[java-identity-provider] 01/07: IDP-553 IDP-1499 Installer Linux chmod and chgrp
Rod Widdowson
rdw at steadingsoftware.com
Sat Oct 19 08:04:10 EDT 2019
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=b8a110c383d2ea9909c6778ceae0c9b2b2fc63df
commit b8a110c383d2ea9909c6778ceae0c9b2b2fc63df
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Fri Oct 18 11:17:40 2019 +0100
IDP-553 IDP-1499 Installer Linux chmod and chgrp
https://issues.shibboleth.net/jira/browse/IDP-1499
https://issues.shibboleth.net/jira/browse/IDP-553
---
.../idp/installer/InstallerProperties.java | 24 +++++++
.../idp/installer/InstallerPropertiesImpl.java | 78 +++++++++++++++++++---
.../shibboleth/idp/installer/InstallerSupport.java | 49 ++++++++++++++
.../net/shibboleth/idp/installer/V4Install.java | 15 ++++-
4 files changed, 156 insertions(+), 10 deletions(-)
diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/InstallerProperties.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/InstallerProperties.java
index e1db882..07ab8fe 100644
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/InstallerProperties.java
+++ b/idp-installer/src/main/java/net/shibboleth/idp/installer/InstallerProperties.java
@@ -37,6 +37,30 @@ public interface InstallerProperties extends InitializableComponent {
*/
@Nonnull public Path getTargetDir() throws BuildException;
+ /** Does the user want us to *not* tidy up.
+ * @return do we not tidy up?*/
+ public boolean isNoTidy();
+
+ /** Mode to set all files in conf.
+ * @return the mode
+ */
+ @Nonnull public String getConfFileMode();
+
+ /** Mode to set on key files in credentials.
+ * @return the mode
+ */
+ @Nonnull public String getCredentialsKeyFileMode();
+
+ /** Group to set on all files in credentials and conf.
+ * @return the mode or null if none to be set
+ */
+ @Nullable public String getConfCredentialsGroup();
+
+ /** Do we set the mode?
+ * @return do we the mode
+ */
+ @Nonnull public boolean isSetGroupAndMode();
+
/** Where is the install coming from?
* @return the source directory
*/
diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/InstallerPropertiesImpl.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/InstallerPropertiesImpl.java
index c01f1c7..7707d82 100644
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/InstallerPropertiesImpl.java
+++ b/idp-installer/src/main/java/net/shibboleth/idp/installer/InstallerPropertiesImpl.java
@@ -121,6 +121,18 @@ public class InstallerPropertiesImpl extends AbstractInitializableComponent impl
/** The the key size to generate. */
public static final String KEY_SIZE = "idp.keysize";
+ /** Mode to set on conf files. */
+ public static final String MODE_CONF = "idp.conf.filemode";
+
+ /** Mode to set on credential *key files. */
+ public static final String MODE_CREDENTIAL_KEYS = "idp.conf.credentials.filemode";
+
+ /** Group to set on conf & *ALL* credential files. */
+ public static final String GROUP_CONF_CREDENTIALS = "idp.conf.group";
+
+ /** Do we do any chgrp/chmod work? */
+ public static final String PERFORM_SET_MODE = "idp.conf.setmode";
+
/** Whether to tidy up after ourselves. */
public static final String NO_TIDY = "idp.no.tidy";
@@ -172,6 +184,15 @@ public class InstallerPropertiesImpl extends AbstractInitializableComponent impl
/** whether to tidy up. */
private boolean tidy = true;
+ /** whether to tidy up. */
+ private boolean setGroupAndMode = true;
+
+ /** conf all file mode. */
+ private String confFileMode;
+
+ /** credentials key file mode. */
+ private String credentialsKeyFileMode;
+
/**
* Constructor.
* @param copiedDistribution Has the distribution been copied? If no we don't need the source dir.
@@ -181,6 +202,7 @@ public class InstallerPropertiesImpl extends AbstractInitializableComponent impl
}
/** {@inheritDoc} */
+ // CheckStyle: CyclomaticComplexity OFF
protected void doInitialize() throws ComponentInitializationException {
installerProperties = new Properties(System.getProperties());
final String antBase = installerProperties.getProperty(ANT_BASE_DIR);
@@ -197,7 +219,12 @@ public class InstallerPropertiesImpl extends AbstractInitializableComponent impl
throw new ComponentInitializationException(ANT_BASE_DIR + " must exist");
}
log.debug("base dir {}", baseDir);
- tidy = installerProperties.get(NO_TIDY) == null;
+ final String noTidy = installerProperties.getProperty(NO_TIDY);
+ tidy = noTidy == null;
+ final String setModeString = installerProperties.getProperty(PERFORM_SET_MODE);
+ if (setModeString != null) {
+ setGroupAndMode = Boolean.valueOf(setModeString);
+ }
if (installerProperties.containsKey(PROPERTY_SOURCE_FILE)) {
final Path file = baseDir.resolve(installerProperties.getProperty(PROPERTY_SOURCE_FILE));
@@ -215,7 +242,7 @@ public class InstallerPropertiesImpl extends AbstractInitializableComponent impl
log.error("Could not load {}", file.toAbsolutePath(), e);
throw new ComponentInitializationException(e);
}
- if (tidy) {
+ if (!isNoTidy()) {
idpPropertyFile.deleteOnExit();
}
}
@@ -236,6 +263,7 @@ public class InstallerPropertiesImpl extends AbstractInitializableComponent impl
keySize = Integer.parseInt(installerProperties.getProperty(KEY_SIZE));
}
}
+ // CheckStyle: CyclomaticComplexity ON
/** Lookup a property. If it isn't defined then ask the user (if we are allowed).
