Security - rc/init scripts

.gitignore

@@ -51,3 +51,4 @@ CmakeLists.txt
 provisioning/osxsierra.legally.ok
 *.gdb_history
 *vgcore.*
+tmpfiles.run.setup 

GNUmakefile

@@ -32,7 +32,8 @@ LDIRT = config.cache config.status config.log files.rpm \
 	autom4te.cache install.manifest install.tmpfiles \
 	debug*.list devel_files libs_files conf_files \
 	base_files.rpm libs_files.rpm devel_files.rpm \
-	perl-pcp*.list* python-pcp*.list* python3-pcp*.list*
+	perl-pcp*.list* python-pcp*.list* python3-pcp*.list* \
+	tmpfiles.run.setup
 LDIRDIRT = pcp-[0-9]*.[0-9]*.[0-9]*  pcp-*-[0-9]*.[0-9]*.[0-9]*
 
 SUBDIRS = vendor src
@@ -45,7 +46,7 @@ default :: default_pcp
 
 pcp : default_pcp
 
-default_pcp : $(CONFIGURE_GENERATED)
+default_pcp : $(CONFIGURE_GENERATED) tmpfiles.run.setup
 	+for d in `echo $(SUBDIRS)`; do \
 	    if test -d "$$d" ; then \
 		echo === $$d ===; \
@@ -77,15 +78,11 @@ ifneq "$(findstring $(TARGET_OS),darwin mingw)" ""
 	$(INSTALL) -m 755 -d $(PCP_MAN_DIR)/man5
 endif
 	$(INSTALL) -m 775 -o $(PCP_USER) -g $(PCP_GROUP) -d $(PCP_TMP_DIR)
-ifeq (, $(filter debian suse, $(PACKAGE_DISTRIBUTION)))
-	# PCP_RUN_DIR usually -> /var/run which may be a temporary filesystem
-	# and lint checks may complain about packages including /var/run/xxx
-	# artifacts ... PCP_RUN_DIR is also conditionally created on the
-	# fly in each before use case, so the inclusion in the package is
-	# sometimes desirable, but not mandatory
-	#
+	# this works if PCP_RUN_DIR is persistent
 	$(INSTALL) -m 775 -o $(PCP_USER) -g $(PCP_GROUP) -d $(PCP_RUN_DIR)
-endif
+	# this works if PCP_RUN_DIR is within a tmpfs that is mounted
+	# empty on re-boot and managed by systemd-tmpfiles(8)
+	$(INSTALL) -m 644 tmpfiles.run.setup /usr/lib/tmpfiles.d/pcp-reboot-init.conf
 	$(INSTALL) -m 755 -d $(PCP_SYSCONFIG_DIR)
 	$(INSTALL) -m 755 -d $(PCP_SYSCONF_DIR)
 	$(INSTALL) -m 755 -d $(PCP_SYSCONF_DIR)/labels
@@ -134,3 +131,6 @@ aclocal.m4:
 pcp.lsm src/include/builddefs src/include/pcp/platform_defs.h: configure pcp.lsm.in src/include/builddefs.in src/include/pcp/platform_defs.h.in
 	@echo Please run ./configure with the appropriate options to generate $@.
 	@false
+
+tmpfiles.run.setup:	tmpfiles.run.setup.in
+	sed -e "s@PCP_RUN_DIR@$(PCP_RUN_DIR)@" -e "s/PCP_USER/$(PCP_USER)/" -e "s/PCP_GROUP/$(PCP_GROUP)/" <tmpfiles.run.setup.in >tmpfiles.run.setup

build/cleanconfigs

@@ -3,15 +3,26 @@
 _clean_configs()
 {
     #
-    # Usage: _clean_configs [-v] new_dir old_dir ...
+    # Usage: _clean_configs [-n|-v] new_dir old_dir ...
     #
     # Across all the files in the new_dir and old_dir args, match
     # names and pick the most recently modified version and leave
     # this (same mode and modification date) in new_dir
     #
-    # -v option is verbose mode for debugging
+    # -n option is show-me for benign debugging
+    # -v option is verbose mode for active debugging
     #
 
