Bug 7675

Summary: New script for changing selinux file labels on perl scripts
Product: Koha Reporter: Marcel de Rooy <m.de.rooy>
Component: Command-line UtilitiesAssignee: Marcel de Rooy <m.de.rooy>
Status: CLOSED FIXED QA Contact: Ian Walls <koha.sekjal>
Severity: enhancement    
Priority: P3 CC: chris, jcamins, mtj, paul.poulain
Version: 3.10   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Patch for xt/set-selinux-labels
Patch for xt/set-selinux-labels
Patch for set-linux-labels.sh
Patch for moving the other two xt scripts
Patch for 7675
Patch for 7675
7675 New script for changing selinux file labels on perl scripts

Description Marcel de Rooy 2012-03-08 13:51:11 UTC
On some Linux distributions like RedHat, Fedora, CentOS you can use SELinux for enhanced security. Among others, this involves file labeling (security context). In other distributions SELinux can be installed additionally.

The attached script xt/set-selinux-labels lets you update and restore such labels on the perl script in a Koha installation.
Note that there is more to it to get Koha running with SELinux, but this is a first step.
Comment 1 Marcel de Rooy 2012-03-08 13:54:49 UTC Comment hidden (obsolete)
Comment 2 Marcel de Rooy 2012-03-08 13:58:18 UTC Comment hidden (obsolete)
Comment 3 Marcel de Rooy 2012-03-08 14:01:31 UTC
Test this script via command line.
Go to root of your Koha clone.
Run xt/set-selinux-labels -u
Check file labels for some perl scripts with ls -Z
Run xt/set-selinux-labels -r
Check again with ls -Z
Comment 4 Jared Camins-Esakov 2012-03-10 21:36:02 UTC
Marcel,

Are you sure a file like this should go in xt? xt/ is generally for tests, I think.
Comment 5 Marcel de Rooy 2012-03-12 07:51:59 UTC
(In reply to comment #4)
> Are you sure a file like this should go in xt? xt/ is generally for tests, I
> think.
You are probably right ;) Found a better place for the other two scripts in xt as well. My next candidate is: misc/bin ! Sounds much better, right?
Comment 6 Marcel de Rooy 2012-03-12 07:55:57 UTC Comment hidden (obsolete)
Comment 7 Marcel de Rooy 2012-03-12 08:30:04 UTC Comment hidden (obsolete)
Comment 8 Marcel de Rooy 2012-03-12 09:17:42 UTC
See 4330 comments too.
Obsoleting the new attachments, getting back the old one.
Comment 9 Chris Cormack 2012-03-12 09:22:33 UTC
Hmm sorry I think I confused you, this should not be in xt/ this is not a release only test, but a script designed to be run as part of an install.
Comment 10 Marcel de Rooy 2012-07-18 15:02:42 UTC
Reviving this one.
In the meantime I added: opac/svc/report.
For the location I still opt for misc/bin and not just install. I ran this script hundreds of times (in a dev environment when git applies or resets etc.)
Another location could be maintenance. But I go for bin.

But now somebody with some courage to try this and sign off :)
Comment 11 Marcel de Rooy 2012-07-18 15:24:38 UTC Comment hidden (obsolete)
Comment 12 Marcel de Rooy 2012-07-19 09:30:01 UTC Comment hidden (obsolete)
Comment 13 Chris Cormack 2012-08-24 03:10:53 UTC
This didn't break my machine horribly.

And it doesn't touch Koha proper, and is only run if people consciously choose to run it, for that reason I'm signing it off.

I think a "Are you sure you want to do this?" wouldn't hurt, so you can't accidentally run it.
Comment 14 Chris Cormack 2012-08-24 03:11:23 UTC
Created attachment 11821 [details] [review]
7675 New script for changing selinux file labels on perl scripts

On some Linux distributions like RedHat, Fedora, CentOS you can use SELinux for enhanced security. Among others, this involves file labeling (security context). In other distributions SELinux can be installed additionally.

The attached script lets you update and restore such labels on the perl scripts in a Koha installation.

July 18, 2012: Added opac/svc.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Comment 15 Mason James 2012-09-14 11:48:52 UTC
> Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

patch applies clean, passing QA...

mason@xen1:~/g/head$ koha-qa.pl 

testing 1 commit(s) (applied to commit 0acebb8)
 * e254b99 7675 New script for changing selinux file labels on perl scripts
      misc/bin/set-selinux-labels.sh
Comment 16 Paul Poulain 2012-09-14 15:17:15 UTC
Patch pushed to master

I don't have selinux, so can't test, but no side-effect risk for users without selinux.