Bug 7675 - New script for changing selinux file labels on perl scripts
Summary: New script for changing selinux file labels on perl scripts
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Command-line Utilities (show other bugs)
Version: 3.10
Hardware: All All
: P3 enhancement (vote)
Assignee: Marcel de Rooy
QA Contact: Ian Walls
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-03-08 13:51 UTC by Marcel de Rooy
Modified: 2013-05-23 06:24 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:


Attachments
Patch for xt/set-selinux-labels (21.50 KB, patch)
2012-03-08 13:54 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Patch for xt/set-selinux-labels (4.78 KB, patch)
2012-03-08 13:58 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Patch for set-linux-labels.sh (4.79 KB, patch)
2012-03-12 07:55 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Patch for moving the other two xt scripts (6.44 KB, patch)
2012-03-12 08:30 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Patch for 7675 (4.82 KB, patch)
2012-07-18 15:24 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Patch for 7675 (4.95 KB, patch)
2012-07-19 09:30 UTC, Marcel de Rooy
Details | Diff | Splinter Review
7675 New script for changing selinux file labels on perl scripts (4.95 KB, patch)
2012-08-24 03:11 UTC, Chris Cormack
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Marcel de Rooy 2012-03-08 13:51:11 UTC
On some Linux distributions like RedHat, Fedora, CentOS you can use SELinux for enhanced security. Among others, this involves file labeling (security context). In other distributions SELinux can be installed additionally.

The attached script xt/set-selinux-labels lets you update and restore such labels on the perl script in a Koha installation.
Note that there is more to it to get Koha running with SELinux, but this is a first step.
Comment 1 Marcel de Rooy 2012-03-08 13:54:49 UTC Comment hidden (obsolete)
Comment 2 Marcel de Rooy 2012-03-08 13:58:18 UTC Comment hidden (obsolete)
Comment 3 Marcel de Rooy 2012-03-08 14:01:31 UTC
Test this script via command line.
Go to root of your Koha clone.
Run xt/set-selinux-labels -u
Check file labels for some perl scripts with ls -Z
Run xt/set-selinux-labels -r
Check again with ls -Z
Comment 4 Jared Camins-Esakov 2012-03-10 21:36:02 UTC
Marcel,

Are you sure a file like this should go in xt? xt/ is generally for tests, I think.
Comment 5 Marcel de Rooy 2012-03-12 07:51:59 UTC
(In reply to comment #4)
> Are you sure a file like this should go in xt? xt/ is generally for tests, I
> think.
You are probably right ;) Found a better place for the other two scripts in xt as well. My next candidate is: misc/bin ! Sounds much better, right?
Comment 6 Marcel de Rooy 2012-03-12 07:55:57 UTC Comment hidden (obsolete)
Comment 7 Marcel de Rooy 2012-03-12 08:30:04 UTC Comment hidden (obsolete)
Comment 8 Marcel de Rooy 2012-03-12 09:17:42 UTC
See 4330 comments too.
Obsoleting the new attachments, getting back the old one.
Comment 9 Chris Cormack 2012-03-12 09:22:33 UTC
Hmm sorry I think I confused you, this should not be in xt/ this is not a release only test, but a script designed to be run as part of an install.
Comment 10 Marcel de Rooy 2012-07-18 15:02:42 UTC
Reviving this one.
In the meantime I added: opac/svc/report.
For the location I still opt for misc/bin and not just install. I ran this script hundreds of times (in a dev environment when git applies or resets etc.)
Another location could be maintenance. But I go for bin.

But now somebody with some courage to try this and sign off :)
Comment 11 Marcel de Rooy 2012-07-18 15:24:38 UTC Comment hidden (obsolete)
Comment 12 Marcel de Rooy 2012-07-19 09:30:01 UTC Comment hidden (obsolete)
Comment 13 Chris Cormack 2012-08-24 03:10:53 UTC
This didn't break my machine horribly.

And it doesn't touch Koha proper, and is only run if people consciously choose to run it, for that reason I'm signing it off.

I think a "Are you sure you want to do this?" wouldn't hurt, so you can't accidentally run it.
Comment 14 Chris Cormack 2012-08-24 03:11:23 UTC
Created attachment 11821 [details] [review]
7675 New script for changing selinux file labels on perl scripts

On some Linux distributions like RedHat, Fedora, CentOS you can use SELinux for enhanced security. Among others, this involves file labeling (security context). In other distributions SELinux can be installed additionally.

The attached script lets you update and restore such labels on the perl scripts in a Koha installation.

July 18, 2012: Added opac/svc.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Comment 15 Mason James 2012-09-14 11:48:52 UTC
> Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

patch applies clean, passing QA...

mason@xen1:~/g/head$ koha-qa.pl 

testing 1 commit(s) (applied to commit 0acebb8)
 * e254b99 7675 New script for changing selinux file labels on perl scripts
      misc/bin/set-selinux-labels.sh
Comment 16 Paul Poulain 2012-09-14 15:17:15 UTC
Patch pushed to master

I don't have selinux, so can't test, but no side-effect risk for users without selinux.