Create update locks for logged in sessions

Change-type: patch
Signed-off-by: Kyle Harding <kyle@balena.io>

README.md

@@ -5,15 +5,12 @@ Shared Yocto development environment
 ## Features
 
 - Yocto and OpenEmbedded build dependencies based on Ubuntu 18.04
-- SSH daemon background service w/ rotating logs
+- SSH daemon service w/ rotating logs
 - Fail2ban blocking IPs after failed login attempts
-- Docker daemon background service
+- Docker daemon service
 - Per-user home directories
 - Per-user SSH authorized keys synced with GitHub profiles
-
-## Planned Features
-
-- Update locking
+- Supervisor update locking for active SSH sessions
 
 ## Administration
 

yocto-build-env/s6-overlay/s6-rc.d/lock-manager/finish

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+rm -f /tmp/balena/updates.lock

yocto-build-env/s6-overlay/s6-rc.d/lock-manager/run

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+[[ ${VERBOSE:-,,} =~ true|yes|on|1 ]] && set -x
+
+LOCKFILE=/tmp/balena/updates.lock
+
+while true; do
+    (
+        # check for active sessions
+        while last | grep -q "still logged in"; do
+
+            # create the lockfile
+            touch $LOCKFILE
+
+            # create a file descriptor over the given lockfile
+            exec {fd}<>${LOCKFILE}
+
+            # request an exclusive lock in non-blocking mode
+            flock -n $fd || exit 0
+
+            echo "Updates are locked while sessions are active..."
+            last | grep "still logged in"
+
+            # wait 30 seconds before checking again
+            # updates are locked during this time
+            sleep 30
+
+        done
+    ) >/dev/null 2>&1
+
+    # remove the lockfile (this should be unecessary?)
+    rm -f $LOCKFILE
+
+    # wait 5 seconds before checking again
+    # updates are unlocked during this time
+    sleep 5
+done

yocto-build-env/s6-overlay/s6-rc.d/lock-manager/type

@@ -0,0 +1 @@
+longrun