|
13 | 13 | # See the License for the specific language governing permissions and |
14 | 14 | # limitations under the License. |
15 | 15 |
|
| 16 | + |
| 17 | + |
16 | 18 | # Used below to execute a command to retrieve the Python interpreter version. |
17 | 19 | run_and_check_persion_version() { |
18 | 20 | command=$1 |
@@ -78,120 +80,19 @@ check_python_version() { |
78 | 80 | echo "Warning, no valid Python interpreter found." |
79 | 81 | } |
80 | 82 |
|
81 | | -# Function which ensures that the provided file path permissions for "group" match the |
82 | | -# provided permission bit in octal notation. |
83 | | -# This function can operate on a file or on a directory. |
84 | | -ensure_path_group_permissions() { |
85 | | - file_path=$1 |
86 | | - wanted_permissions_group=$2 |
87 | | - |
88 | | - if [ "${wanted_permissions_group}" -lt 0 ] || [ "${wanted_permissions_group}" -gt 7 ]; then |
89 | | - echo "wanted_permissions_group value needs to be between 0 and 7" |
90 | | - return 1 |
91 | | - fi |
92 | | - |
93 | | - # Will output permissions on octal mode - xyz, e.g. 644 |
94 | | - file_permissions=$(stat -c %a "${file_path}") |
95 | | - # Permissions for owner - e.g. 6 |
96 | | - file_permissions_owner=$(echo -n "$file_permissions" | head -c 1) |
97 | | - # Permissions for group - e.g. 4 |
98 | | - file_permissions_group=$(echo -n "$file_permissions" | head -c 2 | tail -c 1) |
99 | | - # Permissions for other - e.g. 4 |
100 | | - file_permissions_others=$(echo -n "$file_permissions" | tail -c 1) |
101 | | - |
102 | | - # NOTE: We re-use existing fs permissions for owner and other |
103 | | - if [ "${file_permissions_group}" -ne "${wanted_permissions_group}" ]; then |
104 | | - new_permissions="${file_permissions_owner}${wanted_permissions_group}${file_permissions_others}" |
105 | | - echo "Changing permissions for file ${file_path} from \"${file_permissions}\" to \"${new_permissions}\"." |
106 | | - |
107 | | - # NOTE: On CI chmod sometimes fails with 'getpwuid(): uid not found: 1001' which is likely |
108 | | - # related to some unfinished provisioning on the CI or similar. We simply ignore any |
109 | | - # errors returned by chmod. |
110 | | - set +e |
111 | | - set +o pipefail |
112 | | - chmod "${new_permissions}" "${file_path}" > /dev/null 2>&1 || true; |
113 | | - set -e |
114 | | - set -o pipefail |
115 | | - fi |
116 | | -} |
117 | | - |
118 | | -# Function which ensures that the provided file path permissions for "other" users match the |
119 | | -# provided permission bit in octal notation. |
120 | | -# This function can operate on a file or on a directory. |
121 | | -ensure_path_other_permissions() { |
122 | | - file_path=$1 |
123 | | - wanted_permissions_other=$2 |
124 | | - |
125 | | - if [ "${wanted_permissions_other}" -lt 0 ] || [ "${wanted_permissions_other}" -gt 7 ]; then |
126 | | - echo "wanted_permissions_other value needs to be between 0 and 7" |
127 | | - return 1 |
128 | | - fi |
129 | | - |
130 | | - # Will output permissions on octal mode - xyz, e.g. 644 |
131 | | - file_permissions=$(stat -c %a "${file_path}") |
132 | | - # Permissions for owner and group - e.g. 644 |
133 | | - file_permissions_owner_group=$(echo -n "$file_permissions" | head -c 2) |
134 | | - # Permissions for other - e.g. 4 |
135 | | - file_permissions_others=$(echo -n "$file_permissions" | tail -c 1) |
136 | | - |
137 | | - # NOTE: We re-use existing fs permissions for owner and group |
138 | | - if [ "${file_permissions_others}" -ne "${wanted_permissions_other}" ]; then |
139 | | - new_permissions="${file_permissions_owner_group}${wanted_permissions_other}" |
