Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve ownership and permissions of files in OpenSearch deb and rpm packages #3898

Merged
merged 8 commits into from
Aug 21, 2023
Merged

Improve ownership and permissions of files in OpenSearch deb and rpm packages #3898

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
ca72b98
Do not change shared data permissions
smortex Aug 16, 2023
66d44ad
Restrict access to OpenSearch configuration files
smortex Aug 16, 2023
f5c8cb3
Adjust ownership and permissions of the log directory
smortex Aug 16, 2023
a905357
Adjust permissions of the data directory
smortex Aug 17, 2023
eb0e032
Sync rpm owner/permissions with the deb ones
smortex Aug 17, 2023
ed1636d
Make permisson more explicit
smortex Aug 18, 2023
0b4c277
Restore previous absence of %dir for logs/pid
smortex Aug 18, 2023
71c7c34
Also explicitly remove SGID bit when building .deb
smortex Aug 21, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 9 additions & 3 deletions scripts/pkg/build_templates/opensearch/deb/debian/postinst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,11 +37,17 @@ if ! grep -q '## OpenSearch Performance Analyzer' ${config_dir}/jvm.options; the
echo "--add-opens=jdk.attach/sun.tools.attach=ALL-UNNAMED" >> ${config_dir}/jvm.options
fi

# Set owner
chown -R opensearch.opensearch ${product_dir}
# Set ownership and permissions
peterzhuamazon marked this conversation as resolved.
Show resolved Hide resolved
# FIXME: the opensearch service should not have w permission in the config directory
peterzhuamazon marked this conversation as resolved.
Show resolved Hide resolved
chown -R opensearch.opensearch ${config_dir}
chown -R opensearch.opensearch ${log_dir}
chmod -R u=rwX,g=rX,o= ${config_dir}

chown -R opensearch.adm ${log_dir}
chmod 750 ${log_dir}

chown -R opensearch.opensearch ${data_dir}
chmod 750 ${data_dir}

chown -R opensearch.opensearch ${pid_dir}

# Reload systemctl daemon
Expand Down
2 changes: 1 addition & 1 deletion scripts/pkg/build_templates/opensearch/deb/debmake_opensearch_install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,6 @@ ln -s ${data_dir} ${buildroot}${product_dir}/data
ln -s ${log_dir} ${buildroot}${product_dir}/logs

# Change Permissions
chmod -Rf a+rX,u+w,g-w,o-w ${buildroot}/*
chmod -Rf u=rwX,g=rX,o=rX ${buildroot}/*
peterzhuamazon marked this conversation as resolved.
Show resolved Hide resolved

exit 0
27 changes: 16 additions & 11 deletions scripts/pkg/build_templates/opensearch/rpm/opensearch.rpm.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,8 @@ if [ ! -f %{buildroot}%{data_dir}/performance_analyzer_enabled.conf ]; then
echo 'true' > %{buildroot}%{data_dir}/performance_analyzer_enabled.conf
fi
# Change Permissions
chmod -Rf a+rX,u+w,g-w,o-w %{buildroot}/*
chmod -Rf g-s %{buildroot}/*
chmod -Rf u=rwX,g=rX,o= %{buildroot}/etc
exit 0

%pre
Expand Down Expand Up @@ -150,13 +151,6 @@ exit 0
# Permissions
%defattr(-, %{name}, %{name})

# Root dirs/docs/licenses
%dir %{product_dir}
%doc %{product_dir}/NOTICE.txt
%doc %{product_dir}/README.md
%license %{product_dir}/LICENSE.txt
%{product_dir}/manifest.yml

# Config dirs/files
%dir %{config_dir}
%{config_dir}/jvm.options.d
Expand All @@ -175,16 +169,27 @@ exit 0
%attr(0644, root, root) %config(noreplace) %{_prefix}/lib/sysctl.d/%{name}.conf
%attr(0644, root, root) %config(noreplace) %{_prefix}/lib/tmpfiles.d/%{name}.conf

%dir %attr(750, %{name}, %{name}) %{data_dir}
%dir %attr(750, %{name}, %{name}) %{log_dir}
%dir %attr(750, %{name}, %{name}) %{pid_dir}
peterzhuamazon marked this conversation as resolved.
Show resolved Hide resolved

# Permissions
%defattr(-, root, root)

# Root dirs/docs/licenses
%dir %{product_dir}
peterzhuamazon marked this conversation as resolved.
Show resolved Hide resolved
%doc %{product_dir}/NOTICE.txt
%doc %{product_dir}/README.md
%license %{product_dir}/LICENSE.txt
%{product_dir}/manifest.yml

# Main dirs
%{product_dir}/bin
%{product_dir}/jdk
%{product_dir}/lib
%{product_dir}/modules
%{product_dir}/performance-analyzer-rca
%{product_dir}/plugins
%{log_dir}
%{pid_dir}
%dir %{data_dir}

# Symlinks
%{product_dir}/data
Expand Down