389-ds-base

Clone
Source Code
GIT

#49633 Issue 49106 - Move ds_* scripts to libexec
Closed 3 years ago by spichugi. Opened 6 years ago by vashirov.
vashirov/389-ds-base move-ds_scripts-to-libexec  into  master

file modified
+3 -2 
@@ -753,12 +753,12 @@ 
 

  

  schema_DATA = $(srcdir)/ldap/schema/99user.ldif
 

  

- sbin_SCRIPTS = ldap/admin/src/scripts/ds_selinux_enabled \
 

+ libexec_SCRIPTS = ldap/admin/src/scripts/ds_selinux_enabled \
 

  	ldap/admin/src/scripts/ds_selinux_port_query \
 

  	wrappers/ds_systemd_ask_password_acl
 

  

  if ENABLE_PERL
 

- sbin_SCRIPTS += ldap/admin/src/scripts/setup-ds.pl \
 

+ sbin_SCRIPTS = ldap/admin/src/scripts/setup-ds.pl \
 

  	ldap/admin/src/scripts/migrate-ds.pl \
 

  	ldap/admin/src/scripts/remove-ds.pl \
 

  	ldap/admin/src/scripts/start-dirsrv \
 
@@ -2249,6 +2249,7 @@ 
 

  	-e 's,@bindir\@,$(bindir),g' \
 

  	-e 's,@sbindir\@,$(sbindir),g' \
 

  	-e 's,@libdir\@,$(libdir),g' \
 

+ 	-e 's,@libexecdir\@,$(libexecdir),g' \
 

  	-e 's,@nspr_libdir\@,$(nspr_libdir),g' \
 

  	-e 's,@nss_libdir\@,$(nss_libdir),g' \
 

  	-e 's,@ldapsdk_libdir\@,$(ldapsdk_libdir),g' \

file modified
+6 -6 
@@ -991,7 +991,7 @@ 
 

  

      # if selinux is not available, do nothing
 

      # In perl, exit(1) is 256 from system. ds_selinux_enable returns 1 on true, 0 on false.
 

-     if ((getLogin() eq 'root') and "@with_selinux@" and system("$inf->{slapd}->{sbindir}/ds_selinux_enabled") == 256 ) {
 

+     if ((getLogin() eq 'root') and "@with_selinux@" and system("$inf->{slapd}->{libexecdir}/ds_selinux_enabled") == 256 ) {
 

          debug(1, "Selinux is enabled or permissive, fixing contexts\n");
 

          # -f "@sbindir@/sestatus" and !system ("@sbindir@/sestatus | egrep -i \"selinux status:\\s*enabled\" > $mydevnull 2>&1")) {
 

          my $localstatedir = $inf->{slapd}->{localstatedir};
 
@@ -1021,7 +1021,7 @@ 
 

          # label the selected port as ldap_port_t
 

          # We should be doing this for secure port too .....
 

          if ($inf->{slapd}->{ServerPort} != 0 and not $ENV{DS_SKIP_LABEL}) {
 

-             my $port_query_cmd = ("$inf->{slapd}->{sbindir}/ds_selinux_port_query $inf->{slapd}->{ServerPort} ldap_port_t 2> $mydevnull");
 

+             my $port_query_cmd = ("$inf->{slapd}->{libexecdir}/ds_selinux_port_query $inf->{slapd}->{ServerPort} ldap_port_t 2> $mydevnull");
 

              my $need_label = 0;
 

              my $result = system($port_query_cmd);
 

  
@@ -1034,7 +1034,7 @@ 
 

                  $need_label = 0;
 

                  debug(0, "Port $inf->{slapd}->{ServerPort} already belongs to another selinux type.\n");
 

                  debug(0, " The command below will show you the current type that owns the port.\n");
 

-                 debug(0, "sudo $inf->{slapd}->{sbindir}/ds_selinux_port_query $inf->{slapd}->{ServerPort} ldap_port_t\n");
 

+                 debug(0, "sudo $inf->{slapd}->{libexecdir}/ds_selinux_port_query $inf->{slapd}->{ServerPort} ldap_port_t\n");
 

                  debug(0, " It is highly likely your server will fail to start ... \n");
 

              }
 

              if ($result == 131072) {
 
@@ -1443,12 +1443,12 @@ 
 

  

      # remove the selinux label from the ports if needed
 

      my $mydevnull = (-c "/dev/null" ? " /dev/null " : " NUL ");
 

-     if ((getLogin() eq 'root') and "@with_selinux@" and system("@sbindir@/ds_selinux_enabled") == 256 and not $ENV{DS_SKIP_UNLABEL}) {
 

+     if ((getLogin() eq 'root') and "@with_selinux@" and system("@libexecdir@/ds_selinux_enabled") == 256 and not $ENV{DS_SKIP_UNLABEL}) {
 

          foreach my $port (@{$entry->{"nsslapd-port"}}) 

          {
 

  

              my $need_remove_label = 0;
 

-             my $port_query_cmd = ("@sbindir@/ds_selinux_port_query $port ldap_port_t 2> $mydevnull");
 

+             my $port_query_cmd = ("@libexecdir@/ds_selinux_port_query $port ldap_port_t 2> $mydevnull");
 

              my $result = system($port_query_cmd);
 