140 | | - echo "Changing permissions for file ${file_path} from \"${file_permissions}\" to \"${new_permissions}\"." |
141 | | - |
142 | | - # NOTE: On CI chmod sometimes fails with 'getpwuid(): uid not found: 1001' which is likely |
143 | | - # related to some unfinished provisioning on the CI or similar. We simply ignore any |
144 | | - # errors returned by chmod. |
145 | | - set +e |
146 | | - set +o pipefail |
147 | | - chmod "${new_permissions}" "${file_path}" > /dev/null 2>&1 || true; |
148 | | - set -e |
149 | | - set -o pipefail |
150 | | - fi |
151 | | -} |
152 | | - |
153 | | -# Function which ensures that the provided file path is not readable by "other" users aka has |
154 | | -# "0" value for permission in the octal notation. If permissions don't match, we update them |
155 | | -# and ensure value for the user part is "0". |
156 | | -# This function can operate on a file or on a directory. |
157 | | -ensure_path_not_readable_by_others() { |
158 | | - file_path=$1 |
159 | | - ensure_path_other_permissions "${file_path}" "0" |
160 | | -} |
161 | | - |
162 | 83 | check_python_version |
163 | 84 |
|
164 | | -config_owner=$(stat -c %U /etc/scalyr-agent-2/agent.json) |
165 | | -script_owner=$(stat -c %U /usr/share/scalyr-agent-2/bin/scalyr-agent-2) |
| 85 | +config_owner=`stat -c %U /etc/scalyr-agent-2/agent.json` |
| 86 | +script_owner=`stat -c %U /usr/share/scalyr-agent-2/bin/scalyr-agent-2` |
166 | 87 |
|
167 | 88 | # Determine if the agent had been previously configured to run as a |
168 | | -# different user than root. We can determine this if agent.json |
| 89 | +# different user than root. We can determine this if agentConfig.json |
169 | 90 | # has a different user. If so, then make sure the newly installed files |
170 | 91 | # (like agent.sh) are changed to the correct owners. |
171 | 92 | if [ "$config_owner" != "$script_owner" ]; then |
172 | | - echo "Changing owner for /etc/scalyr-agent-2/agent.json file from $script_owner to $config_owner" |
173 | 93 | /usr/share/scalyr-agent-2/bin/scalyr-agent-2-config --set_user "$config_owner" > /dev/null 2>&1; |
174 | 94 | fi |
175 | 95 |
|
176 | | -# Ensure /etc/scalyr-agent-2/agent.json file is not readable by others |
177 | | -ensure_path_not_readable_by_others "/etc/scalyr-agent-2/agent.json" |
178 | | - |
179 | | -# We also change agent.d group permissions to 751 since it used to be 771 due to default fpm behavior |
180 | | -ensure_path_group_permissions "/etc/scalyr-agent-2/agent.d" "5" |
181 | | - |
182 | | -# Ensure agent.d/*.json files are note readable by others |
183 | | -# NOTE: Most software gives +x bit on *.d directories so we do the same |
184 | | -ensure_path_other_permissions "/etc/scalyr-agent-2/agent.d" "1" |
185 | | - |
186 | | -if [ -d "/etc/scalyr-agent-2/agent.d" ]; then |
187 | | - # NOTE: find + -print0 correctly handles whitespaces in filenames and it's more robust than for, |
188 | | - # but it may have cross platform issues. In that case we may need to revert to for. |
189 | | - #for config_fragment_path in /etc/scalyr-agent-2/agent.d/*.json; do |
190 | | - find /etc/scalyr-agent-2/agent.d/ -name "*.json" -print0 | while read -r -d $'\0' config_fragment_path; do |
191 | | - ensure_path_not_readable_by_others "${config_fragment_path}" |
192 | | - done |
193 | | -fi |
194 | | - |
195 | 96 | # Add in the symlinks in the appropriate /etc/rcX.d/ directories |
196 | 97 | # to stop and start the service at boot time. |
197 | 98 | if [ -f /sbin/chkconfig ] || [ -f /usr/sbin/chkconfig ]; then |
|
0 commit comments