summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authormharmsen <mharmsen@c9f7a03b-bd48-0410-a16d-cbbf54688b0b>2009-12-17 17:11:46 +0000
committermharmsen <mharmsen@c9f7a03b-bd48-0410-a16d-cbbf54688b0b>2009-12-17 17:11:46 +0000
commitdaaee4c591d884a2b85dc3f12dc772ec4abc8a2c (patch)
treed236fd6b10042855ce152bd177405a8aab665f68
parente401d967b4bf5f40784887ab862be588e153a670 (diff)
Bugzilla Bug #529070 - rpm packaging problems (cannot reinstall correctly)
Resolved by implementing a "registry". git-svn-id: svn+ssh://svn.fedorahosted.org/svn/pki/trunk@892 c9f7a03b-bd48-0410-a16d-cbbf54688b0b
Diffstat
-rw-r--r--pki/base/ca/LICENSE20
-rw-r--r--pki/base/ca/build.xml30
-rwxr-xr-xpki/base/ca/setup/postinstall68
-rwxr-xr-xpki/base/ca/shared/etc/init.d/pki-cad (renamed from pki/base/ca/shared/etc/init.d/httpd)863
-rw-r--r--pki/base/common/LICENSE20
-rw-r--r--pki/base/common/build.xml22
-rwxr-xr-xpki/base/common/setup/postinstall56
-rw-r--r--pki/base/config/product.xml1
-rw-r--r--pki/base/selinux/LICENSE20
-rw-r--r--pki/base/setup/LICENSE20
-rwxr-xr-xpki/base/setup/pkicommon16
-rwxr-xr-xpki/base/setup/pkicreate741
-rwxr-xr-xpki/base/setup/pkiremove142
-rw-r--r--pki/base/silent/LICENSE20
-rwxr-xr-xpki/base/silent/templates/subca_silent.template4
15 files changed, 1447 insertions, 596 deletions
diff --git a/pki/base/ca/LICENSE b/pki/base/ca/LICENSE
index e36f2269a..e281f4362 100644
--- a/pki/base/ca/LICENSE
+++ b/pki/base/ca/LICENSE
@@ -11,26 +11,6 @@ You should have received a copy of the GNU General Public License
along with this Program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
-In addition, as a special exception, Red Hat, Inc. gives You the additional
-right to link the code of this Program with code not covered under the GNU
-General Public License ("Non-GPL Code") and to distribute linked combinations
-including the two, subject to the limitations in this paragraph. Non-GPL
-Code permitted under this exception must only link to the code of this
-Program through those well defined interfaces identified in the file named
-EXCEPTION found in the source code files (the "Approved Interfaces").
-
-The files of Non-GPL Code may instantiate templates or use macros or inline
-functions from the Approved Interfaces without causing the resulting work to
-be covered by the GNU General Public License. Only Red Hat, Inc. may make
-changes or additions to the list of Approved Interfaces. You must obey the
-GNU General Public License in all respects for all of the Program code and
-other code used in conjunction with the Program except the Non-GPL Code
-covered by this exception. If you modify this file, you may extend this
-exception to your version of the file, but you are not obligated to do so.
-If you do not wish to provide this exception without modification, you must
-delete this exception statement from your version and license this file
-solely under the GPL without exception.
-
GNU GENERAL PUBLIC LICENSE
Version 2, June 1991
diff --git a/pki/base/ca/build.xml b/pki/base/ca/build.xml
index 8795aeb6c..139e221cb 100644
--- a/pki/base/ca/build.xml
+++ b/pki/base/ca/build.xml
@@ -184,31 +184,30 @@
<zip destfile="${dist.base.binaries}/${dist.name}.zip">
<zipfileset dir="./build/jars"
filemode="755"
- prefix="usr/share/java/${product.prefix}/${product}">
+ prefix="usr/share/java">
<include name="**"/>
</zipfileset>
<zipfileset dir="./setup"
- filemode="755"
- prefix="usr/share/${product.prefix}/${product}/setup">
- <include name="postinstall"/>
- </zipfileset>
- <zipfileset dir="./setup"
filemode="644"
prefix="usr/share/${product.prefix}/${product}/setup">
<include name="config.desktop"/>
</zipfileset>
+ <zipfileset dir="./shared/etc/init.d"
+ filemode="755"
+ prefix="etc/${init.d}">
+ <include name="pki-cad"/>
+ </zipfileset>
<zipfileset dir="./shared"
filemode="755"
prefix="usr/share/${product.prefix}/${product}">
<include name="conf/dtomcat5"/>
- <include name="etc/init.d/httpd"/>
</zipfileset>
<zipfileset dir="./shared"
filemode="644"
prefix="usr/share/${product.prefix}/${product}">
<include name="**"/>
<exclude name="conf/dtomcat5"/>
- <exclude name="etc/init.d/httpd"/>
+ <exclude name="etc/init.d/pki-cad"/>
</zipfileset>
<zipfileset dir="."
filemode="644"
@@ -224,31 +223,30 @@
destfile="${dist.base.binaries}/${dist.name}.tar">
<tarfileset dir="./build/jars"
mode="755"
- prefix="${dist.name}/usr/share/java/${product.prefix}/${product}">
+ prefix="${dist.name}/usr/share/java">
<include name="**"/>
</tarfileset>
<tarfileset dir="./setup"
- mode="755"
- prefix="${dist.name}/usr/share/${product.prefix}/${product}/setup">
- <include name="postinstall"/>
- </tarfileset>
- <tarfileset dir="./setup"
mode="644"
prefix="${dist.name}/usr/share/${product.prefix}/${product}/setup">
<include name="config.desktop"/>
</tarfileset>
+ <tarfileset dir="./shared/etc/init.d"
+ mode="755"
+ prefix="${dist.name}/etc/${init.d}">
+ <include name="pki-cad"/>
+ </tarfileset>
<tarfileset dir="./shared"
mode="755"
prefix="${dist.name}/usr/share/${product.prefix}/${product}">
<include name="conf/dtomcat5"/>
- <include name="etc/init.d/httpd"/>
</tarfileset>
<tarfileset dir="./shared"
mode="644"
prefix="${dist.name}/usr/share/${product.prefix}/${product}">
<include name="**"/>
<exclude name="conf/dtomcat5"/>
- <exclude name="etc/init.d/httpd"/>
+ <exclude name="etc/init.d/pki-cad"/>
</tarfileset>
<tarfileset dir="."
mode="644"
diff --git a/pki/base/ca/setup/postinstall b/pki/base/ca/setup/postinstall
deleted file mode 100755
index 055a6568a..000000000
--- a/pki/base/ca/setup/postinstall
+++ /dev/null
@@ -1,68 +0,0 @@
-#!/bin/bash
-#
-# --- BEGIN COPYRIGHT BLOCK ---
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; version 2 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Copyright (C) 2007 Red Hat, Inc.
-# All rights reserved.
-# --- END COPYRIGHT BLOCK ---
-#
-
-###############################################################################
-## (1) Check command line arguments to see how many were passed in. ##
-###############################################################################
-
-if [ $# -eq 4 ]
-then
- PKI_PRODUCT_NAME=$1
- PKI_SUBSYSTEM_NAME=$2
- VERSION=$3
- RELEASE=$4
-else
- echo
- echo "Usage: $0 PKI_product_name PKI_subsystem_name version release"
- echo
-
- exit 255
-fi
-
-
-###############################################################################
-## (2) Specify variables used by this script. ##
-###############################################################################
-
-PKI_INSTANCE_NAME="${PKI_PRODUCT_NAME}-${PKI_SUBSYSTEM_NAME}"
-AGENT_SECURE_PORT=9443
-EE_SECURE_PORT=9444
-ADMIN_SECURE_PORT=9445
-UNSECURE_PORT=9180
-TOMCAT_SERVER_PORT=9701
-
-
-###############################################################################
-## (3) Create the first instance of a Certificate Authority (CA). ##
-###############################################################################
-
-if [ ! -e "/var/lib/${PKI_INSTANCE_NAME}" ]
-then
- /usr/bin/pkicreate -pki_instance_root=/var/lib -pki_instance_name=${PKI_INSTANCE_NAME} -subsystem_type=${PKI_SUBSYSTEM_NAME} -agent_secure_port=${AGENT_SECURE_PORT} -ee_secure_port=${EE_SECURE_PORT} -admin_secure_port=${ADMIN_SECURE_PORT} -unsecure_port=${UNSECURE_PORT} -tomcat_server_port=${TOMCAT_SERVER_PORT} -redirect conf=/etc/${PKI_INSTANCE_NAME} -redirect logs=/var/log/${PKI_INSTANCE_NAME}
-fi
-
-
-###############################################################################
-## (4) Successfully exit from this postinstallation script. ##
-###############################################################################
-
-exit 0
-
diff --git a/pki/base/ca/shared/etc/init.d/httpd b/pki/base/ca/shared/etc/init.d/pki-cad
index 6183fe792..be68eed2e 100755
--- a/pki/base/ca/shared/etc/init.d/httpd
+++ b/pki/base/ca/shared/etc/init.d/pki-cad
@@ -18,14 +18,14 @@
# All rights reserved.
# --- END COPYRIGHT BLOCK ### ---
#
-# [PKI_INSTANCE_ID] Startup script for Tomcat 5.0, the Apache Servlet Engine
+# pki-cad Startup script for Tomcat 5.0 pki-ca, the Apache Servlet Engine
#
# chkconfig: - 81 19
# description: Certificate Authority \
# (Tomcat 5.0)
-# processname: [PKI_INSTANCE_ID]
-# pidfile: /var/run/[PKI_INSTANCE_ID].pid
-# config: [PKI_INSTANCE_PATH]/conf/tomcat5.conf
+# processname: pki-cad
+# piddir: /var/run/pki/ca
+# config: ${PKI_INSTANCE_PATH}/conf/tomcat5.conf
#
# Gomez Henri <hgomez@users.sourceforge.net>
# Keith Irwin <keith_irwin@non.hp.com>
@@ -60,23 +60,70 @@
# version 1.20tc5rh - Changed TOMCAT_USER from tomcat4 to tomcat
#
+PKI_INIT_SCRIPT=""
+PKI_PATH="/usr/share/pki/ca"
+PKI_PIDDIR="/var/run/pki/ca"
+PKI_PROCESS="pki-cad"
+PKI_REGISTRY="/etc/sysconfig/pki/ca"
+PKI_TYPE="pki-ca"
+
+# PKI subsystem-level directory and file values for locks
+lockfile="/var/lock/subsys/pki-cad"
+
# Disallow 'others' the ability to 'write' to new files
umask 00002
+default_error=0
+command="$1"
+pki_instance="$2"
+case "${command}" in
+ start|stop|restart|condrestart|force-restart|try-restart)
+ # * 1 generic or unspecified error (current practice)
+ default_error=1
+ ;;
+ reload)
+ default_error=3
+ ;;
+ status)
+ # * 4 program or service status is unknown
+ default_error=4
+ ;;
+ *)
+ # * 2 invalid argument(s)
+ default_error=2
+ ;;
+esac
+
# Check to insure that this script's original invocation directory
# has not been deleted!
CWD=`/bin/pwd > /dev/null 2>&1`
if [ $? -ne 0 ] ; then
echo "Cannot invoke '$0' from non-existent directory!"
