From 721472d38e9a70cef96519c05d887380eb596c62 Mon Sep 17 00:00:00 2001 From: Jean Raby Date: Tue, 22 Jan 2013 10:16:15 -0500 Subject: [PATCH 1/8] spec: sogo user as a system user, perms fixes Create the sogo user as a system user Use %attr() to set directory permissions instead of chown/chmod Use more restrictive permissions for the log and spool directories --- packaging/rhel/sogo.spec | 29 ++++++++++++++++++----------- 1 file changed, 18 insertions(+), 11 deletions(-) diff --git a/packaging/rhel/sogo.spec b/packaging/rhel/sogo.spec index 27a986443..f283fd153 100644 --- a/packaging/rhel/sogo.spec +++ b/packaging/rhel/sogo.spec @@ -195,8 +195,9 @@ mkdir -p ${RPM_BUILD_ROOT}/etc/logrotate.d mkdir -p ${RPM_BUILD_ROOT}/etc/sysconfig mkdir -p ${RPM_BUILD_ROOT}/etc/httpd/conf.d mkdir -p ${RPM_BUILD_ROOT}/usr/sbin -mkdir -p ${RPM_BUILD_ROOT}/var/run/sogo +mkdir -p ${RPM_BUILD_ROOT}/var/lib/sogo mkdir -p ${RPM_BUILD_ROOT}/var/log/sogo +mkdir -p ${RPM_BUILD_ROOT}/var/run/sogo mkdir -p ${RPM_BUILD_ROOT}/var/spool/sogo cat Apache/SOGo.conf | sed -e "s@/lib/@/%{_lib}/@g" > ${RPM_BUILD_ROOT}/etc/httpd/conf.d/SOGo.conf install -m 600 Scripts/sogo.cron ${RPM_BUILD_ROOT}/etc/cron.d/sogo @@ -228,9 +229,10 @@ rm -fr ${RPM_BUILD_ROOT} /etc/init.d/sogod /etc/cron.daily/sogo-tmpwatch -/var/run/sogo -/var/log/sogo -/var/spool/sogo +%dir %attr(0700, sogo, sogo) %{_var}/lib/sogo +%dir %attr(0700, sogo, sogo) %{_var}/log/sogo +%dir %attr(0755, sogo, sogo) %{_var}/run/sogo +%dir %attr(0700, sogo, sogo) %{_var}/spool/sogo %{_sbindir}/sogod %{_libdir}/libSOGo.so.* %{_libdir}/libSOGoUI.so.* @@ -299,12 +301,12 @@ rm -fr ${RPM_BUILD_ROOT} %endif # **************************** pkgscripts ***************************** +%pre +if ! id sogo >& /dev/null; then + /usr/sbin/useradd -d %{_var}/lib/sogo -c "SOGo daemon" -s /sbin/nologin -M -r sogo +fi + %post -if ! id sogo >& /dev/null; then /usr/sbin/useradd -m -k /var/empty -r sogo > /dev/null 2>&1; fi -/bin/chown sogo /var/run/sogo -/bin/chown sogo /var/log/sogo -/bin/chown sogo /var/spool/sogo -/bin/chmod 700 /var/spool/sogo # update timestamp on imgs,css,js to let apache know the files changed find %{_libdir}/GNUstep/SOGo/WebServerResources -exec touch {} \; /sbin/chkconfig --add sogod @@ -322,12 +324,17 @@ if test "$1" = "0" then /usr/sbin/userdel sogo /usr/sbin/groupdel sogo > /dev/null 2>&1 - /bin/rm -rf /var/run/sogo - /bin/rm -rf /var/spool/sogo + /bin/rm -rf %{_var}/run/sogo + /bin/rm -rf %{_var}/spool/sogo + # not removing /var/lib/sogo to keep .GNUstepDefaults fi # ********************************* changelog ************************* %changelog +* Tue Jan 22 2013 Jean Raby +- Create the sogo user as a system user +- Use %attr() to set directory permissions instead of chown/chmod + * Mon Nov 12 2012 Jean Raby - Add missing dependency on lasso and lasso-devel From 790a0536bc9c3973587b15f4a104e8d52af6c3e0 Mon Sep 17 00:00:00 2001 From: Jean Raby Date: Tue, 22 Jan 2013 13:27:13 -0500 Subject: [PATCH 2/8] whitespace (tabkill) --- packaging/debian/sogo.postinst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/packaging/debian/sogo.postinst b/packaging/debian/sogo.postinst index e43bfd92a..c4a7272fd 100644 --- a/packaging/debian/sogo.postinst +++ b/packaging/debian/sogo.postinst @@ -18,8 +18,8 @@ PATH=/bin:/sbin:/usr/bin:/usr/sbin case "$1" in configure) - # update timestamp on imgs,css,js to let apache know the files changed - find /usr/lib/GNUstep/SOGo/WebServerResources -exec touch {} \; + # update timestamp on imgs,css,js to let apache know the files changed + find /usr/lib/GNUstep/SOGo/WebServerResources -exec touch {} \; ;; abort-upgrade|abort-remove|abort-deconfigure) From 3cd7beb93d87dd9f92a91f0ab665a61e9bfc3684 Mon Sep 17 00:00:00 2001 From: Jean Raby Date: Tue, 22 Jan 2013 13:29:16 -0500 Subject: [PATCH 3/8] whitespace (tabkill) --- packaging/debian-multiarch/sogo.postinst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/packaging/debian-multiarch/sogo.postinst b/packaging/debian-multiarch/sogo.postinst index e43bfd92a..c4a7272fd 100644 --- a/packaging/debian-multiarch/sogo.postinst +++ b/packaging/debian-multiarch/sogo.postinst @@ -18,8 +18,8 @@ PATH=/bin:/sbin:/usr/bin:/usr/sbin case "$1" in configure) - # update timestamp on imgs,css,js to let apache know the files changed - find /usr/lib/GNUstep/SOGo/WebServerResources -exec touch {} \; + # update timestamp on imgs,css,js to let apache know the files changed + find /usr/lib/GNUstep/SOGo/WebServerResources -exec touch {} \; ;; abort-upgrade|abort-remove|abort-deconfigure) From 884dd7448c259f066a311ac15e87d5d9242da747 Mon Sep 17 00:00:00 2001 From: Jean Raby Date: Tue, 22 Jan 2013 13:29:30 -0500 Subject: [PATCH 4/8] Rewrite useradd for debian packages Add the sogo user as a system user Create and/or fix the permissions/ownership of various directories when installing or upgrading the package. --- packaging/debian-multiarch/sogo.preinst | 17 +++++++---------- packaging/debian/sogo.preinst | 17 +++++++---------- 2 files changed, 14 insertions(+), 20 deletions(-) diff --git a/packaging/debian-multiarch/sogo.preinst b/packaging/debian-multiarch/sogo.preinst index 384bffc2a..fc2d475bf 100644 --- a/packaging/debian-multiarch/sogo.preinst +++ b/packaging/debian-multiarch/sogo.preinst @@ -11,19 +11,16 @@ set -e # for details, see http://www.debian.org/doc/debian-policy/ or # the debian-policy package -if test "x$1" == "xinstall" && test -z "$2" -then +if [ "$1" == "install" ] || [ "$1" == "upgrade" ]; then + if ! id sogo 1> /dev/null 2>&1; then - groupadd -f -K GID_MIN=100 -K GID_MAX=500 sogo - useradd -d /home/sogo -g sogo -m -K UID_MIN=100 -K UID_MAX=500 -K PASS_MAX_DAYS=-1 -s /bin/bash sogo + groupadd -f -r sogo + useradd -d /var/lib/sogo -g sogo -c "SOGo daemon" -s /usr/sbin/nologin -M -r sogo fi - for dir in run spool log - do - if ! test -d /var/$dir/sogo - then - install -m 750 -o sogo -g sogo -d /var/$dir/sogo - fi + # create mandatory dirs and enforce owner/perms + for dir in lib log run spool; do + install -m 750 -o sogo -g sogo -d /var/$dir/sogo done fi diff --git a/packaging/debian/sogo.preinst b/packaging/debian/sogo.preinst index 384bffc2a..fc2d475bf 100644 --- a/packaging/debian/sogo.preinst +++ b/packaging/debian/sogo.preinst @@ -11,19 +11,16 @@ set -e # for details, see http://www.debian.org/doc/debian-policy/ or # the debian-policy package -if test "x$1" == "xinstall" && test -z "$2" -then +if [ "$1" == "install" ] || [ "$1" == "upgrade" ]; then + if ! id sogo 1> /dev/null 2>&1; then - groupadd -f -K GID_MIN=100 -K GID_MAX=500 sogo - useradd -d /home/sogo -g sogo -m -K UID_MIN=100 -K UID_MAX=500 -K PASS_MAX_DAYS=-1 -s /bin/bash sogo + groupadd -f -r sogo + useradd -d /var/lib/sogo -g sogo -c "SOGo daemon" -s /usr/sbin/nologin -M -r sogo fi - for dir in run spool log - do - if ! test -d /var/$dir/sogo - then - install -m 750 -o sogo -g sogo -d /var/$dir/sogo - fi + # create mandatory dirs and enforce owner/perms + for dir in lib log run spool; do + install -m 750 -o sogo -g sogo -d /var/$dir/sogo done fi From 8d9cfdb3b4f3cc71b083e1ccc42c2431ff47b495 Mon Sep 17 00:00:00 2001 From: Jean Raby Date: Tue, 22 Jan 2013 13:32:57 -0500 Subject: [PATCH 5/8] Use 'sogo' group instead of 'adm' in init script This matches what the package preinst script does. --- packaging/debian-multiarch/sogo.init | 8 ++++---- packaging/debian/sogo.init | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/packaging/debian-multiarch/sogo.init b/packaging/debian-multiarch/sogo.init index 9dc4b5c27..cf0600cdd 100644 --- a/packaging/debian-multiarch/sogo.init +++ b/packaging/debian-multiarch/sogo.init @@ -62,10 +62,10 @@ case "$1" in start) log_daemon_msg "Starting $DESC" "$NAME" - # Ensure directory's existence and permissions - install -o $USER -g adm -m 755 -d /var/run/$NAME - install -o $USER -g adm -m 750 -d /var/spool/$NAME - install -o $USER -g adm -m 750 -d /var/log/$NAME + # Enforce directory existence and permissions + install -o $USER -g $USER -m 755 -d /var/run/$NAME + install -o $USER -g $USER -m 750 -d /var/spool/$NAME + install -o $USER -g $USER -m 750 -d /var/log/$NAME if ! start-stop-daemon -c $USER --quiet --start --pidfile $PIDFILE --exec $DAEMON -- $DAEMON_OPTS then diff --git a/packaging/debian/sogo.init b/packaging/debian/sogo.init index 9dc4b5c27..cf0600cdd 100644 --- a/packaging/debian/sogo.init +++ b/packaging/debian/sogo.init @@ -62,10 +62,10 @@ case "$1" in start) log_daemon_msg "Starting $DESC" "$NAME" - # Ensure directory's existence and permissions - install -o $USER -g adm -m 755 -d /var/run/$NAME - install -o $USER -g adm -m 750 -d /var/spool/$NAME - install -o $USER -g adm -m 750 -d /var/log/$NAME + # Enforce directory existence and permissions + install -o $USER -g $USER -m 755 -d /var/run/$NAME + install -o $USER -g $USER -m 750 -d /var/spool/$NAME + install -o $USER -g $USER -m 750 -d /var/log/$NAME if ! start-stop-daemon -c $USER --quiet --start --pidfile $PIDFILE --exec $DAEMON -- $DAEMON_OPTS then From 1e4f737a7d691373b9a529ee05d533064c368c81 Mon Sep 17 00:00:00 2001 From: Jean Raby Date: Tue, 22 Jan 2013 15:24:21 -0500 Subject: [PATCH 6/8] test-sogo-tool.py: Use sudo instead of su - --- Tests/Integration/test-sogo-tool.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Tests/Integration/test-sogo-tool.py b/Tests/Integration/test-sogo-tool.py index 1da98ca54..1e4e604c1 100755 --- a/Tests/Integration/test-sogo-tool.py +++ b/Tests/Integration/test-sogo-tool.py @@ -32,7 +32,7 @@ class sogoToolTest(unittest.TestCase): self.assertEqual(os.getuid(), 0, "this test must run as root...") os.chown(self.backupdir, uid, gid) - status = os.system("su - %s -c \"(cd %s && %s backup . ALL >/dev/null 2>&1)\"" + status = os.system("sudo -u %s bash -c \"(cd %s && %s backup . ALL >/dev/null 2>&1)\"" % (sogo_user, self.backupdir, sogo_tool_path)) rc=os.WEXITSTATUS(status) From cfa7402dec3bf58aafb4bb3f12a333e78a36ca1d Mon Sep 17 00:00:00 2001 From: Jean Raby Date: Tue, 22 Jan 2013 16:03:11 -0500 Subject: [PATCH 7/8] NEWS: Add note related to sudo -u sogo usage --- NEWS | 3 +++ 1 file changed, 3 insertions(+) diff --git a/NEWS b/NEWS index 5b33983e9..6b739d47f 100644 --- a/NEWS +++ b/NEWS @@ -5,6 +5,9 @@ New features - sogo-tool: new "dump-defaults" command to easily create /etc/sogo.conf Enhancements + - The sogo user is now a system user. + For new installs, this means that 'su - sogo' won't work anymore. + Please use 'sudo -u sogo cmd' instead - added basic support for LDAP URL in user sources - renamed default SOGoForceIMAPLoginWithEmail to SOGoForceExternalLoginWithEmail and extended it to SMTP authentication From 95b193391e8a760127f25a222542f0a43f212b1d Mon Sep 17 00:00:00 2001 From: Jean Raby Date: Wed, 23 Jan 2013 09:10:43 -0500 Subject: [PATCH 8/8] Add note about 'requiretty' in sudoers file --- NEWS | 1 + 1 file changed, 1 insertion(+) diff --git a/NEWS b/NEWS index 6b739d47f..00d36eda1 100644 --- a/NEWS +++ b/NEWS @@ -8,6 +8,7 @@ Enhancements - The sogo user is now a system user. For new installs, this means that 'su - sogo' won't work anymore. Please use 'sudo -u sogo cmd' instead + If used in scripts from cronjobs, 'requiretty' must be disabled in sudoers - added basic support for LDAP URL in user sources - renamed default SOGoForceIMAPLoginWithEmail to SOGoForceExternalLoginWithEmail and extended it to SMTP authentication