Skip to content

Commit a87a6fb

Browse files
f-gallandAlexRuiz7
f-galland
and
AlexRuiz7
authored
Fine tuning permissions on assembled packages (#137)
* Fine tuning permissions on RPM spec file * Build a list of files to be packaged excluding items that need special permissions * Fix bad permissions on directories * Remove system directories from packaging definition * Changing permissions on deb packages * Skip unneeded dh_fixperms stage in debian/rules * Clean & format --------- Co-authored-by: Álex Ruiz <[email protected]>
1 parent e2e499a commit a87a6fb

File tree

4 files changed

+182
-57
lines changed

4 files changed

+182
-57
lines changed

‎distribution/packages/src/deb/debian/rules

+9-6
Original file line numberDiff line numberDiff line change
@@ -13,17 +13,20 @@
1313
#export DEB_CFLAGS_MAINT_APPEND = -Wall -pedantic
1414
#export DEB_LDFLAGS_MAINT_APPEND = -Wl,--as-needed
1515

16+
SHELL != sh -c "command -v /bin/bash"
17+
.ONESHELL:
18+
1619
%:
1720
dh $@
1821

22+
override_dh_strip_nondeterminism:
23+
echo "Skipping dh_strip_nondeterminism"
24+
25+
override_dh_fixperms:
26+
echo "Skipping dh_fixperms"
27+
1928
override_dh_builddeb:
2029
dh_builddeb -- -Zgzip
2130

2231
override_dh_gencontrol:
2332
dh_gencontrol -- -DLicense=Apache-2.0
24-
25-
#override_dh_auto_install:
26-
# dh_auto_install -- prefix=/usr
27-
28-
#override_dh_install:
29-
# dh_install --list-missing -X.pyc -X.pyo

‎distribution/packages/src/deb/debmake_install.sh

+66-14
Original file line numberDiff line numberDiff line change
@@ -12,17 +12,22 @@
1212
set -ex
1313

1414
if [ -z "$1" ]; then
15-
echo "Missing curdir path"
16-
exit 1
15+
echo "Missing curdir path"
16+
exit 1
1717
fi
1818

1919
curdir=$1
20-
product_dir=/usr/share/wazuh-indexer
21-
config_dir=/etc/wazuh-indexer
22-
data_dir=/var/lib/wazuh-indexer
23-
log_dir=/var/log/wazuh-indexer
24-
pid_dir=/run/wazuh-indexer
25-
buildroot=${curdir}/debian/wazuh-indexer
20+
21+
name="wazuh-indexer"
22+
23+
product_dir="/usr/share/${name}"
24+
config_dir="/etc/${name}"
25+
# data_dir="/var/lib/${name}"
26+
# log_dir="/var/log/${name}"
27+
pid_dir="/run/${name}"
28+
service_dir="/usr/lib/systemd/system"
29+
30+
buildroot="${curdir}/debian/${name}"
2631

2732
# Create necessary directories
2833
mkdir -p "${buildroot}"
@@ -31,13 +36,60 @@ mkdir -p "${buildroot}${product_dir}/plugins"
3136

3237
# Install directories/files
3338
cp -a "${curdir}"/etc "${curdir}"/usr "${curdir}"/var "${buildroot}"/
34-
chmod -c 0755 "${buildroot}${product_dir}"/bin/*
35-
if [ -d "${buildroot}${product_dir}"/plugins/opensearch-security ]; then
36-
chmod -c 0755 "${buildroot}${product_dir}"/plugins/opensearch-security/tools/*
39+
40+
# General permissions for most of the package's files:
41+
find "${buildroot}" -type d -exec chmod 750 {} \;
42+
find "${buildroot}" -type f -exec chmod 640 {} \;
43+
44+
# Permissions for the Systemd files
45+
systemd_files=()
46+
systemd_files+=("${buildroot}/${service_dir}/${name}.service")
47+
systemd_files+=("${buildroot}/${service_dir}/${name}-performance-analyzer.service")
48+
systemd_files+=("${buildroot}/${service_dir}/${name}-performance-analyzer.service")
49+
systemd_files+=("${buildroot}/etc/init.d/${name}")
50+
systemd_files+=("${buildroot}/usr/lib/sysctl.d/${name}.conf")
51+
systemd_files+=("${buildroot}/usr/lib/tmpfiles.d/${name}.conf")
52+
53+
for i in "${systemd_files[@]}"; do
54+
chmod -c 0644 "$i"
55+
done
56+
57+
# Permissions for config files
58+
config_files=()
59+
config_files+=("${buildroot}/${config_dir}/log4j2.properties")
60+
config_files+=("${buildroot}/${config_dir}/jvm.options")
61+
config_files+=("${buildroot}/${config_dir}/opensearch.yml")
62+
63+
for i in "${config_files[@]}"; do
64+
chmod -c 0660 "$i"
65+
done
66+
67+
# Plugin-related files
68+
if [ -e "${buildroot}/${config_dir}/opensearch-observability/observability.yml" ]; then
69+
chmod -c 660 "${buildroot}/${config_dir}/opensearch-observability/observability.yml"
70+
fi
71+
72+
if [ -e "${buildroot}/${config_dir}/opensearch-reports-scheduler/reports-scheduler.yml" ]; then
73+
chmod -c 660 "${buildroot}/${config_dir}/opensearch-reports-scheduler/reports-scheduler.yml"
3774
fi
3875