- exit 255
+ exit ${default_error}
fi
# Check to insure that this script's associated PKI
# subsystem currently resides on this system.
-PKI_SUBSYSTEM_TYPE=[PKI_SUBSYSTEM_TYPE]
-if [ ! -d /usr/share/pki/${PKI_SUBSYSTEM_TYPE} ] ; then
- echo "This machine is missing the '${PKI_SUBSYSTEM_TYPE}' subsystem!"
- exit 255
+if [ ! -d ${PKI_PATH} ] ; then
+ echo "This machine is missing the '${PKI_TYPE}' subsystem!"
+ if [ "${command}" != "status" ]; then
+ # * 5 program is not installed
+ exit 5
+ else
+ exit ${default_error}
+ fi
+fi
+
+# Check to insure that this script's associated PKI
+# subsystem instance registry currently resides on this system.
+if [ ! -d ${PKI_REGISTRY} ] ; then
+ echo "This machine contains no registered '${PKI_TYPE}' subsystem instances!"
+ if [ "${command}" != "status" ]; then
+ # * 5 program is not installed
+ exit 5
+ else
+ exit ${default_error}
+ fi
fi
# Obtain the operating system upon which this script is being executed
@@ -86,15 +133,29 @@ ARCHITECTURE=""
# This script must be run as root!
RV=0
if [ ${OS} = "Linux" ] ; then
+ PKI_INIT_SCRIPT="/sbin/service ${PKI_PROCESS}"
if [ `id -u` -ne 0 ] ; then
echo "Must be 'root' to execute '$0'!"
- exit 1
+ if [ "${command}" != "status" ]; then
+ # * 4 user had insufficient privilege
+ exit 4
+ else
+ # * 4 program or service status is unknown
+ exit 4
+ fi
fi
ARCHITECTURE=`uname -i`
elif [ ${OS} = "SunOS" ] ; then
+ PKI_INIT_SCRIPT="/etc/init.d/${PKI_PROCESS}"
if [ `/usr/xpg4/bin/id -u` -ne 0 ] ; then
echo "Must be 'root' to execute '$0'!"
- exit 1
+ if [ "${command}" != "status" ]; then
+ # * 4 user had insufficient privilege
+ exit 4
+ else
+ # * 4 program or service status is unknown
+ exit 4
+ fi
fi
ARCHITECTURE=`uname -p`
if [ "${ARCHITECTURE}" = "sparc" ] &&
@@ -103,7 +164,7 @@ elif [ ${OS} = "SunOS" ] ; then
fi
else
echo "Unsupported OS '${OS}'!"
- exit 1
+ exit ${default_error}
fi
# Source function library.
@@ -120,25 +181,32 @@ else
for i in $* ; do
ps -p $i > /dev/null 2>&1 ;
if [ $? -ne 0 ] ; then
- rv=`expr $rv + 1`
+ rv=`expr ${rv} + 1`
else
- rv=`expr $rv + 0`
+ rv=`expr ${rv} + 0`
fi
done
- # echo "rv=$rv"
- return $rv
+ # echo "rv=${rv}"
+ return ${rv}
}
# Create the following directories on platforms
# where they do not exist (e. g. - Solaris) . . .
- if [ ! -d /var/lock/subsys ] ; then
+ if [ ! -d "/var/lock" ] ; then
+ mkdir -p /var/lock
+ chown root:sys /var/lock
+ chmod 00755 /var/lock
+ fi
+ if [ ! -d "/var/lock/subsys" ] ; then
mkdir -p /var/lock/subsys
+ chown root:root /var/lock/subsys
+ chmod 00755 /var/lock/subsys
fi
#######################################################################
## NOTE: The following code needs to eventually be moved into the ##
## template used to create the ##
- ## "[PKI_INSTANCE_PATH]/conf/tomcat5.conf" file! ##
+ ## "${PKI_INSTANCE_PATH}/conf/tomcat5.conf" file! ##
#######################################################################
if [ ${OS} = "SunOS" ] ; then
@@ -162,53 +230,129 @@ else
echo -n "at \"${DEFAULT_SOLARIS_JAVA_HOME}\"!"
echo
echo
- exit 255
+ exit ${default_error}
fi
fi
fi
-#Use CATALINA_BASE
-
-CATALINA_BASE=[PKI_INSTANCE_PATH]
-export CATALINA_BASE
+PKI_REGISTRY_ENTRIES=""
+TOTAL_PKI_REGISTRY_ENTRIES=0
+TOTAL_UNCONFIGURED_PKI_ENTRIES=0
-# Get Tomcat config
+# Gather ALL registered instances of this PKI subsystem type
+for FILE in `/bin/ls -1 ${PKI_REGISTRY}/* 2>/dev/null`; do
+ if [ -f "$FILE" ] ; then
+ inst=`echo "$FILE"`
+ PKI_REGISTRY_ENTRIES="${PKI_REGISTRY_ENTRIES} $inst"
+ TOTAL_PKI_REGISTRY_ENTRIES=`expr ${TOTAL_PKI_REGISTRY_ENTRIES} + 1`
+ fi
+done
-TOMCAT_CFG="[PKI_INSTANCE_PATH]/conf/tomcat5.conf"
+if [ -n "${pki_instance}" ]; then
+ for I in ${PKI_REGISTRY_ENTRIES}; do
+ if [ "${PKI_REGISTRY}/${pki_instance}" = "$I" ]; then
+ PKI_REGISTRY_ENTRIES="${PKI_REGISTRY}/${pki_instance}"
+ TOTAL_PKI_REGISTRY_ENTRIES=1
+ break
+ fi
+ done
+fi
-[ -r "$TOMCAT_CFG" ] && . "${TOMCAT_CFG}"
+usage()
+{
+ echo -n "Usage: ${PKI_INIT_SCRIPT} "
+ echo -n "{start"
+ echo -n "|stop"
+ echo -n "|restart"
+ echo -n "|condrestart"
+ echo -n "|force-restart"
+ echo -n "|try-restart"
+ echo -n "|reload"
+ echo -n "|status} "
+ echo -n "[instance-name]"
+ echo
+ echo
+}
-# Path to the tomcat launch script (direct don't use wrapper)
-TOMCAT_SCRIPT=/usr/bin/dtomcat5-[PKI_INSTANCE_ID]
+list_instances()
+{
+ echo
+ for FILE in `/bin/ls -1 ${PKI_REGISTRY}/* 2>/dev/null`; do
+ echo " ${FILE}"
+ done
+ echo
+}
-# Path to the script that will refresh jar symlinks on startup
-if [ ${OS} = "Linux" ] ; then
- TOMCAT_RELINK_SCRIPT="/usr/share/tomcat5/bin/relink"
+# Check arguments
+if [ $# -lt 1 ] ; then
+ # * 3 unimplemented feature (for example, "reload")
+ # [insufficient arguments]
+ echo "$0: Insufficient arguments!"
+ echo
+ usage
+ echo "where valid instance names include:"
+ list_instances
+ exit 3
+elif [ ${default_error} -eq 2 ] ; then
+ # * 2 invalid argument
+ echo "$0: Invalid arguments!"
+ echo
+ usage
+ echo "where valid instance names include:"
+ list_instances
+ exit 2
+elif [ $# -gt 2 ] ; then
+ echo "$0: Excess arguments!"
+ echo
+ usage
+ echo "where valid instance names include:"
+ list_instances
+ if [ "${command}" != "status" ]; then
+ # * 2 excess arguments
+ exit 2
+ else
+ # * 4 program or service status is unknown
+ exit 4
+ fi
fi
-# Tomcat name :)
-TOMCAT_PROG=[PKI_INSTANCE_ID]
-
-# if TOMCAT_USER is not set, use tomcat5 like Apache HTTP server
-if [ -z "$TOMCAT_USER" ]; then
- TOMCAT_USER="[PKI_USER]"
+# If an "instance" was supplied, check that it is a "valid" instance
+if [ -n "${pki_instance}" ]; then
+ if [ "${PKI_REGISTRY}/${pki_instance}" != "${PKI_REGISTRY_ENTRIES}" ]; then
+ echo -n "${pki_instance} is an invalid '${PKI_TYPE}' instance"
+ echo_failure
+ echo
+ if [ "${command}" != "status" ]; then
+ # * 5 program is not installed
+ exit 5
+ else
+ # * 4 program or service status is unknown
+ exit 4
+ fi
+ fi
fi
-# if TOMCAT_GROUP is not set, use tomcat5 like Apache HTTP server
-if [ -z "$TOMCAT_GROUP" ]; then
- TOMCAT_GROUP="[PKI_GROUP]"
-fi
+# On Solaris /var/run is in tmpfs and gets wiped out upon reboot
+# we have to recreate the ${PKI_PIDDIR} directory and make sure that
+# the directory is writable by the ${PKI_TYPE} server process.
+#
+# IMPORTANT: ALL PKI subsystems installed on this machine MUST utilize
+# the SAME values for ${PKI_GROUP} and ${PKI_USER}, since the
+# "${PKI_PIDDIR}" will end up with the ownership permissions
+# of the first instance that executes this function!
+#
+fix_pid_dir_ownership()
+{
+ if [ ! -d ${PKI_PIDDIR} ] ; then
+ mkdir -p ${PKI_PIDDIR}
-# Since the daemon function will sandbox $tomcat
-# no environment stuff should be defined here anymore.
-# Please use the [PKI_INSTANCE_PATH]/conf/tomcat5.conf
-# file instead ; it will be read by the $tomcat script
+ chown root:root /var/run/pki
+ chmod 00755 /var/run/pki
-pidfile=${PIDFILE:-/var/run/[PKI_INSTANCE_ID].pid}
-lockfile=${LOCKFILE:-/var/lock/subsys/[PKI_INSTANCE_ID]}
-pki_instance_configuration_file=[PKI_INSTANCE_PATH]/conf/CS.cfg
-RESTART_SERVER=[PKI_INSTANCE_PATH]/conf/restart_server_after_configuration
-RETVAL=0
+ chown root:root ${PKI_PIDDIR}
+ chmod 00755 ${PKI_PIDDIR}
+ fi
+}
check_pki_configuration_status()
{
@@ -219,11 +363,27 @@ check_pki_configuration_status()
rv=`expr ${rv} + 0`
if [ ${rv} -ne 0 ] ; then
- echo " '[PKI_INSTANCE_ID]' must still be CONFIGURED!"