  

              if ($result == 256) {
 
@@ -1487,7 +1487,7 @@ 
 

          foreach my $secureport (@{$entry->{"nsslapd-secureport"}})
 

          {
 

              my $need_remove_label = 0;
 

-             my $port_query_cmd = ("@sbindir@/ds_selinux_port_query $secureport ldap_port_t 2> $mydevnull");
 

+             my $port_query_cmd = ("@libexecdir@/ds_selinux_port_query $secureport ldap_port_t 2> $mydevnull");
 

              my $result = system($port_query_cmd);
 

  

              if ($result == 256) {

file modified
+4 -3 
@@ -346,6 +346,7 @@ 
 

             --with-systemdsystemunitdir=%{_unitdir} \
 

             --with-systemdsystemconfdir=%{_sysconfdir}/systemd/system \
 

             --with-systemdgroupname=%{groupname} \
 

+            --libexecdir=%{_libexecdir}/%{pkgname} \
 

             $NSSARGS $TCMALLOC_FLAGS $ASAN_FLAGS $MSAN_FLAGS $TSAN_FLAGS $UBSAN_FLAGS $RUST_FLAGS $PERL_FLAGS $CLANG_FLAGS \
 

             --enable-cmocka
 

  
@@ -548,9 +549,9 @@ 
 

  %{_sbindir}/dsidm
 

  %{_sbindir}/ds-cockpit-setup
 

  %endif
 

- %{_sbindir}/ds_selinux_enabled
 

- %{_sbindir}/ds_selinux_port_query
 

- %{_sbindir}/ds_systemd_ask_password_acl
 

+ %{_libexecdir}/%{pkgname}/ds_selinux_enabled
 

+ %{_libexecdir}/%{pkgname}/ds_selinux_port_query
 

+ %{_libexecdir}/%{pkgname}/ds_systemd_ask_password_acl
 

  %if %{use_perl}
 

  %{_sbindir}/monitor
 

  %{_sbindir}/bak2db

file modified
+1 -1 
@@ -26,7 +26,7 @@ 
 

  EnvironmentFile=@initconfigdir@/@package_name@
 

  EnvironmentFile=@initconfigdir@/@package_name@-%i
 

  PIDFile=@localstatedir@/run/@package_name@/slapd-%i.pid
 

- ExecStartPre=@sbindir@/ds_systemd_ask_password_acl @instconfigdir@/slapd-%i/dse.ldif
 

+ ExecStartPre=@libexecdir@/ds_systemd_ask_password_acl @instconfigdir@/slapd-%i/dse.ldif
 

  ExecStart=@sbindir@/ns-slapd -D @instconfigdir@/slapd-%i -i @localstatedir@/run/@package_name@/slapd-%i.pid
 

  

  # Hardening options:

file modified
+1 -1 
@@ -32,7 +32,7 @@ 
 

  Environment=MSAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.msan:print_stacktrace=1
 

  Environment=UBSAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.ubsan:print_stacktrace=1
 

  LimitCORE=infinity
 

- ExecStartPre=@sbindir@/ds_systemd_ask_password_acl @instconfigdir@/slapd-%i/dse.ldif
 

+ ExecStartPre=@libexecdir@/ds_systemd_ask_password_acl @instconfigdir@/slapd-%i/dse.ldif
 

  ExecStart=@sbindir@/ns-slapd -D @instconfigdir@/slapd-%i -i @localstatedir@/run/@package_name@/slapd-%i.pid
 

  

  # Hardening options:

Bug Description:
Binaries like
/usr/sbin/ds_selinux_enabled
/usr/sbin/ds_selinux_port_query
/usr/sbin/ds_systemd_ask_password_acl

are not user-runnable, they are executed by other programs (setup-ds.pl
for example). They should not reside in /usr/sbin, since it's used for
storing binaries for system administration. Instead they should be placed
in /usr/libexec/dirsrv/ which is designed to store binaries that are
executed by other programs.

Fix Description:
Change install path to libexec.

https://pagure.io/389-ds-base/issue/49106

Reviewed by: ???

Please don't ack for now, I want to run some tests first with this PR. Thanks!

rebased onto a53d9ef413551108e032051a9a74018dee4e7de1
5 years ago

Ack from me, this is very overdue. Thanks for doing it :)

Ack, as well. Looks good, thanks!

rebased onto 17f0a53a85e49b16ef9433c3b8e603a223b6c301
5 years ago

rebased onto 6e1ee76
5 years ago

Pull-Request has been merged by vashirov
5 years ago

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This pull request has been cloned to Github as issue and is available here:
- https://github.com/389ds/389-ds-base/issues/2692

If you want to continue to work on the PR, please navigate to the github issue,
download the patch from the attachments and file a new pull request.

Thank you for understanding. We apologize for all inconvenience.

Pull-Request has been closed by spichugi
3 years ago
Metadata
None
No Tags
Changes Summary 5
+3 -2
file changed
Makefile.am
+6 -6
file changed
ldap/admin/src/scripts/DSCreate.pm.in
+4 -3
file changed
rpm/389-ds-base.spec.in
+1 -1
file changed
wrappers/systemd.template.service.in
+1 -1
file changed
wrappers/systemd.template.xsan.service.in
Powered by Pagure 5.13.3
Documentation • File an Issue • About • SSH Hostkey/Fingerprint
© Red Hat, Inc. and others.