39-
# Change Permissions
40-
chmod -Rf a+rX,u+w,g-w,o-w "${buildroot}"/*
41-
chmod -c 660 "${buildroot}${config_dir}"/wazuh-template.json
76+
# Files that need other permissions
77+
chmod -c 440 "${buildroot}${product_dir}/VERSION"
78+
if [ -d "${buildroot}${product_dir}/plugins/opensearch-security" ]; then
79+
chmod -c 0740 "${buildroot}${product_dir}"/plugins/opensearch-security/tools/*.sh
80+
fi
81+
82+
binary_files=()
83+
binary_files+=("${buildroot}${product_dir}"/bin/*)
84+
binary_files+=("${buildroot}${product_dir}"/jdk/bin/*)
85+
binary_files+=("${buildroot}${product_dir}"/jdk/lib/jspawnhelper)
86+
binary_files+=("${buildroot}${product_dir}"/jdk/lib/modules)
87+
binary_files+=("${buildroot}${product_dir}"/performance-analyzer-rca/bin/*)
88+
89+
for i in "${binary_files[@]}"; do
90+
chmod -c 750 "$i"
91+
done
92+
93+
chmod -c 660 "${buildroot}${config_dir}/wazuh-template.json"
4294

4395
exit 0

‎distribution/packages/src/rpm/wazuh-indexer.rpm.spec

+104-37
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
%define _source_filedigest_algorithm 8
1818
%define _binary_filedigest_algorithm 8
1919

20-
# Fixed in Fedora:
20+
# Fixed in Fedora:
2121
# https://www.endpointdev.com/blog/2011/10/rpm-building-fedoras-sharedstatedir/
2222
%define _sharedstatedir /var/lib
2323

@@ -43,32 +43,36 @@ ExclusiveArch: %{_architecture}
4343
AutoReqProv: no
4444

4545
%description
46-
Wazuh indexer is a near real-time full-text search and analytics engine that
47-
gathers security-related data into one platform. This Wazuh central component
48-
indexes and stores alerts generated by the Wazuh server. Wazuh indexer can be
49-
configured as a single-node or multi-node cluster, providing scalability and
46+
Wazuh indexer is a near real-time full-text search and analytics engine that
47+
gathers security-related data into one platform. This Wazuh central component
48+
indexes and stores alerts generated by the Wazuh server. Wazuh indexer can be
49+
configured as a single-node or multi-node cluster, providing scalability and
5050
high availability.
5151
For more information, see: https://www.wazuh.com/
5252

5353
%prep
5454
# No-op. We are using dir so no need to setup.
5555

5656
%build
57-
# No-op. This is all pre-built Java. Nothing to do here.
57+
58+
%define observability_plugin %( if [ -f %{_topdir}/etc/wazuh-indexer/opensearch-observability/observability.yml ]; then echo "1" ; else echo "0"; fi )
59+
%define reportsscheduler_plugin %( if [ -f %{_topdir}/etc/wazuh-indexer/opensearch-reports-scheduler/reports-scheduler.yml ]; then echo "1" ; else echo "0"; fi )
5860