- echo " (see /var/log/[PKI_INSTANCE_ID]-install.log)"
+ echo " '${PKI_INSTANCE_ID}' must still be CONFIGURED!"
+ echo " (see /var/log/${PKI_INSTANCE_ID}-install.log)"
+ if [ "${command}" != "status" ]; then
+ # * 6 program is not configured
+ rv=6
+ else
+ # * 4 program or service status is unknown
+ rv=4
+ fi
+ TOTAL_UNCONFIGURED_PKI_ENTRIES=`expr ${TOTAL_UNCONFIGURED_PKI_ENTRIES} + 1`
elif [ -f ${RESTART_SERVER} ] ; then
- echo " Although '[PKI_INSTANCE_ID]' has been CONFIGURED, it must still be RESTARTED!"
- rv=255
+ echo -n " Although '${PKI_INSTANCE_ID}' has been CONFIGURED, "
+ echo -n "it must still be RESTARTED!"
+ echo
+ if [ "${command}" != "status" ]; then
+ # * 1 generic or unspecified error (current practice)
+ rv=1
+ else
+ # * 4 program or service status is unknown
+ rv=4
+ fi
fi
return ${rv}
@@ -246,14 +406,14 @@ get_pki_status_definitions()
pki_status_comment_found=0
# first check to see that an instance-specific "server.xml" file exists
- if [ ! -f [PKI_SERVER_XML_CONF] ] ; then
- echo "File '[PKI_SERVER_XML_CONF]' does not exist!"
- exit 255
+ if [ ! -f ${PKI_SERVER_XML_CONF} ] ; then
+ echo "File '${PKI_SERVER_XML_CONF}' does not exist!"
+ exit ${default_error}
fi
# read this instance-specific "server.xml" file line-by-line
# to obtain the current PKI Status Definitions
- exec < [PKI_SERVER_XML_CONF]
+ exec < ${PKI_SERVER_XML_CONF}
while read line; do
# first look for the well-known end PKI Status comment
# (to turn off processing)
@@ -283,12 +443,12 @@ get_pki_status_definitions()
total_ports=`expr ${total_ports} + 1`
fi
fi
- done
+ done
if [ ${total_ports} -eq 6 ] ; then
return 0
else
- return 255
+ return ${default_error}
fi
}
@@ -305,14 +465,14 @@ get_pki_configuration_definitions()
[ "${pki_subsystem}" != "RA" ] &&
[ "${pki_subsystem}" != "TPS" ]
then
- return 255
+ return ${default_error}
fi
if [ "${pki_subsystem}" == "KRA" ] ; then
# Rename "KRA" to "DRM"
pki_subsystem="DRM"
fi
else
- return 255
+ return ${default_error}
fi
# If "${pki_subsystem}" is a CA, DRM, OCSP, or TKS,
@@ -331,7 +491,7 @@ get_pki_configuration_definitions()
pki_clone=""
fi
else
- return 255
+ return ${default_error}
fi
fi
@@ -345,7 +505,7 @@ get_pki_configuration_definitions()
if [ "${line}" != "" ] ; then
pki_hierarchy=`echo "${line}" | cut -b18-`
else
- return 255
+ return ${default_error}
fi
fi
@@ -364,7 +524,7 @@ get_pki_configuration_definitions()
pki_security_domain=""
fi
else
- return 255
+ return ${default_error}
fi
fi
@@ -378,25 +538,25 @@ get_pki_configuration_definitions()
if [ "${line}" != "" ] ; then
pki_security_domain_name=`echo "${line}" | cut -b21-`
else
- return 255
+ return ${default_error}
fi
line=`grep ^securitydomain.host= ${pki_instance_configuration_file}`
if [ "${line}" != "" ] ; then
pki_security_domain_hostname=`echo "${line}" | cut -b21-`
else
- return 255
+ return ${default_error}
fi
line=`grep ^securitydomain.httpsadminport= ${pki_instance_configuration_file}`
if [ "${line}" != "" ] ; then
pki_security_domain_https_admin_port=`echo "${line}" | cut -b31-`
else
- return 255
+ return ${default_error}
fi
# Compose the "PKI Instance Name" Status Line
- pki_instance_name="PKI Instance Name: [PKI_INSTANCE_ID]"
+ pki_instance_name="PKI Instance Name: ${PKI_INSTANCE_ID}"
# Compose the "PKI Subsystem Type" Status Line
header="PKI Subsystem Type: "
@@ -456,7 +616,7 @@ get_pki_configuration_definitions()
then
data="https://${pki_security_domain_hostname}:${pki_security_domain_https_admin_port}"
else
- return 255
+ return ${default_error}
fi
registered_pki_security_domain_url="${header} ${data}"
@@ -490,14 +650,14 @@ get_pki_secure_port()
ssl_comment_found=0
# first check to see that an instance-specific "server.xml" file exists
- if [ ! -f [PKI_SERVER_XML_CONF] ] ; then
- echo "File '[PKI_SERVER_XML_CONF]' does not exist!"
- exit 255
+ if [ ! -f ${PKI_SERVER_XML_CONF} ] ; then
+ echo "File '${PKI_SERVER_XML_CONF}' does not exist!"
+ exit ${default_error}
fi
# read this instance-specific "server.xml" file line-by-line
# to obtain the current value of the PKI secure port
- exec < [PKI_SERVER_XML_CONF]
+ exec < ${PKI_SERVER_XML_CONF}
while read line; do
# first look for the well-known end SSL comment
# (to turn off processing)
@@ -530,48 +690,177 @@ get_pki_secure_port()
fi
fi
fi
- done
+ done
- return 255
+ return ${default_error}
}
-start()
+display_instance_status()
+{
+ rv=0
+
+ if [ -f ${pidfile} ] ; then
+ pid=`cat ${pidfile}`
+ if [ "${pid}" == "" ] ; then
+ echo "${PKI_INSTANCE_ID} pid file exists but is empty"
+ if [ "${command}" != "status" ]; then
+ # * 1 generic or unspecified error (current practice)
+ rv=1
+ else
+ # * 4 program or service status is unknown
+ rv=4
+ fi
+ elif kill -0 ${pid} > /dev/null 2>&1 ; then
+ echo "${PKI_INSTANCE_ID} (pid ${pid}) is running ..."
+ echo
+ check_pki_configuration_status
+ rv=$?
+ if [ ${rv} -eq 0 ] ; then
+ get_pki_status_definitions
+ rv=$?
+ if [ ${rv} -ne 0 ] ; then
+ echo
+ echo "${PKI_INSTANCE_ID} Status Definitions not found"
+ else
+ get_pki_configuration_definitions
+ rv=$?
+ if [ ${rv} -ne 0 ] ; then
+ echo
+ echo "${PKI_INSTANCE_ID} Configuration Definitions not found"
+ fi
+ fi
+ else
+ # From the PKI point of view for a "non-status" action,
+ # a returned error code of "6" implies that the program
+ # is not "configured". Similarly, an error code of "1"
+ # implies that the program was "configured" but must
+ # still be restarted.
+ #
+ # Similarly, from the PKI point of view for a "status"
+ # action, a returned error code of "4" implies that either
+ # the program is not "configured", or that the program
+ # was "configured" but must still be restarted.
+ #
+ # Regardless, it must still be considered that the instance
+ # is "running" from the viewpoint of other OS programs such
+ # as 'chkconfig'.
+ #
+ # For this reason, when returning from
+ # 'display_instance_status()', ignore non-zero return codes
+ # returned from 'check_pki_configuration_status()'.
+ #
+ if [ "${command}" != "status" ]; then
+ # * 0 action was successful
+ rv=0
+ else
+ # * 0 program is running or service is OK
+ rv=0
+ fi
+ fi
+ echo
+ else
+ echo "${PKI_INSTANCE_ID} is dead but pid file exists"
+ if [ "${command}" != "status" ]; then
+ # * 1 generic or unspecified error (current practice)
+ rv=1
+ else
+ # * 1 program is dead and /var/run pid file exists
+ rv=1
+ fi
+ fi
+ else
+ echo "${PKI_INSTANCE_ID} is stopped"
+ if [ "${command}" != "status" ]; then
+ # * 7 program is not running
+ rv=7
+ else
+ # * 3 program is not running
+ rv=3
+ fi
+ fi
+
+ return ${rv}
+}
+
+start_instance()
{
+ rv=0
+
echo -n "Starting $TOMCAT_PROG: "
if [ -f ${RESTART_SERVER} ] ; then
rm -f ${RESTART_SERVER}
fi
- if [ -f ${lockfile} ] ; then
+ if [ -f ${PKI_LOCKFILE} ] ; then
if [ -f ${pidfile} ]; then
read kpid < ${pidfile}
if checkpid $kpid 2>&1; then
echo
- echo "process already running"
- return 255
+ echo "${PKI_INSTANCE_ID} (pid ${kpid}) is already running ..."
+ echo
+ check_pki_configuration_status
+ rv=$?
+ if [ ${rv} != 0 ]; then
+ # From the PKI point of view for a "non-status" action,
+ # a returned error code of "6" implies that the program
+ # is not "configured". Similarly, an error code of "1"
+ # implies that the program was "configured" but must
+ # still be restarted.
+ #
+ # Regardless, it must still be considered that the instance
+ # is "running" from the viewpoint of other OS programs such
+ # as 'chkconfig'.
+ #
+ # For "non-status" actions, ignore return codes of "1"
+ # from 'check_pki_configuration_status()'.
+ #
+ # However, for "non-status" actions that have a return
+ # code of "6", return this value unchanged to
+ # the calling routine so that the total number of
+ # configuration errors may be counted.