+    if [ $# -gt 0 -a X"$1" = "X-n" ]
+    then
+	MKDIR="echo + mkdir "
+	CP="echo + cp "
+	shift
+    else
+	MKDIR=mkdir
+	CP=cp
+    fi
+
     _verbose=false
     if [ $# -gt 0 -a X"$1" = "X-v" ]
     then
@@ -21,15 +32,15 @@ _clean_configs()
 
     if [ $# -lt 2 ]
     then
-	echo >&2 "Usage: _clean_configs [-v] new_dir old_dir ..."
+	echo >&2 "Usage: _clean_configs [-n|-v] new_dir old_dir ..."
 	return
     fi
 
     _new="$1"
     if [ ! -d "$_new" ]
     then
 	$verbose && echo >&2 + mkdir -p "$_new"
-	mkdir -p "$_new"
+	$MKDIR -p "$_new"
     fi
 
     shift
@@ -59,10 +70,10 @@ _clean_configs()
 		    if [ ! -d "$_dest" ]
 		    then
 			$verbose && >&2 echo + mkdir "$_dest"
-			mkdir "$_dest"
+			$MKDIR "$_dest"
 		    fi
 		    $_verbose && echo >&2 + cp -p "$_dir/$_file" "$_new/$_file"
-		    cp -p "$_dir/$_file" "$_new/$_file"
+		    $CP -p "$_dir/$_file" "$_new/$_file"
 		fi
 	    done
 	fi

build/rpm/redhat.spec

@@ -2773,8 +2773,8 @@ semodule -r pcpqa >/dev/null 2>&1 || true
 chown -R pcpqa:pcpqa %{_testsdir} 2>/dev/null
 %if 0%{?rhel}
 %if !%{disable_systemd}
-    systemctl restart pmcd pmlogger >/dev/null 2>&1
-    systemctl enable pmcd pmlogger >/dev/null 2>&1
+    systemctl restart pcp-reboot-init pmcd pmlogger >/dev/null 2>&1
+    systemctl enable pcp-reboot-init pmcd pmlogger >/dev/null 2>&1
 %else
     /sbin/chkconfig --add pmcd >/dev/null 2>&1
     /sbin/chkconfig --add pmlogger >/dev/null 2>&1
@@ -3059,9 +3059,9 @@ if [ "$1" -eq 0 ]
 then
     # stop daemons before erasing the package
     %if !%{disable_systemd}
-       %systemd_preun pmlogger_check.timer pmlogger_daily.timer pmlogger_farm_check.timer pmlogger_farm_check.service pmlogger_farm.service pmlogger.service pmie_check.timer pmie_daily.timer pmie_farm_check.timer pmie_farm_check.service pmie_farm.service pmie.service pmproxy.service pmfind.service pmcd.service
+       %systemd_preun pmlogger_check.timer pmlogger_daily.timer pmlogger_farm_check.timer pmlogger_farm_check.service pmlogger_farm.service pmlogger.service pmie_check.timer pmie_daily.timer pmie_farm_check.timer pmie_farm_check.service pmie_farm.service pmie.service pmproxy.service pmfind.service pmcd.service pcp-reboot-init.service
 
-       systemctl stop pmlogger.service pmie.service pmproxy.service pmfind.service pmcd.service >/dev/null 2>&1
+       systemctl stop pmlogger.service pmie.service pmproxy.service pmfind.service pmcd.service pcp-reboot-init.service >/dev/null 2>&1
     %else
        /sbin/service pmlogger stop >/dev/null 2>&1
        /sbin/service pmie stop >/dev/null 2>&1
@@ -3095,8 +3095,8 @@ done
 %{run_pmieconf "$PCP_PMIECONFIG_DIR" dmthin}
 %if 0%{?rhel}
 %if !%{disable_systemd}
-    systemctl restart pmcd pmlogger pmie >/dev/null 2>&1
-    systemctl enable pmcd pmlogger pmie >/dev/null 2>&1
+    systemctl restart pcp-reboot-init pmcd pmlogger pmie >/dev/null 2>&1
+    systemctl enable pcp-reboot-init pmcd pmlogger pmie >/dev/null 2>&1
 %else
     /sbin/chkconfig --add pmcd >/dev/null 2>&1
     /sbin/chkconfig --add pmlogger >/dev/null 2>&1