5961
%install
6062
set -e
6163
cd %{_topdir} && pwd
64+
6265
# Create necessary directories
6366
mkdir -p %{buildroot}%{pid_dir}
6467
mkdir -p %{buildroot}%{product_dir}/plugins
68+
6569
# Install directories/files
6670
cp -a etc usr var %{buildroot}
67-
chmod 0750 %{buildroot}%{product_dir}/bin/*
71+
chmod 0755 %{buildroot}%{product_dir}/bin/*
6872
if [ -d %{buildroot}%{product_dir}/plugins/opensearch-security ]; then
69-
chmod 0640 %{buildroot}%{product_dir}/plugins/opensearch-security/tools/*
70-
chmod 0740 %{buildroot}%{product_dir}/plugins/opensearch-security/tools/*.sh
73+
chmod 0755 %{buildroot}%{product_dir}/plugins/opensearch-security/tools/*
7174
fi
75+
7276
# Pre-populate the folders to ensure rpm build success even without all plugins
7377
mkdir -p %{buildroot}%{config_dir}/opensearch-observability
7478
mkdir -p %{buildroot}%{config_dir}/opensearch-reports-scheduler
@@ -81,6 +85,70 @@ fi
8185
if [ ! -f %{buildroot}%{data_dir}/performance_analyzer_enabled.conf ]; then
8286
echo 'true' > %{buildroot}%{data_dir}/performance_analyzer_enabled.conf
8387
fi
88+
89+
# Build a filelist to be included in the %files section
90+
echo '%defattr(640, %{name}, %{name}, 750)' > filelist.txt
91+
find %{buildroot} -type d >> filelist.txt
92+
sed -i 's|%{buildroot}|%%dir |' filelist.txt
93+
find %{buildroot} -type f >> filelist.txt
94+
sed -i 's|%{buildroot}||' filelist.txt
95+
96+
# The %install section gets executed under a dash shell,
97+
# which doesn't have array structures.
98+
# Below, we are building a list of directories
99+
# which will later be excluded from filelist.txt
100+
set -- "%%dir %{_sysconfdir}"
101+
set -- "$@" "%%dir %{_sysconfdir}/sysconfig"
102+
set -- "$@" "%%dir %{_sysconfdir}/init.d"
103+
set -- "$@" "%%dir /usr"
104+
set -- "$@" "%%dir /usr/lib"
105+
set -- "$@" "%%dir /usr/lib/systemd/system"
106+
set -- "$@" "%%dir /usr/lib/tmpfiles.d"
107+
set -- "$@" "%%dir /usr/share"
108+
set -- "$@" "%%dir /var"
109+
set -- "$@" "%%dir /var/lib"
110+
set -- "$@" "%%dir /var/log"
111+
set -- "$@" "%%dir /usr/lib/sysctl.d"
112+
set -- "$@" "%%dir /usr/lib/systemd"
113+
set -- "$@" "%%dir /usr/lib/systemd"
114+
set -- "$@" "%{_sysconfdir}/sysconfig/%{name}"
115+
set -- "$@" "%{config_dir}/log4j2.properties"
116+
set -- "$@" "%{config_dir}/jvm.options"
117+
set -- "$@" "%{config_dir}/opensearch.yml"
118+
set -- "$@" "%{config_dir}/wazuh-template.json"
119+
set -- "$@" "%{product_dir}/VERSION"
120+
set -- "$@" "%{product_dir}/plugins/opensearch-security/tools/.*\.sh"
121+
set -- "$@" "%{product_dir}/bin/.*"
122+
set -- "$@" "%{product_dir}/jdk/bin/.*"
123+
set -- "$@" "%{product_dir}/jdk/lib/jspawnhelper"
124+
set -- "$@" "%{product_dir}/jdk/lib/modules"
125+
set -- "$@" "%{product_dir}/performance-analyzer-rca/bin/.*"
126+
set -- "$@" "%{product_dir}/NOTICE.txt"
127+
set -- "$@" "%{product_dir}/README.md"
128+
set -- "$@" "%{product_dir}/LICENSE.txt"
129+
set -- "$@" "%{_prefix}/lib/systemd/system/%{name}.service"
130+
set -- "$@" "%{_prefix}/lib/systemd/system/%{name}-performance-analyzer.service"
131+
set -- "$@" "%{_sysconfdir}/init.d/%{name}"
132+
set -- "$@" "%{_sysconfdir}/sysconfig/%{name}"
133+
set -- "$@" "%{_prefix}/lib/sysctl.d/%{name}.conf"
134+
set -- "$@" "%{_prefix}/lib/tmpfiles.d/%{name}.conf"
135+
set -- "$@" "%%dir %{product_dir}/bin/opensearch-performance-analyzer"
136+
137+
# Check if we are including the observability and reports scheduler
138+
# plugins
139+
if [ %observability_plugin -eq 1 ]; then
140+
set -- "$@" "%{config_dir}/opensearch-observability/observability.yml"
141+
fi
142+
143+
if [ %reportsscheduler_plugin -eq 1 ]; then
144+
set -- "$@" "%{config_dir}/opensearch-reports-scheduler/reports-scheduler.yml"
145+
fi
146+
147+
for i in "$@"
148+
do
149+
sed -ri "\|^$i$|d" filelist.txt
150+
done
151+
84152
# Change Permissions
85153
chmod -Rf a+rX,u+w,g-w,o-w %{buildroot}/*
86154
exit 0
@@ -107,6 +175,7 @@ exit 0
107175
set -e
108176
chown -R %{name}.%{name} %{config_dir}
109177
chown -R %{name}.%{name} %{log_dir}
178+
110179
# Apply PerformanceAnalyzer Settings
111180
chmod a+rw /tmp
112181
if ! grep -q '## OpenSearch Performance Analyzer' %{config_dir}/jvm.options; then
@@ -152,47 +221,45 @@ if command -v systemctl >/dev/null && systemctl is-active %{name}-performance-an
152221
fi
153222
exit 0
154223