+ #
+
+ echo
+ if [ ${rv} = 1 ] ; then
+ # * 0 action was successful
+ return 0
+ elif [ ${rv} = 6 ] ; then
+ # * 6 program is not configured
+ return 6
+ else
+ # should never be reached
+ return ${rv}
+ fi
+ else
+ return 0
+ fi
else
echo
echo -n "lock file found but no process "
echo -n "running for pid $kpid, continuing"
echo
echo
+ rm -f ${PKI_LOCKFILE}
fi
fi
fi
+ fix_pid_dir_ownership
+
CATALINA_PID=${pidfile}
export CATALINA_PID
touch $CATALINA_PID
chown $TOMCAT_USER:$TOMCAT_GROUP $CATALINA_PID
- [ -x /sbin/restorecon ] && /sbin/restorecon $CATALINA_PID
+ chmod 00600 $CATALINA_PID
+ [ -x /sbin/restorecon ] && /sbin/restorecon $CATALINA_PID
- # restore context for ncipher hsm
- [ -x /sbin/restorecon ] && [ -d /dev/nfast ] && /sbin/restorecon -R /dev/nfast
+ # restore context for ncipher hsm
+ [ -x /sbin/restorecon ] && [ -d /dev/nfast ] && /sbin/restorecon -R /dev/nfast
# Always initialize CLASSPATH to start looking
# in the local PKI classes directory . . .
- CLASSPATH=/usr/share/[PKI_FLAVOR]/classes
+ CLASSPATH=/usr/share/pki/classes
if [ ${OS} = "Linux" ] ; then
$TOMCAT_RELINK_SCRIPT
@@ -790,7 +1079,7 @@ start()
if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]pop3\-1.3.1.jar ]; then
ln -s /usr/share/java/javamail/pop3-1.3.1.jar [javamail]pop3-1.3.1.jar
fi
- if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]pop3.jar ]; then
+ if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]pop3.jar ]; then
ln -s /usr/share/java/javamail/pop3.jar [javamail]pop3.jar
fi
if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]providers\-1.3.1.jar ]; then
@@ -1053,17 +1342,21 @@ start()
cd /var/lib/tomcat5/shared/lib
fi
- # daemon --user $TOMCAT_USER $TOMCAT_SCRIPT start
+ # daemon --user $TOMCAT_USER $TOMCAT_SCRIPT start
if [ ${OS} = "SunOS" ] ; then
su $TOMCAT_USER -c "$TOMCAT_SCRIPT start" > /dev/null
- else
+ else
runuser -s /bin/bash $TOMCAT_USER -c "$TOMCAT_SCRIPT start" > /dev/null
fi
- RETVAL=$?
- [ $RETVAL = 0 ] && touch ${lockfile}
+ rv=$?
+ if [ ${rv} = 0 ] ; then
+ touch ${PKI_LOCKFILE}
+ chown $TOMCAT_USER:$TOMCAT_GROUP $PKI_LOCKFILE
+ chmod 00600 $PKI_LOCKFILE
+ fi
- if [ $RETVAL = 0 ] ; then
+ if [ ${rv} = 0 ] ; then
count=0;
let swait=$STARTUP_WAIT
@@ -1090,12 +1383,13 @@ start()
PKI_SECURE_PORT="<Port Undefined>"
fi
+ # ignore "status" return codes
echo
- status
+ display_instance_status
else
if [ -f /etc/init.d/functions ]; then
if [ "$CONSOLETYPE" = "serial" ]; then
- echo -n " "
+ $0 echo -n " "
fi
echo_failure
echo
@@ -1105,27 +1399,29 @@ start()
fi
sleep 5
- return $RETVAL
+ return ${rv}
}
-stop()
+stop_instance()
{
+ rv=0
+
echo -n "Stopping $TOMCAT_PROG: "
- if [ -f ${lockfile} ] ; then
+ if [ -f ${PKI_LOCKFILE} ] ; then
CATALINA_PID=${pidfile}
export CATALINA_PID
# daemon --user $TOMCAT_USER $TOMCAT_SCRIPT stop
if [ ${OS} = "SunOS" ] ; then
su $TOMCAT_USER -c "$TOMCAT_SCRIPT stop" > /dev/null
- else
+ else
runuser -s /bin/bash $TOMCAT_USER -c "$TOMCAT_SCRIPT stop" > /dev/null
fi
- RETVAL=$?
+ rv=$?
- if [ $RETVAL = 0 ]; then
+ if [ ${rv} = 0 ]; then
count=0;
if [ -f ${pidfile} ]; then
@@ -1145,7 +1441,7 @@ stop()
fi
fi
- rm -f ${lockfile}
+ rm -f ${PKI_LOCKFILE}
rm -f ${pidfile}
if [ -f /etc/init.d/functions ]; then
@@ -1167,75 +1463,346 @@ stop()
else
echo " [ FAILED ]"
fi
+ rv=${default_error}
fi
else
echo
echo "process already stopped"
+ rv=0
fi
+
+ return ${rv}
}
-status()
+start()
{
- if [ -f ${pidfile} ] ; then
- pid=`cat ${pidfile}`
- if [ "${pid}" == "" ] ; then
- echo "[PKI_INSTANCE_ID] pid file exists but is empty"
- elif kill -0 ${pid} > /dev/null 2>&1 ; then
- echo "[PKI_INSTANCE_ID] (pid ${pid}) is running ..."
+ # From "http://fedoraproject.org/wiki/FCNewInit/Initscripts":
+ #
+ # * 0 action was successful
+ # * 1 generic or unspecified error (current practice)
+ # * 2 invalid or excess argument(s)
+ # * 3 unimplemented feature (for example, "reload")
+ # * 4 user had insufficient privilege
+ # * 5 program is not installed
+ # * 6 program is not configured
+ # * 7 program is not running
+ # * 8-99 reserved for future LSB use
+ # * 100-149 reserved for distribution use
+ # * 150-199 reserved for application use
+ # * 200-254 reserved
+ #
+
+ error_rv=0
+ rv=0
+
+ if [ -n "${PKI_REGISTRY_ENTRIES}" ]; then
+ config_errors=0
+ errors=0
+
+ if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
+ echo "BEGIN STARTING '${PKI_TYPE}' INSTANCE(S):"
+ fi
+
+ # Start every PKI instance of this type that isn't already running
+ for PKI_REGISTRY_ENTRY in ${PKI_REGISTRY_ENTRIES}; do
+ # Source values associated with this particular PKI instance
+ [ -f ${PKI_REGISTRY_ENTRY} ] &&
+ . ${PKI_REGISTRY_ENTRY}
+
+ pidfile=${PKI_PIDDIR}/${PKI_PIDFILE}
+
+ [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] && echo
+
+ start_instance
+
+ rv=$?
+ if [ ${rv} = 6 ] ; then
+ # Since at least ONE configuration error exists, then there
+ # is at least ONE unconfigured instance from the PKI point
+ # of view.
+ #
+ # However, it must still be considered that the
+ # instance is "running" from the point of view of other
+ # OS programs such as 'chkconfig'.
+ #
+ # Therefore, ignore non-zero return codes resulting
+ # from configuration errors.
+ #
+
+ config_errors=`expr $config_errors + 1`
+ rv=0
+ elif [ ${rv} != 0 ] ; then
+ errors=`expr $errors + 1`
+ error_rv=${rv}
+ fi
+ done
+
+ if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt ${errors} ] ; then
+ touch ${lockfile}
+ chmod 00600 ${lockfile}
+ fi
+
+ # ONLY print a "WARNING" message if multiple
+ # instances are being examined
+ if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
+ # NOTE: "bad" return code(s) OVERRIDE configuration errors!
+ if [ ${errors} -eq 1 ]; then
+ # Since only ONE error exists, return that "bad" error code.
+ rv=${error_rv}
+ elif [ ${errors} -gt 1 ]; then
+ # Since MORE than ONE error exists, return an OVERALL status
+ # of "1 generic or unspecified error (current practice)"
+ rv=1
+ fi
+
+ if [ ${errors} -ge 1 ]; then
+ echo
+ echo -n "WARNING: "
+ echo -n "${errors} of ${TOTAL_PKI_REGISTRY_ENTRIES} "
+ echo -n "'${PKI_TYPE}' instances failed to start!"
+ echo
+ fi
+
+ if [ ${TOTAL_UNCONFIGURED_PKI_ENTRIES} -ge 1 ]; then
+ echo
+ echo -n "WARNING: "
+ echo -n "${TOTAL_UNCONFIGURED_PKI_ENTRIES} "
+ echo -n "of ${TOTAL_PKI_REGISTRY_ENTRIES} "
+ echo -n "'${PKI_TYPE}' instances MUST be configured!"
+ echo
+ fi
+
echo
- check_pki_configuration_status
- if [ $? -eq 0 ] ; then
- get_pki_status_definitions
- if [ $? -ne 0 ] ; then
- echo
- echo "[PKI_INSTANCE_ID] Status Definitions not found"
- fi
- get_pki_configuration_definitions
- if [ $? -ne 0 ] ; then
- echo
- echo "[PKI_INSTANCE_ID] Configuration Definitions not found"
- fi
+ echo "FINISHED STARTING '${PKI_TYPE}' INSTANCE(S)."
+ fi
+ else
+ echo
+ echo "ERROR: No '${PKI_TYPE}' instances installed!"
+ rv=5
+ fi
+
+ return ${rv}
+}
+
+stop()
+{
+ # From "http://fedoraproject.org/wiki/FCNewInit/Initscripts":
+ #
+ # * 0 action was successful
+ # * 1 generic or unspecified error (current practice)
+ # * 2 invalid or excess argument(s)
+ # * 3 unimplemented feature (for example, "reload")
+ # * 4 user had insufficient privilege
+ # * 5 program is not installed
+ # * 6 program is not configured
+ # * 7 program is not running
+ # * 8-99 reserved for future LSB use
+ # * 100-149 reserved for distribution use
+ # * 150-199 reserved for application use
+ # * 200-254 reserved
+ #
+
+ error_rv=0
+ rv=0
+
+ if [ -n "${PKI_REGISTRY_ENTRIES}" ]; then
+ errors=0
+
+ if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
+ echo "BEGIN SHUTTING DOWN '${PKI_TYPE}' INSTANCE(S):"
+ fi
+
+ # Shutdown every PKI instance of this type that is running
+ for PKI_REGISTRY_ENTRY in ${PKI_REGISTRY_ENTRIES}; do
+ # Source values associated with this particular PKI instance
+ [ -f ${PKI_REGISTRY_ENTRY} ] &&
+ . ${PKI_REGISTRY_ENTRY}
+
+ pidfile=${PKI_PIDDIR}/${PKI_PIDFILE}
+
+ [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] && echo
+
+ stop_instance
+
+ rv=$?
+ if [ ${rv} != 0 ] ; then
+ errors=`expr $errors + 1`
+ error_rv=${rv}
+ fi
+ done
+
+ if [ ${errors} -eq 0 ] ; then
+ rm -f ${lockfile}
+ fi
+
+ # ONLY print a "WARNING" message if multiple
+ # instances are being examined
+ if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
+ if [ ${errors} -eq 1 ]; then
+ # Since only ONE error exists, return that "bad" error code.
+ rv=${error_rv}
+ elif [ ${errors} -gt 1 ]; then
+ # Since MORE than ONE error exists, return an OVERALL status
+ # of "1 generic or unspecified error (current practice)"
+ rv=1
+ fi
+
+ if [ ${errors} -ge 1 ]; then
+ echo
+ echo -n "WARNING: "
+ echo -n "${errors} of ${TOTAL_PKI_REGISTRY_ENTRIES} "
+ echo -n "'${PKI_TYPE}' instances were "
+ echo -n "unsuccessfully stopped!"
