From 6e1ee76e05ffda9c445ee4268e00ea285b45622f Mon Sep 17 00:00:00 2001 From: Viktor Ashirov Date: May 14 2018 11:20:45 +0000 Subject: Issue 49106 - Move ds_* scripts to libexec Bug Description: Binaries like /usr/sbin/ds_selinux_enabled /usr/sbin/ds_selinux_port_query /usr/sbin/ds_systemd_ask_password_acl are not user-runnable, they are executed by other programs (setup-ds.pl for example). They should not reside in /usr/sbin, since it's used for storing binaries for system administration. Instead they should be placed in /usr/libexec/dirsrv/ which is designed to store binaries that are executed by other programs. Fix Description: Change install path to libexec. https://pagure.io/389-ds-base/issue/49106 Reviewed by: mhonek, wibrown (Thanks!) --- diff --git a/Makefile.am b/Makefile.am index dc80bef..32b7b2b 100644 --- a/Makefile.am +++ b/Makefile.am @@ -753,12 +753,12 @@ systemschema_DATA = $(srcdir)/ldap/schema/00core.ldif \ schema_DATA = $(srcdir)/ldap/schema/99user.ldif -sbin_SCRIPTS = ldap/admin/src/scripts/ds_selinux_enabled \ +libexec_SCRIPTS = ldap/admin/src/scripts/ds_selinux_enabled \ ldap/admin/src/scripts/ds_selinux_port_query \ wrappers/ds_systemd_ask_password_acl if ENABLE_PERL -sbin_SCRIPTS += ldap/admin/src/scripts/setup-ds.pl \ +sbin_SCRIPTS = ldap/admin/src/scripts/setup-ds.pl \ ldap/admin/src/scripts/migrate-ds.pl \ ldap/admin/src/scripts/remove-ds.pl \ ldap/admin/src/scripts/start-dirsrv \ @@ -2249,6 +2249,7 @@ fixupcmd = sed \ -e 's,@bindir\@,$(bindir),g' \ -e 's,@sbindir\@,$(sbindir),g' \ -e 's,@libdir\@,$(libdir),g' \ + -e 's,@libexecdir\@,$(libexecdir),g' \ -e 's,@nspr_libdir\@,$(nspr_libdir),g' \ -e 's,@nss_libdir\@,$(nss_libdir),g' \ -e 's,@ldapsdk_libdir\@,$(ldapsdk_libdir),g' \ diff --git a/ldap/admin/src/scripts/DSCreate.pm.in b/ldap/admin/src/scripts/DSCreate.pm.in index 71db353..248b65d 100644 --- a/ldap/admin/src/scripts/DSCreate.pm.in +++ b/ldap/admin/src/scripts/DSCreate.pm.in @@ -991,7 +991,7 @@ sub updateSelinuxPolicy { # if selinux is not available, do nothing # In perl, exit(1) is 256 from system. ds_selinux_enable returns 1 on true, 0 on false. - if ((getLogin() eq 'root') and "@with_selinux@" and system("$inf->{slapd}->{sbindir}/ds_selinux_enabled") == 256 ) { + if ((getLogin() eq 'root') and "@with_selinux@" and system("$inf->{slapd}->{libexecdir}/ds_selinux_enabled") == 256 ) { debug(1, "Selinux is enabled or permissive, fixing contexts\n"); # -f "@sbindir@/sestatus" and !system ("@sbindir@/sestatus | egrep -i \"selinux status:\\s*enabled\" > $mydevnull 2>&1")) { my $localstatedir = $inf->{slapd}->{localstatedir}; @@ -1021,7 +1021,7 @@ sub updateSelinuxPolicy { # label the selected port as ldap_port_t # We should be doing this for secure port too ..... if ($inf->{slapd}->{ServerPort} != 0 and not $ENV{DS_SKIP_LABEL}) { - my $port_query_cmd = ("$inf->{slapd}->{sbindir}/ds_selinux_port_query $inf->{slapd}->{ServerPort} ldap_port_t 2> $mydevnull"); + my $port_query_cmd = ("$inf->{slapd}->{libexecdir}/ds_selinux_port_query $inf->{slapd}->{ServerPort} ldap_port_t 2> $mydevnull"); my $need_label = 0; my $result = system($port_query_cmd); @@ -1034,7 +1034,7 @@ sub updateSelinuxPolicy { $need_label = 0; debug(0, "Port $inf->{slapd}->{ServerPort} already belongs to another selinux type.\n"); debug(0, " The command below will show you the current type that owns the port.