jjkiers/cloudron-box
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

better sudoers configuration check

Browse Source
This commit is contained in:
Girish Ramakrishnan
2023-12-03 16:10:02 +01:00
parent 702de2557e
commit 943325baa3
2 changed files with 28 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
src/test/check-install
View File

@@ -2,31 +2,19 @@
set -eu
readonly SOURCE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
readonly TEST_IMAGE="cloudron/test:25.2.0"
readonly source_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
readonly sudo_scripts_dir="${source_dir}/src/scripts"
if [[ ! -f /usr/bin/node ]]; then
echo "node is not in root user's environment. '/usr/bin/env node' will not work"
exit 1
fi
# reset sudo timestamp to avoid wrong success
sudo -k || sudo --reset-timestamp
# checks if all scripts are sudo access
scripts=("${SOURCE_DIR}/src/scripts/clearvolume.sh" \
"${SOURCE_DIR}/src/scripts/mvvolume.sh" \
"${SOURCE_DIR}/src/scripts/mkdirvolume.sh" \
"${SOURCE_DIR}/src/scripts/rmaddondir.sh" \
"${SOURCE_DIR}/src/scripts/reboot.sh" \
"${SOURCE_DIR}/src/scripts/restart.sh" \
"${SOURCE_DIR}/src/scripts/restartservice.sh" \
"${SOURCE_DIR}/src/scripts/update.sh" \
"${SOURCE_DIR}/src/scripts/du.sh" \
"${SOURCE_DIR}/src/scripts/remotesupport.sh" \
"${SOURCE_DIR}/src/scripts/starttask.sh" \
"${SOURCE_DIR}/src/scripts/stoptask.sh" \
"${SOURCE_DIR}/src/scripts/rmmailbox.sh" \
"${SOURCE_DIR}/src/scripts/setblocklist.sh" \
"${SOURCE_DIR}/src/scripts/setldapallowlist.sh" \
"${SOURCE_DIR}/src/scripts/hdparm.sh" \
"${SOURCE_DIR}/src/scripts/configurelogrotate.sh")
readarray -d '' scripts < <(find ${sudo_scripts_dir} -type f -print0)
declare -a missing_scripts=()
for script in "${scripts[@]}"; do
if [[ $(sudo -n "${script}" --check 2>/dev/null) != "OK" ]]; then
@@ -35,7 +23,7 @@ for script in "${scripts[@]}"; do
done
if [[ ${#missing_scripts[@]} -gt 0 ]]; then
echo "The following script(s) have no sudo access: ${missing_scripts[*]} . Try 'sudo -n ${script[0]} --check'"
echo "The following script(s) have no sudo access: ${missing_scripts[*]} . Try 'sudo -n ${missing_scripts[0]} --check'"
echo -e "\nYou have to add the lines below to /etc/sudoers.d/yellowtent\n\n"
for missing_script in "${missing_scripts[@]}"; do
@@ -47,7 +35,20 @@ if [[ ${#missing_scripts[@]} -gt 0 ]]; then
exit 1
fi
images=$(node -e "const i = require('${SOURCE_DIR}/src/infra_version.js'); console.log(Object.keys(i.images).map(x => i.images[x]).join(' '));")
setenv_scripts=(starttask.sh backupupload.js)
for script in "${setenv_scripts[@]}"; do
if ! grep -q ":SETENV:.*${script}" "/etc/sudoers.d/yellowtent"; then
echo "SETENV missing for ${script} in /etc/sudoers.d/yellowtent"
exit 1
fi
done
if ! grep -q "backupupload.js closefrom_override" "/etc/sudoers.d/yellowtent"; then
echo "backupupload.js needs closefrom_override in /etc/sudoers.d/yellowtent"
exit 1
fi
images=$(node -e "const i = require('${source_dir}/src/infra_version.js'); console.log(Object.keys(i.images).map(x => i.images[x]).join(' '));")
for image in ${images}; do
if ! docker inspect "${image}" >/dev/null 2>/dev/null; then