* This is used by most (but all) getters that redirect through a property
@@ -327,6 +355,11 @@ public class InstallerPropertiesImpl extends AbstractInitializableComponent impl
return entityID;
}
+ /** {@inheritDoc} */
+ public boolean isNoTidy() {
+ return !tidy;
+ }
+
/** Is this address named? Helper method for {@link #bestHostName()}
* @return true unless the name is the canonical name...
* @param addr what to look at
@@ -398,6 +431,33 @@ public class InstallerPropertiesImpl extends AbstractInitializableComponent impl
return hostname;
}
+ /** {@inheritDoc} */
+ @Override @Nonnull public String getConfFileMode() {
+ if (confFileMode ==null) {
+ confFileMode = installerProperties.getProperty(MODE_CONF, "600");
+ }
+ return confFileMode;
+ }
+
+ /** {@inheritDoc} */
+ @Override @Nonnull public String getCredentialsKeyFileMode() {
+ if (credentialsKeyFileMode == null) {
+ credentialsKeyFileMode = installerProperties.getProperty(MODE_CREDENTIAL_KEYS, "600");
+ }
+ return credentialsKeyFileMode;
+ }
+
+ /** {@inheritDoc} */
+ @Override @Nullable public String getConfCredentialsGroup() {
+ return installerProperties.getProperty(GROUP_CONF_CREDENTIALS);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean isSetGroupAndMode() {
+ return setGroupAndMode;
+ }
+
/** Evaluate the default scope value.
* @return everything after the first '.' in {@link #getHostName()}
*/
@@ -411,7 +471,7 @@ public class InstallerPropertiesImpl extends AbstractInitializableComponent impl
}
/** {@inheritDoc}. */
- @Nonnull public String getScope() {
+ @Override @Nonnull public String getScope() {
if (scope == null) {
scope = getValue(SCOPE, "Attribute Scope:", () -> defaultScope());
}
@@ -419,12 +479,12 @@ public class InstallerPropertiesImpl extends AbstractInitializableComponent impl
}
/** {@inheritDoc}. */
- @Nonnull public String getSubjectAltName() {
+ @Override @Nonnull public String getSubjectAltName() {
return "https://" + getHostName() + "/idp/shibboleth";
}
/** {@inheritDoc}. */
- @Nonnull public String getKeyStorePassword() {
+ @Override @Nonnull public String getKeyStorePassword() {
if (keyStorePassword == null) {
keyStorePassword = getPassword(KEY_STORE_PASSWORD, "Backchannel PKCS12 Password:");
}
@@ -432,7 +492,7 @@ public class InstallerPropertiesImpl extends AbstractInitializableComponent impl
}
/** {@inheritDoc}. */
- @Nonnull public String getSealerPassword() {
+ @Override @Nonnull public String getSealerPassword() {
if (sealerPassword == null) {
sealerPassword = getPassword(SEALER_PASSWORD, "Cookie Encryption Key Password:");
}
@@ -451,7 +511,7 @@ public class InstallerPropertiesImpl extends AbstractInitializableComponent impl
}
/** {@inheritDoc}. default is {@value #DEFAULT_KEY_SIZE}. */
- public int getKeySize() {
+ @Override public int getKeySize() {
return keySize;
}
@@ -475,12 +535,12 @@ public class InstallerPropertiesImpl extends AbstractInitializableComponent impl
}
/** {@inheritDoc}. Default to the file pointed to by {@value #IDP_PROPERTIES_MERGE}. */
- public File getIdPMergePropertiesFile() throws BuildException {
+ @Override public File getIdPMergePropertiesFile() throws BuildException {
return getMergePropertiesFile(IDP_PROPERTIES_MERGE);
}
/** {@inheritDoc}. Default to the file pointed to by {@value #LDAP_PROPERTIES_MERGE}. */
- public File getLDAPMergePropertiesFile() throws BuildException {
+ @Override public File getLDAPMergePropertiesFile() throws BuildException {
return getMergePropertiesFile(LDAP_PROPERTIES_MERGE);
}
}
diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/InstallerSupport.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/InstallerSupport.java
index 9844fd5..bfd90c8 100644
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/InstallerSupport.java
+++ b/idp-installer/src/main/java/net/shibboleth/idp/installer/InstallerSupport.java
@@ -23,11 +23,13 @@ import java.nio.file.Path;
import org.apache.tools.ant.BuildException;
import org.apache.tools.ant.Project;
+import org.apache.tools.ant.taskdefs.Chmod;
import org.apache.tools.ant.taskdefs.Copy;
import org.apache.tools.ant.taskdefs.Delete;
