[Bug 7675] New: New script for changing selinux file labels on perl scripts
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7675 Priority: P3 Change sponsored?: --- Bug ID: 7675 Assignee: m.de.rooy@rijksmuseum.nl Summary: New script for changing selinux file labels on perl scripts QA Contact: koha.sekjal@gmail.com Severity: enhancement Classification: Unclassified OS: All Reporter: m.de.rooy@rijksmuseum.nl Hardware: All Status: ASSIGNED Version: master Component: Command-line Utilities Product: Koha On some Linux distributions like RedHat, Fedora, CentOS you can use SELinux for enhanced security. Among others, this involves file labeling (security context). In other distributions SELinux can be installed additionally. The attached script xt/set-selinux-labels lets you update and restore such labels on the perl script in a Koha installation. Note that there is more to it to get Koha running with SELinux, but this is a first step. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7675 --- Comment #1 from M. de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 8087 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=8087&action=edit Patch for xt/set-selinux-labels -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7675 M. de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7675 M. de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #8087|0 |1 is obsolete| | --- Comment #2 from M. de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 8089 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=8089&action=edit Patch for xt/set-selinux-labels Default error: wrong file. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7675 --- Comment #3 from M. de Rooy <m.de.rooy@rijksmuseum.nl> --- Test this script via command line. Go to root of your Koha clone. Run xt/set-selinux-labels -u Check file labels for some perl scripts with ls -Z Run xt/set-selinux-labels -r Check again with ls -Z -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7675 Jared Camins-Esakov <jcamins@cpbibliography.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jcamins@cpbibliography.com --- Comment #4 from Jared Camins-Esakov <jcamins@cpbibliography.com> --- Marcel, Are you sure a file like this should go in xt? xt/ is generally for tests, I think. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7675 --- Comment #5 from M. de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to comment #4)
Are you sure a file like this should go in xt? xt/ is generally for tests, I think. You are probably right ;) Found a better place for the other two scripts in xt as well. My next candidate is: misc/bin ! Sounds much better, right?
-- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7675 --- Comment #6 from M. de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 8172 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=8172&action=edit Patch for set-linux-labels.sh Moving the script from xt to misc/bin -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7675 --- Comment #7 from M. de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 8173 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=8173&action=edit Patch for moving the other two xt scripts Just moving two files and eliminating two trailings spaces.. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7675 M. de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #8089|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7675 --- Comment #8 from M. de Rooy <m.de.rooy@rijksmuseum.nl> --- See 4330 comments too. Obsoleting the new attachments, getting back the old one. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7675 M. de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #8172|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7675 M. de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #8173|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7675 M. de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #8089|1 |0 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7675 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |chris@bigballofwax.co.nz --- Comment #9 from Chris Cormack <chris@bigballofwax.co.nz> --- Hmm sorry I think I confused you, this should not be in xt/ this is not a release only test, but a script designed to be run as part of an install. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7675 M. de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #8089|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7675 M. de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |ASSIGNED -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7675 --- Comment #10 from M. de Rooy <m.de.rooy@rijksmuseum.nl> --- Reviving this one. In the meantime I added: opac/svc/report. For the location I still opt for misc/bin and not just install. I ran this script hundreds of times (in a dev environment when git applies or resets etc.) Another location could be maintenance. But I go for bin. But now somebody with some courage to try this and sign off :) -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7675 --- Comment #11 from M. de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 10984 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=10984&action=edit Patch for 7675 There he goes.. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7675 M. de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7675 M. de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #10984|0 |1 is obsolete| | --- Comment #12 from M. de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 10998 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=10998&action=edit Patch for 7675 Accidentally, submitted the old version again ;) -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7675 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off --- Comment #13 from Chris Cormack <chris@bigballofwax.co.nz> --- This didn't break my machine horribly. And it doesn't touch Koha proper, and is only run if people consciously choose to run it, for that reason I'm signing it off. I think a "Are you sure you want to do this?" wouldn't hurt, so you can't accidentally run it. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7675 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #10998|0 |1 is obsolete| | --- Comment #14 from Chris Cormack <chris@bigballofwax.co.nz> --- Created attachment 11821 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=11821&action=edit 7675 New script for changing selinux file labels on perl scripts On some Linux distributions like RedHat, Fedora, CentOS you can use SELinux for enhanced security. Among others, this involves file labeling (security context). In other distributions SELinux can be installed additionally. The attached script lets you update and restore such labels on the perl scripts in a Koha installation. July 18, 2012: Added opac/svc. Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7675 Mason James <mtj@kohaaloha.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA CC| |mtj@kohaaloha.com --- Comment #15 from Mason James <mtj@kohaaloha.com> ---
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
patch applies clean, passing QA... mason@xen1:~/g/head$ koha-qa.pl testing 1 commit(s) (applied to commit 0acebb8) * e254b99 7675 New script for changing selinux file labels on perl scripts misc/bin/set-selinux-labels.sh -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7675 Paul Poulain <paul.poulain@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master CC| |paul.poulain@biblibre.com Version|master |rel_3_10 --- Comment #16 from Paul Poulain <paul.poulain@biblibre.com> --- Patch pushed to master I don't have selinux, so can't test, but no side-effect risk for users without selinux. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org