+ echo
fi
+
echo
- else
- echo "[PKI_INSTANCE_ID] is dead but pid file exists"
+ echo "FINISHED SHUTTING DOWN '${PKI_TYPE}' INSTANCE(S)."
fi
else
- echo "[PKI_INSTANCE_ID] is stopped"
+ echo
+ echo "ERROR: No '${PKI_TYPE}' instances installed!"
+ rv=5
fi
+
+ return ${rv}
}
-# See how we were called.
-case "$1" in
- start)
- start
- ;;
- stop)
- stop
- ;;
- restart)
- stop
- sleep 2
- start
- ;;
- condrestart)
- if [ -f ${pidfile} ] ; then
- stop
- sleep 2
- start
- else
- echo -n "Unable to restart process since "
- echo -n "'${pidfile}' does not exist!"
+restart()
+{
+ # From "http://fedoraproject.org/wiki/FCNewInit/Initscripts":
+ #
+ # * 0 action was successful
+ # * 1 generic or unspecified error (current practice)
+ # * 2 invalid or excess argument(s)
+ # * 3 unimplemented feature (for example, "reload")
+ # * 4 user had insufficient privilege
+ # * 5 program is not installed
+ # * 6 program is not configured
+ # * 7 program is not running
+ # * 8-99 reserved for future LSB use
+ # * 100-149 reserved for distribution use
+ # * 150-199 reserved for application use
+ # * 200-254 reserved
+ #
+
+ stop
+ sleep 2
+ echo
+ echo "============================================================"
+ echo
+ start
+
+ return $?
+}
+
+status()
+{
+ # From "http://fedoraproject.org/wiki/FCNewInit/Initscripts":
+ #
+ # * 0 program is running or service is OK
+ # * 1 program is dead and /var/run pid file exists
+ # * 2 program is dead and /var/lock lock file exists
+ # * 3 program is not running
+ # * 4 program or service status is unknown
+ # * 5-99 reserved for future LSB use
+ # * 100-149 reserved for distribution use
+ # * 150-199 reserved for application use
+ # * 200-254 reserved
+ #
+
+ error_rv=0
+ rv=0
+
+ if [ -n "${PKI_REGISTRY_ENTRIES}" ]; then
+ errors=0
+
+ if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
+ echo "REPORT STATUS OF '${PKI_TYPE}' INSTANCE(S):"
+ fi
+
+ # Obtain status of every PKI instance of this type
+ for PKI_REGISTRY_ENTRY in ${PKI_REGISTRY_ENTRIES}; do
+ # Source values associated with this particular PKI instance
+ [ -f ${PKI_REGISTRY_ENTRY} ] &&
+ . ${PKI_REGISTRY_ENTRY}
+
+ pidfile=${PKI_PIDDIR}/${PKI_PIDFILE}
+
+ [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] && echo
+
+ display_instance_status
+
+ rv=$?
+ if [ ${rv} -ne 0 ] ; then
+ errors=`expr $errors + 1`
+ error_rv=${rv}
+ fi
+ done
+
+ # ONLY print a "WARNING" message if multiple
+ # instances are being examined
+ if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
+ if [ ${errors} -eq 1 ]; then
+ # Since only ONE error exists, return that "bad" error code.
+ rv=${error_rv}
+ elif [ ${errors} -gt 1 ]; then
+ # Since MORE than ONE error exists, return an OVERALL status
+ # of "4 - program or service status is unknown"
+ rv=4
+ fi
+
+ if [ ${errors} -ge 1 ]; then
+ echo
+ echo -n "WARNING: "
+ echo -n "${errors} of ${TOTAL_PKI_REGISTRY_ENTRIES} "
+ echo -n "'${PKI_TYPE}' instances reported status failures!"
+ echo
+ fi
+
+ if [ ${TOTAL_UNCONFIGURED_PKI_ENTRIES} -ge 1 ]; then
+ echo
+ echo -n "WARNING: "
+ echo -n "${TOTAL_UNCONFIGURED_PKI_ENTRIES} "
+ echo -n "of ${TOTAL_PKI_REGISTRY_ENTRIES} "
+ echo -n "'${PKI_TYPE}' instances MUST be configured!"
+ echo
+ fi
+
echo
+ echo "FINISHED REPORTING STATUS OF '${PKI_TYPE}' INSTANCE(S)."
fi
+ else
+ echo
+ echo "ERROR: No '${PKI_TYPE}' instances installed!"
+ rv=4
+ fi
+
+ return ${rv}
+}
+
+# See how we were called.
+case "${command}" in
+ start|stop|restart|status)
+ ${command}
+ exit $?
;;
- status)
- status
+ condrestart|force-restart|try-restart)
+ [ ! -f ${lockfile} ] || restart
+ exit $?
+ ;;
+ reload)
+ echo "The 'reload' action is an unimplemented feature."
+ exit ${default_error}
;;
*)
- echo "Usage: $TOMCAT_PROG {start|stop|restart|condrestart|status}"
- exit 1
+ # * 3 unimplemented feature (for example, "reload")
+ # [invalid command - should never be reached]
+ echo
+ usage
+ echo "where valid instance names include:"
+ list_instances
+ exit 3
+ ;;
esac
-exit $RETVAL
-
diff --git a/pki/base/common/LICENSE b/pki/base/common/LICENSE
index e36f2269a..e281f4362 100644
--- a/pki/base/common/LICENSE
+++ b/pki/base/common/LICENSE
@@ -11,26 +11,6 @@ You should have received a copy of the GNU General Public License
along with this Program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
-In addition, as a special exception, Red Hat, Inc. gives You the additional
-right to link the code of this Program with code not covered under the GNU
-General Public License ("Non-GPL Code") and to distribute linked combinations
-including the two, subject to the limitations in this paragraph. Non-GPL
-Code permitted under this exception must only link to the code of this
-Program through those well defined interfaces identified in the file named
-EXCEPTION found in the source code files (the "Approved Interfaces").
-
-The files of Non-GPL Code may instantiate templates or use macros or inline
-functions from the Approved Interfaces without causing the resulting work to
-be covered by the GNU General Public License. Only Red Hat, Inc. may make
-changes or additions to the list of Approved Interfaces. You must obey the
-GNU General Public License in all respects for all of the Program code and
-other code used in conjunction with the Program except the Non-GPL Code
-covered by this exception. If you modify this file, you may extend this
-exception to your version of the file, but you are not obligated to do so.
-If you do not wish to provide this exception without modification, you must
-delete this exception statement from your version and license this file
-solely under the GPL without exception.
-
GNU GENERAL PUBLIC LICENSE
Version 2, June 1991
diff --git a/pki/base/common/build.xml b/pki/base/common/build.xml
index 96dc86317..fd12328b5 100644
--- a/pki/base/common/build.xml
+++ b/pki/base/common/build.xml
@@ -260,17 +260,6 @@
prefix="usr/share/${product.prefix}/scripts">
<include name="**"/>
</zipfileset>
- <zipfileset dir="./setup"
- filemode="755"
- prefix="usr/share/${product.prefix}/setup">
- <include name="postinstall"/>
- </zipfileset>
- <zipfileset dir="./setup"
- filemode="644"
- prefix="usr/share/${product.prefix}/setup">
- <include name="**"/>
- <exclude name="postinstall"/>
- </zipfileset>
<zipfileset dir="."
filemode="644"
prefix="usr/share/doc/${dist.name}">
@@ -298,17 +287,6 @@
prefix="${dist.name}/usr/share/${product.prefix}/scripts">
<include name="**"/>
</tarfileset>
- <tarfileset dir="./setup"
- mode="755"
- prefix="usr/share/${product.prefix}/setup">
- <include name="postinstall"/>
- </tarfileset>
- <tarfileset dir="./setup"
- mode="644"
- prefix="usr/share/${product.prefix}/setup">
- <include name="**"/>
- <exclude name="postinstall"/>
- </tarfileset>
<tarfileset dir="."
mode="644"
prefix="${dist.name}/usr/share/doc/${dist.name}">
diff --git a/pki/base/common/setup/postinstall b/pki/base/common/setup/postinstall
deleted file mode 100755
index f8b342440..000000000
--- a/pki/base/common/setup/postinstall
+++ /dev/null
@@ -1,56 +0,0 @@
-#!/bin/bash
-#
-# BEGIN COPYRIGHT BLOCK
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; version 2 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# (C) 2007 Red Hat, Inc.
-# All rights reserved.
-# END COPYRIGHT BLOCK
-#
-
-###############################################################################
-## (1) Check command line arguments to see how many were passed in. ##
-###############################################################################
-
-if [ $# -eq 1 ]
-then
- PKI_PRODUCT_NAME=$1
-else
- echo
- echo "Usage: $0 PKI_product_name"
- echo
-
- exit 255
-fi
-
-
-###############################################################################
-## (2) Specify variables used by this script. ##
-###############################################################################
-
-
-
-###############################################################################
-## (3) Create the first instance of a Certificate Authority (CA). ##
-###############################################################################
-
-/usr/share/${PKI_PRODUCT_NAME}/scripts/pkicomplete
-
-
-###############################################################################
-## (4) Successfully exit from this postinstallation script. ##
-###############################################################################
-
-exit 0
-
diff --git a/pki/base/config/product.xml b/pki/base/config/product.xml
index e4059f8ad..f228b3323 100644
--- a/pki/base/config/product.xml
+++ b/pki/base/config/product.xml
@@ -37,6 +37,7 @@
<!-- Set up optional properties passed-in via the build scripts -->
<property name="basedir" value=""/>
<property name="dirsec" value=""/>
+ <property name="init.d" value=""/>
<property name="target" value=""/>
diff --git a/pki/base/selinux/LICENSE b/pki/base/selinux/LICENSE
index e36f2269a..e281f4362 100644
--- a/pki/base/selinux/LICENSE
+++ b/pki/base/selinux/LICENSE
@@ -11,26 +11,6 @@ You should have received a copy of the GNU General Public License
along with this Program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
-In addition, as a special exception, Red Hat, Inc. gives You the additional
-right to link the code of this Program with code not covered under the GNU
-General Public License ("Non-GPL Code") and to distribute linked combinations
-including the two, subject to the limitations in this paragraph. Non-GPL
-Code permitted under this exception must only link to the code of this
-Program through those well defined interfaces identified in the file named
-EXCEPTION found in the source code files (the "Approved Interfaces").
-
-The files of Non-GPL Code may instantiate templates or use macros or inline
-functions from the Approved Interfaces without causing the resulting work to
-be covered by the GNU General Public License. Only Red Hat, Inc. may make
-changes or additions to the list of Approved Interfaces. You must obey the
-GNU General Public License in all respects for all of the Program code and
-other code used in conjunction with the Program except the Non-GPL Code
-covered by this exception. If you modify this file, you may extend this
-exception to your version of the file, but you are not obligated to do so.
