changing file permissions of /var/log/gosa-si-client.log, /etc/ldap/ldap-shell.conf...

git-svn-id: https://oss.gonicus.de/repositories/gosa/branches/2.6-lhm@13508 594d385d-05f5-0310-b6e9-bd551577e9d8

diff --git a/trunk/gosa-si/client/events/corefunctions.pm b/trunk/gosa-si/client/events/corefunctions.pm
index 7e19a8b18dcdbd1f0e37d3e2f8dd2b0e94cddc56..9f3b9d7bc13cd0408d10b27e4dc7493d7f530e94 100644 (file)
--- a/trunk/gosa-si/client/events/corefunctions.pm
+++ b/trunk/gosa-si/client/events/corefunctions.pm
@@ -117,8 +117,8 @@ sub registered {
     my $hostname= $main::client_dnsname;
     $hostname =~ s/\..*$//;
     $hostname =~ tr/A-Z/a-z/;
-    open($opts_file_FH, ">$main::opts_file");
-    print $opts_file_FH "MAC=\"$main::client_mac_address\"\n";
+       sysopen($opts_file_FH, $main::opts_file, O_RDWR | O_CREAT | O_TRUNC , 0644);
+       print $opts_file_FH "MAC=\"$main::client_mac_address\"\n";
     print $opts_file_FH "IPADDRESS=\"$main::client_ip\"\n";
     print $opts_file_FH "HOSTNAME=\"$hostname\"\n";
     print $opts_file_FH "FQDN=\"$main::client_dnsname\"\n";
@@ -444,6 +444,10 @@ sub new_ldap_config {
            daemon_log("wrote $cfg_name", 5);
     }
 
+    # Set permissions and ownership structure
+    chown(0, 0, $cfg_name);
+    chmod(0600, $cfg_name);
+
     return;
 }
 

diff --git a/trunk/gosa-si/gosa-si-client b/trunk/gosa-si/gosa-si-client
index 94b7c66f1cdad922a9a26c0df970debf0206259d..8142b35a0b753691e907d54913c9e1807f16d8ca 100755 (executable)
--- a/trunk/gosa-si/gosa-si-client
+++ b/trunk/gosa-si/gosa-si-client
@@ -38,6 +38,7 @@ use MIME::Base64;
 use XML::Simple;
 use File::Basename;
 use File::Spec;
+use Fcntl;
 
 # Workaround: need pure perl to make it work with UTF-8 :-(
 $XML::Simple::PREFERRED_PARSER= "XML::SAX::PurePerl";
@@ -51,6 +52,7 @@ use lib "/usr/lib/gosa-si/client/events";
 my (%cfg_defaults, $foreground, $verbose, $pid_file, $procid, $pid, $log_file, $fai_logpath);
 my ($server_ip, $server_port, $server_timeout, $server_domain, $server_key_lifetime);
 my ($client_port, $ldap_enabled, $ldap_config, $pam_config, $nss_config);
+my ($root_uid, $adm_gid);
 my $xml;
 my $event_hash;
 my $default_server_key;
@@ -234,11 +236,17 @@ sub daemon_log {
     if(not defined $msg) { return }
     if(not defined $level) { $level = 1 }
     if(defined $log_file){
-        open(LOG_HANDLE, ">>$log_file");
-        if(not defined open( LOG_HANDLE, ">>$log_file" )) {
+               my $open_log_fh = sysopen(LOG_HANDLE, $log_file, O_WRONLY | O_CREAT | O_APPEND , 0440);
+        if(not $open_log_fh) {
             print STDERR "cannot open $log_file: $!";
-            return 
+            return;
         }
+        # check owner and group of log_file and update settings if necessary
+        my ($dev, $ino, $mode, $nlink, $uid, $gid, $rdev, $size, $atime, $mtime, $ctime, $blksize, $blocks) = stat($log_file);
+        if((not $uid eq $root_uid) || (not $gid eq $adm_gid)) {
+            chown($root_uid, $adm_gid, $log_file);
+        }
+
         chomp($msg);
         if($level <= $verbose){
             my ($seconds, $minutes, $hours, $monthday, $month,
@@ -1121,11 +1129,12 @@ if ($client_headURL =~ /\/tag\// ||
     $client_status = "developmental" ;
 }
 