155-
%files
156-
# Permissions
157-
%defattr(-, %{name}, %{name})
224+
%files -f %{_topdir}/filelist.txt
225+
%defattr(640, %{name}, %{name}, 750)
158226

159-
# Root dirs/docs/licenses
160-
%dir %{product_dir}
161227
%doc %{product_dir}/NOTICE.txt
162228
%doc %{product_dir}/README.md
163229
%license %{product_dir}/LICENSE.txt
164230

165-
# Config dirs/files
166-
%dir %{config_dir}
167-
%{config_dir}/jvm.options.d
168-
%{config_dir}/opensearch-*
169-
%config(noreplace) %{config_dir}/opensearch.yml
170-
%config(noreplace) %{config_dir}/jvm.options
171-
%config(noreplace) %{config_dir}/log4j2.properties
172-
%config(noreplace) %{data_dir}/rca_enabled.conf
173-
%config(noreplace) %{data_dir}/performance_analyzer_enabled.conf
174-
175231
# Service files
176232
%attr(0644, root, root) %{_prefix}/lib/systemd/system/%{name}.service
177233
%attr(0644, root, root) %{_prefix}/lib/systemd/system/%{name}-performance-analyzer.service
178234
%attr(0644, root, root) %{_sysconfdir}/init.d/%{name}
179-
%attr(0644, root, root) %config(noreplace) %{_sysconfdir}/sysconfig/%{name}
180235
%attr(0644, root, root) %config(noreplace) %{_prefix}/lib/sysctl.d/%{name}.conf
181236
%attr(0644, root, root) %config(noreplace) %{_prefix}/lib/tmpfiles.d/%{name}.conf
182237

183-
# Main dirs
184-
%{product_dir}/bin
185-
%{product_dir}/jdk
186-
%{product_dir}/lib
187-
%{product_dir}/modules
188-
%{product_dir}/performance-analyzer-rca
189-
%{product_dir}/plugins
190-
%{log_dir}
191-
%{pid_dir}
192-
%dir %{data_dir}
193-
194-
# Wazuh additional files
238+
239+
# Configuration files
240+
%config(noreplace) %attr(0660, root, %{name}) "%{_sysconfdir}/sysconfig/%{name}"
241+
%config(noreplace) %attr(660, %{name}, %{name}) %{config_dir}/log4j2.properties
242+
%config(noreplace) %attr(660, %{name}, %{name}) %{config_dir}/jvm.options
243+
%config(noreplace) %attr(660, %{name}, %{name}) %{config_dir}/opensearch.yml
244+
245+
246+
%if %observability_plugin
247+
%config(noreplace) %attr(660, %{name}, %{name}) %{config_dir}/opensearch-observability/observability.yml
248+
%endif
249+
250+
%if %reportsscheduler_plugin
251+
%config(noreplace) %attr(660, %{name}, %{name}) %{config_dir}/opensearch-reports-scheduler/reports-scheduler.yml
252+
%endif
253+
254+
255+
# Files that need other permissions
195256
%attr(440, %{name}, %{name}) %{product_dir}/VERSION
257+
%attr(740, %{name}, %{name}) %{product_dir}/plugins/opensearch-security/tools/*.sh
258+
%attr(750, %{name}, %{name}) %{product_dir}/bin/*
259+
%attr(750, %{name}, %{name}) %{product_dir}/jdk/bin/*
260+
%attr(750, %{name}, %{name}) %{product_dir}/jdk/lib/jspawnhelper
261+
%attr(750, %{name}, %{name}) %{product_dir}/jdk/lib/modules
262+
%attr(750, %{name}, %{name}) %{product_dir}/performance-analyzer-rca/bin/*
196263
%attr(660, %{name}, %{name}) %{config_dir}/wazuh-template.json
197264

198265
%changelog

‎scripts/assemble.sh

+3
Original file line numberDiff line numberDiff line change
@@ -349,6 +349,9 @@ function assemble_deb() {
349349
remove_unneeded_files
350350
add_wazuh_tools "${version}"
351351

352+
# Configure debmake to only generate binaries
353+
echo 'DEBUILD_DPKG_BUILDPACKAGE_OPTS="-us -uc -ui -b"' >~/.devscripts
354+
352355
# Generate final package
353356
debmake \
354357
--fullname "Wazuh Team" \

0 commit comments

Comments
 (0)