-If you do not wish to provide this exception without modification, you must
-delete this exception statement from your version and license this file
-solely under the GPL without exception.
-
GNU GENERAL PUBLIC LICENSE
Version 2, June 1991
diff --git a/pki/base/setup/LICENSE b/pki/base/setup/LICENSE
index e36f2269a..e281f4362 100644
--- a/pki/base/setup/LICENSE
+++ b/pki/base/setup/LICENSE
@@ -11,26 +11,6 @@ You should have received a copy of the GNU General Public License
along with this Program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
-In addition, as a special exception, Red Hat, Inc. gives You the additional
-right to link the code of this Program with code not covered under the GNU
-General Public License ("Non-GPL Code") and to distribute linked combinations
-including the two, subject to the limitations in this paragraph. Non-GPL
-Code permitted under this exception must only link to the code of this
-Program through those well defined interfaces identified in the file named
-EXCEPTION found in the source code files (the "Approved Interfaces").
-
-The files of Non-GPL Code may instantiate templates or use macros or inline
-functions from the Approved Interfaces without causing the resulting work to
-be covered by the GNU General Public License. Only Red Hat, Inc. may make
-changes or additions to the list of Approved Interfaces. You must obey the
-GNU General Public License in all respects for all of the Program code and
-other code used in conjunction with the Program except the Non-GPL Code
-covered by this exception. If you modify this file, you may extend this
-exception to your version of the file, but you are not obligated to do so.
-If you do not wish to provide this exception without modification, you must
-delete this exception statement from your version and license this file
-solely under the GPL without exception.
-
GNU GENERAL PUBLIC LICENSE
Version 2, June 1991
diff --git a/pki/base/setup/pkicommon b/pki/base/setup/pkicommon
index 4f71d8139..7b72a5660 100755
--- a/pki/base/setup/pkicommon
+++ b/pki/base/setup/pkicommon
@@ -217,6 +217,22 @@ $HTTPS_PREFIX = "https://";
$LDAP_PREFIX = "ldap://";
$LDAPS_PREFIX = "ldaps://";
+# Subsystem names
+$CA = "ca";
+$KRA = "kra";
+$OCSP = "ocsp";
+$TKS = "tks";
+$RA = "ra";
+$TPS = "tps";
+
+# Subsystem init scripts
+$CA_INIT_SCRIPT = "pki-cad";
+$KRA_INIT_SCRIPT = "pki-krad";
+$OCSP_INIT_SCRIPT = "pki-ocspd";
+$TKS_INIT_SCRIPT = "pki-tksd";
+$RA_INIT_SCRIPT = "pki-rad";
+$TPS_INIT_SCRIPT = "pki-tpsd";
+
##############################################################
# Global Variables
diff --git a/pki/base/setup/pkicreate b/pki/base/setup/pkicreate
index 9cab383f7..770983985 100755
--- a/pki/base/setup/pkicreate
+++ b/pki/base/setup/pkicreate
@@ -26,17 +26,17 @@
# Sample Invocation (for CA):
#
# ./pkicreate -pki_instance_root=/var/lib
-# -pki_instance_name=pki-ca1
+# -pki_instance_name=pki-ca
# -subsystem_type=ca
-# -agent_secure_port=9543
-# -ee_secure_port=9544
-# -admin_secure_port=9545
-# -unsecure_port=9580
-# -tomcat_server_port=9801
+# -agent_secure_port=9443
+# -ee_secure_port=9444
+# -admin_secure_port=9445
+# -unsecure_port=9180
+# -tomcat_server_port=9701
# -user=pkiuser
# -group=pkiuser
-# -redirect conf=/etc/pki-ca1
-# -redirect logs=/var/log/pki-ca1
+# -redirect conf=/etc/pki-ca
+# -redirect logs=/var/log/pki-ca
# -verbose
#
##############################################################
@@ -134,7 +134,7 @@ $pki_flavor =~ s/\s+$//g;
# Establish path to scripts
my $pki_subsystem_common_area = "/usr/share/$pki_flavor";
-my $common_path = "/usr/share/pki/scripts";
+my $common_path = "/usr/share/$pki_flavor/scripts";
if( ! -d "$common_path" ) {
print( STDERR
@@ -180,14 +180,6 @@ my $jdbc_stdext_link = "/var/lib/tomcat5/common/lib/\[jdbc-stdext\].jar";
my $jndi_link = "/var/lib/tomcat5/common/lib/\[jndi\].jar";
my $jaas_link = "/var/lib/tomcat5/server/lib/\[jaas\].jar";
-# Subsystem names
-my $CA = "ca";
-my $OCSP = "ocsp";
-my $KRA = "kra";
-my $TKS = "tks";
-my $RA = "ra";
-my $TPS = "tps";
-
# Base subsystem directory names
my $acl_base_subsystem_dir = "acl"; # CA, KRA, OCSP, TKS
my $alias_base_subsystem_dir = "alias"; # CA, KRA, OCSP, TKS, RA, TPS
@@ -250,8 +242,10 @@ my $cmsbundle_jar_base_name = "cmsbundle.jar"; # CA, KRA, OCSP, TKS
my $cmscore_jar_base_name = "cmscore.jar"; # CA, KRA, OCSP, TKS
my $conf_base_name = "conf"; # CA, KRA, OCSP, TKS,
# RA, TPS
-my $httpd_base_name = "httpd"; # CA, KRA, OCSP, TKS,
+# BEGIN Legacy Start/Stop Implementation
+my $httpd_base_name = "httpd"; # KRA, OCSP, TKS,
# RA, TPS
+# END Legacy Start/Stop Implementation
my $httpd_conf_base_name = "httpd.conf"; # RA, TPS
my $index_html_base_name = "index.html"; # CA, KRA, OCSP, TKS
my $logs_base_name = "logs"; # CA, KRA, OCSP, TKS,
@@ -278,7 +272,9 @@ my $velocity_prop_base_name = "velocity.properties"; # CA, KRA, OCSP, TKS
my $web_xml_base_name = "web.xml"; # CA, KRA, OCSP, TKS
# Subdirectory names
-my $initd_base_subsystem_dir = "init.d"; # CA, KRA, OCSP, TKS, RA, TPS
+# BEGIN Legacy Start/Stop Implementation
+my $initd_base_subsystem_dir = "init.d"; # KRA, OCSP, TKS, RA, TPS
+# END Legacy Start/Stop Implementation
my $perl_base_instance_symlink = "perl"; # RA, TPS
my $perl_base_subsystem_dir = "perl"; # RA, TPS
my $signed_audit_base_instance_dir = "signedAudit"; # CA, KRA, OCSP, TKS, TPS
@@ -293,7 +289,6 @@ my $default_dir_permissions = 00770;
my $default_exe_permissions = 00770;
my $default_file_permissions = 00660;
my $default_security_token = "internal";
-my $default_start_stop_scripts = "/etc/init.d";
my $default_tomcat_common_path = "/var/lib/tomcat5/common";
# Default PKI user and group to give to PKI installed files
@@ -514,7 +509,6 @@ my $httpd_conf_subsystem_file_path = ""; # RA, TPS
my $index_html_instance_file_path = ""; # CA, KRA, OCSP, TKS
my $index_html_subsystem_file_path = ""; # CA, KRA, OCSP, TKS
my $java_pki_flavor_jar_path = ""; # CA, KRA, OCSP, TKS
-my $java_pki_flavor_subsystem_jar_path = ""; # CA, KRA, OCSP, TKS
my $magic_instance_file_path = ""; # RA, TPS
my $magic_subsystem_file_path = ""; # RA, TPS
my $mime_types_instance_file_path = ""; # RA, TPS
@@ -538,14 +532,14 @@ my $pki_cfg_instance_file_path = ""; # CA, KRA, OCSP, TKS,
# RA, TPS
my $pki_cfg_subsystem_file_path = ""; # CA, KRA, OCSP, TKS,
# RA, TPS
-my $pki_start_stop_command = ""; # CA, KRA, OCSP, TKS,
- # RA, TPS
-my $pki_start_stop_script_instance_file_path = ""; # CA, KRA, OCSP, TKS,
+# BEGIN Legacy Start/Stop Implementation
+my $pki_start_stop_script_instance_file_path = ""; # KRA, OCSP, TKS,
# RA, TPS
-my $pki_start_stop_script_subsystem_file_path = ""; # CA, KRA, OCSP, TKS,
+my $pki_start_stop_script_subsystem_file_path = ""; # KRA, OCSP, TKS,
# RA, TPS
-my $pki_start_stop_script_symlink_path = ""; # CA, KRA, OCSP, TKS,
+my $pki_start_stop_script_symlink_path = ""; # KRA, OCSP, TKS,
# RA, TPS
+# END Legacy Start/Stop Implementation
my $schemaMods_ldif_instance_file_path = ""; # RA, TPS
my $schemaMods_ldif_subsystem_file_path = ""; # RA, TPS
my $server_xml_instance_file_path = ""; # CA, KRA, OCSP, TKS
@@ -567,6 +561,26 @@ my $webinf_instance_path = ""; # CA, KRA, OCSP, TKS
my $webinf_lib_instance_path = ""; # CA, KRA, OCSP, TKS
my $webinf_subsystem_path = ""; # CA, KRA, OCSP, TKS
+# PKI init script variables
+my $default_init_scripts_path = ""; # CA, KRA, OCSP, TKS
+ # RA, TPS
+my $pki_init_script = ""; # CA, KRA, OCSP, TKS,
+ # RA, TPS
+my $pki_init_script_command = ""; # CA, KRA, OCSP, TKS,
+ # RA, TPS
+
+# PKI registry variables
+my $default_registry_path = ""; # CA, KRA, OCSP, TKS
+ # RA, TPS
+my $pki_registry_path = ""; # CA, KRA, OCSP, TKS
+ # RA, TPS
+my $pki_registry_subsystem_path = ""; # CA, KRA, OCSP, TKS
+ # RA, TPS
+my $pki_instance_registry = ""; # CA, KRA, OCSP, TKS
+ # RA, TPS
+my $pki_instance_registry_entry = ""; # CA, KRA, OCSP, TKS
+ # RA, TPS
+
# PKI creation variables
my $host = "";
my $db_password = 0;
@@ -587,6 +601,12 @@ if( $^O eq "linux" ) {
$setup_config_area = "/usr/share/applications";
$setup_config_name = "config.desktop";
+ # Linux init scripts
+ $default_init_scripts_path = "/etc/rc.d/init.d";
+
+ # Linux registry
+ $default_registry_path = "/etc/sysconfig";
+
# Platform-specific directories
@pki_static_directories = ( "temp",
"shared",
@@ -608,6 +628,12 @@ if( $^O eq "linux" ) {