-# Prepare log file
-my $root_uid = getpwnam('root');
-my $adm_gid = getgrnam('adm');
-chmod(0640, $log_file);
-chown($root_uid, $adm_gid, $log_file);
+# Determine root uid and adm gid, used for creating log files
+$root_uid = getpwnam('root');
+$adm_gid = getgrnam('adm');
+if(not defined $adm_gid){
+       $adm_gid = getgrnam('root');
+}
 
 
 daemon_log(" ", 1);

diff --git a/trunk/gosa-si/gosa-si-server b/trunk/gosa-si/gosa-si-server
index 7e0d203a4320926e70a8edfdf95ef4a332b7ce58..9191d3e858a580cc590816c1af73351ee606f9e7 100755 (executable)
--- a/trunk/gosa-si/gosa-si-server
+++ b/trunk/gosa-si/gosa-si-server
@@ -326,11 +326,17 @@ sub daemon_log {
     if(not defined $msg) { return }
     if(not defined $level) { $level = 1 }
     if(defined $log_file){
-        open(LOG_HANDLE, ">>$log_file");
-        if(not defined open( LOG_HANDLE, ">>$log_file" )) {
+        my $open_log_fh = sysopen(LOG_HANDLE, $log_file, O_WRONLY | O_CREAT | O_APPEND , 0440);
+        if(not $open_log_fh) {
             print STDERR "cannot open $log_file: $!";
-            return 
+            return;
+        }
+        # check owner and group of log_file and update settings if necessary
+        my ($dev, $ino, $mode, $nlink, $uid, $gid, $rdev, $size, $atime, $mtime, $ctime, $blksize, $blocks) = stat($log_file);
+        if((not $uid eq $root_uid) || (not $gid eq $adm_gid)) {
+            chown($root_uid, $adm_gid, $log_file);
         }
+
         chomp($msg);
         #$msg =~s/\n//g;   # no newlines are allowed in log messages, this is important for later log parsing
         if($level <= $verbose){
@@ -3241,10 +3247,12 @@ if ($server_headURL =~ /\/tag\// ||
     $server_status = "developmental" ;
 }
 
-# Prepare log file
+# Prepare log file and set permissons
 $root_uid = getpwnam('root');
 $adm_gid = getgrnam('adm');
-chmod(0640, $log_file);
+open(FH, ">>$log_file");
+close FH;
+chmod(0440, $log_file);
 chown($root_uid, $adm_gid, $log_file);
 chown($root_uid, $adm_gid, "/var/lib/gosa-si");
 
@@ -3295,56 +3303,56 @@ daemon_log($server_status_hash->{$server_status}.": $server_revision", 1);
         # connect to gosa-si job queue
         unlink($job_queue_file_name);  ## just for debugging
         $job_db = GOSA::DBsqlite->new($job_queue_file_name);
-        chmod(0660, $job_queue_file_name);
+        chmod(0640, $job_queue_file_name);
         chown($root_uid, $adm_gid, $job_queue_file_name);
         
         # connect to known_clients_db
         unlink($known_clients_file_name);   ## just for debugging
         $known_clients_db = GOSA::DBsqlite->new($known_clients_file_name);
-        chmod(0660, $known_clients_file_name);
+        chmod(0640, $known_clients_file_name);
         chown($root_uid, $adm_gid, $known_clients_file_name);
         
         # connect to foreign_clients_db
         unlink($foreign_clients_file_name);
         $foreign_clients_db = GOSA::DBsqlite->new($foreign_clients_file_name);
-        chmod(0660, $foreign_clients_file_name);
+        chmod(0640, $foreign_clients_file_name);
         chown($root_uid, $adm_gid, $foreign_clients_file_name);
         
