diff --git a/README.org b/README.org index 8816b62..8ffab3a 100644 --- a/README.org +++ b/README.org @@ -1,4 +1,8 @@ * node_package +** Release 3.0.0 - Release notes + +Please see [[RELEASE-NOTES.md][RELEASE-NOTES.md]] for important changes in the 3.0.0 release of `node_package` + ** Overview `node_package` is a set of RPM/Debian/Solaris templates and scripts, suitable for diff --git a/RELEASE-NOTES.md b/RELEASE-NOTES.md new file mode 100644 index 0000000..e7233cd --- /dev/null +++ b/RELEASE-NOTES.md @@ -0,0 +1,108 @@ +# node_package 3.0.0 +## Security Improvements +### Introduction +### Security Advisory dated March 1, 2016 +It was [recently reported](http://docs.basho.com/riak/latest/community/product-advisories/codeinjectioninitfiles/) +that, if a user could gain access to the `riak` user (or, in node_package +parlance, the `package_install_user`), that user would then +have write access to init scripts that are generally run as `root`, exposing an +escalation of privileges attack where said user could then get the `root` user +to execute a script that could allow the original user to become `root` on the +system. + +### Additional Security Review + +After the security advisory was initially released, a more thorough review of +all of the `node_package`-generated packages was conducted. This review found +some additional cases of files or directories owned by the +`package_install_user` or `package_install_group` that could also potentially +allow a someone with access to run in the context of that user account to +overwrite files that may later be executed by `root`. This release of +`node_package` has significantly tightened the ownership and permissions of +files installed, in most cases following the target systems' conventions +(`root:root`, `root:bin`, `root:wheel`) for all files that are executable or +could be executed, including library files that the packaged application may +read. + +The [node_package](https://github.com/basho/node_package) library is used to +build deployable packages for Erlang applications that target many operating +systems. Node_package supports building installation packages for: + +- Redhat / Fedora and variants +- Debian / Ubuntu and variants +- FreeBSD +- OSX +- SmartOS +- Solaris + +### TL;DR - What should I do? + +#### You're a user updating a system (like Riak) installed by node_package: + +When upgrading from an older version of a system like Riak that uses +node_package for installation, you may need to verify the following (note, the +examples will be for a Centos 7-based Linux installation of Riak, but should +illustrate the required checks for most OSes and similar packages): + +- Validate permissions on existing directories and make them owned by root:root + (or the appropriate user/group for your operating system) and not writable by + the package_install_user/group. For this example, we will list the specific + directories for the Centos 7 install, and then their `node_package` template + names in parenthesis afterward. Directories and files include: + - /usr/lib64/riak (`platform_lib_dir`) + - /etc/riak (`platform_etc_dir`) + - /usr/bin (`platform_bin_dir`), specifically + - riak + - riak-admin + - riak-debug + - riak-repl + - search-cmd + - /etc/init.d/riak (`platform_etc_dir`/init.d/`package_install_name`) + +- Validate the home directory of the `platform_install_user` user is set to the + `platform_data_dir`, in the case of Riak on Centos 7 this should be the `riak` + user and the `/var/lib/riak` directory, and not `/usr/lib64/riak`. If + necessary, change the home directory of the `riak` (`package_install_user`) + user to point to `/var/lib/riak` (`platform_data_dir`). + +#### You're an application maintainer that uses node_package to produce packages for your application: + +Please upgrade to version 3.0.0 of node_package and test your packaging/install +process carefully. If you were depending on the writability of directories +outside of the `platform_data_dir` you may need to adjust your application to +store writable files in `platform_data_dir` rather than some other directory, +like `package_root_dir`. + +Additionally, the home directory of the `package_install_user` has been +normalized across platforms to be the `platform_data_dir`. If you depended on +the home directory to be set to `platform_base_dir` make appropriate changes to +ensure your application can handle the change in home directory. + +### Changes in version 3.0.0 +#### File Ownership/Permissions +In all cases, the only files installed as owned by +`package_install_user:package_install_group` are now files to which the +packaged application needs to write. These files/directories include data +directories and log directories. All other files/directories installed by +`node_package`-packaged systems should now be owned by the appropriate `root` +account and group for the target operating system. + +#### Home directory of `package_install_user` +In some cases, the home directory of the created `package_install_user` was set +to a directory that is now not writable by that user (often the +`package_base_dir`). In all cases, we have standardized on using the +`platform_data_dir` for the home directory of the `package_install_user`. This +may cause issues on upgrades, as the user in that case won't be updated (since +it already exists) but post-install scripts may now ensure that the directory +set as the `package_install_user`'s home directory is owned by the appropriate +root user/group. This will manifest itself as start/stop scripts, ping, etc. +failing to be able to write to a file called `.erlang.cookie` in that +directory. In order to resolve this issue, please use your operating system's +`usermod` or similar utility to change the home directory of the user to match +the `platform_data_dir` of the installed application. + +### Details of the changes: +To view the individual changes to install package instructions, please see +[this PR](https://github.com/basho/node_package/pull/196). As always, if you +have seen or find any additional issues that may raise security concerns, +please email [security@basho.com](mailto:security@basho.com). diff --git a/priv/base/env.sh b/priv/base/env.sh index 4ec9231..cac7e27 100755 --- a/priv/base/env.sh +++ b/priv/base/env.sh @@ -8,8 +8,8 @@ if [ `uname -s` = 'SunOS' -a "${POSIX_SHELL}" != "true" ]; then POSIX_SHELL="true" export POSIX_SHELL - # To support 'whoami' add /usr/ucb to path - PATH=/usr/ucb:$PATH + # To support POSIX.2 compliant 'id' add /usr/xpg4/bin to path + PATH=/usr/xpg4/bin:$PATH export PATH exec /usr/bin/ksh $0 "$@" fi @@ -239,7 +239,7 @@ check_user() { # after the arguments were passed into the new shell during exec su # # So this regex finds any '(', ')', "'" , '"', '{', or '}' and prepends with a '\' - ESCAPED_ARGS=$(echo "$@" | sed -e "s/\([\\\(\\\){}\"']\)/\\\\\1/g") + ESCAPED_ARGS=`echo "$@" | sed -e 's/\([\\\(\\\){}"\x27]\)/\\\\\1/g'` # This will drop priviledges into the runner user # It exec's in a new shell and the current shell will exit @@ -272,7 +272,7 @@ node_down_check() { node_up_check() { MUTE=`ping_node 2> /dev/null` if [ "$?" -ne 0 ]; then - echoerr "Node is not running!" + echoerr "Node did not respond to ping!" exit 1 fi } diff --git a/priv/base/nodetool b/priv/base/nodetool index 51b8f9d..10a5521 100755 --- a/priv/base/nodetool +++ b/priv/base/nodetool @@ -189,11 +189,12 @@ nodename(Name) -> end. append_node_suffix(Name, Suffix) -> + Rnd = erlang:phash2({os:timestamp(),os:getpid()}, 1000), case string:tokens(Name, "@") of [Node, Host] -> - list_to_atom(lists:concat([Node, Suffix, os:getpid(), "@", Host])); + list_to_atom(lists:concat([Node, Suffix, Rnd, "@", Host])); [Node] -> - list_to_atom(lists:concat([Node, Suffix, os:getpid()])) + list_to_atom(lists:concat([Node, Suffix, Rnd])) end. chkconfig(File) -> diff --git a/priv/base/runner b/priv/base/runner index eed11b4..dde45d0 100755 --- a/priv/base/runner +++ b/priv/base/runner @@ -89,14 +89,16 @@ This is the primary script for controlling the $SCRIPT node. attach Attaches to the console of a $SCRIPT node running in the background using an Erlang remote shell, giving access to the Erlang shell and - runtime messages. Prints "Node is not running!" when the node cannot - be reached. Exit \`$SCRIPT attach\` by pressing Ctrl-C twice. + runtime messages. Prints "Node did not respond to ping!" when the + node cannot be reached. + Exit \`$SCRIPT attach\` by pressing \"Ctrl-G q\". attach-direct Attaches to the console of a $SCRIPT node running in the background using a directly connected FIFO, giving access to the Erlang shell - and runtime messages. Prints "Node is not running!" when the node - cannot be reached. Exit \`$SCRIPT attach-direct\` by pressing Ctrl-D. + and runtime messages. Prints "Node did not respond to ping!" when the + node cannot be reached. + Exit \`$SCRIPT attach-direct\` by pressing \"Ctrl-D\". chkconfig Confirms whether the $SCRIPT.conf and advanced.config is @@ -301,10 +303,12 @@ case "$1" in # Make sure a node is running node_up_check - echo "Remote Shell: Use \"Ctrl-C a\" to quit. q() or init:stop() will terminate the $SCRIPT node." + echo "Remote Shell: Use \"Ctrl-G q\" to quit." + echo "q() or init:stop() will terminate the $SCRIPT node." shift + RAND=$(($(($$ % 1000)) + 1)) NODE_NAME=${NAME_ARG#* } - exec $ERTS_PATH/erl -name c_$$_$NODE_NAME -hidden -remsh $NODE_NAME $COOKIE_ARG $NET_TICKTIME_ARG + exec $ERTS_PATH/erl -name c$RAND$NODE_NAME -hidden -remsh $NODE_NAME $COOKIE_ARG $NET_TICKTIME_ARG ;; console) @@ -359,11 +363,11 @@ case "$1" in node_up_check shift - MYPID=$$ + RAND=$(($(($$ % 1000)) + 1)) NODE_NAME=${NAME_ARG#* } $ERTS_PATH/erl -noshell -noinput \ -pa $RUNNER_PATCH_DIR \ - -hidden $NAME_PARAM np_etop$MYPID$NAME_HOST $COOKIE_ARG $NET_TICKTIME_ARG \ + -hidden $NAME_PARAM np_etop$RAND$NAME_HOST $COOKIE_ARG $NET_TICKTIME_ARG \ -s etop -s erlang halt -output text \ -node $NODE_NAME \ $* -tracing off diff --git a/priv/templates/deb/deb.template b/priv/templates/deb/deb.template index c1ceb4b..1f0c07c 100644 --- a/priv/templates/deb/deb.template +++ b/priv/templates/deb/deb.template @@ -31,8 +31,11 @@ {template, "control", "control"}. {template, "copyright", "copyright"}. {template, "dirs", "dirs"}. +{template, "install", "install"}. {template, "postinst", "postinst"}. {template, "postrm", "postrm"}. {template, "rules", "rules"}. {template, "vars.config", "vars.config"}. -{template, "init.script", "init.script"}. +{template, "init.script", "{{package_name}}.{{package_install_name}}.init"}. +{template, "package.service", "{{package_name}}.{{package_install_name}}.service"}. +{template, "package.manpages", "{{package_name}}.manpages"}. diff --git a/priv/templates/deb/dirs b/priv/templates/deb/dirs index 1425671..3220e0d 100644 --- a/priv/templates/deb/dirs +++ b/priv/templates/deb/dirs @@ -1,9 +1,2 @@ -etc/init.d -etc/{{package_install_name}} etc/logrotate.d -usr/lib/{{package_install_name}} -usr/{{bin_or_sbin}} -usr/share/man/man1 -var/run/{{package_install_name}} -var/lib/{{package_install_name}} var/log/{{package_install_name}} diff --git a/priv/templates/deb/init.script b/priv/templates/deb/init.script index 6ff2e3c..c0fbd90 100755 --- a/priv/templates/deb/init.script +++ b/priv/templates/deb/init.script @@ -12,6 +12,7 @@ NAME={{package_install_name}} DAEMON=/usr/{{bin_or_sbin}}/$NAME SCRIPTNAME=/etc/init.d/$NAME +RUNDIR=/var/run/$NAME # Read configuration variable file if it is present [ -r /etc/default/$NAME ] && . /etc/default/$NAME @@ -32,6 +33,10 @@ fi # do_start() { + if [ ! -d $RUNDIR ]; then + mkdir $RUNDIR + chown {{package_install_user}}:{{package_install_group}} $RUNDIR + fi # Return # 0 if daemon has been started # 1 if daemon was already running diff --git a/priv/templates/deb/install b/priv/templates/deb/install new file mode 100644 index 0000000..5f314b5 --- /dev/null +++ b/priv/templates/deb/install @@ -0,0 +1,10 @@ +rel/{{package_install_name}}/lib usr/lib/{{package_install_name}} +rel/{{package_install_name}}/erts* usr/lib/{{package_install_name}} +rel/{{package_install_name}}/releases usr/lib/{{package_install_name}} + +{{#package_commands}} +rel/{{package_install_name}}/bin/{{name}} usr/{{bin_or_sbin}} +{{/package_commands}} + +rel/{{package_install_name}}/etc/* etc/{{package_install_name}} +rel/{{package_install_name}}/data/* var/lib/{{package_install_name}} \ No newline at end of file diff --git a/priv/templates/deb/package.manpages b/priv/templates/deb/package.manpages new file mode 100644 index 0000000..e3db37c --- /dev/null +++ b/priv/templates/deb/package.manpages @@ -0,0 +1 @@ +doc/man/man1/*.1.gz \ No newline at end of file diff --git a/priv/templates/deb/package.service b/priv/templates/deb/package.service new file mode 100644 index 0000000..7514142 --- /dev/null +++ b/priv/templates/deb/package.service @@ -0,0 +1,14 @@ +[Unit] +Description={{package_shortdesc}} + +[Service] +ExecStart=/usr/{{bin_or_sbin}}/{{package_install_name}} start +ExecStop=/usr/{{bin_or_sbin}}/{{package_install_name}} stop +User={{package_install_user}} +Type=forking +PIDFile=/var/run/{{package_install_name}}/{{package_install_name}}.pid +EnvironmentFile=-/etc/default/{{package_install_name}} +RuntimeDirectory={{package_install_name}} + +[Install] +WantedBy=multi-user.target \ No newline at end of file diff --git a/priv/templates/deb/postinst b/priv/templates/deb/postinst index 1c3d32b..88f272a 100755 --- a/priv/templates/deb/postinst +++ b/priv/templates/deb/postinst @@ -5,9 +5,6 @@ set -e -# install startup script -update-rc.d {{package_install_name}} defaults >/dev/null - # create group if ! getent group {{package_install_group}} >/dev/null; then addgroup --system {{package_install_group}} @@ -22,19 +19,10 @@ if ! getent passwd {{package_install_user}} >/dev/null; then --gecos "{{package_install_user_desc}}" {{package_install_user}} fi -for i in lib run log; do +for i in lib log; do chown -R {{package_install_user}}:{{package_install_group}} /var/$i/{{package_install_name}} done -chown -R {{package_install_user}}:{{package_install_group}} /usr/lib/{{package_install_name}} -chown -R {{package_install_user}}:{{package_install_group}} /etc/{{package_install_name}} - -chmod 0755 /var/run/{{package_install_name}} /etc/{{package_install_name}} -chmod 0644 /etc/{{package_install_name}}/* -chmod -R +X /etc/{{package_install_name}} -chmod 0755 /usr/lib/{{package_install_name}}/lib/env.sh -chmod 0755 /usr/lib/{{package_install_name}}/erts-*/bin/nodetool - case "$1" in configure) ;; diff --git a/priv/templates/deb/postrm b/priv/templates/deb/postrm index bbdf548..df83a1f 100755 --- a/priv/templates/deb/postrm +++ b/priv/templates/deb/postrm @@ -22,10 +22,6 @@ set -e case "$1" in purge) rm -f /etc/default/{{package_install_name}} - - # ensure we remove the rc.d scripts installed by postinst - update-rc.d {{package_install_name}} remove >/dev/null - if [ -d /var/log/{{package_install_name}} ]; then rm -r /var/log/{{package_install_name}} fi diff --git a/priv/templates/deb/rules b/priv/templates/deb/rules index deee941..d06fee8 100755 --- a/priv/templates/deb/rules +++ b/priv/templates/deb/rules @@ -11,6 +11,7 @@ # Uncomment this to turn on verbose mode. export DH_VERBOSE=1 +ROOTDIR := debian/{{package_name}} ## Clear variables that may confound our build of sub-projects; also ## note that it is necessary to use overlay_vars relative to .. as @@ -27,47 +28,24 @@ clean: ## dh_shlibdeps was added to figure out the dependencies on shared libraries ## and will populate the ${shlibs:Depends} callout in the control file +install: LIBDIR := $(ROOTDIR)/usr/lib/{{package_install_name}} install: build dh_testdir dh_testroot dh_prep dh_installdirs - - cp -R rel/{{package_install_name}}/lib \ - debian/{{package_name}}/usr/lib/{{package_install_name}} - - cp -R rel/{{package_install_name}}/erts* \ - debian/{{package_name}}/usr/lib/{{package_install_name}} - - cp -R rel/{{package_install_name}}/releases \ - debian/{{package_name}}/usr/lib/{{package_install_name}} - -## executables - if [ -d rel/{{package_install_name}}/bin ]; then \ - mkdir -p debian/{{package_name}}/usr/{{bin_or_sbin}} && \ - {{#package_commands}}install -p -D -m 0755 rel/{{package_install_name}}/bin/{{name}} debian/{{package_name}}/usr/{{bin_or_sbin}}/ && \ - {{/package_commands}}echo -n; fi - -## install man pages if they exist - if [ -d doc/man/man1 ]; then \ - mkdir -p debian/usr/share/man/man1 && \ - {{#package_commands}}if [ -f doc/man/man1/{{name}}.1.gz ]; then \ - install -p -D -m 0544 doc/man/man1/{{name}}.1.gz \ - debian/{{package_name}}/usr/share/man/man1/ \ - ; fi && \ - {{/package_commands}}echo -n; fi - - mkdir -p debian/{{package_name}}/etc/{{package_install_name}} - cp -R rel/{{package_install_name}}/etc/* \ - debian/{{package_name}}/etc/{{package_install_name}} - - mkdir -p debian/{{package_name}}/var/lib - cp -R rel/{{package_install_name}}/data/* \ - debian/{{package_name}}/var/lib/{{package_install_name}} - - install -m755 debian/init.script \ - debian/{{package_name}}/etc/init.d/{{package_install_name}} - + dh_install + dh_installman + dh_installinit --name={{package_install_name}} --no-start + dh_fixperms + chmod 0755 $(ROOTDIR)/etc/{{package_install_name}} + chmod -R a+rX $(ROOTDIR)/etc/{{package_install_name}} + for file in lib/env.sh lib/app_epath.sh erts-*/bin/nodetool; do \ + if [ -f $(LIBDIR)/$$file ]; then \ + chmod 0755 $(LIBDIR)/$$file; \ + fi; \ + done + chmod -R go+rX debian/{{package_name}}/usr/lib/{{package_install_name}}/lib/ dh_shlibdeps # We have nothing to do by default. diff --git a/priv/templates/fbsd/+DISPLAY b/priv/templates/fbsd/+DISPLAY index e268700..7cbf6e3 100644 --- a/priv/templates/fbsd/+DISPLAY +++ b/priv/templates/fbsd/+DISPLAY @@ -1,6 +1,6 @@ Thank you for installing {{package_name}}. -{{package_name}} has been installed in /usr/local owned by user:group {{package_install_user}}:{{package_install_group}} +{{package_name}} has been installed in /usr/local owned by user:group root:wheel The primary directories are: diff --git a/priv/templates/fbsd/Makefile b/priv/templates/fbsd/Makefile index 26e7108..ed5c580 100644 --- a/priv/templates/fbsd/Makefile +++ b/priv/templates/fbsd/Makefile @@ -57,7 +57,7 @@ packing_list_files: $(BUILD_STAGE_DIR) echo "@name {{package_name}}-$(PKG_VERSION)" >> plist echo "@conflicts {{package_name}}-*" >> plist echo "@exec if ! pw groupshow {{package_install_group}} 2>/dev/null; then pw groupadd {{package_install_group}}; fi" >> plist - echo "@exec if ! pw usershow {{package_install_user}} 2>/dev/null; then pw useradd {{package_install_user}} -g {{package_install_group}} -h - -d {{platform_base_dir}} -s /bin/sh -c \"{{package_install_user_desc}}\"; fi" >> plist + echo "@exec if ! pw usershow {{package_install_user}} 2>/dev/null; then pw useradd {{package_install_user}} -g {{package_install_group}} -h - -d {{platform_data_dir}} -s /bin/sh -c \"{{package_install_user_desc}}\"; fi" >> plist echo "@comment ORIGIN:{{freebsd_package_category}}/{{package_install_name}}" >> plist @echo "Copying Man pages to staging directory" @@ -73,9 +73,9 @@ packing_list_files: $(BUILD_STAGE_DIR) {{/package_commands}} echo -n; fi @echo "Scanning data and log directories for empty directories to add" - $(eval DIRS_INSTALL = {{platform_log_dir}}) - $(eval DIRS_INSTALL += $(shell cd $(BUILD_STAGE_DIR) && find $(PDATA_ROOT_DIR) -type d -exec printf "/%s " {} \;)) - for i in $(DIRS_INSTALL); \ + $(eval PACKAGE_USER_WRITABLE_DIRS = {{platform_log_dir}}) + $(eval PACKAGE_USER_WRITABLE_DIRS += $(shell cd $(BUILD_STAGE_DIR) && find $(PDATA_ROOT_DIR) -type d -exec printf "/%s " {} \;)) + for i in $(PACKAGE_USER_WRITABLE_DIRS); \ do \ echo "@exec mkdir -p $$i" >> plist; \ echo "@exec chown -R {{package_install_user}}:{{package_install_group}} $$i" >> plist; \ @@ -88,22 +88,18 @@ packing_list_files: $(BUILD_STAGE_DIR) @echo "Packaging /usr/local files" cd $(BUILD_STAGE_DIR) && \ echo "@cwd /usr/local" >> +CONTENTS && \ - echo "@owner {{package_install_user}}" >> +CONTENTS && \ - echo "@group {{package_install_group}}" >> +CONTENTS && \ - echo "@mode 0755" >> +CONTENTS - cd $(BUILD_STAGE_DIR) && \ - find {{bin_or_sbin}} -type f >> +CONTENTS + echo "@owner root" >> +CONTENTS && \ + echo "@group wheel" >> +CONTENTS && \ + echo "@mode 0755" >> +CONTENT cd $(BUILD_STAGE_DIR) && \ find lib -type f >> +CONTENTS && \ find lib -d -type d -mindepth 1 -exec echo "@dirrm {}" \; >> +CONTENTS && \ - echo "@exec chown -R {{package_install_user}}:{{package_install_group}} {{platform_base_dir}}" >> +CONTENTS + echo "@exec chown -R root:wheel {{platform_base_dir}}" >> +CONTENTS && \ + find {{bin_or_sbin}} -type f >> +CONTENTS cd $(BUILD_STAGE_DIR) && \ - echo "@owner root" >> +CONTENTS && \ - echo "@group wheel" >> +CONTENTS && \ echo "@mode 0644" >> +CONTENTS && \ find etc -type f >> +CONTENTS && \ find etc -d -type d -mindepth 1 -exec echo "@dirrm {}" \; >> +CONTENTS - @echo "Packaging /var files" cd $(BUILD_STAGE_DIR) && \ echo "@cwd /var" >> +CONTENTS diff --git a/priv/templates/rpm/rhel.init.script b/priv/templates/rpm/rhel.init.script index b620d8a..0cdd20c 100755 --- a/priv/templates/rpm/rhel.init.script +++ b/priv/templates/rpm/rhel.init.script @@ -40,7 +40,7 @@ status -p $pidfile -l $(basename $lockfile) $NAME >/dev/null 2>&1 running=$? check_pid_status() { - pid=$(ps ax | grep beam.smp | grep "\-progname $NAME" | awk '{print $1}') + pid=$(ps ax | grep beam.smp | grep "\-progname $NAME " | awk '{print $1}') if [ "$pid" = "" ]; then # prog not running? return 1 diff --git a/priv/templates/rpm/specfile b/priv/templates/rpm/specfile index 5775241..4acc798 100644 --- a/priv/templates/rpm/specfile +++ b/priv/templates/rpm/specfile @@ -169,14 +169,15 @@ exit 0 # Man pages are optional and might be missing, read from file %files -f additional_files_list %defattr(-,{{package_install_user}},{{package_install_group}}) -%{_libdir}/* -%dir %{_sysconfdir}/{{package_install_name}} -%config(noreplace) %{_sysconfdir}/{{package_install_name}}/* -%{_{{bin_or_sbin}}dir}/* %{_localstatedir}/lib/{{package_install_name}} %{_localstatedir}/log/{{package_install_name}} %{_localstatedir}/run/{{package_install_name}} +%defattr(-,root,root) %{_sysconfdir}/init.d/{{package_install_name}} +%{_{{bin_or_sbin}}dir}/* +%{_libdir}/* +%dir %{_sysconfdir}/{{package_install_name}} +%config(noreplace) %{_sysconfdir}/{{package_install_name}}/* %clean rm -rf %{buildroot} diff --git a/priv/templates/rpm/suse.init.script b/priv/templates/rpm/suse.init.script index 8314622..d65c48d 100755 --- a/priv/templates/rpm/suse.init.script +++ b/priv/templates/rpm/suse.init.script @@ -44,7 +44,7 @@ do_status() { } check_pid_status() { - pid=$(ps ax | grep beam.smp | grep "\-progname $NAME" | awk '{print $1}') + pid=$(ps ax | grep beam.smp | grep "\-progname $NAME " | awk '{print $1}') if [ "$pid" = "" ]; then # prog not running? return 1 diff --git a/priv/templates/smartos/+DISPLAY b/priv/templates/smartos/+DISPLAY index 6cdebda..a0f0ad9 100644 --- a/priv/templates/smartos/+DISPLAY +++ b/priv/templates/smartos/+DISPLAY @@ -1,6 +1,6 @@ Thank you for installing {{package_name}}. -{{package_name}} has been installed in {{platform_base_dir}} owned by user:group {{package_install_user}}:{{package_install_group}} +{{package_name}} has been installed in {{platform_base_dir}} owned by user:group root:root The primary directories are: diff --git a/priv/templates/smartos/+INSTALL b/priv/templates/smartos/+INSTALL index a785cd7..59227f2 100755 --- a/priv/templates/smartos/+INSTALL +++ b/priv/templates/smartos/+INSTALL @@ -1,7 +1,7 @@ #!