View | Details | Raw Unified | Return to bug 7675
Collapse All | Expand All

(-)a/misc/bin/set-selinux-labels.sh (-1 / +119 lines)
Line 0 Link Here
0
- 
1
#!/bin/sh
2
#
3
# This script changes selinux file labels for cgi scripts.
4
# It may be useful for Linux installations with SELinux (like CentOS, Fedora,
5
# RedHat among others) and having it enabled (enforcing mode).
6
#
7
# Copyright 2012 Rijksmuseum
8
#
9
# This file is part of Koha.
10
#
11
# Koha is free software; you can redistribute it and/or modify it under the
12
# terms of the GNU General Public License as published by the Free Software
13
# Foundation; either version 2 of the License, or (at your option) any later
14
# version.
15
#
16
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
17
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
18
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
19
#
20
# You should have received a copy of the GNU General Public License along
21
# with Koha; if not, write to the Free Software Foundation, Inc.,
22
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
23
24
usage() {
25
    echo "Usage: set-selinux-labels [-h] [-u] [-r] [-s] [-v]"
26
    echo "  -h prints help information."
27
    echo "  -u updates the selinux label for scripts in Koha installation."
28
    echo "    Note: you should be in the root directory of a Koha install."
29
    echo "  -r uses restorecon on scripts to restore default label."
30
    echo "  -s shows all files (incl. scripts), not having default label."
31
    echo "  -v provides (verbose) diagnostics per file (for update/restore)."
32
    echo
33
    echo "The output of -s may be confusing, but it does not reset any labels. It only prints informational messages from restorecon with -n flag."
34
}
35
36
updatelabel() {
37
    #Now set perl scripts to httpd_sys_script_exec_t
38
    #We skip scripts in: misc docs t xt and atomicupdate
39
    find -name "*.pl" -and ! -path "./docs/*" -and ! -path "./misc/*" -and ! -path "./t/*" -and ! -path "./xt/*" -and ! -path "./installer/data/mysql/atomicupdate/*" | xargs chcon $verbose -t httpd_sys_script_exec_t
40
41
    #Handle exceptions to the rule: scripts without .pl
42
    chcon $verbose -t httpd_sys_script_exec_t opac/unapi
43
    find svc -type f | xargs chcon $verbose -t httpd_sys_script_exec_t
44
}
45
46
restorelabel() {
47
    find -name "*.pl" -and ! -path "./docs/*" -and ! -path "./misc/*" -and ! -path "./t/*" -and ! -path "./xt/*" -and ! -path "./installer/data/mysql/atomicupdate/*" | xargs restorecon $verbose
48
    restorecon $verbose opac/unapi
49
    find svc -type f | xargs restorecon $verbose
50
}
51
52
showlabel() {
53
    restorecon -r -n -v *
54
}
55
56
#First: check on chcon xargs restorecon
57
chcon --help >/dev/null 2>&1
58
retval=$?
59
if [ $retval -ne 0 ]; then
60
    echo "Chcon command not found. Exiting script now.";
61
    exit;
62
fi
63
xargs --help >/dev/null 2>&1
64
retval=$?
65
if [ $retval -ne 0 ]; then
66
    echo "Xargs command not found. Exiting script now.";
67
    exit;
68
fi
69
restorecon -n >/dev/null 2>&1
70
retval=$?
71
if [ $retval -ne 0 ]; then
72
    echo "Restorecon command not found. Exiting script now.";
73
    exit;
74
fi
75
76
#No arguments?
77
if [ $# -eq 0 ]; then
78
    usage
79
    exit
80
fi
81
82
#Check command line options
83
restore=0
84
show=0
85
update=0
86
verbose=
87
while getopts "hrsuv" option; do
88
    case $option in
89
    h)
90
        usage
91
        exit;;
92
    r)
93
        restore=1;;
94
    s)
95
        show=1;;
96
    u)
97
        update=1;;
98
    v)
99
        verbose="-v";;
100
    esac
101
done
102
103
#Check if you are on root level of Koha installation
104
if [ ! -e kohaversion.pl ]; then
105
    echo "You are not in root directory of Koha install. Cannot continue. Bye.";
106
    exit;
107
fi
108
109
#Cannot update and restore together
110
if [ $update -eq 1 ] && [ $restore -eq 1 ]; then
111
    echo "You cannot run update and restore at the same time."
112
    exit;
113
fi
114
115
#Now run the job or print usage
116
if [ $update -eq 1 ]; then updatelabel; exit; fi
117
if [ $restore -eq 1 ]; then restorelabel; exit; fi
118
if [ $show -eq 1 ]; then showlabel; exit; fi
119
usage

Return to bug 7675