From 485a3da159decdbc22acc8fdfdebd9adcf904bda Mon Sep 17 00:00:00 2001 From: Tom Briden Date: Wed, 15 Apr 2015 07:54:52 +0100 Subject: [PATCH 01/42] Set NODETOOL up as an alias and include ERL_FLAGS env vars nodetool won't work with TLS distribution as the erlang vm args don't get passed in to escript. This commit reads the TLS args from the vm.args file if it exists and prefixes the call to escript with them. The only way to have this work properly is to alias the command rather than store it as a variable basho/riak#509 --- priv/base/env.sh | 14 +++++++++----- priv/base/runner | 4 ++-- 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/priv/base/env.sh b/priv/base/env.sh index bcaf475..5d3d547 100755 --- a/priv/base/env.sh +++ b/priv/base/env.sh @@ -117,8 +117,12 @@ APP_VSN=${START_ERL#* } ERTS_PATH=$RUNNER_BASE_DIR/erts-$ERTS_VSN/bin # Setup command to control the node -NODETOOL="$ERTS_PATH/escript $ERTS_PATH/nodetool $NET_TICKTIME_ARG $NAME_ARG $COOKIE_ARG" -NODETOOL_LITE="$ERTS_PATH/escript $ERTS_PATH/nodetool" +if [ -f $RUNNER_ETC_DIR/vm.args ]; then + SSL_ARGS=$(grep -e '^\-ssl_dist_opt' -e '^\-proto_dist' $RUNNER_ETC_DIR/vm.args | tr '\n' ' ') + ERL_FLAGS="$ERL_FLAGS $SSL_ARGS" +fi +alias NODETOOL="ERL_FLAGS=\"$ERL_FLAGS\" $ERTS_PATH/escript $ERTS_PATH/nodetool $NET_TICKTIME_ARG $NAME_ARG $COOKIE_ARG" +alias NODETOOL_LITE="ERL_FLAGS=\"$ERL_FLAGS\" $ERTS_PATH/escript $ERTS_PATH/nodetool" ## Are we using cuttlefish (http://github.com/basho/cuttlefish) @@ -133,7 +137,7 @@ fi # Ping node without stealing stdin ping_node() { - $NODETOOL ping < /dev/null + NODETOOL ping < /dev/null } # Attempts to create a pid directory like /var/run/APPNAME and then @@ -288,7 +292,7 @@ check_config() { fi fi - MUTE=`$NODETOOL_LITE chkconfig $CONFIG_ARGS` + MUTE=`NODETOOL_LITE chkconfig $CONFIG_ARGS` if [ "$?" -ne 0 ]; then echoerr "Error reading $CONFIG_ARGS" exit 1 @@ -313,7 +317,7 @@ check_ulimit() { # Set the PID global variable, return 1 on error get_pid() { - PID=`$NODETOOL getpid < /dev/null` + PID=`NODETOOL getpid < /dev/null` if [ "$?" -ne 0 ]; then echo "Node is not running!" return 1 diff --git a/priv/base/runner b/priv/base/runner index eed11b4..21bedbe 100755 --- a/priv/base/runner +++ b/priv/base/runner @@ -203,7 +203,7 @@ do_start() { if [ "$?" -ne 0 ]; then continue fi - PROCESS=`$NODETOOL rpcterms erlang whereis "'${WAIT_FOR_PROCESS}'."` + PROCESS=`NODETOOL rpcterms erlang whereis "'${WAIT_FOR_PROCESS}'."` if [ "$PROCESS" != "undefined" ]; then # Attempt to create a .pid file for the process create_pid_file @@ -229,7 +229,7 @@ do_stop() { fi # Tell nodetool to stop - $NODETOOL stop + NODETOOL stop ES=$? if [ "$ES" -ne 0 ]; then exit $ES From 8130779640599a841f4f34d0e3573a5a1df5e996 Mon Sep 17 00:00:00 2001 From: Doug Rohrer Date: Wed, 17 Feb 2016 21:41:24 -0500 Subject: [PATCH 02/42] Make sure init.d files are installed as root --- priv/templates/rpm/specfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/priv/templates/rpm/specfile b/priv/templates/rpm/specfile index 5775241..a55a38f 100644 --- a/priv/templates/rpm/specfile +++ b/priv/templates/rpm/specfile @@ -114,7 +114,7 @@ cp -R %{relpath}/data/* \ %{buildroot}%{_localstatedir}/lib/{{package_install_name}} mkdir -p %{buildroot}%{_sysconfdir}/init.d -install -m755 %{_topdir}/init.script %{buildroot}%{_sysconfdir}/init.d/{{package_install_name}} +install -u root -g root -m755 %{_topdir}/init.script %{buildroot}%{_sysconfdir}/init.d/{{package_install_name}} # Needed to work around check-rpaths which seems to be hardcoded into recent # RPM releases From df24d52db4f516b151c85ebd205d37fe511719b1 Mon Sep 17 00:00:00 2001 From: Doug Rohrer Date: Thu, 18 Feb 2016 12:49:24 -0500 Subject: [PATCH 03/42] update to use %defattr% for init.d package to install as root. --- priv/templates/rpm/specfile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/priv/templates/rpm/specfile b/priv/templates/rpm/specfile index a55a38f..5cc2a76 100644 --- a/priv/templates/rpm/specfile +++ b/priv/templates/rpm/specfile @@ -114,7 +114,7 @@ cp -R %{relpath}/data/* \ %{buildroot}%{_localstatedir}/lib/{{package_install_name}} mkdir -p %{buildroot}%{_sysconfdir}/init.d -install -u root -g root -m755 %{_topdir}/init.script %{buildroot}%{_sysconfdir}/init.d/{{package_install_name}} +install -m755 %{_topdir}/init.script %{buildroot}%{_sysconfdir}/init.d/{{package_install_name}} # Needed to work around check-rpaths which seems to be hardcoded into recent # RPM releases @@ -176,6 +176,7 @@ exit 0 %{_localstatedir}/lib/{{package_install_name}} %{_localstatedir}/log/{{package_install_name}} %{_localstatedir}/run/{{package_install_name}} +%defattr(-,root,root) %{_sysconfdir}/init.d/{{package_install_name}} %clean From 5925b4ce7d1b1860df382f9c1ea6c8d4f44e8ecb Mon Sep 17 00:00:00 2001 From: Doug Rohrer Date: Wed, 2 Mar 2016 11:58:01 -0500 Subject: [PATCH 04/42] Move {{bin_or_sbin}} to section owned by root:wheel instead of riak:riak --- priv/templates/fbsd/Makefile | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/priv/templates/fbsd/Makefile b/priv/templates/fbsd/Makefile index 26e7108..df0cea4 100644 --- a/priv/templates/fbsd/Makefile +++ b/priv/templates/fbsd/Makefile @@ -91,8 +91,6 @@ packing_list_files: $(BUILD_STAGE_DIR) echo "@owner {{package_install_user}}" >> +CONTENTS && \ echo "@group {{package_install_group}}" >> +CONTENTS && \ echo "@mode 0755" >> +CONTENTS - cd $(BUILD_STAGE_DIR) && \ - find {{bin_or_sbin}} -type f >> +CONTENTS cd $(BUILD_STAGE_DIR) && \ find lib -type f >> +CONTENTS && \ find lib -d -type d -mindepth 1 -exec echo "@dirrm {}" \; >> +CONTENTS && \ @@ -102,8 +100,9 @@ packing_list_files: $(BUILD_STAGE_DIR) echo "@group wheel" >> +CONTENTS && \ echo "@mode 0644" >> +CONTENTS && \ find etc -type f >> +CONTENTS && \ - find etc -d -type d -mindepth 1 -exec echo "@dirrm {}" \; >> +CONTENTS - + find etc -d -type d -mindepth 1 -exec echo "@dirrm {}" \; >> +CONTENTS && \ + echo "@mode 0755" >> +CONTENTS && \ + find {{bin_or_sbin}} -type f >> +CONTENTS @echo "Packaging /var files" cd $(BUILD_STAGE_DIR) && \ echo "@cwd /var" >> +CONTENTS From 12fee7ab0d143a0998ce8465c5f44907f8899786 Mon Sep 17 00:00:00 2001 From: Doug Rohrer Date: Fri, 4 Mar 2016 22:06:02 +0000 Subject: [PATCH 05/42] make sure /usr/sbin files are also owned by root --- priv/templates/rpm/specfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/priv/templates/rpm/specfile b/priv/templates/rpm/specfile index 5cc2a76..e2ac5c6 100644 --- a/priv/templates/rpm/specfile +++ b/priv/templates/rpm/specfile @@ -172,12 +172,12 @@ exit 0 %{_libdir}/* %dir %{_sysconfdir}/{{package_install_name}} %config(noreplace) %{_sysconfdir}/{{package_install_name}}/* -%{_{{bin_or_sbin}}dir}/* %{_localstatedir}/lib/{{package_install_name}} %{_localstatedir}/log/{{package_install_name}} %{_localstatedir}/run/{{package_install_name}} %defattr(-,root,root) %{_sysconfdir}/init.d/{{package_install_name}} +%{_{{bin_or_sbin}}dir}/* %clean rm -rf %{buildroot} From e8b3ca9421b399dc3f9b29d8ec8f27ad504a60a3 Mon Sep 17 00:00:00 2001 From: Doug Rohrer Date: Mon, 7 Mar 2016 14:02:27 -0500 Subject: [PATCH 06/42] move non-writable files to root:root section of specfile --- priv/templates/rpm/specfile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/priv/templates/rpm/specfile b/priv/templates/rpm/specfile index e2ac5c6..4acc798 100644 --- a/priv/templates/rpm/specfile +++ b/priv/templates/rpm/specfile @@ -169,15 +169,15 @@ exit 0 # Man pages are optional and might be missing, read from file %files -f additional_files_list %defattr(-,{{package_install_user}},{{package_install_group}}) -%{_libdir}/* -%dir %{_sysconfdir}/{{package_install_name}} -%config(noreplace) %{_sysconfdir}/{{package_install_name}}/* %{_localstatedir}/lib/{{package_install_name}} %{_localstatedir}/log/{{package_install_name}} %{_localstatedir}/run/{{package_install_name}} %defattr(-,root,root) %{_sysconfdir}/init.d/{{package_install_name}} %{_{{bin_or_sbin}}dir}/* +%{_libdir}/* +%dir %{_sysconfdir}/{{package_install_name}} +%config(noreplace) %{_sysconfdir}/{{package_install_name}}/* %clean rm -rf %{buildroot} From 981c495c98686df553ce84d3520a42d319ecdd6d Mon Sep 17 00:00:00 2001 From: Doug Rohrer Date: Mon, 7 Mar 2016 15:24:26 -0500 Subject: [PATCH 07/42] Updated FreeBSD (old) to install almost everything as root:wheel. --- priv/templates/fbsd/Makefile | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/priv/templates/fbsd/Makefile b/priv/templates/fbsd/Makefile index df0cea4..daed87e 100644 --- a/priv/templates/fbsd/Makefile +++ b/priv/templates/fbsd/Makefile @@ -88,21 +88,18 @@ packing_list_files: $(BUILD_STAGE_DIR) @echo "Packaging /usr/local files" cd $(BUILD_STAGE_DIR) && \ echo "@cwd /usr/local" >> +CONTENTS && \ - echo "@owner {{package_install_user}}" >> +CONTENTS && \ - echo "@group {{package_install_group}}" >> +CONTENTS && \ - echo "@mode 0755" >> +CONTENTS + echo "@owner root" >> +CONTENTS && \ + echo "@group wheel" >> +CONTENTS && \ + echo "@mode 0755" >> +CONTENT cd $(BUILD_STAGE_DIR) && \ find lib -type f >> +CONTENTS && \ find lib -d -type d -mindepth 1 -exec echo "@dirrm {}" \; >> +CONTENTS && \ - echo "@exec chown -R {{package_install_user}}:{{package_install_group}} {{platform_base_dir}}" >> +CONTENTS + echo "@exec chown -R root:wheel {{platform_base_dir}}" >> +CONTENTS && \ + find {{bin_or_sbin}} -type f >> +CONTENTS cd $(BUILD_STAGE_DIR) && \ - echo "@owner root" >> +CONTENTS && \ - echo "@group wheel" >> +CONTENTS && \ echo "@mode 0644" >> +CONTENTS && \ find etc -type f >> +CONTENTS && \ - find etc -d -type d -mindepth 1 -exec echo "@dirrm {}" \; >> +CONTENTS && \ - echo "@mode 0755" >> +CONTENTS && \ - find {{bin_or_sbin}} -type f >> +CONTENTS + find etc -d -type d -mindepth 1 -exec echo "@dirrm {}" \; >> +CONTENTS @echo "Packaging /var files" cd $(BUILD_STAGE_DIR) && \ echo "@cwd /var" >> +CONTENTS From dd06ed561934148c9f59bc7b379b23f35c7c7894 Mon Sep 17 00:00:00 2001 From: Doug Rohrer Date: Tue, 8 Mar 2016 20:37:51 -0500 Subject: [PATCH 08/42] Fix install message, and set home directory to {{platform_data_dir}} instead of {{platform_base_dir}} so it's writable for the riak user --- priv/templates/fbsd/+DISPLAY | 2 +- priv/templates/fbsd/Makefile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/priv/templates/fbsd/+DISPLAY