View | Details | Raw Unified | Return to bug 7675
Collapse All | Expand All

(-)a/misc/bin/set-selinux-labels.sh (-1 / +121 lines)
Line 0 Link Here
0
- 
1
#!/bin/sh
2
#
3
# This script changes selinux file labels for cgi scripts.
4
# It may be useful for Linux installations with SELinux (like CentOS, Fedora,
5
# RedHat among others) and having it enabled (enforcing mode).
6
#
7
# Copyright 2012 Rijksmuseum
8
#
9
# This file is part of Koha.
10
#
11
# Koha is free software; you can redistribute it and/or modify it under the
12
# terms of the GNU General Public License as published by the Free Software
13
# Foundation; either version 2 of the License, or (at your option) any later
14
# version.
15
#
16
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
17
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
18
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
19
#
20
# You should have received a copy of the GNU General Public License along
21
# with Koha; if not, write to the Free Software Foundation, Inc.,
22
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
23
24
usage() {
25
    echo "Usage: set-selinux-labels [-h] [-u] [-r] [-s] [-v]"
26
    echo "  -h prints help information."
27
    echo "  -u updates the selinux label for scripts in Koha installation."
28
    echo "    Note: you should be in the root directory of a Koha install."
29
    echo "  -r uses restorecon on scripts to restore default label."
30
    echo "  -s shows all files (incl. scripts), not having default label."
31
    echo "  -v provides (verbose) diagnostics per file (for update/restore)."
32
    echo
33
    echo "The output of -s may be confusing, but it does not reset any labels. It only prints informational messages from restorecon with -n flag."
34
}
35
36
updatelabel() {
37
    #Now set perl scripts to httpd_sys_script_exec_t
38
    #We skip scripts in: misc docs t xt and atomicupdate
39
    find -name "*.pl" -and ! -path "./docs/*" -and ! -path "./misc/*" -and ! -path "./t/*" -and ! -path "./xt/*" -and ! -path "./installer/data/mysql/atomicupdate/*" | xargs chcon $verbose -t httpd_sys_script_exec_t
40
41
    #Handle exceptions to the rule: scripts without .pl
42
    chcon $verbose -t httpd_sys_script_exec_t opac/unapi
43
    find opac/svc -type f | xargs chcon $verbose -t httpd_sys_script_exec_t
44
    find svc -type f | xargs chcon $verbose -t httpd_sys_script_exec_t
45
}
46
47
restorelabel() {
48
    find -name "*.pl" -and ! -path "./docs/*" -and ! -path "./misc/*" -and ! -path "./t/*" -and ! -path "./xt/*" -and ! -path "./installer/data/mysql/atomicupdate/*" | xargs restorecon $verbose
49
    restorecon $verbose opac/unapi
50
    find opac/svc -type f | xargs restorecon $verbose
51
    find svc -type f | xargs restorecon $verbose
52
}
53
54
showlabel() {
55
    restorecon -r -n -v *
56
}
57
58
#First: check on chcon xargs restorecon
59
chcon --help >/dev/null 2>&1
60
retval=$?
61
if [ $retval -ne 0 ]; then
62
    echo "Chcon command not found. Exiting script now.";
63
    exit;
64
fi
65
xargs --help >/dev/null 2>&1
66
retval=$?
67
if [ $retval -ne 0 ]; then
68
    echo "Xargs command not found. Exiting script now.";
69
    exit;
70
fi
71
restorecon -n >/dev/null 2>&1
72
retval=$?
73
if [ $retval -ne 0 ]; then
74
    echo "Restorecon command not found. Exiting script now.";
75
    exit;
76
fi
77
78
#No arguments?
79
if [ $# -eq 0 ]; then
80
    usage
81
    exit
82
fi
83
84
#Check command line options
85
restore=0
86
show=0
87
update=0
88
verbose=
89
while getopts "hrsuv" option; do
90
    case $option in
91
    h)
92
        usage
93
        exit;;
94
    r)
95
        restore=1;;
96
    s)
97
        show=1;;
98
    u)
99
        update=1;;
100
    v)
101
        verbose="-v";;
102
    esac
103
done
104
105
#Check if you are on root level of Koha installation
106
if [ ! -e kohaversion.pl ]; then
107
    echo "You are not in root directory of Koha install. Cannot continue. Bye.";
108
    exit;
109
fi
110
111
#Cannot update and restore together
112
if [ $update -eq 1 ] && [ $restore -eq 1 ]; then
113
    echo "You cannot run update and restore at the same time."
114
    exit;
115
fi
116
117
#Now run the job or print usage
118
if [ $update -eq 1 ]; then updatelabel; exit; fi
119
if [ $restore -eq 1 ]; then restorelabel; exit; fi
120
if [ $show -eq 1 ]; then showlabel; exit; fi
121
usage

Return to bug 7675