build/tar/postinstall.tail

@@ -43,6 +43,7 @@ then
     CHOWN="echo + chown"
     SYSTEMCTL="echo + systemctl"
     RC_UPDATE="echo + rc-update"
+    MAKEWHATIS="echo + makewhatis"
 else
     show_me=false
     RM=rm
@@ -52,6 +53,7 @@ else
     CHOWN=chown
     SYSTEMCTL=systemctl
     RC_UPDATE=rc-update
+    MAKEWHATIS=makewhatis
 fi
 
 _cd()
@@ -310,8 +312,6 @@ done
 
 # directories that may be empty and hence not in the tarball
 #
-# from src/pmcd/GNUmakefile
-_do_dir "root:$grp" 700 "$PCP_TMP_DIR"/pmcd
 # from GNUmakefile
 _do_dir "root:$grp" 755 "$PCP_SYSCONF_DIR"/labels
 _do_dir "root:$grp" 755 "$PCP_SYSCONF_DIR"/labels/optional
@@ -320,6 +320,9 @@ then
     # from src/pmdas/openmetrics
     _do_dir "root:$grp" 755 "$PCP_PMDAS_DIR"/openmetrics/config.d
 fi
+# from src/pmcd/GNUmakefile
+_do_dir "root:$grp" 700 "$PCP_VAR_DIR"/pmcd
+_do_dir "root:$grp" 755 "$PCP_LOG_DIR"/pmcd
 # from src/pmfind/GNUmakefile
 _do_dir "pcp:pcp" 775 "$PCP_LOG_DIR"/pmfind
 _do_dir "root:$grp" 755 "$PCP_SYSCONF_DIR"/pmfind
@@ -348,7 +351,7 @@ done
 # pcp:pcp and mode 775 directories
 #
 for dir in "$PCP_LOG_DIR" \
-	   "$PCP_LOG_DIR"/pmcd "$PCP_LOG_DIR"/pmproxy \
+	   "$PCP_LOG_DIR"/pmproxy \
 	   "$PCP_LOG_DIR"/pmie "$PCP_LOG_DIR"/pmlogger \
 	   "$PCP_SA_DIR" \
 	   "$PCP_RUN_DIR" \
@@ -471,7 +474,7 @@ fi
 if which makewhatis >/dev/null 2>&1
 then
     echo "Rebuilding whatis DB in the background"
-    makewhatis &
+    $MAKEWHATIS &
 fi
 
 # cull any old files or directories that used to be in the distribution

build/tar/preinstall.head.in

@@ -22,14 +22,35 @@ else
     exit
 fi
 
+# -n (show-me) is the only command line option ...
+#
+if [ $# -eq 1 -a X"$1" = X"-n" ]
+then
+    show_me=true
+    RM="echo + rm"
+    MV="echo + mv"
+    MKDIR="echo + mkdir"
+    SYSTEMCTL="echo + systemctl"
+    RC_UPDATE="echo + rc-update"
+    KILL="echo + kill"
+else
+    show_me=false
+    RM=rm
+    MV=mv
+    MKDIR=mkdir
+    SYSTEMCTL=systemctl
+    RC_UPDATE=rc-update
+    KILL=kill
+fi
+
 # The new place ... this should match the setting in /etc/pcp.conf
 # _after_ the installation
 #
 PCP_SYSCONF_DIR=@pcp_sysconf_dir@
 # and same here ...
 #
 PCP_LOG_DIR=@pcp_log_dir@
-[ -d "$PCP_LOG_DIR" ] || mkdir "$PCP_LOG_DIR"
+[ -d "$PCP_LOG_DIR" ] || $MKDIR "$PCP_LOG_DIR"
 