         # connect to known_server_db
         unlink($known_server_file_name);
         $known_server_db = GOSA::DBsqlite->new($known_server_file_name);
-        chmod(0660, $known_server_file_name);
+        chmod(0640, $known_server_file_name);
         chown($root_uid, $adm_gid, $known_server_file_name);
         
         # connect to login_usr_db
         unlink($login_users_file_name);
         $login_users_db = GOSA::DBsqlite->new($login_users_file_name);
-        chmod(0660, $login_users_file_name);
+        chmod(0640, $login_users_file_name);
         chown($root_uid, $adm_gid, $login_users_file_name);
         
         # connect to fai_server_db
         unlink($fai_server_file_name);
         $fai_server_db = GOSA::DBsqlite->new($fai_server_file_name);
-        chmod(0660, $fai_server_file_name);
+        chmod(0640, $fai_server_file_name);
         chown($root_uid, $adm_gid, $fai_server_file_name);
         
         # connect to fai_release_db
         unlink($fai_release_file_name);
         $fai_release_db = GOSA::DBsqlite->new($fai_release_file_name);
-        chmod(0660, $fai_release_file_name);
+        chmod(0640, $fai_release_file_name);
         chown($root_uid, $adm_gid, $fai_release_file_name);
         
         # connect to packages_list_db
         #unlink($packages_list_file_name);
         unlink($packages_list_under_construction);
         $packages_list_db = GOSA::DBsqlite->new($packages_list_file_name);
-        chmod(0660, $packages_list_file_name);
+        chmod(0640, $packages_list_file_name);
         chown($root_uid, $adm_gid, $packages_list_file_name);
         
         # connect to messaging_db
         unlink($messaging_file_name);
         $messaging_db = GOSA::DBsqlite->new($messaging_file_name);
-        chmod(0660, $messaging_file_name);
+        chmod(0640, $messaging_file_name);
         chown($root_uid, $adm_gid, $messaging_file_name);
     }
 }

diff --git a/trunk/gosa-si/modules/DBsqlite.pm b/trunk/gosa-si/modules/DBsqlite.pm
index c9ebc440f562bc4d91405895236e40f4125f6e9c..c1d7b84a6d7e2e362a1814a9337fe9a6c1b478c0 100644 (file)
--- a/trunk/gosa-si/modules/DBsqlite.pm
+++ b/trunk/gosa-si/modules/DBsqlite.pm
@@ -43,6 +43,9 @@ sub lock {
        open($self->{db_lock_handle}, ">>".($self->{db_lock})) unless ref $self->{db_lock_handle};
        flock($self->{db_lock_handle},LOCK_EX);
        seek($self->{db_lock_handle}, 0, 2);
+
+       chown($main::root_uid, $main::adm_gid, $self->{db_lock_handle});
+       chmod(0640, $self->{db_lock_handle});
 }
 
 

diff --git a/trunk/gosa-si/server/events/clMessages.pm b/trunk/gosa-si/server/events/clMessages.pm
index 0d3344db5034c95c7fadfd4ec247595c2c1e1073..2b4ff98d942eda75fccbb9a9795b14cd93e70c6f 100644 (file)
--- a/trunk/gosa-si/server/events/clMessages.pm
+++ b/trunk/gosa-si/server/events/clMessages.pm
@@ -101,9 +101,11 @@ sub save_fai_log {
         my ($log_file, $log_string) = split(":", $log);
         my $client_fai_log_file = File::Spec->catfile( $client_fai_log_dir, $log_file);
 
-       open(my $LOG_FILE, ">$client_fai_log_file"); 
+               open(my $LOG_FILE, ">$client_fai_log_file"); 
         print $LOG_FILE &decode_base64($log_string);
         close($LOG_FILE);
+               chown($main::root_uid, $main::adm_gid, $client_fai_log_file);
+        chmod(0440, $client_fai_log_file);
 
     }
     return;