 4.0.24</loctext>
</common_name>
<documentation>
<manpage title='mysql' section='1' manpath='/usr/sfw/share/man' />
</documentation>
</template>
</service>
</service_bundle>
--= EOT =--
As you can notice both of them depend on the milestone/local-env. This is my own creation. Because I'm using /var/run/apache and /var/run/mysqld I setup a shellscript to create them and linked this to a milestone entry. You can just leave it out or create your own manifest. I wonder if this forum can hold a message this long :-)

Answer 1

Well, I just realized that without the milestone manifest you're missing out on some essential dependencies (network & filesystem) so I just dump it into 2 messages 8-)
local-env.xml milestone
<?xml version="1.0"?>
<!--
The local environment milestone represents the completion of system
configuration so the local applications (apache, mysql & squid) can
be started. In its current form this means setting up the /var/run
directories to put the .pid and socket files in.
-->
<service_bundle type='manifest' name='Local_environment'>
<service name='milestone/local-env' type='service' version='1'>
<create_default_instance enabled='false' />
<single_instance />
<dependency
name='filesystem'
grouping='require_all'
restart_on='error'
type='service'>
<service_fmri value='svc:/system/filesystem/local' />
</dependency>
<dependency
name='network'
grouping='require_all'
restart_on='none'
type='service'>
<service_fmri value='svc:/milestone/network' />
</dependency>
<exec_method
type='method'
name='start'
exec='/usr/local/sbin/setlocenv start'
timeout_seconds='5' />
<exec_method
type='method'
name='stop'
exec=':false'
timeout_seconds='0' />
<property_group name='general' type='framework'>
<propval name='duration' type='astring' value='transient' />
</property_group>
<stability value='Evolving' />
<template>
<common_name>
<loctext xml:lang='C'>
Local configuration milestone
</loctext>
</common_name>
</template>
</service>
</service_bundle>
--= EOT =--
Keep in mind that this may work or simply won't do what you want. For example; whenever a filesystem error occurs the milestone will restart (thus re-creating /var/run/mysql and such and setting the proper ownership) but the real services (apache,mysql) won't respond to this. This maybe unsuited behaviour for you, in that case
just readjust the manifest to better suit your liking :)
You'll also notice that squid is mentioned, thats another project but although things work I'm not happy with it yet. Still; doesn't matter for the manifest since it basicly calls a shellscript which does the actual creating/setting of the proper directories (and even that need depends on how you configured mysql/apache).
Hope this works for you.