[java-idp-jetty-base] 03/03: IDP-2136 Consider Splitting the Windows Installer into IdP and Jetty+Procrun
Rod Widdowson
rdw at steadingsoftware.com
Mon Aug 7 13:25:45 UTC 2023
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch 10-windows
in repository java-idp-jetty-base.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-jetty-base.git;a=commit;h=9f87a4c7c6b97856cc190aafd11d9ddd99db85b7
commit 9f87a4c7c6b97856cc190aafd11d9ddd99db85b7
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Mon Aug 7 14:25:17 2023 +0100
IDP-2136 Consider Splitting the Windows Installer into IdP and Jetty+Procrun
https://shibboleth.atlassian.net/browse/IDP-2136
Multiple bugs around ACL inheritance.
---
src/main/wix/Jetty-User.wxs | 79 ++++++++++++++++++++++++++++-----------------
src/main/wix/Jetty.bat | 4 +--
2 files changed, 52 insertions(+), 31 deletions(-)
diff --git a/src/main/wix/Jetty-User.wxs b/src/main/wix/Jetty-User.wxs
index a98db65..d0084bb 100644
--- a/src/main/wix/Jetty-User.wxs
+++ b/src/main/wix/Jetty-User.wxs
@@ -101,55 +101,76 @@
/t recursive
/setowner [ACE_USER]
/inheritance:r Remove inhetited ACLS
- /grant:r SYSTEM:F *add* Full access for SYSTEM (replacing any existing)
- [ACE_USER]:(GR,RD,X) *add* GENERIC_READ,READ_DATA,TRAVERSE access
+ /grant:r SYSTEM:(CI)(OI)(F) *add* Full access for SYSTEM (replacing any existing, with inheritance)
+ [ACE_USER]:(CI)(OI)(GR,RD,X) *add* GENERIC_READ,READ_DATA,TRAVERSE access (with inheritance)
(Remember, when user not supplied ACE_USER is Administrators
icacls "C:\Program Files (x86)\Shibboleth\IdP\conf" /setowner administrators /t /inheritance:r /grant SYSTEM:F Administrators:F Administrators:(GR,RD,X)
-->
<CustomAction Id="SetIcaclsVerb" Property="IcaclsVerb" Value=""c:\Windows\System32\icacls.exe""/>
- <CustomAction Id="SetIcaclsPost" Property="IcaclsPost" Value="/t /inheritance:r /grant:r SYSTEM:F Administrators:F"/>
+ <CustomAction Id="SetIcaclsPostFiles" Property="IcaclsPostFiles" Value="/t /inheritance:r /grant:r SYSTEM:F Administrators:F"/>
+ <CustomAction Id="SetIcaclsPostDirs" Property="IcaclsPostDirs" Value="/t /inheritance:r /grant:r SYSTEM:(CI)(OI)(F) Administrators:(CI)(OI)(F)"/>
<!-- conf -->
- <CustomAction Id="SetACEIdpWith" Property="QtSetACEIdP" Value=""[IDP_INSTALLDIR]\bin\setacl.bat""/>
- <CustomAction Id="SetACEIdpWithout" Property="QtSetACEIdP" Value=""[IDP_INSTALLDIR]\bin\setacl.bat" [ACE_USER]"/>
+ <CustomAction Id="SetACEIdpWithout" Property="QtSetACEIdP" Value=""[IDP_INSTALLDIR]\bin\setacl.bat""/>
+ <CustomAction Id="SetACEIdpWith" Property="QtSetACEIdP" Value=""[IDP_INSTALLDIR]\bin\setacl.bat" [ACE_USER]"/>
<CustomAction Id="QtSetACEIdP" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
<!-- Jetty tmp -->
- <CustomAction Id="SetACEJettyTmp" Property="QtSetACEJettyTmp" Value="[IcaclsVerb] "[IDP_INSTALLDIR]\jetty-base\tmp" [IcaclsPost] [ACE_USER]:F"/>