 # and some other things we need ...
 #

build/tar/preinstall.tail

@@ -15,11 +15,16 @@ done
 export PATH
 
 # migrate and clean configs
-echo >>$PCP_LOG_DIR/install.log
-date >>$PCP_LOG_DIR/install.log
+$show_me || echo >>$PCP_LOG_DIR/install.log
+$show_me || date >>$PCP_LOG_DIR/install.log
 for base in pmcd pmie pmlogger pmproxy
 do
-    _clean_configs -v 2>>$PCP_LOG_DIR/install.log $PCP_SYSCONF_DIR/$base /var/lib/pcp/config/$base /etc/$base /etc/pcp/$base /etc/sysconfig/$base
+    if $show_me
+    then
+	_clean_configs -n $PCP_SYSCONF_DIR/$base /var/lib/pcp/config/$base /etc/$base /etc/pcp/$base /etc/sysconfig/$base
+    else
+	_clean_configs -v 2>>$PCP_LOG_DIR/install.log $PCP_SYSCONF_DIR/$base /var/lib/pcp/config/$base /etc/$base /etc/pcp/$base /etc/sysconfig/$base
+    fi
 done
 
 for svc in pmproxy pmie pmlogger pmmgr pmcd pcp 
@@ -33,21 +38,21 @@ do
     #   may have clobbered libpcp.so during the earlier build on this host.
     #
     pids=`_get_pids_by_name -a $svc`
-    [ -n "$pids" ] && kill -TERM $pids
+    [ -n "$pids" ] && $KILL -TERM $pids
     if which systemctl >/dev/null 2>&1
     then
 	if systemctl list-unit-files $svc.service 2>&1 | grep "^$svc.service" >/dev/null
 	then
-	    systemctl stop $svc.service
-	    systemctl disable $svc.service
+	    $SYSTEMCTL stop $svc.service
+	    $SYSTEMCTL disable $svc.service
 	fi
     elif which rc-update >/dev/null 2>&1
     then
 	if rc-update show | grep " $svc " >/dev/null 2>&1
 	then
 	    # service is installed ...
 	    #
-	    rc-update delete $svc
+	    $RC_UPDATE delete $svc
 	fi
     fi
 done
@@ -61,8 +66,8 @@ for conf in \
 do
     if [ -f "$conf" ]
     then
-	rm -f "$conf.pre"
-	mv "$conf" "$conf.pre"
+	$RM -f "$conf.pre"
+	$MV "$conf" "$conf.pre"
     fi
 done
 

debian/libpcp3-dev.install

@@ -38,6 +38,7 @@ usr/share/man/man3/__pmAFunblock.3.gz
 usr/share/man/man3/__pmAFunregister.3.gz
 usr/share/man/man3/__pmAddIPC.3.gz
 usr/share/man/man3/__pmConnectLogger.3.gz
+usr/share/man/man3/__pmCleanMapDir.3.gz
 usr/share/man/man3/__pmControlLog.3.gz
 usr/share/man/man3/__pmConvertHighResTime.3.gz
 usr/share/man/man3/__pmConvertTime.3.gz

debian/pcp.postinst.tail

@@ -4,28 +4,36 @@ then
     _version_configs "$@"
 fi
 
+getent group pcp >/dev/null || groupadd -r pcp
+getent passwd pcp >/dev/null || \
+useradd -c "Performance Co-Pilot" -g pcp -d /var/lib/pcp -M -r -s /usr/sbin/nologin pcp
+
+# must match pmns/GNUmakefile, owned by root:root so $PCP_SYSCONF_DIR/pmcd/rc
+# can remove it once PMNS rebuild is done on first pmcd startup
+#
 touch /var/lib/pcp/pmns/.NeedRebuild
 chmod 644 /var/lib/pcp/pmns/.NeedRebuild
+
+# owned by pcp:pcp so pmlogger_daily can remove it once rewriting
+# is done
+#
 touch /var/log/pcp/pmlogger/.NeedRewrite
+chown pcp:pcp /var/log/pcp/pmlogger/.NeedRewrite
 chmod 644 /var/log/pcp/pmlogger/.NeedRewrite
 
-getent group pcp >/dev/null || groupadd -r pcp
-getent passwd pcp >/dev/null || \
-useradd -c "Performance Co-Pilot" -g pcp -d /var/lib/pcp -M -r -s /usr/sbin/nologin pcp
-
 # must match GNUmakefile
+#
 chown pcp:pcp /var/lib/pcp/config/pmda
 chmod 775 /var/lib/pcp/config/pmda
 chown pcp:pcp /var/lib/pcp/tmp
 chmod 775 /var/lib/pcp/tmp
 chown pcp:pcp /var/log/pcp
 chmod 775 /var/log/pcp
-
-# must match src/pmcd/GNUmakefile
-chown pcp:pcp /var/log/pcp/pmcd
-chmod 775 /var/log/pcp/pmcd
+chown pcp:pcp /var/run/pcp
+chmod 775 /var/run/pcp
 
 # must match src/pmdas/{json,bash,mmv}/GNUmakefile
+#
 for PMDA in bash json mmv; do
     # directory may be in optionally build component, so test first
     #
@@ -37,13 +45,13 @@ for PMDA in bash json mmv; do
 done
 
 # must match src/pmdas/mmv/src/GNUmakefile
-chown pcp:pcp /var/lib/pcp/tmp/mmv
-chmod 775 /var/lib/pcp/tmp/mmv
 # (strange but true, the "pmproxy" pmda is built in the mmv dir)
+#
 chown pcp:pcp /var/lib/pcp/tmp/pmproxy
 chmod 775 /var/lib/pcp/tmp/pmproxy
 
 # must match src/pmie/GNUmakefile
+#
 chown pcp:pcp /var/lib/pcp/config/pmie
 chmod 775 /var/lib/pcp/config/pmie
 chown pcp:pcp /var/lib/pcp/tmp/pmie
@@ -52,6 +60,7 @@ chown pcp:pcp /var/log/pcp/pmie
 chmod 775 /var/log/pcp/pmie
 
 # must match src/pmlogger/GNUmakefile
+#
 chown pcp:pcp /var/lib/pcp/config/pmlogger
 chmod 775 /var/lib/pcp/config/pmlogger
 chown pcp:pcp /var/lib/pcp/tmp/pmlogger
@@ -62,10 +71,12 @@ chown pcp:pcp /var/log/pcp/sa
 chmod 775 /var/log/pcp/sa
 
 # must match src/pmproxy/GNUmakefile
+#
 chown pcp:pcp /var/log/pcp/pmproxy
 chmod 775 /var/log/pcp/pmproxy
 
 # must match src/pmfind/GNUmakefile
+#
 chown pcp:pcp /var/log/pcp/pmfind
 chmod 775 /var/log/pcp/pmfind
 
@@ -96,6 +107,7 @@ fi
 
 if $do_systemd_helper
 then
+    deb-systemd-helper enable pcp-reboot-init.service >/dev/null
     deb-systemd-helper enable pmcd.service >/dev/null
     deb-systemd-helper enable pmlogger.service >/dev/null
     deb-systemd-helper enable pmie.service >/dev/null
@@ -115,6 +127,7 @@ fi
 if $do_systemctl
 then
     systemctl daemon-reload >/dev/null
+    systemctl start pcp-reboot-init.service >/dev/null
     systemctl start pmcd.service >/dev/null
     systemctl start pmlogger.service >/dev/null
 elif which invoke-rc.d >/dev/null 2>&1