/bin/sh # Variable that will get replaced by the Makefile dirs_create target -CREATE_DIRS="%DIRS_CREATE%" +PACKAGE_USER_WRITABLE_DIRS="%PACKAGE_USER_WRITABLE_DIRS%" # Config files that could possibly be installed CONFIG_FILES="vm.args app.config advanced.config {{cuttlefish_conf}}" @@ -12,12 +12,12 @@ if [ "$2" = "PRE-INSTALL" ]; then fi if ! getent passwd "{{package_install_user}}" 2>/dev/null 1>&2; then - useradd -g {{package_install_group}} -d {{platform_base_dir}} -s /bin/sh {{package_install_user}} + useradd -g {{package_install_group}} -d {{platform_data_dir}} -s /bin/sh {{package_install_user}} fi # Create var directories outside of +CONTENTS - # Read directories from the CREATE_DIRS variable - for i in $CREATE_DIRS; do + # Read directories from the PACKAGE_USER_WRITABLE_DIRS variable + for i in $PACKAGE_USER_WRITABLE_DIRS; do if [ -d $i ]; then echo "Skipping directory creation of $i, directory already exists" else @@ -42,12 +42,12 @@ if [ "$2" = "POST-INSTALL" ]; then # Ensure proper permissions on {{package_name}} scripts for i in {{#package_commands}}{{name}} {{/package_commands}}; do - chown {{package_install_user}}:{{package_install_group}} {{platform_bin_dir}}/$i + chown root:root {{platform_bin_dir}}/$i chmod 755 {{platform_bin_dir}}/$i done # Ensure proper ownership of lib directory - chown -R {{package_install_user}}:{{package_install_group}} {{platform_lib_dir}} + chown -R root:root {{platform_lib_dir}} chmod -R g+r {{platform_lib_dir}} # Treat new configuration files as new if old ones already exist @@ -86,8 +86,12 @@ if [ "$2" = "POST-INSTALL" ]; then -c "{{package_install_name}} default project" {{package_install_name}} fi + # Ensure proper permissions of SMF files + chown -R root:root /opt/local/share/smf/{{package_install_name}} + chown -R root:root /opt/local/share/smf/{{package_install_name}}-epmd + chmod 755 /opt/local/share/smf/{{package_install_name}}-epmd/{{package_install_name}}-epmd + # Import SMF definitions svccfg import /opt/local/share/smf/{{package_install_name}}-epmd/manifest.xml - chmod 755 /opt/local/share/smf/{{package_install_name}}-epmd/{{package_install_name}}-epmd svccfg import /opt/local/share/smf/{{package_install_name}}/manifest.xml fi diff --git a/priv/templates/smartos/Makefile b/priv/templates/smartos/Makefile index e68d9e5..6224c8e 100644 --- a/priv/templates/smartos/Makefile +++ b/priv/templates/smartos/Makefile @@ -42,6 +42,12 @@ OPENSSL_DEP = openssl-1.0.1* GCC_DEP = gcc47-libs>=4.7.0 SMF_MANIFEST = manifest131.xml endif +ifeq ($(PKGSRC_VERSION),2015Q4) # SmartOS 15.4.0 +NCURSES_DEP = ncurses-6* +OPENSSL_DEP = openssl-1.0.2* +GCC_DEP = gcc49-libs>=4.9.3 +SMF_MANIFEST = manifest154.xml +endif # Where we install things (based on vars.config) @@ -133,23 +139,23 @@ packing_list_files: $(BUILD_STAGE_DIR) templates cd $(BUILD_STAGE_DIR) && \ echo "@comment Packing lib files" >> +CONTENTS && \ echo "@cwd /opt/local" >> +CONTENTS && \ - echo "@owner {{package_install_user}}" >> +CONTENTS && \ - echo "@group {{package_install_group}}" >> +CONTENTS + echo "@owner root" >> +CONTENTS && \ + echo "@group root" >> +CONTENTS cd $(BUILD_STAGE_DIR) && \ find lib -type f >> +CONTENTS && \ - echo "@exec chown -R {{package_install_user}}:{{package_install_group}} {{platform_base_dir}}" >> +CONTENTS + echo "@exec chown -R root:root {{platform_base_dir}}" >> +CONTENTS cd $(BUILD_STAGE_DIR) && \ echo "@comment Packing /usr/local {{bin_or_sbin}} files" >> +CONTENTS && \ - echo "@owner {{package_install_user}}" >> +CONTENTS && \ - echo "@group {{package_install_group}}" >> +CONTENTS && \ + echo "@owner root" >> +CONTENTS && \ + echo "@group root" >> +CONTENTS && \ echo "@mode 0755" >> +CONTENTS && \ find {{bin_or_sbin}} -type f >> +CONTENTS cd $(BUILD_STAGE_DIR) && \ - echo "@owner {{package_install_user}}" >> +CONTENTS && \ - echo "@group {{package_install_group}}" >> +CONTENTS && \ + echo "@owner root" >> +CONTENTS && \ + echo "@group root" >> +CONTENTS && \ find share -type f >> +CONTENTS cd $(BUILD_STAGE_DIR) && \ @@ -167,13 +173,13 @@ packing_list_files: $(BUILD_STAGE_DIR) templates # I feel dirty now. dirs_file: $(BUILD_STAGE_DIR) @echo "Adding data and log directories to directory list" - $(eval DIRS_INSTALL = {{platform_data_dir}}) - $(eval DIRS_INSTALL += {{platform_log_dir}}) + $(eval