- <CustomAction Id="QtSetACEJettyTmp" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+ <CustomAction Id="SetACEJettyTmpFiles" Property="QtSetACEJettyTmpFiles" Value="[IcaclsVerb] "[IDP_INSTALLDIR]\jetty-base\tmp" [IcaclsPostFiles] [ACE_USER]:F"/>
+ <CustomAction Id="SetACEJettyTmpDirs" Property="QtSetACEJettyTmpDirs" Value="[IcaclsVerb] "[IDP_INSTALLDIR]\jetty-base\tmp" [IcaclsPostDirs] [ACE_USER]:(CI)(OI)(F)"/>
+ <CustomAction Id="QtSetACEJettyTmpFiles" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+ <CustomAction Id="QtSetACEJettyTmpDirs" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
<!-- Jetty logs -->
- <CustomAction Id="SetACEJettyLogs" Property="QtSetACEJettyLogs" Value="[IcaclsVerb] "[IDP_INSTALLDIR]\jetty-base\logs" [IcaclsPost] [ACE_USER]:F" />
- <CustomAction Id="QtSetACEJettyLogs" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+ <CustomAction Id="SetACEJettyLogsFiles" Property="QtSetACEJettyLogsFiles" Value="[IcaclsVerb] "[IDP_INSTALLDIR]\jetty-base\logs" [IcaclsPostFiles] [ACE_USER]:F" />
+ <CustomAction Id="SetACEJettyLogsDirs" Property="QtSetACEJettyLogsDirs" Value="[IcaclsVerb] "[IDP_INSTALLDIR]\jetty-base\logs" [IcaclsPostDirs] [ACE_USER]:(CI)(OI)(F)" />
+ <CustomAction Id="QtSetACEJettyLogsFiles" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+ <CustomAction Id="QtSetACEJettyLogsDirs" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
<!-- Procmon Logs -->
- <CustomAction Id="SetACEProcrunLog1" Property="QtSetACEProcrunLog1" Value="[IcaclsVerb] "[SHIBBOLETHDIR]ProcRun\log" /t /setowner Administrators" />
- <CustomAction Id="SetACEProcrunLog2" Property="QtSetACEProcrunLog2" Value="[IcaclsVerb] "[SHIBBOLETHDIR]ProcRun\log" [IcaclsPost] [ACE_USER]:F" />
- <CustomAction Id="QtSetACEProcrunLog1" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
- <CustomAction Id="QtSetACEProcrunLog2" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+ <CustomAction Id="SetACEProcrunLogOwner" Property="QtSetACEProcrunLogOwner" Value="[IcaclsVerb] "[SHIBBOLETHDIR]ProcRun\log" /t /setowner Administrators" />
+ <CustomAction Id="SetACEProcrunLogFiles" Property="QtSetACEProcrunLogFiles" Value="[IcaclsVerb] "[SHIBBOLETHDIR]ProcRun\log" [IcaclsPostFiles] [ACE_USER]:F" />
+ <CustomAction Id="SetACEProcrunLogDirs" Property="QtSetACEProcrunLogDirs" Value="[IcaclsVerb] "[SHIBBOLETHDIR]ProcRun\log" [IcaclsPostDirs] [ACE_USER]:(CI)(OI)(F)" />
+ <CustomAction Id="QtSetACEProcrunLogOwner" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+ <CustomAction Id="QtSetACEProcrunLogFiles" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+ <CustomAction Id="QtSetACEProcrunLogDirs" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
<InstallExecuteSequence>
- <!-- Write the ACEs. IdP : conf, creds, logs -->
- <Custom Action="SetIcaclsPost" Before="SetIcaclsVerb"/>
+ <!-- Write the ACEs using the setacl command -->
+ <Custom Action="SetIcaclsPostDirs" Before="SetIcaclsPostFiles"/>
+ <Custom Action="SetIcaclsPostFiles" Before="SetIcaclsVerb"/>
<Custom Action="SetIcaclsVerb" Before="InstallFiles"/>
