From d6a7a37358997f28e03cf2d7804c7e4cce824b15 Mon Sep 17 00:00:00 2001 From: Tom Levy Date: Tue, 2 Jan 2024 01:35:58 +1300 Subject: [PATCH 1/4] Reword explanation of config var APP_USER (#236) Currently, this configuration variable doesn't *cause* the app to run as that username. We just ask for it so that we can set the correct ownership on some files. --- script/install/config.bash | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/script/install/config.bash b/script/install/config.bash index 4d4de3e0..9048997b 100644 --- a/script/install/config.bash +++ b/script/install/config.bash @@ -53,7 +53,7 @@ fi while [ -z "$APP_USER" ] ; do anyset=true - prompt "What username should the server run as (default=$USER)? " APP_USER + prompt "What username will the server run as (default=$USER)? " APP_USER if [[ ! $APP_USER ]] ; then APP_USER=$USER ; fi done From cfec596ea13433accf35173bb97c4db9b917d0a6 Mon Sep 17 00:00:00 2001 From: Tom Levy Date: Tue, 2 Jan 2024 01:45:36 +1300 Subject: [PATCH 2/4] Add config var APP_GROUP (#236) Previously the scripts assumed that the group name is the same as the username, but that's not necessarily the case. --- script/install.cfg.template | 1 + script/install/config.bash | 9 ++++++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/script/install.cfg.template b/script/install.cfg.template index cfb31a65..670a869d 100644 --- a/script/install.cfg.template +++ b/script/install.cfg.template @@ -14,6 +14,7 @@ export APP_NAME=${APP_NAME} # Rails environment that will be used to run this installation export RAILS_ROOT=${RAILS_ROOT} export APP_USER=${APP_USER} # user this app will run under +export APP_GROUP=${APP_GROUP} # group this app will run under export RAILS_ENV=${RAILS_ENV} # development or production # Unicorn diff --git a/script/install/config.bash b/script/install/config.bash index 9048997b..62d830dd 100644 --- a/script/install/config.bash +++ b/script/install/config.bash @@ -57,6 +57,13 @@ while [ -z "$APP_USER" ] ; do if [[ ! $APP_USER ]] ; then APP_USER=$USER ; fi done +default_app_group="$(id -gn "$APP_USER")" +while [ -z "$APP_GROUP" ] ; do + anyset=true + prompt "What group will the server run as (default=$default_app_group)? " APP_GROUP + if [[ ! $APP_GROUP ]] ; then APP_GROUP=$default_app_group ; fi +done + while [ -z "$RAILS_ENV" ] ; do anyset=true prompt 'What environment is used to run this rails installation - d[evelopment] (default), p[roduction] or t[est]? ' RAILS_ENV @@ -202,7 +209,7 @@ declare -p ISOLATE_BRANCH &> /dev/null || ISOLATE_BRANCH=master # no prompt shopt -u nocasematch; if $anyset ; then - export SERVER_NAME APP_NAME RAILS_ROOT APP_USER RAILS_ENV UNICORN_PORT + export SERVER_NAME APP_NAME RAILS_ROOT APP_USER APP_GROUP RAILS_ENV UNICORN_PORT export DATABASE TEST_DATABASE DATABASE_USERNAME export REDIS_HOST REDIS_PORT REDIS_PASS REDIS_INSTALL export SCHEDULE_BACKUPS BACKUP_RSYNC BACKUP_RSYNC_MODE BACKUP_RSYNC_PORT BACKUP_RSYNC_HOST BACKUP_RSYNC_USER BACKUP_RSYNC_PASS BACKUP_RSYNC_SSH_KEY BACKUP_RSYNC_PATH From e33ed4e3f5d6bd3adfa732147219a43fadab49f9 Mon Sep 17 00:00:00 2001 From: Tom Levy Date: Tue, 2 Jan 2024 01:46:07 +1300 Subject: [PATCH 3/4] Use APP_GROUP for group of isolate/isolock (#236) Previously the scripts assumed that the group name is the same as the username, but that's not necessarily the case. --- script/install/isolate.bash | 2 +- script/install/isolock.bash | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/script/install/isolate.bash b/script/install/isolate.bash index 0cd54e74..d8d3dc8c 100644 --- a/script/install/isolate.bash +++ b/script/install/isolate.bash @@ -26,5 +26,5 @@ make install || { exit 1 } -chgrp "$APP_USER" /usr/local/bin/isolate || exit 1 +chgrp "$APP_GROUP" /usr/local/bin/isolate || exit 1 chmod 4750 /usr/local/bin/isolate || exit 1 # change permissions from default (4755) to prevent other users from executing, because it is setuid diff --git a/script/install/isolock.bash b/script/install/isolock.bash index 3a968160..bfcc7383 100644 --- a/script/install/isolock.bash +++ b/script/install/isolock.bash @@ -16,7 +16,7 @@ else git clone https://github.com/NZOI/isolock.git && cd isolock || exit 1 fi -make && chown root bin/isolock && chgrp $APP_USER bin/isolock && chmod 6750 bin/isolock || { +make && chown root bin/isolock && chgrp "$APP_GROUP" bin/isolock && chmod 6750 bin/isolock || { echo "Failure to setup isolock permissions - aborting" cd .. rm -r $srclocation/isolock From 6b6781d61d1a04c46da3f8ca598088c44d5381e3 Mon Sep 17 00:00:00 2001 From: Tom Levy Date: Tue, 2 Jan 2024 01:47:34 +1300 Subject: [PATCH 4/4] Don't set isolock to be setgid (#236) It only needs to be setuid, like isolate. --- script/install/isolock.bash | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/script/install/isolock.bash b/script/install/isolock.bash index bfcc7383..38e369e9 100644 --- a/script/install/isolock.bash +++ b/script/install/isolock.bash @@ -16,7 +16,7 @@ else git clone https://github.com/NZOI/isolock.git && cd isolock || exit 1 fi -make && chown root bin/isolock && chgrp "$APP_GROUP" bin/isolock && chmod 6750 bin/isolock || { +make && chown root bin/isolock && chgrp "$APP_GROUP" bin/isolock && chmod 4750 bin/isolock || { echo "Failure to setup isolock permissions - aborting" cd .. rm -r $srclocation/isolock