b/priv/templates/fbsd/+DISPLAY index e268700..7cbf6e3 100644 --- a/priv/templates/fbsd/+DISPLAY +++ b/priv/templates/fbsd/+DISPLAY @@ -1,6 +1,6 @@ Thank you for installing {{package_name}}. -{{package_name}} has been installed in /usr/local owned by user:group {{package_install_user}}:{{package_install_group}} +{{package_name}} has been installed in /usr/local owned by user:group root:wheel The primary directories are: diff --git a/priv/templates/fbsd/Makefile b/priv/templates/fbsd/Makefile index daed87e..dd43252 100644 --- a/priv/templates/fbsd/Makefile +++ b/priv/templates/fbsd/Makefile @@ -57,7 +57,7 @@ packing_list_files: $(BUILD_STAGE_DIR) echo "@name {{package_name}}-$(PKG_VERSION)" >> plist echo "@conflicts {{package_name}}-*" >> plist echo "@exec if ! pw groupshow {{package_install_group}} 2>/dev/null; then pw groupadd {{package_install_group}}; fi" >> plist - echo "@exec if ! pw usershow {{package_install_user}} 2>/dev/null; then pw useradd {{package_install_user}} -g {{package_install_group}} -h - -d {{platform_base_dir}} -s /bin/sh -c \"{{package_install_user_desc}}\"; fi" >> plist + echo "@exec if ! pw usershow {{package_install_user}} 2>/dev/null; then pw useradd {{package_install_user}} -g {{package_install_group}} -h - -d {{platform_data_dir}} -s /bin/sh -c \"{{package_install_user_desc}}\"; fi" >> plist echo "@comment ORIGIN:{{freebsd_package_category}}/{{package_install_name}}" >> plist @echo "Copying Man pages to staging directory" From 4a2f0c2bec326b1b0d57c10fb46203a72fd2e122 Mon Sep 17 00:00:00 2001 From: Joe Caswell Date: Wed, 9 Mar 2016 10:30:58 -0800 Subject: [PATCH 09/42] Change ping fail message If all we are checking is ping, only report that ping failed. --- priv/base/env.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/priv/base/env.sh b/priv/base/env.sh index 4ec9231..94e23a2 100755 --- a/priv/base/env.sh +++ b/priv/base/env.sh @@ -272,7 +272,7 @@ node_down_check() { node_up_check() { MUTE=`ping_node 2> /dev/null` if [ "$?" -ne 0 ]; then - echoerr "Node is not running!" + echoerr "Node did not respond to ping!" exit 1 fi } From aaf3e1562247a47efd3eed809bdd3446660cb418 Mon Sep 17 00:00:00 2001 From: Doug Rohrer Date: Wed, 9 Mar 2016 16:20:14 -0500 Subject: [PATCH 10/42] Multiple additional security tightenings: - Changes to make sure we install as many things as possible as root:root or root:wheel, rather than package_install_user:package_install_group. - Updates to make it more clear when using variables that they will be writable by the package_install_user. - Always use `package_data_dir` as home directory for user, as package_base_dir should not be writable or owned by package user and more. Erlang cookie file `.erlang.cookie` is created in the home directory, so it must be writable. --- priv/templates/deb/postinst | 3 --- priv/templates/fbsd/Makefile | 6 +++--- priv/templates/smartos/+DISPLAY | 2 +- priv/templates/smartos/+INSTALL | 14 +++++++------- priv/templates/smartos/Makefile | 24 ++++++++++++------------ priv/templates/smartos/manifest131.xml | 2 +- priv/templates/solaris/preinstall | 2 +- 7 files changed, 25 insertions(+), 28 deletions(-) diff --git a/priv/templates/deb/postinst b/priv/templates/deb/postinst index 1c3d32b..9be3eb9 100755 --- a/priv/templates/deb/postinst +++ b/priv/templates/deb/postinst @@ -26,9 +26,6 @@ for i in lib run log; do chown -R {{package_install_user}}:{{package_install_group}} /var/$i/{{package_install_name}} done -chown -R {{package_install_user}}:{{package_install_group}} /usr/lib/{{package_install_name}} -chown -R {{package_install_user}}:{{package_install_group}} /etc/{{package_install_name}} - chmod 0755 /var/run/{{package_install_name}} /etc/{{package_install_name}} chmod 0644 /etc/{{package_install_name}}/* chmod -R +X /etc/{{package_install_name}} diff --git a/priv/templates/fbsd/Makefile b/priv/templates/fbsd/Makefile index dd43252..ed5c580 100644 --- a/priv/templates/fbsd/Makefile +++ b/priv/templates/fbsd/Makefile @@ -73,9 +73,9 @@ packing_list_files: $(BUILD_STAGE_DIR) {{/package_commands}} echo -n; fi @echo "Scanning data and log directories for empty directories to add" - $(eval DIRS_INSTALL = {{platform_log_dir}}) - $(eval DIRS_INSTALL += $(shell cd $(BUILD_STAGE_DIR) && find $(PDATA_ROOT_DIR) -type d -exec printf "/%s " {} \;)) - for i in $(DIRS_INSTALL); \ + $(eval PACKAGE_USER_WRITABLE_DIRS = {{platform_log_dir}}) + $(eval PACKAGE_USER_WRITABLE_DIRS += $(shell cd $(BUILD_STAGE_DIR) && find $(PDATA_ROOT_DIR) -type d -exec printf "/%s " {} \;)) + for i in $(PACKAGE_USER_WRITABLE_DIRS); \ do \ echo "@exec mkdir -p $$i" >> plist; \ echo "@exec chown -R {{package_install_user}}:{{package_install_group}} $$i" >> plist; \ diff --git a/priv/templates/smartos/+DISPLAY b/priv/templates/smartos/+DISPLAY index 6cdebda..a0f0ad9 100644 --- a/priv/templates/smartos/+DISPLAY +++ b/priv/templates/smartos/+DISPLAY @@ -1,6 +1,6 @@ Thank you for installing {{package_name}}. -{{package_name}} has been installed in {{platform_base_dir}} owned by user:group {{package_install_user}}:{{package_install_group}} +{{package_name}} has been installed in {{platform_base_dir}} owned by user:group root:root The primary directories are: diff --git a/priv/templates/smartos/+INSTALL b/priv/templates/smartos/+INSTALL index a785cd7..aea2de2 100755 --- a/priv/templates/smartos/+INSTALL +++ b/priv/templates/smartos/+INSTALL @@ -1,7 +1,7 @@ #!/bin/sh # Variable that will get replaced by the Makefile dirs_create target -CREATE_DIRS="%DIRS_CREATE%" +PACKAGE_USER_WRITABLE_DIRS="%PACKAGE_USER_WRITABLE_DIRS%" # Config files that could possibly be installed CONFIG_FILES="vm.args app.config advanced.config {{cuttlefish_conf}}" @@ -12,12 +12,12 @@ if [ "$2" = "PRE-INSTALL" ]; then fi if ! getent passwd "{{package_install_user}}" 2>/dev/null 1>&2; then - useradd -g {{package_install_group}} -d {{platform_base_dir}} -s /bin/sh {{package_install_user}} + useradd -g {{package_install_group}} -d {{platform_data_dir}} -s /bin/sh {{package_install_user}} fi # Create var directories outside of +CONTENTS - # Read directories from the CREATE_DIRS variable - for i in $CREATE_DIRS; do + # Read directories from the PACKAGE_USER_WRITABLE_DIRS variable + for i in $PACKAGE_USER_WRITABLE_DIRS; do if [ -d $i ]; then echo "Skipping directory creation of $i, directory already exists" else @@ -42,12 +42,12 @@ if [ "$2" = "POST-INSTALL" ]; then # Ensure proper permissions on {{package_name}} scripts for i in {{#package_commands}}{{name}} {{/package_commands}}; do - chown {{package_install_user}}:{{package_install_group}} {{platform_bin_dir}}/$i + chown root:root {{platform_bin_dir}}/$i chmod 755 {{platform_bin_dir}}/$i done # Ensure proper ownership of lib directory - chown -R {{package_install_user}}:{{package_install_group}} {{platform_lib_dir}} + chown -R root:root {{platform_lib_dir}} chmod -R g+r {{platform_lib_dir}} # Treat new configuration files as new if old ones already exist @@ -68,7 +68,7 @@ if [ "$2" = "POST-INSTALL" ]; then # This shouldn't have to happen in the post-install, but # there is some non-deterministic stuff happening during # install on SmartOS that causes wrong ownership. - chown -R root:{{package_install_group}} {{platform_etc_dir}} + chown -R root:root {{platform_etc_dir}} for i in $CONFIG_FILES; do if [ -f {{platform_etc_dir}}/$i ]; then diff --git a/priv/templates/smartos/Makefile b/priv/templates/smartos/Makefile index e68d9e5..0b440a8 100644 --- a/priv/templates/smartos/Makefile +++ b/priv/templates/smartos/Makefile @@ -127,29 +127,29 @@ packing_list_files: $(BUILD_STAGE_DIR) templates echo "@comment Packing /opt/local/etc files" >> +CONTENTS && \ echo "@cwd /opt/local" >> +CONTENTS && \ echo "@owner root" >> +CONTENTS && \ - echo "@group {{package_install_user}}" >> +CONTENTS && \ + echo "@group root" >> +CONTENTS && \ find etc -type f >> +CONTENTS cd $(BUILD_STAGE_DIR) && \ echo "@comment Packing lib files" >> +CONTENTS && \ echo "@cwd /opt/local" >> +CONTENTS && \ - echo "@owner {{package_install_user}}" >> +CONTENTS && \ - echo "@group {{package_install_group}}" >> +CONTENTS + echo "@owner root" >> +CONTENTS && \ + echo "@group root" >> +CONTENTS cd $(BUILD_STAGE_DIR) && \ find lib -type f >> +CONTENTS && \ - echo "@exec chown -R {{package_install_user}}:{{package_install_group}} {{platform_base_dir}}" >> +CONTENTS + echo "@exec chown -R root:root {{platform_base_dir}}" >> +CONTENTS cd $(BUILD_STAGE_DIR) && \ echo "@comment Packing /usr/local {{bin_or_sbin}} files" >> +CONTENTS && \ - echo "@owner {{package_install_user}}" >> +CONTENTS && \ - echo "@group {{package_install_group}}" >> +CONTENTS && \ + echo "@owner root" >> +CONTENTS && \ + echo "@group root" >> +CONTENTS && \ echo "@mode 0755" >> +CONTENTS && \ find {{bin_or_sbin}} -type f >> +CONTENTS cd $(BUILD_STAGE_DIR) && \ - echo "@owner {{package_install_user}}" >> +CONTENTS && \ - echo "@group {{package_install_group}}" >> +CONTENTS && \ + echo "@owner root" >> +CONTENTS && \ + echo "@group root" >> +CONTENTS && \ find share -type f >> +CONTENTS cd $(BUILD_STAGE_DIR) && \ @@ -167,13 +167,13 @@ packing_list_files: $(BUILD_STAGE_DIR) templates # I feel dirty now. dirs_file: $(BUILD_STAGE_DIR) @echo "Adding data and log directories to directory list" - $(eval DIRS_INSTALL = {{platform_data_dir}}) - $(eval DIRS_INSTALL += {{platform_log_dir}}) + $(eval PACKAGE_USER_WRITABLE_DIRS = {{platform_data_dir}}) + $(eval PACKAGE_USER_WRITABLE_DIRS += {{platform_log_dir}}) @echo "Scanning var directory for any additional install paths" - $(eval DIRS_INSTALL += $(shell cd $(BUILD_STAGE_DIR) && find $(PDATA_ROOT_DIR) -type d -exec printf "/%s " {} \;)) + $(eval PACKAGE_USER_WRITABLE_DIRS += $(shell cd $(BUILD_STAGE_DIR) && find $(PDATA_ROOT_DIR) -type d -exec printf "/%s " {} \;)) cd $(BUILD_STAGE_DIR) && \ cp +INSTALL +INSTALL.tmp && \ - sed -e 's|%DIRS_CREATE%|${DIRS_INSTALL}|' < \ + sed -e 's|%PACKAGE_USER_WRITABLE_DIRS%|${PACKAGE_USER_WRITABLE_DIRS}|' < \ +INSTALL.tmp > +INSTALL && \ rm +INSTALL.tmp diff --git a/priv/templates/smartos/manifest131.xml b/priv/templates/smartos/manifest131.xml index 73ae5fc..f41e5d7 100644 --- a/priv/templates/smartos/manifest131.xml +++ b/priv/templates/smartos/manifest131.xml @@ -16,7 +16,7 @@ - + diff --git a/priv/templates/solaris/preinstall b/priv/templates/solaris/preinstall index 785b71d..0cafd8f 100755 --- a/priv/templates/solaris/preinstall +++ b/priv/templates/solaris/preinstall @@ -9,7 +9,7 @@ fi # create {{package_install_user}} user only if it doesn't already exist getent passwd {{package_install_user}} >/dev/null 2>&1 if [ $? -ne 0 ]; then - useradd -g {{package_install_group}} -d /opt/{{package_install_name}} -s /usr/bin/ksh {{package_install_user}} + useradd -g {{package_install_group}} -d {{platform_data_dir}} -s /usr/bin/ksh {{package_install_user}} usermod -c "{{package_install_user_desc}}" {{package_install_user}} fi From 4a1aacaee4c21999c2d1b3f532a34398a75422f4 Mon Sep 17 00:00:00 2001 From: Doug Rohrer Date: Wed, 9 Mar 2016 19:54:03 -0500 Subject: [PATCH 11/42] New SmartOS version (15.4.0) attempt --- priv/templates/smartos/Makefile | 6 +++++ priv/templates/smartos/manifest154.xml | 37 ++++++++++++++++++++++++++ 2 files changed, 43 insertions(+) create mode 100644 priv/templates/smartos/manifest154.xml diff --git a/priv/templates/smartos/Makefile b/priv/templates/smartos/Makefile index 0b440a8..b014a15 100644 --- a/priv/templates/smartos/Makefile +++ b/priv/templates/smartos/Makefile @@ -42,6 +42,12 @@ OPENSSL_DEP = openssl-1.0.1* GCC_DEP = gcc47-libs>=4.7.0 SMF_MANIFEST = manifest131.xml endif +ifeq ($(PKGSRC_VERSION),2015Q4) # SmartOS 15.4.0 +NCURSES_DEP = ncurses-6* +OPENSSL_DEP = openssl-1.0.2* +GCC_DEP = gcc49-libs>=4.9.3 +SMF_MANIFEST = manifest154.xml +endif # Where we install things (based on vars.config) diff --git a/priv/templates/smartos/manifest154.xml b/priv/templates/smartos/manifest154.xml new file mode 100644 index 0000000..f41e5d7 --- /dev/null +++ b/priv/templates/smartos/manifest154.xml @@ -0,0 +1,37 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + From 79017cd586063a584dc3c1820b8b9a77e39dbbca Mon Sep 17 00:00:00 2001 From: Doug Rohrer Date: Thu, 10 Mar 2016 08:11:56 -0500 Subject: [PATCH 12/42] Add manifest154.xml to template for SmartOS --- priv/templates/smartos/smartos.template | 1 + 1 file changed, 1 insertion(+) diff --git a/priv/templates/smartos/smartos.template b/priv/templates/smartos/smartos.template index 0365f30..e25729a 100644 --- a/priv/templates/smartos/smartos.template +++ b/priv/templates/smartos/smartos.template @@ -30,5 +30,6 @@ {template, "manifest16.xml", "manifest16.xml"}. {template, "manifest18.xml", "manifest18.xml"}. {template, "manifest131.xml", "manifest131.xml"}. +{template, "manifest154.xml", "manifest154.xml"}. {template, "epmd", "epmd"}. {template, "runner.patch", "runner.patch"}. From dc8a0ea7a60538ff524b6971818250f74727a519 Mon Sep 17 00:00:00 2001 From: Doug Rohrer Date: Thu, 10 Mar 2016 09:02:47 -0500 Subject: [PATCH 13/42] Make etc files root:riak (and only writable by root) --- priv/templates/smartos/+INSTALL | 2 +- priv/templates/smartos/Makefile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/priv/templates/smartos/+INSTALL b/priv/templates/smartos/+INSTALL index aea2de2..8f3a68e 100755 --- a/priv/templates/smartos/+INSTALL +++ b/priv/templates/smartos/+INSTALL @@ -68,7 +68,7 @@ if [ "$2" = "POST-INSTALL" ]; then # This shouldn't have to happen in the post-install, but # there is some non-deterministic stuff happening during # install on SmartOS that causes wrong ownership. - chown -R root:root {{platform_etc_dir}} + chown -R root:{{package_install_group}} {{platform_etc_dir}} for i in $CONFIG_FILES; do if [ -f {{platform_etc_dir}}/$i ]; then diff --git a/priv/templates/smartos/Makefile b/priv/templates/smartos/Makefile index b014a15..cfc13ce 100644 --- a/priv/templates/smartos/Makefile +++ b/priv/templates/smartos/Makefile @@ -133,7 +133,7 @@ packing_list_files: $(BUILD_STAGE_DIR) templates echo "@comment Packing /opt/local/etc files" >> +CONTENTS && \ echo "@cwd /opt/local" >> +CONTENTS && \ echo "@owner root" >> +CONTENTS && \ - echo "@group root" >> +CONTENTS && \ + echo "@group riak" >> +CONTENTS && \ find etc -type f >> +CONTENTS cd $(BUILD_STAGE_DIR) && \ From f8e5ea10858f909c6a9968f1ed0db3ff67f91ccf Mon Sep 17 00:00:00 2001 From: Doug Rohrer Date: Sat, 12 Mar 2016 11:00:39 -0500 Subject: [PATCH 14/42] Attempt to more carefully assign ownership to files in Solaris --- priv/templates/solaris/Makefile | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/priv/templates/solaris/Makefile b/priv/templates/solaris/Makefile index 79d4cff..ee7321a 100644 --- a/priv/templates/solaris/Makefile +++ b/priv/templates/solaris/Makefile @@ -50,7 +50,9 @@ prototype: echo "i r.preserve" >> prototype echo '' >> prototype pkgproto rel/{{package_install_name}}={{package_install_name}} >> prototype - sed -e "s/ $(LOGNAME) .*$$/ {{package_install_user}} {{package_install_group}}/" \ + sed -e "s/ $(LOGNAME) .*$$/ root bin/" \ + -e "s/d none {{package_install_name}}\/data \(.*\) $(LOGNAME) \(.*\)/d none {{package_install_name}}\/data \1 {{package_install_user}} {{package_install_group}}/" \ + -e "s/d none {{package_install_name}}\/log \(.*\) $(LOGNAME) \(.*\)/d none {{package_install_name}}\/log \1 {{package_install_user}} {{package_install_group}}/" \ -e 's/f none {{package_install_name}}\/etc/e preserve {{package_install_name}}\/etc/' prototype > prototype.tmp && mv prototype.tmp prototype $(PKGERDIR)/pkgclean: From e47088da8f61ccc851f5d685301b0615acab4464 Mon Sep 17 00:00:00 2001 From: Doug Rohrer Date: Sat, 12 Mar 2016 13:17:28 -0500 Subject: [PATCH 15/42] clean up regular expressions and make them actually work (solaris) --- priv/templates/solaris/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/priv/templates/solaris/Makefile b/priv/templates/solaris/Makefile index ee7321a..70ca865 100644 --- a/priv/templates/solaris/Makefile +++ b/priv/templates/solaris/Makefile @@ -51,8 +51,8 @@ prototype: echo '' >> prototype pkgproto rel/{{package_install_name}}={{package_install_name}} >> prototype sed -e "s/ $(LOGNAME) .*$$/ root bin/" \ - -e "s/d none {{package_install_name}}\/data \(.*\) $(LOGNAME) \(.*\)/d none {{package_install_name}}\/data \1 {{package_install_user}} {{package_install_group}}/" \ - -e "s/d none {{package_install_name}}\/log \(.*\) $(LOGNAME) \(.*\)/d none {{package_install_name}}\/log \1 {{package_install_user}} {{package_install_group}}/" \ + -e "s/\([f|d]\) none {{package_install_name}}\/log\(.*\) \(.*\) root bin/\1 none {{package_install_name}}\/log\2 \3 {{package_install_user}} {{package_install_group}}/" \ + -e "s/\([f|d]\) none {{package_install_name}}\/data\(.*\) \(.*\) root bin/\1 none {{package_install_name}}\/data\2 \3 {{package_install_user}} {{package_install_group}}/" \ -e 's/f none {{package_install_name}}\/etc/e preserve {{package_install_name}}\/etc/' prototype > prototype.tmp && mv prototype.tmp prototype $(PKGERDIR)/pkgclean: From 385bbe6a888fb8ad3d9b049d4b542e1d40f5f0cd Mon Sep 17 00:00:00 2001 From: Nick Marino Date: Thu, 17 Mar 2016 10:19:50 -0400 Subject: [PATCH 16/42] Ensure proper perms on all SMF files for SmartOS I'm not entirely clear on why this is necessary, because it seems like the @owner/@group directives that the Makefile generates should take care of it for us. But this should hopefully fix the issue that Doug and I saw where the SMF files were getting installed as the user that built the package instead of root. --- priv/templates/smartos/+INSTALL | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/priv/templates/smartos/+INSTALL b/priv/templates/smartos/+INSTALL index 8f3a68e..59227f2 100755 --- a/priv/templates/smartos/+INSTALL +++ b/priv/templates/smartos/+INSTALL @@ -86,8 +86,12 @@ if [ "$2" = "POST-INSTALL" ]; then -c "{{package_install_name}} default project" {{package_install_name}} fi + # Ensure proper permissions of SMF files + chown -R root:root /opt/local/share/smf/{{package_install_name}} + chown -R root:root /opt/local/share/smf/{{package_install_name}}-epmd + chmod 755 /opt/local/share/smf/{{package_install_name}}-epmd/{{package_install_name}}-epmd + # Import SMF definitions svccfg import /opt/local/share/smf/{{package_install_name}}-epmd/manifest.xml - chmod 755 /opt/local/share/smf/{{package_install_name}}-epmd/{{package_install_name}}-epmd svccfg import /opt/local/share/smf/{{package_install_name}}/manifest.xml fi From b92e7ba4fe3a25b70e4abc0b5300907795385db4 Mon Sep 17 00:00:00 2001 From: Nick Marino Date: Fri, 18 Mar 2016 10:01:04 -0400 Subject: [PATCH 17/42] Revert hard-coded riak user in smartos makefile --- priv/templates/smartos/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/priv/templates/smartos/Makefile b/priv/templates/smartos/Makefile index cfc13ce..6224c8e 100644 --- a/priv/templates/smartos/Makefile +++ b/priv/templates/smartos/Makefile @@ -133,7 +133,7 @@ packing_list_files: $(BUILD_STAGE_DIR) templates echo "@comment Packing /opt/local/etc files" >> +CONTENTS && \ echo "@cwd /opt/local" >> +CONTENTS && \ echo "@owner root" >> +CONTENTS && \ - echo "@group riak" >> +CONTENTS && \ + echo "@group {{package_install_user}}" >> +CONTENTS && \ find etc -type f >> +CONTENTS cd $(BUILD_STAGE_DIR) && \ From 0d7b81989dc29cd3f38d89c3245dd23e16a650c5 Mon Sep 17 00:00:00 2001 From: Magnus Kessler Date: Fri, 26 Feb 2016 11:35:22 +0000 Subject: [PATCH 18/42] Use "Ctrl-G q" to exit from remote shell On some OS configurations, such as RHEL/CentOS, pressing "Ctrl-C" immediately detaches the Erlang shell from the controlling terminal. The beam process continues to run, and will eventually start to consume considerable CPU resources. Advise user to press "Ctrl-G q", in line with the instructions printed by Eshell. --- priv/base/runner | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/priv/base/runner b/priv/base/runner index eed11b4..bdfe7c6 100755 --- a/priv/base/runner +++ b/priv/base/runner @@ -90,7 +90,7 @@ This is the primary script for controlling the $SCRIPT node. Attaches to the console of a $SCRIPT node running in the background using an Erlang remote shell, giving access to the Erlang shell and runtime messages. Prints "Node is not running!" when the node cannot - be reached. Exit \`$SCRIPT attach\` by pressing Ctrl-C twice. + be reached. Exit \`$SCRIPT attach\` by pressing \"Ctrl-G q\". attach-direct Attaches to the console of a $SCRIPT node running in the background @@ -301,7 +301,8 @@ case "$1" in # Make sure a node is running node_up_check - echo "Remote Shell: Use \"Ctrl-C a\" to quit. q() or init:stop() will terminate the $SCRIPT node." + echo "Remote Shell: Use \"Ctrl-G q\" to quit." + echo "q() or init:stop() will terminate the $SCRIPT node." shift NODE_NAME=${NAME_ARG#* } exec $ERTS_PATH/erl -name c_$$_$NODE_NAME -hidden -remsh $NODE_NAME $COOKIE_ARG $NET_TICKTIME_ARG From 12fc4f287f76a63622334de8a2cee5acf285ab6f Mon Sep 17 00:00:00 2001 From: Magnus Kessler Date: Fri, 26 Feb 2016 11:37:39 +0000 Subject: [PATCH 19/42] Standardize use of "Ctrl-*" in help texts --- priv/base/runner | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/priv/base/runner b/priv/base/runner index bdfe7c6..5d975d6 100755 --- a/priv/base/runner +++ b/priv/base/runner @@ -96,7 +96,7 @@ This is the primary script for controlling the $SCRIPT node. Attaches to the console of a $SCRIPT node running in the background using a directly connected FIFO, giving access to the Erlang shell and runtime messages. Prints "Node is not running!" when the node - cannot be reached. Exit \`$SCRIPT attach-direct\` by pressing Ctrl-D. + cannot be reached. Exit \`$SCRIPT attach-direct\` by pressing \"Ctrl-D\". chkconfig Confirms whether the $SCRIPT.conf and advanced.config is From 1cad9dab033c6fd56ec72f88bdd5e7027cccf1e5 Mon Sep 17 00:00:00 2001 From: Magnus Kessler Date: Fri, 18 Mar 2016 13:54:12 +0000 Subject: [PATCH 20/42] Reflect new ping failure output in help. --- priv/base/runner | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/priv/base/runner b/priv/base/runner index 5d975d6..d9e1707 100755 --- a/priv/base/runner +++ b/priv/base/runner @@ -89,14 +89,16 @@ This is the primary script for controlling the $SCRIPT node. attach Attaches to the console of a $SCRIPT node running in the background using an Erlang remote shell, giving access to the Erlang shell and - runtime messages. Prints "Node is not running!" when the node cannot - be reached. Exit \`$SCRIPT attach\` by pressing \"Ctrl-G q\". + runtime messages. Prints "Node did not respond to ping!" when the + node cannot be reached. + Exit \`$SCRIPT attach\` by pressing \"Ctrl-G q\". attach-direct Attaches to the console of a $SCRIPT node running in the background using a directly connected FIFO, giving access to the Erlang shell - and runtime messages. Prints "Node is not running!" when the node - cannot be reached. Exit \`$SCRIPT attach-direct\` by pressing \"Ctrl-D\". + and runtime messages. Prints "Node did not respond to ping!" when the + node cannot be reached. + Exit \`$SCRIPT attach-direct\` by pressing \"Ctrl-D\". chkconfig Confirms whether the $SCRIPT.conf and advanced.config is From 59f60e952cbe601d2ba6d05fd349600b73623ce7 Mon Sep 17 00:00:00 2001 From: Doug Rohrer Date: Sat, 19 Mar 2016 14:15:14 -0400 Subject: [PATCH 21/42] Add RELEASE-NOTES.md --- RELEASE-NOTES.md | 51 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 RELEASE-NOTES.md diff --git a/RELEASE-NOTES.md b/RELEASE-NOTES.md new file mode 100644 index 0000000..3c3ab17 --- /dev/null +++ b/RELEASE-NOTES.md @@ -0,0 +1,51 @@ +# node_package 3.0.0 +## Security Improvements +### Introduction +### Security Advisory dated March 1, 2016 +It was [recently reported](http://docs.basho.com/riak/latest/community/product-advisories/codeinjectioninitfiles/) that, if a user could gain access to the `riak` user (or, in node_package parlance, the `package_install_user`), that use would then have write access to init scripts that are generally run as `root`, exposing an escalation of privileges attack where said use could then get the `root` user to execute a script that could allow the original user to become `root` on the system. + +### Additional Security Review + +After the security advisory was initially released, a more through review of all of the `node_package`-generated packages was conducted. This review found some additional cases of files or directories owned by the `package_install_user` or `package_install_group` that could also potentially allow a user with access to run in the context of that user to overwrite files that may later be executed by `root`. This release of `node_package` has significantly tightened the ownership and permissions of files installed, in most cases following the target systems' conventions (`root:root`, `root:bin`, `root:wheel`) for all files that are executable or could be executed, including library files that the packaged application may read. +The [node_package](https://github.com/basho/node_package) library is used to build deployable packages for Erlang applications that target many operating systems. Node_package supports building installation packages for: + +- Redhat / Fedora and variants +- Debian / Ubuntu and variants +- FreeBSD +- OSX +- SmartOS +- Solaris + +### TL;DR - What should I do? + +#### You're a user updating a system (like Riak) installed by node_package: + +When upgrading from an older version of a system like Riak that uses node_package for installation, you may need to verify the following (note, the examples will be for a Centos 7-based Linux installation of Riak, but should illustrate the required checks for most OSes and similar packages): + +- Validate permissions on existing directories and make them owned by root:root (or the appropriate user/group for your operating system) and not writable by the package_install_user/group. For this example, we will list the specific directories for the Centos 7 install, and then their `node_package` template names in parenthesis afterward. Directories and files include: + - /usr/lib64/riak (`platform_lib_dir`) + - /etc/riak (`platform_etc_dir`) + - /usr/bin (`platform_bin_dir`), specifically + - riak + - riak-admin + - riak-debug + - riak-repl + - search-cmd + - /etc/init.d/riak (`platform_etc_dir`/init.d/`package_install_name`) +- Validate the home directory of the `platform_install_user` user is set to the `platform_data_dir`, in the case of Riak on Centos 7 this should be the `riak` user and the `/var/lib/riak` directory, and not `/usr/lib64/riak`. If necessary, change the home directory of the `riak` (`package_install_user`) user to point to `/var/lib/riak` (`platform_data_dir`). + +#### You're an application maintainer that uses node_package to produce packages for your application: + +Please upgrade to version 3.0.0 of node_package and test your packaging/install process carefully. If you were depending on the writability of directories outside of the `platform_data_dir` you may need to adjust your application to store writable files in `platform_data_dir` rather than some other directory, like `package_root_dir`. + +Additionally, the home directory of the `package_install_user` has been normalized across platforms to be the `platform_data_dir`. If you somehow depended on the home directory to be set to `platform_base_dir` make appropriate changes to ensure your application can handle the change in home directory. + +### Changes in version 3.0.0 +#### File Ownership/Permissions +In all cases, the only files installed as owned by `package_install_user:package_install_group` are now files to which the packaged application needs to write. These files/directories include data directories and log directories. All other files/directories installed by `node_package`-packaged systems should now be owned by the appropriate `root` account and group for the target operating system. + +#### Home directory of `package_install_user` +In some cases, the home directory of the created `package_install_user` was set to a directory that is now not writable by that user (often the `package_base_dir`). In all cases, we have standardized on using the `platform_data_dir` for the home directory of the `package_install_user`. This may cause issues on upgrades, as the user in that case won't be updated (since it already exists) but post-install scripts may now ensure that the directory set as the `package_install_user`'s home directory is owned by the appropriate root user/group. This will manifest itself as start/stop scripts, ping, etc. failing to be able to write to a file called `.erlang.cookie` in that directory. In order to resolve this issue, please use your operating system's `usermod` or similar utility to change the home directory of the user to match the `platform_data_dir` of the installed application. + +### Details of the changes: +To view the individual changes to install package instructions, please see [this PR](https://github.com/basho/node_package/pull/196). As always, if you have seen or find any additional issues that may raise security concerns, please email [security@basho.com](mailto:security@basho.com). \ No newline at end of file From 1bc15c3e42f256ef1b258560690a90d9f6438013 Mon Sep 17 00:00:00 2001 From: Doug Rohrer Date: Sat, 19 Mar 2016 14:18:44 -0400 Subject: [PATCH 22/42] Update README.org to point to RELEASE-NOTES.md --- README.org | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.org b/README.org index 8816b62..8ffab3a 100644 --- a/README.org +++ b/README.org @@ -1,4 +1,8 @@ * node_package +** Release 3.0.0 - Release notes + +Please see [[RELEASE-NOTES.md][RELEASE-NOTES.md]] for important changes in the 3.0.0 release of `node_package` + ** Overview `node_package` is a set of RPM/Debian/Solaris templates and scripts, suitable for From 748b608276a330ca39d52f26b15d00266fa88c3e Mon Sep 17 00:00:00 2001 From: Mark Allen Date: Mon, 21 Mar 2016 13:18:08 -0500 Subject: [PATCH 23/42] Address review comments, reformat for 80 columns --- RELEASE-NOTES.md | 79 +++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 68 insertions(+), 11 deletions(-) diff --git a/RELEASE-NOTES.md b/RELEASE-NOTES.md index 3c3ab17..e7233cd 100644 --- a/RELEASE-NOTES.md +++ b/RELEASE-NOTES.md @@ -2,12 +2,31 @@ ## Security Improvements ### Introduction ### Security Advisory dated March 1, 2016 -It was [recently reported](http://docs.basho.com/riak/latest/community/product-advisories/codeinjectioninitfiles/) that, if a user could gain access to the `riak` user (or, in node_package parlance, the `package_install_user`), that use would then have write access to init scripts that are generally run as `root`, exposing an escalation of privileges attack where said