- <Custom Action="SetACEIdpWith" After="InstallFiles">INSTALL_JETTYD_USER</Custom>
- <Custom Action="SetACEIdpWithout" After="InstallFiles">NOT INSTALL_JETTYD_USER</Custom>
+ <!-- Do the ACLS on the Shib install tree BEFORE we install the files
+ That way the install will inherit the protections -->
+ <Custom Action="SetACEIdpWith" Before="QtSetACEIdP">INSTALL_JETTYD_USER</Custom>
+ <Custom Action="SetACEIdpWithout" Before="QtSetACEIdP">NOT INSTALL_JETTYD_USER</Custom>
<Custom Action="QtSetACEIdP" After="QtFinalizeJetty"/>
- <!-- Write the ACEs. jetty : tmp, logs -->
- <Custom Action="SetACEJettyTmp" After="SetIcaclsVerb"/>
- <Custom Action="QtSetACEJettyTmp" After="QtSetACEIdP"/>
-
- <Custom Action="SetACEJettyLogs" After="SetIcaclsVerb"/>
- <Custom Action="QtSetACEJettyLogs" After="QtSetACEIdP"/>
-
- <!-- Write the ACEs. Procrun: log -->
- <Custom Action="SetACEProcrunLog1" After="SetIcaclsVerb"/>
- <Custom Action="SetACEProcrunLog2" After="SetIcaclsVerb"/>
- <Custom Action="QtSetACEProcrunLog1" After="QtFinalizeJetty"/>
- <Custom Action="QtSetACEProcrunLog2" After="QtSetACEProcrunLog1"/>
+ <!-- Write the ACLS on the jetty-base, and procrun install tree.
+ Do this AFTER we install the files, That way the install will inherit the protections -->
+ <!-- jetty-base/tmp, files then dirs -->
+ <Custom Action="SetACEJettyTmpFiles" After="SetIcaclsVerb"/>
+ <Custom Action="SetACEJettyTmpDirs" After="SetIcaclsVerb"/>
+
+ <Custom Action="QtSetACEJettyTmpFiles" After="QtSetACEIdP"/>
+ <Custom Action="QtSetACEJettyTmpDirs" After="QtSetACEJettyTmpFiles"/>
+
+ <!-- jetty-base/logs, files then dirs -->
+ <Custom Action="SetACEJettyLogsFiles" After="SetIcaclsVerb"/>
+ <Custom Action="SetACEJettyLogsDirs" After="SetIcaclsVerb"/>
+ <Custom Action="QtSetACEJettyLogsFiles" After="QtSetACEIdP"/>
+ <Custom Action="QtSetACEJettyLogsDirs" After="QtSetACEJettyLogsFiles"/>
+
+ <!-- Procrun: log -->
+ <Custom Action="SetACEProcrunLogOwner" After="SetIcaclsVerb"/>
+ <Custom Action="SetACEProcrunLogFiles" After="SetIcaclsVerb"/>
+ <Custom Action="SetACEProcrunLogDirs" After="SetIcaclsVerb"/>
+
+ <Custom Action="QtSetACEProcrunLogOwner" After="QtFinalizeJetty"/>
+ <Custom Action="QtSetACEProcrunLogFiles" After="QtSetACEProcrunLogOwner"/>
+ <Custom Action="QtSetACEProcrunLogDirs" After="QtSetACEProcrunLogFiles"/>
</InstallExecuteSequence>
</Fragment>
diff --git a/src/main/wix/Jetty.bat b/src/main/wix/Jetty.bat
index 87947e3..c4f78c7 100644
--- a/src/main/wix/Jetty.bat
+++ b/src/main/wix/Jetty.bat
@@ -152,8 +152,8 @@ if ERRORLEVEL 1 (
rem IDP-1149 make doubley sure that we have a jetty-base\tmp & log dir
mkdir tmp
echo "keeper" > tmp\.keep
-mkdir log
-echo "keeper" > log\.log
+mkdir logs
+echo "keeper" > logs\.keep
cd ..\..
"%WIX%/BIN/HEAT" dir idp-jetty-base-extract\jetty-base -platform -gg -dr IDP_INSTALLDIR -var var.jettyBaseRoot -cg JettyBaseGroup -out jetty_base_contents.wxs -src
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list