Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix: Set correct user for service and cli #1040

Merged
merged 14 commits into from
Dec 7, 2023
Merged

Fix: Set correct user for service and cli #1040

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
4fad466
Set root as default user#
ngetahun Oct 20, 2023
72ea191
Change migration service user
ngetahun Oct 20, 2023
bfdb967
Update changelog
ngetahun Oct 20, 2023
936aa7a
Revert "Change migration service user"
ngetahun Oct 25, 2023
04b0e1f
Revert "Set root as default user#"
ngetahun Oct 25, 2023
b63dde4
Give public tools directory nginx readable permissions
ngetahun Oct 26, 2023
bc21a45
Ensure secrets are readable by nginx group
ngetahun Oct 27, 2023
e4f020b
Update changelog message
ngetahun Oct 27, 2023
a6c8c0f
Merge branch 'master' into fix_rmt_service_file_permissions
ngetahun Oct 27, 2023
e57f786
Replace with group variable
ngetahun Oct 27, 2023
7d20dfe
Use no-dereference flag on chown
ngetahun Oct 31, 2023
007bc0e
Amend permissions for public tools path
ngetahun Nov 20, 2023
b16fac6
- Reorder chown and chmod calls
ngetahun Nov 22, 2023
d4d7485
Merge branch 'master' into fix_rmt_service_file_permissions
ngetahun Dec 5, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions package/files/nginx/nginx-http.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,10 @@ server {
# return 301 https://$host$request_uri;
}

location /public/tools {
felixsch marked this conversation as resolved.
Show resolved Hide resolved
autoindex on;
}

location /suma {
autoindex on;
}
Expand Down
4 changes: 4 additions & 0 deletions package/files/nginx/nginx-https.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,10 @@ server {
try_files $uri @rmt_app;
}

location /public/tools {
autoindex on;
}

location /suma {
autoindex on;
}
Expand Down
14 changes: 14 additions & 0 deletions package/files/update_rmt_app_dir_permissions.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,3 +16,17 @@ if [[ $app_dir_ownership == "_rmt nginx" ]]; then

find -P $app_dir -type f -user _rmt -group nginx | xargs -I {} chown -h root:root {}
fi

# Change secrets encrypted and key files to nginx readable
secret_key_files=('config/secrets.yml.key' 'config/secrets.yml.enc')

for secretFile in $secret_key_files; do
file_path="$app_dir/$secretFile"
if [[ -e $file_path ]]; then
if [[ "$(stat -c "%U %G" $file_path)" == "root root" ]]; then
chmod 0640 $file_path
jsegitz marked this conversation as resolved.
Show resolved Hide resolved
chown -h root:nginx $file_path
fi
fi

done
1 change: 1 addition & 0 deletions package/obs/rmt-server.changes
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ Wed Oct 04 13:23:00 UTC 2023 - Felix Schnizlein <[email protected]>
- Version 2.15:
* Moving system hardware information to systems database table to
allow transmitting system information dynamically. (jsc#PED-3734)
* Fix secrets access for server user (bsc#1215176)

-------------------------------------------------------------------
Thu Jun 06 15:44:00 UTC 2023 - Luís Caparroz <[email protected]>
Expand Down
13 changes: 9 additions & 4 deletions package/obs/rmt-server.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -240,6 +240,7 @@ chrpath -d %{buildroot}%{lib_dir}/vendor/bundle/ruby/*/extensions/*/*/mysql2-*/m

%files
%attr(0755,root,root) %{app_dir}
%attr(0755,root,root) %{app_dir}/public/tools
%exclude %{app_dir}/engines/
%exclude %{app_dir}/package/
%exclude %{app_dir}/rmt/tmp
Expand All @@ -253,8 +254,8 @@ chrpath -d %{buildroot}%{lib_dir}/vendor/bundle/ruby/*/extensions/*/*/mysql2-*/m
%ghost %{_datadir}/rmt/public/suma

# The secrets file is created by running the initial rake tasks in the `post` section
%ghost %{app_dir}/config/secrets.yml.key
%ghost %{app_dir}/config/secrets.yml.enc
%ghost %attr(0640,root,%{rmt_group}) %{app_dir}/config/secrets.yml.key
%ghost %attr(0640,root,%{rmt_group}) %{app_dir}/config/secrets.yml.enc

%dir %{_sysconfdir}/slp.reg.d
%config(noreplace) %attr(0640, %{rmt_user}, root) %{_sysconfdir}/rmt.conf
Expand Down Expand Up @@ -320,8 +321,12 @@ getent passwd %{rmt_user} >/dev/null || \

%post
%service_add_post rmt-server.target rmt-server.service rmt-server-migration.service rmt-server-mirror.service rmt-server-sync.service rmt-server-systems-scc-sync.service
cd %{_datadir}/rmt && bin/rails rmt:secrets:create_encryption_key >/dev/null RAILS_ENV=production && \
cd %{_datadir}/rmt && bin/rails rmt:secrets:create_secret_key_base >/dev/null RAILS_ENV=production && \

# Rails by default creates `secrets.yml.key` with `0600` file mode, see here
# https://github.com/rails/rails/blob/6-0-stable/railties/lib/rails/generators/rails/encryption_key_file/encryption_key_file_generator.rb
cd %{_datadir}/rmt && runuser -u root -g %{rmt_group} -- bin/rails rmt:secrets:create_encryption_key >/dev/null RAILS_ENV=production && \
felixsch marked this conversation as resolved.
Show resolved Hide resolved
cd %{_datadir}/rmt && runuser -u root -g %{rmt_group} -- bin/rails rmt:secrets:create_secret_key_base >/dev/null RAILS_ENV=production && \

# Run only on install
if [ $1 -eq 1 ]; then
echo "Please run the YaST RMT module (or 'yast2 rmt' from the command line) to complete the configuration of your RMT" >> /dev/stdout
Expand Down
Loading