use could then get the `root` user to execute a script that could allow the original user to become `root` on the system. +It was [recently reported](http://docs.basho.com/riak/latest/community/product-advisories/codeinjectioninitfiles/) +that, if a user could gain access to the `riak` user (or, in node_package +parlance, the `package_install_user`), that user would then +have write access to init scripts that are generally run as `root`, exposing an +escalation of privileges attack where said user could then get the `root` user +to execute a script that could allow the original user to become `root` on the +system. ### Additional Security Review -After the security advisory was initially released, a more through review of all of the `node_package`-generated packages was conducted. This review found some additional cases of files or directories owned by the `package_install_user` or `package_install_group` that could also potentially allow a user with access to run in the context of that user to overwrite files that may later be executed by `root`. This release of `node_package` has significantly tightened the ownership and permissions of files installed, in most cases following the target systems' conventions (`root:root`, `root:bin`, `root:wheel`) for all files that are executable or could be executed, including library files that the packaged application may read. -The [node_package](https://github.com/basho/node_package) library is used to build deployable packages for Erlang applications that target many operating systems. Node_package supports building installation packages for: +After the security advisory was initially released, a more thorough review of +all of the `node_package`-generated packages was conducted. This review found +some additional cases of files or directories owned by the +`package_install_user` or `package_install_group` that could also potentially +allow a someone with access to run in the context of that user account to +overwrite files that may later be executed by `root`. This release of +`node_package` has significantly tightened the ownership and permissions of +files installed, in most cases following the target systems' conventions +(`root:root`, `root:bin`, `root:wheel`) for all files that are executable or +could be executed, including library files that the packaged application may +read. + +The [node_package](https://github.com/basho/node_package) library is used to +build deployable packages for Erlang applications that target many operating +systems. Node_package supports building installation packages for: - Redhat / Fedora and variants - Debian / Ubuntu and variants @@ -20,9 +39,16 @@ The [node_package](https://github.com/basho/node_package) library is used to bui #### You're a user updating a system (like Riak) installed by node_package: -When upgrading from an older version of a system like Riak that uses node_package for installation, you may need to verify the following (note, the examples will be for a Centos 7-based Linux installation of Riak, but should illustrate the required checks for most OSes and similar packages): +When upgrading from an older version of a system like Riak that uses +node_package for installation, you may need to verify the following (note, the +examples will be for a Centos 7-based Linux installation of Riak, but should +illustrate the required checks for most OSes and similar packages): -- Validate permissions on existing directories and make them owned by root:root (or the appropriate user/group for your operating system) and not writable by the package_install_user/group. For this example, we will list the specific directories for the Centos 7 install, and then their `node_package` template names in parenthesis afterward. Directories and files include: +- Validate permissions on existing directories and make them owned by root:root + (or the appropriate user/group for your operating system) and not writable by + the package_install_user/group. For this example, we will list the specific + directories for the Centos 7 install, and then their `node_package` template + names in parenthesis afterward. Directories and files include: - /usr/lib64/riak (`platform_lib_dir`) - /etc/riak (`platform_etc_dir`) - /usr/bin (`platform_bin_dir`), specifically @@ -32,20 +58,51 @@ When upgrading from an older version of a system like Riak that uses node_packag - riak-repl - search-cmd - /etc/init.d/riak (`platform_etc_dir`/init.d/`package_install_name`) -- Validate the home directory of the `platform_install_user` user is set to the `platform_data_dir`, in the case of Riak on Centos 7 this should be the `riak` user and the `/var/lib/riak` directory, and not `/usr/lib64/riak`. If necessary, change the home directory of the `riak` (`package_install_user`) user to point to `/var/lib/riak` (`platform_data_dir`). + +- Validate the home directory of the `platform_install_user` user is set to the + `platform_data_dir`, in the case of Riak on Centos 7 this should be the `riak` + user and the `/var/lib/riak` directory, and not `/usr/lib64/riak`. If + necessary, change the home directory of the `riak` (`package_install_user`) + user to point to `/var/lib/riak` (`platform_data_dir`). #### You're an application maintainer that uses node_package to produce packages for your application: -Please upgrade to version 3.0.0 of node_package and test your packaging/install process carefully. If you were depending on the writability of directories outside of the `platform_data_dir` you may need to adjust your application to store writable files in `platform_data_dir` rather than some other directory, like `package_root_dir`. +Please upgrade to version 3.0.0 of node_package and test your packaging/install +process carefully. If you were depending on the writability of directories +outside of the `platform_data_dir` you may need to adjust your application to +store writable files in `platform_data_dir` rather than some other directory, +like `package_root_dir`. -Additionally, the home directory of the `package_install_user` has been normalized across platforms to be the `platform_data_dir`. If you somehow depended on the home directory to be set to `platform_base_dir` make appropriate changes to ensure your application can handle the change in home directory. +Additionally, the home directory of the `package_install_user` has been +normalized across platforms to be the `platform_data_dir`. If you depended on +the home directory to be set to `platform_base_dir` make appropriate changes to +ensure your application can handle the change in home directory. ### Changes in version 3.0.0 #### File Ownership/Permissions -In all cases, the only files installed as owned by `package_install_user:package_install_group` are now files to which the packaged application needs to write. These files/directories include data directories and log directories. All other files/directories installed by `node_package`-packaged systems should now be owned by the appropriate `root` account and group for the target operating system. +In all cases, the only files installed as owned by +`package_install_user:package_install_group` are now files to which the +packaged application needs to write. These files/directories include data +directories and log directories. All other files/directories installed by +`node_package`-packaged systems should now be owned by the appropriate `root` +account and group for the target operating system. #### Home directory of `package_install_user` -In some cases, the home directory of the created `package_install_user` was set to a directory that is now not writable by that user (often the `package_base_dir`). In all cases, we have standardized on using the `platform_data_dir` for the home directory of the `package_install_user`. This may cause issues on upgrades, as the user in that case won't be updated (since it already exists) but post-install scripts may now ensure that the directory set as the `package_install_user`'s home directory is owned by the appropriate root user/group. This will manifest itself as start/stop scripts, ping, etc. failing to be able to write to a file called `.erlang.cookie` in that directory. In order to resolve this issue, please use your operating system's `usermod` or similar utility to change the home directory of the user to match the `platform_data_dir` of the installed application. +In some cases, the home directory of the created `package_install_user` was set +to a directory that is now not writable by that user (often the +`package_base_dir`). In all cases, we have standardized on using the +`platform_data_dir` for the home directory of the `package_install_user`. This +may cause issues on upgrades, as the user in that case won't be updated (since +it already exists) but post-install scripts may now ensure that the directory +set as the `package_install_user`'s home directory is owned by the appropriate +root user/group. This will manifest itself as start/stop scripts, ping, etc. +failing to be able to write to a file called `.erlang.cookie` in that +directory. In order to resolve this issue, please use your operating system's +`usermod` or similar utility to change the home directory of the user to match +the `platform_data_dir` of the installed application. ### Details of the changes: -To view the individual changes to install package instructions, please see [this PR](https://github.com/basho/node_package/pull/196). As always, if you have seen or find any additional issues that may raise security concerns, please email [security@basho.com](mailto:security@basho.com). \ No newline at end of file +To view the individual changes to install package instructions, please see +[this PR](https://github.com/basho/node_package/pull/196). As always, if you +have seen or find any additional issues that may raise security concerns, +please email [security@basho.com](mailto:security@basho.com). From fb11d562e54c9daf0d5ef3a9b4d846403b05e5db Mon Sep 17 00:00:00 2001 From: Nick Marino Date: Thu, 14 Apr 2016 23:59:47 +0000 Subject: [PATCH 24/42] Force correct permissions on Debian files Somehow our build machine is set up subtly differently from the VM we used to test the recent permissions fixes, and