import org.apache.tools.ant.taskdefs.Execute;
import org.apache.tools.ant.taskdefs.Jar;
import org.apache.tools.ant.taskdefs.condition.Os;
+import org.apache.tools.ant.taskdefs.optional.unix.Chgrp;
import org.apache.tools.ant.types.FileSet;
import org.apache.tools.ant.types.selectors.PresentSelector;
import org.apache.tools.ant.types.selectors.PresentSelector.FilePresence;
@@ -84,6 +86,7 @@ public final class InstallerSupport {
fromSet.setDir(from.toFile());
result.addFileset(fromSet);
result.setProject(ANT_PROJECT);
+ result.setVerbose(log.isDebugEnabled());
return result;
}
@@ -115,6 +118,7 @@ public final class InstallerSupport {
fromSet.addPresent(present);
copy.addFileset(fromSet);
copy.setProject(ANT_PROJECT);
+ copy.setVerbose(log.isDebugEnabled());
copy.execute();
log.debug("Copied not-previously-existing files from {} to {}", from, to);
@@ -150,6 +154,50 @@ public final class InstallerSupport {
}
}
+ /** On Non Windows sets the file mode.
+ * @param directory where
+ * @param permissions what to set
+ * @param includes what to include
+ * @throws BuildException if badness occurrs
+ */
+ public static void setMode(final Path directory, final String permissions, final String includes)
+ throws BuildException {
+ if (Os.isFamily(Os.FAMILY_WINDOWS)) {
+ log.debug("Windows. Not sdoing chmod");
+ return;
+ }
+ final Chmod chmod = new Chmod();
+ chmod.setProject(ANT_PROJECT);
+ chmod.setPerm(permissions);
+ chmod.setDir(directory.toFile());
+ chmod.setIncludes(includes);
+ chmod.setVerbose(log.isDebugEnabled());
+ chmod.execute();
+ }
+
+ /** On Non Windows sets the files (only) group.
+ * @param directory where
+ * @param group what to set
+ * @param includes what to include
+ * @throws BuildException if badness occurrs
+ */
+ public static void setGroup(final Path directory, final String group, final String includes)
+ throws BuildException {
+ if (Os.isFamily(Os.FAMILY_WINDOWS)) {
+ log.debug("Windows. Not sdoing chmod");
+ return;
+ }
+ final Chgrp chgrp = new Chgrp();
+ chgrp.setProject(ANT_PROJECT);
+ chgrp.setVerbose(log.isDebugEnabled());
+ chgrp.setGroup(group);
+ final FileSet fileSet = new FileSet();
+ fileSet.setDir(directory.toFile());
+ fileSet.setIncludes(includes);
+ chgrp.addFileset(fileSet);
+ chgrp.execute();
+ }
+
/** Delete the tree.
* @param where where
* @throws BuildException if badness occurrs
@@ -167,6 +215,7 @@ public final class InstallerSupport {
final Delete delete = new Delete();
delete.setDir(where.toFile());
delete.setFailOnError(false);
+ delete.setVerbose(log.isDebugEnabled());
delete.execute();
}
diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/V4Install.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/V4Install.java
index a2767e2..744da24 100644
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/V4Install.java
+++ b/idp-installer/src/main/java/net/shibboleth/idp/installer/V4Install.java
@@ -324,7 +324,20 @@ public class V4Install extends AbstractInitializableComponent {
protected void reprotect() throws BuildException {
InstallerSupport.setReadOnly(installerProps.getTargetDir().resolve("dist"), true);
InstallerSupport.setReadOnly(installerProps.getTargetDir().resolve("system"), true);
- log.warn("Reprotect Implementation still pending");
+
+ if (installerProps.isSetGroupAndMode()) {
+ InstallerSupport.setMode(installerProps.getTargetDir().resolve("bin"), "755", "**/*.sh");
+ InstallerSupport.setMode(installerProps.getTargetDir().resolve("system"), "444", "**/*");
+ InstallerSupport.setMode(installerProps.getTargetDir().resolve("credentials"),
+ installerProps.getCredentialsKeyFileMode(), "**/*.key");
+ InstallerSupport.setMode(installerProps.getTargetDir().resolve("conf"),
+ installerProps.getConfFileMode(), "**/*");
+ final String group = installerProps.getConfCredentialsGroup();
+ if (group != null) {
+ InstallerSupport.setGroup(installerProps.getTargetDir().resolve("credentials"), group, "**/*");
+ InstallerSupport.setGroup(installerProps.getTargetDir().resolve("conf"), group, "**/*");
+ }
+ }
}
/**
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list