"shared/lib",
"work" );
+ # Solaris init scripts
+ $default_init_scripts_path = "/etc/init.d";
+
+ # Solaris registry
+ $default_registry_path = "/etc/inet";
+
# Superuser and group to give to PKI installed files
$root_user = "root";
$root_group = "other";
@@ -717,6 +743,10 @@ if( -l $jaas_link ) {
}
}
+# Establish PKI-level registry
+$pki_registry_path = $default_registry_path
+ . "/" . $pki_flavor;
+
##############################################################
# PKI Instance Creation Subroutines
@@ -875,36 +905,113 @@ sub usage()
print( STDOUT
"###############################################################################\n"
- . "### EXAMPLE: PKI (Apache) subsystem instance creation of a TPS ###\n"
+ . "### EXAMPLES: ###\n"
+ . "### PKI (Tomcat) subsystem instance creation of a CA ###\n"
+ . "### PKI (Tomcat) subsystem instance creation of a Subordinate CA ###\n"
+ . "### PKI (Tomcat) subsystem instance creation of a KRA ###\n"
+ . "### PKI (Tomcat) subsystem instance creation of an OCSP ###\n"
+ . "### PKI (Tomcat) subsystem instance creation of a TKS ###\n"
+ . "### PKI (Apache) subsystem instance creation of an RA ###\n"
+ . "### PKI (Apache) subsystem instance creation of a TPS ###\n"
+ . "### PKI (Apache) subsystem instance creation of a second TPS ###\n"
. "###############################################################################\n\n"
- . "pkicreate -pki_instance_root=/var/lib \\\n"
- . " -pki_instance_name=$pki_flavor-tps1 \\\n"
- . " -subsystem_type=tps \\\n"
- . " -secure_port=7989 \\\n"
- . " -non_clientauth_secure_port=7990 \\\n"
- . " -unsecure_port=7988 \\\n"
- . " -user=pkiuser \\\n"
- . " -group=pkiuser \\\n"
- . " -redirect conf=/etc/$pki_flavor-tps1 \\\n"
- . " -redirect logs=/var/log/$pki_flavor-tps1 \\\n"
- . " -verbose\n\n" );
-
- print( STDOUT
- "###############################################################################\n"
- . "### EXAMPLE: PKI (Tomcat) subsystem instance creation of a CA ###\n"
- . "###############################################################################\n\n"
- . "pkicreate -pki_instance_root=/var/lib \\\n"
- . " -pki_instance_name=$pki_flavor-ca1 \\\n"
- . " -subsystem_type=ca \\\n"
- . " -agent_secure_port=9543 \\\n"
- . " -ee_secure_port=9544 \\\n"
- . " -admin_secure_port=9545 \\\n"
- . " -unsecure_port=9580 \\\n"
- . " -tomcat_server_port=9801 \\\n"
- . " -user=pkiuser \\\n"
- . " -group=pkiuser \\\n"
- . " -redirect conf=/etc/$pki_flavor-ca1 \\\n"
- . " -redirect logs=/var/log/$pki_flavor-ca1 \\\n"
+ . "pkicreate -pki_instance_root=/var/lib \\\n"
+ . " -pki_instance_name=pki-ca \\\n"
+ . " -subsystem_type=ca \\\n"
+ . " -agent_secure_port=9443 \\\n"
+ . " -ee_secure_port=9444 \\\n"
+ . " -admin_secure_port=9445 \\\n"
+ . " -unsecure_port=9180 \\\n"
+ . " -tomcat_server_port=9701 \\\n"
+ . " -user=pkiuser \\\n"
+ . " -group=pkiuser \\\n"
+ . " -redirect conf=/etc/pki-ca \\\n"
+ . " -redirect logs=/var/log/pki-ca \\\n"
+ . " -verbose\n\n"
+ . "pkicreate -pki_instance_root=/var/lib \\\n"
+ . " -pki_instance_name=pki-subca \\\n"
+ . " -subsystem_type=ca \\\n"
+ . " -agent_secure_port=9543 \\\n"
+ . " -ee_secure_port=9544 \\\n"
+ . " -admin_secure_port=9545 \\\n"
+ . " -unsecure_port=9580 \\\n"
+ . " -tomcat_server_port=9801 \\\n"
+ . " -user=pkiuser \\\n"
+ . " -group=pkiuser \\\n"
+ . " -redirect conf=/etc/pki-subca \\\n"
+ . " -redirect logs=/var/log/pki-subca \\\n"
+ . " -verbose\n\n"
+ . "pkicreate -pki_instance_root=/var/lib \\\n"
+ . " -pki_instance_name=pki-kra \\\n"
+ . " -subsystem_type=kra \\\n"
+ . " -agent_secure_port=10443 \\\n"
+ . " -ee_secure_port=10444 \\\n"
+ . " -admin_secure_port=10445 \\\n"
+ . " -unsecure_port=10180 \\\n"
+ . " -tomcat_server_port=10701 \\\n"
+ . " -user=pkiuser \\\n"
+ . " -group=pkiuser \\\n"
+ . " -redirect conf=/etc/pki-kra \\\n"
+ . " -redirect logs=/var/log/pki-kra \\\n"
+ . " -verbose\n\n"
+ . "pkicreate -pki_instance_root=/var/lib \\\n"
+ . " -pki_instance_name=pki-ocsp \\\n"
+ . " -subsystem_type=ocsp \\\n"
+ . " -agent_secure_port=11443 \\\n"
+ . " -ee_secure_port=11444 \\\n"
+ . " -admin_secure_port=11445 \\\n"
+ . " -unsecure_port=11180 \\\n"
+ . " -tomcat_server_port=11701 \\\n"
+ . " -user=pkiuser \\\n"
+ . " -group=pkiuser \\\n"
+ . " -redirect conf=/etc/pki-ocsp \\\n"
+ . " -redirect logs=/var/log/pki-ocsp \\\n"
+ . " -verbose\n\n"
+ . "pkicreate -pki_instance_root=/var/lib \\\n"
+ . " -pki_instance_name=pki-tks \\\n"
+ . " -subsystem_type=tks \\\n"
+ . " -agent_secure_port=13443 \\\n"
+ . " -ee_secure_port=13444 \\\n"
+ . " -admin_secure_port=13445 \\\n"
+ . " -unsecure_port=13180 \\\n"
+ . " -tomcat_server_port=13701 \\\n"
+ . " -user=pkiuser \\\n"
+ . " -group=pkiuser \\\n"
+ . " -redirect conf=/etc/pki-tks \\\n"
+ . " -redirect logs=/var/log/pki-tks \\\n"
+ . " -verbose\n\n"
+ . "pkicreate -pki_instance_root=/var/lib \\\n"
+ . " -pki_instance_name=pki-ra \\\n"
+ . " -subsystem_type=ra \\\n"
+ . " -secure_port=12889 \\\n"
+ . " -non_clientauth_secure_port=12890 \\\n"
+ . " -unsecure_port=12888 \\\n"
+ . " -user=pkiuser \\\n"
+ . " -group=pkiuser \\\n"
+ . " -redirect conf=/etc/pki-ra \\\n"
+ . " -redirect logs=/var/log/pki-ra \\\n"
+ . " -verbose\n\n"
+ . "pkicreate -pki_instance_root=/var/lib \\\n"
+ . " -pki_instance_name=pki-tps \\\n"
+ . " -subsystem_type=tps \\\n"
+ . " -secure_port=7889 \\\n"
+ . " -non_clientauth_secure_port=7890 \\\n"
+ . " -unsecure_port=7888 \\\n"
+ . " -user=pkiuser \\\n"
+ . " -group=pkiuser \\\n"
+ . " -redirect conf=/etc/pki-tps \\\n"
+ . " -redirect logs=/var/log/pki-tps \\\n"
+ . " -verbose\n\n"
+ . "pkicreate -pki_instance_root=/var/lib \\\n"
+ . " -pki_instance_name=pki-tps1 \\\n"
+ . " -subsystem_type=tps \\\n"
+ . " -secure_port=7989 \\\n"
+ . " -non_clientauth_secure_port=7990 \\\n"
+ . " -unsecure_port=7988 \\\n"
+ . " -user=pkiuser \\\n"
+ . " -group=pkiuser \\\n"
+ . " -redirect conf=/etc/pki-tps1 \\\n"
+ . " -redirect logs=/var/log/pki-tps1 \\\n"
. " -verbose\n\n" );
print( STDOUT
@@ -921,8 +1028,18 @@ sub pki_instance_already_exists
{
my $name = $_[0];
my $result = 0;
+ my $instance = "";
- my $instance = $default_start_stop_scripts . "/" . $name;
+ if( $subsystem_type ne $CA ) {
+ # BEGIN Legacy Start/Stop Implementation
+ $instance = $default_init_scripts_path
+ . "/" . $name;
+ # END Legacy Start/Stop Implementation
+ } else {
+ $instance = $pki_registry_path
+ . "/" . $subsystem_type
+ . "/" . $name;
+ }
if( -e $instance ) {
$result = 1;
@@ -995,6 +1112,33 @@ sub parse_arguments()
return 0;
}
+ ## Mandatory "-subsystem_type=s" option
+ if( $subsystem_type ne $CA &&
+ $subsystem_type ne $KRA &&
+ $subsystem_type ne $OCSP &&
+ $subsystem_type ne $TKS &&
+ $subsystem_type ne $RA &&
+ $subsystem_type ne $TPS ) {
+ usage();
+ emit( "Illegal value => $subsystem_type : for -subsystem_type!\n",
+ "error" );
+ return 0;
+ }
+
+ $pki_subsystem_path = $pki_subsystem_common_area
+ . "/" . $subsystem_type;
+
+ if( !( -d "$pki_subsystem_path" ) ) {
+ usage();
+ emit( "$pki_subsystem_path not present. "
+ . "Please install the corresponding subsystem RPM first!\n",
+ "error" );
+ return 0;
+ } else {
+ emit( " subsystem_type $subsystem_type\n" );
+ }
+
+
## Mandatory "-pki_instance_name=s" option
if( $pki_instance_name eq "" ) {
usage();
@@ -1027,7 +1171,6 @@ sub parse_arguments()
return 0;
}
-
# capture installation information in a log file
# (always overwrite this file)
$logfile = "/var/log/$pki_instance_name-install.log";
@@ -1046,33 +1189,6 @@ sub parse_arguments()
emit( " pki_instance_root $pki_instance_root\n" );
emit( " pki_instance_name $pki_instance_name\n" );
-
- ## Mandatory "-subsystem_type=s" option
- if( $subsystem_type ne $CA &&
- $subsystem_type ne $KRA &&
- $subsystem_type ne $OCSP &&
- $subsystem_type ne $TKS &&
- $subsystem_type ne $RA &&
- $subsystem_type ne $TPS ) {
- usage();
- emit( "Illegal value => $subsystem_type : for -subsystem_type!\n",
- "error" );
- return 0;
- }
-
- $pki_subsystem_path = $pki_subsystem_common_area
- . "/" . $subsystem_type;
-
- if( !( -d "$pki_subsystem_path" ) ) {
- usage();
- emit( "$pki_subsystem_path not present. "
- . "Please install the corresponding subsystem RPM first!\n",
- "error" );
- return 0;
- } else {
- emit( " subsystem_type $subsystem_type\n" );
- }
-
## Mandatory "-secure_port=<secure_port>" option
if( $l_secure_port >= 0 ) {
$secure_port = $l_secure_port;