\n"); - debug(0, "sudo $inf->{slapd}->{sbindir}/ds_selinux_port_query $inf->{slapd}->{ServerPort} ldap_port_t\n"); + debug(0, "sudo $inf->{slapd}->{libexecdir}/ds_selinux_port_query $inf->{slapd}->{ServerPort} ldap_port_t\n"); debug(0, " It is highly likely your server will fail to start ... \n"); } if ($result == 131072) { @@ -1443,12 +1443,12 @@ sub removeDSInstance { # remove the selinux label from the ports if needed my $mydevnull = (-c "/dev/null" ? " /dev/null " : " NUL "); - if ((getLogin() eq 'root') and "@with_selinux@" and system("@sbindir@/ds_selinux_enabled") == 256 and not $ENV{DS_SKIP_UNLABEL}) { + if ((getLogin() eq 'root') and "@with_selinux@" and system("@libexecdir@/ds_selinux_enabled") == 256 and not $ENV{DS_SKIP_UNLABEL}) { foreach my $port (@{$entry->{"nsslapd-port"}}) { my $need_remove_label = 0; - my $port_query_cmd = ("@sbindir@/ds_selinux_port_query $port ldap_port_t 2> $mydevnull"); + my $port_query_cmd = ("@libexecdir@/ds_selinux_port_query $port ldap_port_t 2> $mydevnull"); my $result = system($port_query_cmd); if ($result == 256) { @@ -1487,7 +1487,7 @@ sub removeDSInstance { foreach my $secureport (@{$entry->{"nsslapd-secureport"}}) { my $need_remove_label = 0; - my $port_query_cmd = ("@sbindir@/ds_selinux_port_query $secureport ldap_port_t 2> $mydevnull"); + my $port_query_cmd = ("@libexecdir@/ds_selinux_port_query $secureport ldap_port_t 2> $mydevnull"); my $result = system($port_query_cmd); if ($result == 256) { diff --git a/rpm/389-ds-base.spec.in b/rpm/389-ds-base.spec.in index 0e6bbc5..d5fcc23 100644 --- a/rpm/389-ds-base.spec.in +++ b/rpm/389-ds-base.spec.in @@ -346,6 +346,7 @@ autoreconf -fiv --with-systemdsystemunitdir=%{_unitdir} \ --with-systemdsystemconfdir=%{_sysconfdir}/systemd/system \ --with-systemdgroupname=%{groupname} \ + --libexecdir=%{_libexecdir}/%{pkgname} \ $NSSARGS $TCMALLOC_FLAGS $ASAN_FLAGS $MSAN_FLAGS $TSAN_FLAGS $UBSAN_FLAGS $RUST_FLAGS $PERL_FLAGS $CLANG_FLAGS \ --enable-cmocka @@ -548,9 +549,9 @@ fi %{_sbindir}/dsidm %{_sbindir}/ds-cockpit-setup %endif -%{_sbindir}/ds_selinux_enabled -%{_sbindir}/ds_selinux_port_query -%{_sbindir}/ds_systemd_ask_password_acl +%{_libexecdir}/%{pkgname}/ds_selinux_enabled +%{_libexecdir}/%{pkgname}/ds_selinux_port_query +%{_libexecdir}/%{pkgname}/ds_systemd_ask_password_acl %if %{use_perl} %{_sbindir}/monitor %{_sbindir}/bak2db diff --git a/wrappers/systemd.template.service.in b/wrappers/systemd.template.service.in index 0d88900..3c1d368 100644 --- a/wrappers/systemd.template.service.in +++ b/wrappers/systemd.template.service.in @@ -26,7 +26,7 @@ TimeoutStopSec=600 EnvironmentFile=@initconfigdir@/@package_name@ EnvironmentFile=@initconfigdir@/@package_name@-%i PIDFile=@localstatedir@/run/@package_name@/slapd-%i.pid -ExecStartPre=@sbindir@/ds_systemd_ask_password_acl @instconfigdir@/slapd-%i/dse.ldif +ExecStartPre=@libexecdir@/ds_systemd_ask_password_acl @instconfigdir@/slapd-%i/dse.ldif ExecStart=@sbindir@/ns-slapd -D @instconfigdir@/slapd-%i -i @localstatedir@/run/@package_name@/slapd-%i.pid # Hardening options: diff --git a/wrappers/systemd.template.xsan.service.in b/wrappers/systemd.template.xsan.service.in index 9a6b01f..1a4d7dc 100644 --- a/wrappers/systemd.template.xsan.service.in +++ b/wrappers/systemd.template.xsan.service.in @@ -32,7 +32,7 @@ Environment=TSAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i Environment=MSAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.msan:print_stacktrace=1 Environment=UBSAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.ubsan:print_stacktrace=1 LimitCORE=infinity -ExecStartPre=@sbindir@/ds_systemd_ask_password_acl @instconfigdir@/slapd-%i/dse.ldif +ExecStartPre=@libexecdir@/ds_systemd_ask_password_acl @instconfigdir@/slapd-%i/dse.ldif ExecStart=@sbindir@/ns-slapd -D @instconfigdir@/slapd-%i -i @localstatedir@/run/@package_name@/slapd-%i.pid # Hardening options: