From 96daa5df64f2dd819804ec0098449965dbb2431b Mon Sep 17 00:00:00 2001
From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Date: Thu, 8 Mar 2012 14:36:42 +0100
Subject: [PATCH] 7675 New script for changing selinux file labels on perl
 scripts
Content-Type: text/plain; charset="utf-8"

On some Linux distributions like RedHat, Fedora, CentOS you can use SELinux for enhanced security. Among others, this involves file labeling (security context). In other distributions SELinux can be installed additionally.

The attached script lets you update and restore such labels on the perl scripts in a Koha installation.

July 18, 2012: Added opac/svc.
---
 misc/bin/set-selinux-labels.sh |  119 ++++++++++++++++++++++++++++++++++++++++
 1 files changed, 119 insertions(+), 0 deletions(-)
 create mode 100755 misc/bin/set-selinux-labels.sh

diff --git a/misc/bin/set-selinux-labels.sh b/misc/bin/set-selinux-labels.sh
new file mode 100755
index 0000000..10ff1ab
--- /dev/null
+++ b/misc/bin/set-selinux-labels.sh
@@ -0,0 +1,119 @@
+#!/bin/sh
+#
+# This script changes selinux file labels for cgi scripts.
+# It may be useful for Linux installations with SELinux (like CentOS, Fedora,
+# RedHat among others) and having it enabled (enforcing mode).
+#
+# Copyright 2012 Rijksmuseum
+#
+# This file is part of Koha.
+#
+# Koha is free software; you can redistribute it and/or modify it under the
+# terms of the GNU General Public License as published by the Free Software
+# Foundation; either version 2 of the License, or (at your option) any later
+# version.
+#
+# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with Koha; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+usage() {
+    echo "Usage: set-selinux-labels [-h] [-u] [-r] [-s] [-v]"
+    echo "  -h prints help information."
+    echo "  -u updates the selinux label for scripts in Koha installation."
+    echo "    Note: you should be in the root directory of a Koha install."
+    echo "  -r uses restorecon on scripts to restore default label."
+    echo "  -s shows all files (incl. scripts), not having default label."
+    echo "  -v provides (verbose) diagnostics per file (for update/restore)."
+    echo
+    echo "The output of -s may be confusing, but it does not reset any labels. It only prints informational messages from restorecon with -n flag."
+}
+
+updatelabel() {
+    #Now set perl scripts to httpd_sys_script_exec_t
+    #We skip scripts in: misc docs t xt and atomicupdate
+    find -name "*.pl" -and ! -path "./docs/*" -and ! -path "./misc/*" -and ! -path "./t/*" -and ! -path "./xt/*" -and ! -path "./installer/data/mysql/atomicupdate/*" | xargs chcon $verbose -t httpd_sys_script_exec_t
+
+    #Handle exceptions to the rule: scripts without .pl
+    chcon $verbose -t httpd_sys_script_exec_t opac/unapi
+    find svc -type f | xargs chcon $verbose -t httpd_sys_script_exec_t
+}
+
+restorelabel() {
+    find -name "*.pl" -and ! -path "./docs/*" -and ! -path "./misc/*" -and ! -path "./t/*" -and ! -path "./xt/*" -and ! -path "./installer/data/mysql/atomicupdate/*" | xargs restorecon $verbose
+    restorecon $verbose opac/unapi
+    find svc -type f | xargs restorecon $verbose
+}
+
+showlabel() {
+    restorecon -r -n -v *
+}
+
+#First: check on chcon xargs restorecon
+chcon --help >/dev/null 2>&1
+retval=$?
+if [ $retval -ne 0 ]; then
+    echo "Chcon command not found. Exiting script now.";
+    exit;
+fi
+xargs --help >/dev/null 2>&1
+retval=$?
+if [ $retval -ne 0 ]; then
+    echo "Xargs command not found. Exiting script now.";
+    exit;
+fi
+restorecon -n >/dev/null 2>&1
+retval=$?
+if [ $retval -ne 0 ]; then
+    echo "Restorecon command not found. Exiting script now.";
+    exit;
+fi
+
+#No arguments?
+if [ $# -eq 0 ]; then
+    usage
+    exit
+fi
+
+#Check command line options
+restore=0
+show=0
+update=0
+verbose=
+while getopts "hrsuv" option; do
+    case $option in
+    h)
+        usage
+        exit;;
+    r)
+        restore=1;;
+    s)
+        show=1;;
+    u)
+        update=1;;
+    v)
+        verbose="-v";;
+    esac
+done
+
+#Check if you are on root level of Koha installation
+if [ ! -e kohaversion.pl ]; then
+    echo "You are not in root directory of Koha install. Cannot continue. Bye.";
+    exit;
+fi
+
+#Cannot update and restore together
+if [ $update -eq 1 ] && [ $restore -eq 1 ]; then
+    echo "You cannot run update and restore at the same time."
+    exit;
+fi
+
+#Now run the job or print usage
+if [ $update -eq 1 ]; then updatelabel; exit; fi
+if [ $restore -eq 1 ]; then restorelabel; exit; fi
+if [ $show -eq 1 ]; then showlabel; exit; fi
+usage
-- 
1.7.7.6