it ended up creating a package with some files set to 600 and 700. This fix should prevent such issues from happening, regardless of what permissions files happen to be created with at build time. --- priv/templates/deb/postinst | 2 ++ 1 file changed, 2 insertions(+) diff --git a/priv/templates/deb/postinst b/priv/templates/deb/postinst index 9be3eb9..0653310 100755 --- a/priv/templates/deb/postinst +++ b/priv/templates/deb/postinst @@ -30,7 +30,9 @@ chmod 0755 /var/run/{{package_install_name}} /etc/{{package_install_name}} chmod 0644 /etc/{{package_install_name}}/* chmod -R +X /etc/{{package_install_name}} chmod 0755 /usr/lib/{{package_install_name}}/lib/env.sh +chmod 0755 /usr/lib/{{package_install_name}}/lib/app_epath.sh chmod 0755 /usr/lib/{{package_install_name}}/erts-*/bin/nodetool +chmod -R go+r /usr/lib/{{package_install_name}}/lib/ case "$1" in configure) From 6b86deaff9f7408504db405c4146012cb93725cb Mon Sep 17 00:00:00 2001 From: Nick Marino Date: Fri, 15 Apr 2016 19:18:53 +0000 Subject: [PATCH 25/42] Also add execute perms to dirs/scripts as needed The +X flag adds executable permissions to any file or directory that already has executable permissions for some user. So, e.g., 744 would become 755. --- priv/templates/deb/postinst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/priv/templates/deb/postinst b/priv/templates/deb/postinst index 0653310..2a0e991 100755 --- a/priv/templates/deb/postinst +++ b/priv/templates/deb/postinst @@ -32,7 +32,7 @@ chmod -R +X /etc/{{package_install_name}} chmod 0755 /usr/lib/{{package_install_name}}/lib/env.sh chmod 0755 /usr/lib/{{package_install_name}}/lib/app_epath.sh chmod 0755 /usr/lib/{{package_install_name}}/erts-*/bin/nodetool -chmod -R go+r /usr/lib/{{package_install_name}}/lib/ +chmod -R go+rX /usr/lib/{{package_install_name}}/lib/ case "$1" in configure) From 0a11af73f66066597d0a6f6855484b76173bee67 Mon Sep 17 00:00:00 2001 From: Nick Marino Date: Fri, 15 Apr 2016 19:58:19 +0000 Subject: [PATCH 26/42] Fix permissions for files in /etc/ as well --- priv/templates/deb/postinst | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/priv/templates/deb/postinst b/priv/templates/deb/postinst index 2a0e991..2ac7b9b 100755 --- a/priv/templates/deb/postinst +++ b/priv/templates/deb/postinst @@ -27,8 +27,7 @@ for i in lib run log; do done chmod 0755 /var/run/{{package_install_name}} /etc/{{package_install_name}} -chmod 0644 /etc/{{package_install_name}}/* -chmod -R +X /etc/{{package_install_name}} +chmod -R a+rX /etc/{{package_install_name}} chmod 0755 /usr/lib/{{package_install_name}}/lib/env.sh chmod 0755 /usr/lib/{{package_install_name}}/lib/app_epath.sh chmod 0755 /usr/lib/{{package_install_name}}/erts-*/bin/nodetool From 3a332e87745ef3a9378a8312c555fe3c96899929 Mon Sep 17 00:00:00 2001 From: Ian Milligan Date: Fri, 29 Jul 2016 15:54:20 -0700 Subject: [PATCH 27/42] Install files using dh_install Create an install file for use by dh_install. Files listed here do not need their parent directories listed in the dirs file. --- priv/templates/deb/deb.template | 1 + priv/templates/deb/dirs | 4 ---- priv/templates/deb/install | 10 ++++++++++ priv/templates/deb/rules | 24 +----------------------- 4 files changed, 12 insertions(+), 27 deletions(-) create mode 100644 priv/templates/deb/install diff --git a/priv/templates/deb/deb.template b/priv/templates/deb/deb.template index c1ceb4b..520894a 100644 --- a/priv/templates/deb/deb.template +++ b/priv/templates/deb/deb.template @@ -31,6 +31,7 @@ {template, "control", "control"}. {template, "copyright", "copyright"}. {template, "dirs", "dirs"}. +{template, "install", "install"}. {template, "postinst", "postinst"}. {template, "postrm", "postrm"}. {template, "rules", "rules"}. diff --git a/priv/templates/deb/dirs b/priv/templates/deb/dirs index 1425671..70d9237 100644 --- a/priv/templates/deb/dirs +++ b/priv/templates/deb/dirs @@ -1,9 +1,5 @@ etc/init.d -etc/{{package_install_name}} etc/logrotate.d -usr/lib/{{package_install_name}} -usr/{{bin_or_sbin}} usr/share/man/man1 var/run/{{package_install_name}} -var/lib/{{package_install_name}} var/log/{{package_install_name}} diff --git a/priv/templates/deb/install b/priv/templates/deb/install new file mode 100644 index 0000000..5f314b5 --- /dev/null +++ b/priv/templates/deb/install @@ -0,0 +1,10 @@ +rel/{{package_install_name}}/lib usr/lib/{{package_install_name}} +rel/{{package_install_name}}/erts* usr/lib/{{package_install_name}} +rel/{{package_install_name}}/releases usr/lib/{{package_install_name}} + +{{#package_commands}} +rel/{{package_install_name}}/bin/{{name}} usr/{{bin_or_sbin}} +{{/package_commands}} + +rel/{{package_install_name}}/etc/* etc/{{package_install_name}} +rel/{{package_install_name}}/data/* var/lib/{{package_install_name}} \ No newline at end of file diff --git a/priv/templates/deb/rules b/priv/templates/deb/rules index deee941..3e0c9f8 100755 --- a/priv/templates/deb/rules +++ b/priv/templates/deb/rules @@ -32,21 +32,7 @@ install: build dh_testroot dh_prep dh_installdirs - - cp -R rel/{{package_install_name}}/lib \ - debian/{{package_name}}/usr/lib/{{package_install_name}} - - cp -R rel/{{package_install_name}}/erts* \ - debian/{{package_name}}/usr/lib/{{package_install_name}} - - cp -R rel/{{package_install_name}}/releases \ - debian/{{package_name}}/usr/lib/{{package_install_name}} - -## executables - if [ -d rel/{{package_install_name}}/bin ]; then \ - mkdir -p debian/{{package_name}}/usr/{{bin_or_sbin}} && \ - {{#package_commands}}install -p -D -m 0755 rel/{{package_install_name}}/bin/{{name}} debian/{{package_name}}/usr/{{bin_or_sbin}}/ && \ - {{/package_commands}}echo -n; fi + dh_install ## install man pages if they exist if [ -d doc/man/man1 ]; then \ @@ -57,14 +43,6 @@ install: build ; fi && \ {{/package_commands}}echo -n; fi - mkdir -p debian/{{package_name}}/etc/{{package_install_name}} - cp -R rel/{{package_install_name}}/etc/* \ - debian/{{package_name}}/etc/{{package_install_name}} - - mkdir -p debian/{{package_name}}/var/lib - cp -R rel/{{package_install_name}}/data/* \ - debian/{{package_name}}/var/lib/{{package_install_name}} - install -m755 debian/init.script \ debian/{{package_name}}/etc/init.d/{{package_install_name}} From d27068f64ebfc87209e94241db944737d8f05e10 Mon Sep 17 00:00:00 2001 From: Ian Milligan Date: Mon, 1 Aug 2016 11:04:20 -0700 Subject: [PATCH 28/42] Use dh_installman to install manpages --- priv/templates/deb/deb.template | 1 + priv/templates/deb/dirs | 1 - priv/templates/deb/package.manpages | 1 + priv/templates/deb/rules | 10 +--------- 4 files changed, 3 insertions(+), 10 deletions(-) create mode 100644 priv/templates/deb/package.manpages diff --git a/priv/templates/deb/deb.template b/priv/templates/deb/deb.template index 520894a..813e8fc 100644 --- a/priv/templates/deb/deb.template +++ b/priv/templates/deb/deb.template @@ -37,3 +37,4 @@ {template, "rules", "rules"}. {template, "vars.config", "vars.config"}. {template, "init.script", "init.script"}. +{template, "package.manpages", "{{package_name}}.manpages"}. diff --git a/priv/templates/deb/dirs b/priv/templates/deb/dirs index 70d9237..8892526 100644 --- a/priv/templates/deb/dirs +++ b/priv/templates/deb/dirs @@ -1,5 +1,4 @@ etc/init.d etc/logrotate.d -usr/share/man/man1 var/run/{{package_install_name}} var/log/{{package_install_name}} diff --git a/priv/templates/deb/package.manpages b/priv/templates/deb/package.manpages new file mode 100644 index 0000000..e3db37c --- /dev/null +++ b/priv/templates/deb/package.manpages @@ -0,0 +1 @@ +doc/man/man1/*.1.gz \ No newline at end of file diff --git a/priv/templates/deb/rules b/priv/templates/deb/rules index 3e0c9f8..9c40355 100755 --- a/priv/templates/deb/rules +++ b/priv/templates/deb/rules @@ -33,15 +33,7 @@ install: build dh_prep dh_installdirs dh_install - -## install man pages if they exist - if [ -d doc/man/man1 ]; then \ - mkdir -p debian/usr/share/man/man1 && \ - {{#package_commands}}if [ -f doc/man/man1/{{name}}.1.gz ]; then \ - install -p -D -m 0544 doc/man/man1/{{name}}.1.gz \ - debian/{{package_name}}/usr/share/man/man1/ \ - ; fi && \ - {{/package_commands}}echo -n; fi + dh_installman install -m755 debian/init.script \ debian/{{package_name}}/etc/init.d/{{package_install_name}} From 4c6717b9964b18f283aedcb936fe1600d1efad7b Mon Sep 17 00:00:00 2001 From: Ian Milligan Date: Mon, 1 Aug 2016 16:30:48 -0700 Subject: [PATCH 29/42] Use dh_installinit to install init script The update-rc.d lines can be removed from the postinst / postrm templates as these are added by debhelper. --- priv/templates/deb/deb.template | 2 +- priv/templates/deb/dirs | 1 - priv/templates/deb/postinst | 3 --- priv/templates/deb/postrm | 4 ---- priv/templates/deb/rules | 5 +---- 5 files changed, 2 insertions(+), 13 deletions(-) diff --git a/priv/templates/deb/deb.template b/priv/templates/deb/deb.template index 813e8fc..467932e 100644 --- a/priv/templates/deb/deb.template +++ b/priv/templates/deb/deb.template @@ -36,5 +36,5 @@ {template, "postrm", "postrm"}. {template, "rules", "rules"}. {template, "vars.config", "vars.config"}. -{template, "init.script", "init.script"}. +{template, "init.script", "{{package_name}}.