PACKAGE_USER_WRITABLE_DIRS = {{platform_data_dir}}) + $(eval PACKAGE_USER_WRITABLE_DIRS += {{platform_log_dir}}) @echo "Scanning var directory for any additional install paths" - $(eval DIRS_INSTALL += $(shell cd $(BUILD_STAGE_DIR) && find $(PDATA_ROOT_DIR) -type d -exec printf "/%s " {} \;)) + $(eval PACKAGE_USER_WRITABLE_DIRS += $(shell cd $(BUILD_STAGE_DIR) && find $(PDATA_ROOT_DIR) -type d -exec printf "/%s " {} \;)) cd $(BUILD_STAGE_DIR) && \ cp +INSTALL +INSTALL.tmp && \ - sed -e 's|%DIRS_CREATE%|${DIRS_INSTALL}|' < \ + sed -e 's|%PACKAGE_USER_WRITABLE_DIRS%|${PACKAGE_USER_WRITABLE_DIRS}|' < \ +INSTALL.tmp > +INSTALL && \ rm +INSTALL.tmp diff --git a/priv/templates/smartos/manifest131.xml b/priv/templates/smartos/manifest131.xml index 73ae5fc..f41e5d7 100644 --- a/priv/templates/smartos/manifest131.xml +++ b/priv/templates/smartos/manifest131.xml @@ -16,7 +16,7 @@ - + diff --git a/priv/templates/smartos/manifest154.xml b/priv/templates/smartos/manifest154.xml new file mode 100644 index 0000000..f41e5d7 --- /dev/null +++ b/priv/templates/smartos/manifest154.xml @@ -0,0 +1,37 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/priv/templates/smartos/smartos.template b/priv/templates/smartos/smartos.template index 0365f30..e25729a 100644 --- a/priv/templates/smartos/smartos.template +++ b/priv/templates/smartos/smartos.template @@ -30,5 +30,6 @@ {template, "manifest16.xml", "manifest16.xml"}. {template, "manifest18.xml", "manifest18.xml"}. {template, "manifest131.xml", "manifest131.xml"}. +{template, "manifest154.xml", "manifest154.xml"}. {template, "epmd", "epmd"}. {template, "runner.patch", "runner.patch"}. diff --git a/priv/templates/solaris/Makefile b/priv/templates/solaris/Makefile index 79d4cff..e7e7ca4 100644 --- a/priv/templates/solaris/Makefile +++ b/priv/templates/solaris/Makefile @@ -27,6 +27,13 @@ buildrel: @# Ye Olde Bourne Shell on Solaris means we have to do it old school echo "Using `which erl` to build"; \ OVERLAY_VARS="overlay_vars=../solaris/vars.config" $(MAKE) rel + chmod -R go+rX rel/{{package_install_name}} + chmod 0755 rel/{{package_install_name}}/etc + chmod -R a+rX rel/{{package_install_name}}/etc + chmod 0755 rel/{{package_install_name}}/lib/env.sh + chmod 0755 rel/{{package_install_name}}/lib/app_epath.sh + chmod 0755 rel/{{package_install_name}}/erts-*/bin/nodetool + chmod -R go+rX rel/{{package_install_name}}/lib/ chmod 0755 rel/{{package_install_name}}/bin/* \ rel/{{package_install_name}}/erts-*/bin/* if [ "{{bin_or_sbin}}" != "bin" ]; then \ @@ -50,7 +57,9 @@ prototype: echo "i r.preserve" >> prototype echo '' >> prototype pkgproto rel/{{package_install_name}}={{package_install_name}} >> prototype - sed -e "s/ $(LOGNAME) .*$$/ {{package_install_user}} {{package_install_group}}/" \ + sed -e "s/ $(LOGNAME) .*$$/ root bin/" \ + -e "s/\([f|d]\) none {{package_install_name}}\/log\(.*\) \(.*\) root bin/\1 none {{package_install_name}}\/log\2 \3 {{package_install_user}} {{package_install_group}}/" \ + -e "s/\([f|d]\) none {{package_install_name}}\/data\(.*\) \(.*\) root bin/\1 none {{package_install_name}}\/data\2 \3 {{package_install_user}} {{package_install_group}}/" \ -e 's/f none {{package_install_name}}\/etc/e preserve {{package_install_name}}\/etc/' prototype > prototype.tmp && mv prototype.tmp prototype $(PKGERDIR)/pkgclean: diff --git a/priv/templates/solaris/preinstall b/priv/templates/solaris/preinstall index 785b71d..0cafd8f 100755 --- a/priv/templates/solaris/preinstall +++ b/priv/templates/solaris/preinstall @@ -9,7 +9,7 @@ fi # create {{package_install_user}} user only if it doesn't already exist getent passwd {{package_install_user}} >/dev/null 2>&1 if [ $? -ne 0 ]; then - useradd -g {{package_install_group}} -d /opt/{{package_install_name}} -s /usr/bin/ksh {{package_install_user}} + useradd -g {{package_install_group}} -d {{platform_data_dir}} -s /usr/bin/ksh {{package_install_user}} usermod -c "{{package_install_user_desc}}" {{package_install_user}} fi