{{package_install_name}}.init"}. {template, "package.manpages", "{{package_name}}.manpages"}. diff --git a/priv/templates/deb/dirs b/priv/templates/deb/dirs index 8892526..9f72199 100644 --- a/priv/templates/deb/dirs +++ b/priv/templates/deb/dirs @@ -1,4 +1,3 @@ -etc/init.d etc/logrotate.d var/run/{{package_install_name}} var/log/{{package_install_name}} diff --git a/priv/templates/deb/postinst b/priv/templates/deb/postinst index 2ac7b9b..36c2847 100755 --- a/priv/templates/deb/postinst +++ b/priv/templates/deb/postinst @@ -5,9 +5,6 @@ set -e -# install startup script -update-rc.d {{package_install_name}} defaults >/dev/null - # create group if ! getent group {{package_install_group}} >/dev/null; then addgroup --system {{package_install_group}} diff --git a/priv/templates/deb/postrm b/priv/templates/deb/postrm index bbdf548..df83a1f 100755 --- a/priv/templates/deb/postrm +++ b/priv/templates/deb/postrm @@ -22,10 +22,6 @@ set -e case "$1" in purge) rm -f /etc/default/{{package_install_name}} - - # ensure we remove the rc.d scripts installed by postinst - update-rc.d {{package_install_name}} remove >/dev/null - if [ -d /var/log/{{package_install_name}} ]; then rm -r /var/log/{{package_install_name}} fi diff --git a/priv/templates/deb/rules b/priv/templates/deb/rules index 9c40355..282c284 100755 --- a/priv/templates/deb/rules +++ b/priv/templates/deb/rules @@ -34,10 +34,7 @@ install: build dh_installdirs dh_install dh_installman - - install -m755 debian/init.script \ - debian/{{package_name}}/etc/init.d/{{package_install_name}} - + dh_installinit --name={{package_install_name}} --no-start dh_shlibdeps # We have nothing to do by default. From fbfa27050cb4d34b68397f4baae71eee1ab0a341 Mon Sep 17 00:00:00 2001 From: Ian Milligan Date: Mon, 1 Aug 2016 17:23:42 -0700 Subject: [PATCH 30/42] Add systemd service file --- priv/templates/deb/deb.template | 1 + priv/templates/deb/package.service | 14 ++++++++++++++ 2 files changed, 15 insertions(+) create mode 100644 priv/templates/deb/package.service diff --git a/priv/templates/deb/deb.template b/priv/templates/deb/deb.template index 467932e..1f0c07c 100644 --- a/priv/templates/deb/deb.template +++ b/priv/templates/deb/deb.template @@ -37,4 +37,5 @@ {template, "rules", "rules"}. {template, "vars.config", "vars.config"}. {template, "init.script", "{{package_name}}.{{package_install_name}}.init"}. +{template, "package.service", "{{package_name}}.{{package_install_name}}.service"}. {template, "package.manpages", "{{package_name}}.manpages"}. diff --git a/priv/templates/deb/package.service b/priv/templates/deb/package.service new file mode 100644 index 0000000..7514142 --- /dev/null +++ b/priv/templates/deb/package.service @@ -0,0 +1,14 @@ +[Unit] +Description={{package_shortdesc}} + +[Service] +ExecStart=/usr/{{bin_or_sbin}}/{{package_install_name}} start +ExecStop=/usr/{{bin_or_sbin}}/{{package_install_name}} stop +User={{package_install_user}} +Type=forking +PIDFile=/var/run/{{package_install_name}}/{{package_install_name}}.pid +EnvironmentFile=-/etc/default/{{package_install_name}} +RuntimeDirectory={{package_install_name}} + +[Install] +WantedBy=multi-user.target \ No newline at end of file From 97ac13baaf9f487cb746cc386ed3616e135be103 Mon Sep 17 00:00:00 2001 From: Ian Milligan Date: Tue, 2 Aug 2016 17:01:11 -0700 Subject: [PATCH 31/42] Do not install directory under /var/run /var/run can be a temporary filesystem so we should not install a package specific runtime directory and instead rely on the init script to create one. In the case of systemd, this is handled automatically. --- priv/templates/deb/dirs | 1 - priv/templates/deb/init.script | 5 +++++ priv/templates/deb/postinst | 4 ++-- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/priv/templates/deb/dirs b/priv/templates/deb/dirs index 9f72199..3220e0d 100644 --- a/priv/templates/deb/dirs +++ b/priv/templates/deb/dirs @@ -1,3 +1,2 @@ etc/logrotate.d -var/run/{{package_install_name}} var/log/{{package_install_name}} diff --git a/priv/templates/deb/init.script b/priv/templates/deb/init.script index 6ff2e3c..c0fbd90 100755 --- a/priv/templates/deb/init.script +++ b/priv/templates/deb/init.script @@ -12,6 +12,7 @@ NAME={{package_install_name}} DAEMON=/usr/{{bin_or_sbin}}/$NAME SCRIPTNAME=/etc/init.d/$NAME +RUNDIR=/var/run/$NAME # Read configuration variable file if it is present [ -r /etc/default/$NAME ] && . /etc/default/$NAME @@ -32,6 +33,10 @@ fi # do_start() { + if [ ! -d $RUNDIR ]; then + mkdir $RUNDIR + chown {{package_install_user}}:{{package_install_group}} $RUNDIR + fi # Return # 0 if daemon has been started # 1 if daemon was already running diff --git a/priv/templates/deb/postinst b/priv/templates/deb/postinst index 36c2847..0e75c32 100755 --- a/priv/templates/deb/postinst +++ b/priv/templates/deb/postinst @@ -19,11 +19,11 @@ if ! getent passwd {{package_install_user}} >/dev/null; then --gecos "{{package_install_user_desc}}" {{package_install_user}} fi -for i in lib run log; do +for i in lib log; do chown -R {{package_install_user}}:{{package_install_group}} /var/$i/{{package_install_name}} done -chmod 0755 /var/run/{{package_install_name}} /etc/{{package_install_name}} +chmod 0755 /etc/{{package_install_name}} chmod -R a+rX /etc/{{package_install_name}} chmod 0755 /usr/lib/{{package_install_name}}/lib/env.sh chmod 0755 /usr/lib/{{package_install_name}}/lib/app_epath.sh From 2a8bf3f8f7c244e11bf040059f9e9bf021c991db Mon Sep 17 00:00:00 2001 From: Ian Milligan Date: Tue, 2 Aug 2016 17:47:54 -0700 Subject: [PATCH 32/42] Fix permissions in rules rather than postinst Addionally, avoid calling chmod on nonexistent files --- priv/templates/deb/postinst | 7 ------- priv/templates/deb/rules | 11 +++++++++++ 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/priv/templates/deb/postinst b/priv/templates/deb/postinst index 0e75c32..88f272a 100755 --- a/priv/templates/deb/postinst +++ b/priv/templates/deb/postinst @@ -23,13 +23,6 @@ for i in lib log; do chown -R {{package_install_user}}:{{package_install_group}} /var/$i/{{package_install_name}} done -chmod 0755 /etc/{{package_install_name}} -chmod -R a+rX /etc/{{package_install_name}} -chmod 0755 /usr/lib/{{package_install_name}}/lib/env.sh -chmod 0755 /usr/lib/{{package_install_name}}/lib/app_epath.sh -chmod 0755 /usr/lib/{{package_install_name}}/erts-*/bin/nodetool -chmod -R go+rX /usr/lib/{{package_install_name}}/lib/ - case "$1" in configure) ;; diff --git a/priv/templates/deb/rules b/priv/templates/deb/rules index 282c284..d06fee8 100755 --- a/priv/templates/deb/rules +++ b/priv/templates/deb/rules @@ -11,6 +11,7 @@ # Uncomment this to turn on verbose mode. export DH_VERBOSE=1 +ROOTDIR := debian/{{package_name}} ## Clear variables that may confound our build of sub-projects; also ## note that it is necessary to use overlay_vars relative to .. as @@ -27,6 +28,7 @@ clean: ## dh_shlibdeps was added to figure out the dependencies on shared libraries ## and will populate the ${shlibs:Depends} callout in the control file +install: LIBDIR := $(ROOTDIR)/usr/lib/{{package_install_name}} install: build dh_testdir dh_testroot @@ -35,6 +37,15 @@ install: build dh_install dh_installman dh_installinit --name={{package_install_name}} --no-start + dh_fixperms + chmod 0755 $(ROOTDIR)/etc/{{package_install_name}} + chmod -R a+rX $(ROOTDIR)/etc/{{package_install_name}} + for file in lib/env.sh lib/app_epath.sh erts-*/bin/nodetool; do \ + if [ -f $(LIBDIR)/$$file ]; then \ + chmod 0755 $(LIBDIR)/$$file; \ + fi; \ + done + chmod -R go+rX debian/{{package_name}}/usr/lib/{{package_install_name}}/lib/ dh_shlibdeps # We have nothing to do by default. From be96c3eeb47a622be9e147a85cd9fcd8fb3b6476 Mon Sep 17 00:00:00 2001 From: Magnus Kessler Date: Mon, 8 Aug 2016 16:46:00 +0100 Subject: [PATCH 33/42] Use backticks for command substitution. Fixes use on Solaris The default Solaris shell does not support command substitution with the '$(...)' bash syntax. Use backtick substitution instead. In sed expressions the single quote character "'" can be escaped as "\x27". The double quote ('"') character can then be left unescaped. --- priv/base/env.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/priv/base/env.sh b/priv/base/env.sh index 94e23a2..c384c08 100755 --- a/priv/base/env.sh +++ b/priv/base/env.sh @@ -239,7 +239,7 @@ check_user() { # after the arguments were passed into the new shell during exec su # # So this regex finds any '(', ')', "'" , '"', '{', or '}' and prepends with a '\' - ESCAPED_ARGS=$(echo "$@" | sed -e "s/\([\\\(\\\){}\"']\)/\\\\\1/g") + ESCAPED_ARGS=`echo "$@" | sed -e 's/\([\\\(\\\){}"\x27]\)/\\\\\1/g'` # This will drop priviledges into the runner user # It exec's in a new shell and the current shell will exit From 60901bd61e52389ae95513e106c8dfaab3af5338 Mon Sep 17 00:00:00 2001 From: Magnus Kessler Date: Thu, 29 Sep 2016 12:11:17 +0100 Subject: [PATCH 34/42] Fix use of 'id' on Solaris 10 Commit 8d556bf0860fc628d273822dcf5fb063b107b3a1 changed how the current user is determined from using 'whoami' to 'id'. On Solaris10 only the version of 'id' in '/usr/xpg4/bin' knows about the '-u' flag. This fix simply changes the PATH variable to use '/usr/xpg4/bin' instead of '/usr/ucb', which was previously added to support 'whoami'. --- priv/base/env.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/priv/base/env.sh b/priv/base/env.sh index c384c08..cac7e27 100755 --- a/priv/base/env.sh +++ b/priv/base/env.sh @@ -8,8 +8,8 @@ if [ `uname -s` = 'SunOS' -a "${POSIX_SHELL}" != "true" ]; then POSIX_SHELL="true" export POSIX_SHELL - # To support 'whoami' add /usr/ucb to path - PATH=/usr/ucb:$PATH + # To support POSIX.2 compliant 'id' add /usr/xpg4/bin to path + PATH=/usr/xpg4/bin:$PATH export PATH exec /usr/bin/ksh $0 "$@" fi From e07cb2d2d0000f0436c282e2d72f9bdd267a869d Mon Sep 17 00:00:00 2001 From: Doug Rohrer Date: Fri, 30 Sep 2016 14:09:23 -0400 Subject: [PATCH 35/42] Fix permissions before building package on Solaris to defend against umask/bad file permissions issues. --- priv/templates/solaris/Makefile | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/priv/templates/solaris/Makefile b/priv/templates/solaris/Makefile index 70ca865..e7e7ca4 100644 --- a/priv/templates/solaris/Makefile +++ b/priv/templates/solaris/Makefile @@ -27,6 +27,13 @@ buildrel: @# Ye Olde Bourne Shell on Solaris means we have to do it old school echo "Using `which erl` to build"; \ OVERLAY_VARS="overlay_vars=../solaris/vars.config" $(MAKE) rel + chmod -R go+rX rel/{{package_install_name}} + chmod 0755 rel/{{package_install_name}}/etc + chmod -R a+rX rel/{{package_install_name}}/etc + chmod 0755 rel/{{package_install_name}}/lib/env.sh + chmod 0755 rel/{{package_install_name}}/lib/app_epath.sh + chmod 0755 rel/{{package_install_name}}/erts-*/bin/nodetool + chmod -R go+rX rel/{{package_install_name}}/lib/ chmod 0755 rel/{{package_install_name}}/bin/* \ rel/{{package_install_name}}/erts-*/bin/* if [ "{{bin_or_sbin}}" != "bin" ]; then \ From 413a4aba1d8ccabd1faf229e1f904196f98e92fa Mon Sep 17 00:00:00 2001 From: Brian Sparrow Date: Mon, 9 Jan 2017 12:32:59 -0500 Subject: [PATCH 36/42] Restrict atom usage for riak and riak-admin commands Restrict the possible atoms used by `riak` and `riak-admin` commands to 1000. Also, change node name used by `riak top` to match `riak-admin top` convention. --- priv/base/nodetool | 4 ++-- priv/base/runner | 7 ++++--- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/priv/base/nodetool b/priv/base/nodetool index 51b8f9d..c542903 100755 --- a/priv/base/nodetool +++ b/priv/base/nodetool @@ -191,9 +191,9 @@ nodename(Name) -> append_node_suffix(Name, Suffix) -> case string:tokens(Name, "@") of [Node, Host] -> - list_to_atom(lists:concat([Node, Suffix, os:getpid(), "@", Host])); + list_to_atom(lists:concat([Node, Suffix, random:uniform(1000), "@", Host])); [Node] -> - list_to_atom(lists:concat([Node, Suffix, os:getpid()])) + list_to_atom(lists:concat([Node, Suffix, random:uniform(1000)])) end. chkconfig(File) -> diff --git a/priv/base/runner b/priv/base/runner index d9e1707..20eb1e3 100755 --- a/priv/base/runner +++ b/priv/base/runner @@ -306,8 +306,9 @@ case "$1" in echo "Remote Shell: Use \"Ctrl-G q\" to quit." echo "q() or init:stop() will terminate the $SCRIPT node." shift + RAND=$(bc <<< "$(($(($RANDOM % 1000)) + 1))") NODE_NAME=${NAME_ARG#* } - exec $ERTS_PATH/erl -name c_$$_$NODE_NAME -hidden -remsh $NODE_NAME $COOKIE_ARG $NET_TICKTIME_ARG + exec $ERTS_PATH/erl -name c_$RAND_$NODE_NAME -hidden -remsh $NODE_NAME $COOKIE_ARG $NET_TICKTIME_ARG ;; console) @@ -362,11 +363,11 @@ case "$1" in node_up_check shift - MYPID=$$ + RAND=$(bc <<< "$(($(($RANDOM % 1000)) + 1))") NODE_NAME=${NAME_ARG#* } $ERTS_PATH/erl -noshell -noinput \ -pa $RUNNER_PATCH_DIR \ - -hidden $NAME_PARAM np_etop$MYPID$NAME_HOST $COOKIE_ARG $NET_TICKTIME_ARG \ + -hidden $NAME_PARAM riak_etop$RAND$NAME_HOST $COOKIE_ARG $NET_TICKTIME_ARG \ -s etop -s erlang halt -output text \ -node $NODE_NAME \ $* -tracing off From 9c9ff3fe1c7618a64355cb43a0de93aea6a7df4e Mon Sep 17 00:00:00 2001 From: Brian Sparrow Date: Mon, 9 Jan 2017 15:17:48 -0500 Subject: [PATCH 37/42] Make sure we set a new `random:seed` each run Remove `bc` and `<<<` for compliance. --- priv/base/nodetool | 1 + priv/base/runner | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/priv/base/nodetool b/priv/base/nodetool index c542903..3427838 100755 --- a/priv/base/nodetool +++ b/priv/base/nodetool @@ -189,6 +189,7 @@ nodename(Name) -> end. append_node_suffix(Name, Suffix) -> + random:seed(os:getpid()), case string:tokens(Name, "@") of [Node, Host] -> list_to_atom(lists:concat([Node, Suffix, random:uniform(1000), "@", Host])); diff --git a/priv/base/runner b/priv/base/runner index 20eb1e3..d684be6 100755 --- a/priv/base/runner +++ b/priv/base/runner @@ -306,7 +306,7 @@ case "$1" in echo "Remote Shell: Use \"Ctrl-G q\" to quit." echo "q() or init:stop() will terminate the $SCRIPT node." shift - RAND=$(bc <<< "$(($(($RANDOM % 1000)) + 1))") + RAND=$(($(($RANDOM % 1000)) + 1)) NODE_NAME=${NAME_ARG#* } exec $ERTS_PATH/erl -name c_$RAND_$NODE_NAME -hidden -remsh $NODE_NAME $COOKIE_ARG $NET_TICKTIME_ARG ;; @@ -367,7 +367,7 @@ case "$1" in NODE_NAME=${NAME_ARG#* } $ERTS_PATH/erl -noshell -noinput \ -pa $RUNNER_PATCH_DIR \ - -hidden $NAME_PARAM riak_etop$RAND$NAME_HOST $COOKIE_ARG $NET_TICKTIME_ARG \ + -hidden $NAME_PARAM np_etop$RAND$NAME_HOST $COOKIE_ARG $NET_TICKTIME_ARG \ -s etop -s erlang halt -output text \ -node $NODE_NAME \ $* -tracing off From 09179609b3c0b771fa04ad163e5d2aca150e57dc Mon Sep 17 00:00:00 2001 From: Brian Sparrow Date: Mon, 9 Jan 2017 15:36:18 -0500 Subject: [PATCH 38/42] Use `os:timestamp()` to set `random:seed()` --- priv/base/nodetool | 2 +- priv/base/runner | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/priv/base/nodetool b/priv/base/nodetool index 3427838..a6da8a2 100755 --- a/priv/base/nodetool +++ b/priv/base/nodetool @@ -189,7 +189,7 @@ nodename(Name) -> end. append_node_suffix(Name, Suffix) -> - random:seed(os:getpid()), + random:seed(os:timestamp()), case string:tokens(Name, "@") of [Node, Host] -> list_to_atom(lists:concat([Node, Suffix, random:uniform(1000), "@", Host])); diff --git a/priv/base/runner b/priv/base/runner index d684be6..fd48a2b 100755 --- a/priv/base/runner +++ b/priv/base/runner @@ -363,7 +363,7 @@ case "$1" in node_up_check shift - RAND=$(bc <<< "$(($(($RANDOM % 1000)) + 1))") + RAND=$(($(($RANDOM % 1000)) + 1)) NODE_NAME=${NAME_ARG#* } $ERTS_PATH/erl -noshell -noinput \ -pa $RUNNER_PATCH_DIR \ From 5bc07cf581f58a3fdbf6d53b9fe1f3babd39ae43 Mon Sep 17 00:00:00 2001 From: Brian Sparrow Date: Tue, 31 Jan 2017 10:11:39 -0500 Subject: [PATCH 39/42] Revert "Set NODETOOL up as an alias and include ERL_FLAGS env vars" --- priv/base/env.sh | 14 +++++--------- priv/base/runner | 4 ++-- 2 files changed, 7 insertions(+), 11 deletions(-) diff --git a/priv/base/env.sh b/priv/base/env.sh index 6b75455..cac7e27 100755 --- a/priv/base/env.sh +++ b/priv/base/env.sh @@ -124,12 +124,8 @@ APP_VSN=${START_ERL#* } ERTS_PATH=$RUNNER_BASE_DIR/erts-$ERTS_VSN/bin # Setup command to control the node -if [ -f $RUNNER_ETC_DIR/vm.args ]; then - SSL_ARGS=$(grep -e '^\-ssl_dist_opt' -e '^\-proto_dist' $RUNNER_ETC_DIR/vm.args | tr '\n' ' ') - ERL_FLAGS="$ERL_FLAGS $SSL_ARGS" -fi -alias NODETOOL="ERL_FLAGS=\"$ERL_FLAGS\" $ERTS_PATH/escript $ERTS_PATH/nodetool $NET_TICKTIME_ARG $NAME_ARG $COOKIE_ARG" -alias NODETOOL_LITE="ERL_FLAGS=\"$ERL_FLAGS\" $ERTS_PATH/escript $ERTS_PATH/nodetool" +NODETOOL="$ERTS_PATH/escript $ERTS_PATH/nodetool $NET_TICKTIME_ARG $NAME_ARG $COOKIE_ARG" +NODETOOL_LITE="$ERTS_PATH/escript $ERTS_PATH/nodetool" ## Are we using cuttlefish (http://github.com/basho/cuttlefish) @@ -144,7 +140,7 @@ fi # Ping node without stealing stdin ping_node() { - NODETOOL ping < /dev/null + $NODETOOL ping < /dev/null } # Attempts to create a pid directory like /var/run/APPNAME and then @@ -299,7 +295,7 @@ check_config() { fi fi - MUTE=`NODETOOL_LITE chkconfig $CONFIG_ARGS` + MUTE=`$NODETOOL_LITE chkconfig $CONFIG_ARGS` if [ "$?" -ne 0 ]; then echoerr "Error reading $CONFIG_ARGS" exit 1 @@ -324,7 +320,7 @@ check_ulimit() { # Set the PID global variable, return 1 on error get_pid() { - PID=`NODETOOL getpid < /dev/null` + PID=`$NODETOOL getpid < /dev/null` if [ "$?" -ne 0 ]; then echo "Node is not running!" return 1 diff --git a/priv/base/runner b/priv/base/runner index e2a041b..fd48a2b 100755 --- a/priv/base/runner +++ b/priv/base/runner @@ -205,7 +205,7 @@ do_start() { if [ "$?" -ne 0 ]; then continue fi - PROCESS=`NODETOOL rpcterms erlang whereis "'${WAIT_FOR_PROCESS}'."` + PROCESS=`$NODETOOL rpcterms erlang whereis "'${WAIT_FOR_PROCESS}'."` if [ "$PROCESS" != "undefined" ]; then # Attempt to create a .pid file for the process create_pid_file @@ -231,7 +231,7 @@ do_stop() { fi # Tell nodetool to stop - NODETOOL stop + $NODETOOL stop ES=$? if [ "$ES" -ne 0 ]; then exit $ES From 6c40ae5a13d28a30826bd4048035c8972b58984b Mon Sep 17 00:00:00 2001 From: Lars Hesel Christensen Date: Tue, 28 Mar 2017 22:55:12 +0200 Subject: [PATCH 40/42] Remove random module usage (#214) --- priv/base/nodetool | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/priv/base/nodetool b/priv/base/nodetool index a6da8a2..10a5521 100755 --- a/priv/base/nodetool +++ b/priv/base/nodetool @@ -189,12 +189,12 @@ nodename(Name) -> end. append_node_suffix(Name, Suffix) -> - random:seed(os:timestamp()), + Rnd = erlang:phash2({os:timestamp(),os:getpid()}, 1000), case string:tokens(Name, "@") of [Node, Host] -> - list_to_atom(lists:concat([Node, Suffix, random:uniform(1000), "@", Host])); + list_to_atom(lists:concat([Node, Suffix, Rnd, "@", Host])); [Node] -> - list_to_atom(lists:concat([Node, Suffix, random:uniform(1000)])) + list_to_atom(lists:concat([Node, Suffix, Rnd])) end. chkconfig(File) -> From b07e6ae7b9ef9fcbb3db7c34f3056a26b587e169 Mon Sep 17 00:00:00 2001 From: viawest-davidsix Date: Tue, 28 Mar 2017 16:55:44 -0400 Subject: [PATCH 41/42] Allow check_pid_status to differentiate similar names (#216) Without a trailing space in the grep command, two different programs with the same prefix (e.g. riak and riak-cs) will be confused. In this example, if riak and riak-cs are configured to run on the same server the riak init script will incorrectly say that it is running in the situation where riak is stopped and riak-cs is running. Also, compare to the grep line in hardstop (which already has the trailing space). --- priv/templates/rpm/rhel.init.script | 2 +- priv/templates/rpm/suse.init.script | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/priv/templates/rpm/rhel.init.script b/priv/templates/rpm/rhel.init.script index b620d8a..0cdd20c 100755 --- a/priv/templates/rpm/rhel.init.script +++ b/priv/templates/rpm/rhel.init.script @@ -40,7 +40,7 @@ status -p $pidfile -l $(basename $lockfile) $NAME >/dev/null 2>&1 running=$? check_pid_status() { - pid=$(ps ax | grep beam.smp | grep "\-progname $NAME" | awk '{print $1}') + pid=$(ps ax | grep beam.smp | grep "\-progname $NAME " | awk '{print $1}') if [ "$pid" = "" ]; then # prog not running? return 1 diff --git a/priv/templates/rpm/suse.init.script b/priv/templates/rpm/suse.init.script index 8314622..d65c48d 100755 --- a/priv/templates/rpm/suse.init.script +++ b/priv/templates/rpm/suse.init.script @@ -44,7 +44,7 @@ do_status() { } check_pid_status() { - pid=$(ps ax | grep beam.smp | grep "\-progname $NAME" | awk '{print $1}') + pid=$(ps ax | grep beam.smp | grep "\-progname $NAME " | awk '{print $1}') if [ "$pid" = "" ]; then # prog not running? return 1 From a541c79bb65fb4ac6f60197c333f841065d0aff6 Mon Sep 17 00:00:00 2001 From: Brian Sparrow Date: Tue, 28 Mar 2017 16:59:23 -0400 Subject: [PATCH 42/42] Replace $RANDOM with PID to support non-bash (#218) --- priv/base/runner | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/priv/base/runner b/priv/base/runner index fd48a2b..dde45d0 100755 --- a/priv/base/runner +++ b/priv/base/runner @@ -306,9 +306,9 @@ case "$1" in echo "Remote Shell: Use \"Ctrl-G q\" to quit." echo "q() or init:stop() will terminate the $SCRIPT node." shift - RAND=$(($(($RANDOM % 1000)) + 1)) + RAND=$(($(($$ % 1000)) + 1)) NODE_NAME=${NAME_ARG#* } - exec $ERTS_PATH/erl -name c_$RAND_$NODE_NAME -hidden -remsh $NODE_NAME $COOKIE_ARG $NET_TICKTIME_ARG + exec $ERTS_PATH/erl -name c$RAND$NODE_NAME -hidden -remsh $NODE_NAME $COOKIE_ARG $NET_TICKTIME_ARG ;; console) @@ -363,7 +363,7 @@ case "$1" in node_up_check shift - RAND=$(($(($RANDOM % 1000)) + 1)) + RAND=$(($(($$ % 1000)) + 1)) NODE_NAME=${NAME_ARG#* } $ERTS_PATH/erl -noshell -noinput \ -pa $RUNNER_PATCH_DIR \