@@ -1485,7 +1601,8 @@ sub initialize_subdirectory_paths()
## Initialize subdirectory paths (subsystem independent)
$pki_cfg_subsystem_file_path = $conf_subsystem_path
. "/" . $pki_cfg_base_name;
- $pki_start_stop_script_instance_file_path = $default_start_stop_scripts
+ # BEGIN Legacy Start/Stop Implementation
+ $pki_start_stop_script_instance_file_path = $default_init_scripts_path
. "/" . $pki_instance_name;
$pki_start_stop_script_subsystem_file_path = $pki_subsystem_path
. "/" . $etc_base_subsystem_dir
@@ -1493,6 +1610,7 @@ sub initialize_subdirectory_paths()
. "/" . $httpd_base_name;
$pki_start_stop_script_symlink_path = $pki_instance_path
. "/" . $pki_instance_name;
+ # END Legacy Start/Stop Implementation
if( $^O eq "linux" ) {
$setup_config_instance_file_path = $setup_config_area
. "/" . $pki_instance_name
@@ -1501,6 +1619,19 @@ sub initialize_subdirectory_paths()
. "/" . $setup_config_name;
}
+ if( $subsystem_type eq $CA ) {
+ $pki_init_script = $CA_INIT_SCRIPT;
+ } elsif( $subsystem_type eq $KRA ) {
+ $pki_init_script = $KRA_INIT_SCRIPT;
+ } elsif( $subsystem_type eq $OCSP ) {
+ $pki_init_script = $OCSP_INIT_SCRIPT;
+ } elsif( $subsystem_type eq $RA ) {
+ $pki_init_script = $RA_INIT_SCRIPT;
+ } elsif( $subsystem_type eq $TKS ) {
+ $pki_init_script = $TKS_INIT_SCRIPT;
+ } elsif( $subsystem_type eq $TPS ) {
+ $pki_init_script = $TPS_INIT_SCRIPT;
+ }
## Initialize subdirectory paths (CA subsystems)
# if( $subsystem_type eq $CA ) {
@@ -1612,12 +1743,8 @@ sub initialize_subdirectory_paths()
. "/" . $webinf_base_instance_dir;
$webinf_lib_instance_path = $webinf_instance_path
. "/" . $lib_base_instance_dir;
-
$java_pki_flavor_jar_path = $default_java_path
. "/" . $pki_flavor;
- $java_pki_flavor_subsystem_jar_path = $java_pki_flavor_jar_path
- . "/" . $subsystem_type;
-
$catalina_sh_instance_file_path = $default_system_user_binaries
. "/" . $catalina_sh_base_name
. "-" . $pki_instance_name;
@@ -1659,8 +1786,17 @@ sub initialize_subdirectory_paths()
. "/" . $server_xml_base_name;
$servercertnick_conf_subsystem_file_path = $conf_subsystem_path
. "/" . $servercertnick_conf_base_name;
- $subsystem_jar_file_path = $java_pki_flavor_subsystem_jar_path
+ if( $subsystem_type eq $CA ) {
+ $subsystem_jar_file_path = $default_java_path
. "/" . $subsystem_type . ".jar";
+ } else {
+ # BEGIN Legacy Start/Stop Implementation
+ $subsystem_jar_file_path = $default_java_path
+ . "/" . $pki_flavor
+ . "/" . $subsystem_type
+ . "/" . $subsystem_type . ".jar";
+ # END Legacy Start/Stop Implementation
+ }
$subsystem_jar_symlink_path = $webinf_lib_instance_path
. "/" . $subsystem_type . ".jar";
$tomcat5_conf_subsystem_file_path = $conf_subsystem_path
@@ -2397,26 +2533,30 @@ LoadModule nss_module /opt/fortitude/modules.local/libmodnss.so
chmod( $default_file_permissions,
$pki_cfg_instance_file_path );
- # process "httpd" template
- #
- # NOTE: CA, KRA, OCSP, TKS instances are dependent upon the location
- # of the instance-specific "server.xml" file, while RA and TPS
- # instances are dependent upon the instance-specific location
- # of the "nss.conf" file.
- #
- $result = process_file_template(
- $pki_start_stop_script_subsystem_file_path,
- $pki_start_stop_script_instance_file_path,
- \%slot_hash );
- if( !$result ) {
- return 0;
- }
+ # BEGIN Legacy Start/Stop Implementation
+ if( $subsystem_type ne $CA ) {
+ # process "httpd" template
+ #
+ # NOTE: CA, KRA, OCSP, TKS instances are dependent upon the location
+ # of the instance-specific "server.xml" file, while RA and TPS
+ # instances are dependent upon the instance-specific location
+ # of the "nss.conf" file.
+ #
+ $result = process_file_template(
+ $pki_start_stop_script_subsystem_file_path,
+ $pki_start_stop_script_instance_file_path,
+ \%slot_hash );
+ if( !$result ) {
+ return 0;
+ }
- chmod( $default_exe_permissions,
- $pki_start_stop_script_instance_file_path );
+ chmod( $default_exe_permissions,
+ $pki_start_stop_script_instance_file_path );
- push( @installed_files,
- $pki_start_stop_script_instance_file_path );
+ push( @installed_files,
+ $pki_start_stop_script_instance_file_path );
+ }
+ # END Legacy Start/Stop Implementation
if( $^O eq "linux" ) {
@@ -2764,30 +2904,83 @@ sub process_pki_files_and_symlinks()
$pfile_instance_file_path );
- # create instance symlink to actual instance "start/stop" script
- $result = create_symbolic_link( $pki_start_stop_script_symlink_path,
- $pki_start_stop_script_instance_file_path );
- if( !$result ) {
- return 0;
- }
- #
- # NOTE: This symlink requires "$root_user:$root_group" ownership
- # since the destination that it refers to is owned by
- # "$root_user:$root_group".
- #
- $result = give_symbolic_link_to( $pki_start_stop_script_symlink_path,
- $root_user,
- $root_group );
- if( !$result ) {
- emit( "$pki_start_stop_script_instance_file_path ownership problems!",
- "error" );
- return 0;
- }
+ if( $subsystem_type ne $CA ) {
+ # BEGIN Legacy Start/Stop Implementation
+ # create instance symlink to actual instance "start/stop" script
+ $result = create_symbolic_link( $pki_start_stop_script_symlink_path,
+ $pki_start_stop_script_instance_file_path );
+ if( !$result ) {
+ return 0;
+ }
+ #
+ # NOTE: This symlink requires "$root_user:$root_group" ownership
+ # since the destination that it refers to is owned by
+ # "$root_user:$root_group".
+ #
+ $result = give_symbolic_link_to( $pki_start_stop_script_symlink_path,
+ $root_user,
+ $root_group );
+ if( !$result ) {
+ emit( "$pki_start_stop_script_instance_file_path ownership problems!",
+ "error" );
+ return 0;
+ }
+ # END Legacy Start/Stop Implementation
+ } else {
+ # generate a local init script for this PKI instance
+ my $local_pki_init_script = new FileHandle;
+ my $local_pki_init_script_name = $pki_instance_path
+ . "/" . $pki_instance_name;
+ my $local_pki_init_script_command = "";
+
+ # create this PKI instance's local init script
+ $local_pki_init_script->open( ">$local_pki_init_script_name" ) or
+ die "Could not open $local_pki_init_script_name\n";
+
+ # publish the appropriate contents to this
+ # PKI instance's local init script
+ $local_pki_init_script->print( "#!/bin/bash\n" );
+ $local_pki_init_script->print( "if [ \$# -ne 1 ]; then\n" );
+ $local_pki_init_script->print( " echo \"Usage: \$0 {start|stop|restart|condrestart|force-restart|try-restart|reload|status}\"\n" );
+ $local_pki_init_script->print( " exit 3\n" );
+ $local_pki_init_script->print( "fi\n\n" );
+
+ if( $^O eq "linux" ) {
+ $local_pki_init_script_command = "/sbin/service"
+ . " " . $pki_init_script
+ . " " . "\$1"
+ . " " . $pki_instance_name;
+ } else {
+ # default case: e. g. - ( $^O eq "solaris" )
+ $local_pki_init_script_command = $default_init_scripts_path
+ . "/" . $pki_init_script
+ . " " . "\$1"
+ . " " . $pki_instance_name;
+ }
+ $local_pki_init_script->print( "$local_pki_init_script_command\n\n" );
- ## Populate instances (CA instances)
- # if( $subsystem_type eq $CA ) {
- # }
+ # close and save this PKI instance's local init script
+ $local_pki_init_script->close();
+
+ #
+ # NOTE: This PKI instance's local init script requires
+ # "$root_user:$root_group" ownership since the
+ # destination that it refers to is owned by
+ # "$root_user:$root_group".
+ #
+ $result = give_file_to( $local_pki_init_script_name,
+ $root_user,
+ $root_group );
+ if( !$result ) {
+ emit( "$local_pki_init_script_name ownership problems!",
+ "error" );
+ return 0;
+ }
+
+ chmod( $default_exe_permissions,
+ $local_pki_init_script_name );
+ }
## Populate instances (RA, TPS instances)
@@ -3106,6 +3299,179 @@ sub process_pki_security_modules()
return 1;
}
+# no args
+# return 1 - success, or
+# return 0 - failure
+sub build_pki_registry_subsystem_path()
+{
+ my $result = 0;
+
+ # Establish PKI subsystem-level registry
+ $pki_registry_subsystem_path = $pki_registry_path
+ . "/" . $subsystem_type;
+
+ if( !directory_exists( "$pki_registry_subsystem_path" ) ) {
+ # create pki registry for this subsystem
+ $result = create_directory( "$pki_registry_subsystem_path" );
+ if( !$result ) {
+ emit( "Failed to create directory "
+ . "$pki_registry_subsystem_path ...\n" );
+ return 0;
+ }
+ }
+
+ return 1;
+}
+
+# no args
+# return 1 - success, or
+# return 0 - failure
+sub construct_pki_instance_registry()
+{
+ my $result = 0;
+
+ # generate a registry entry for this PKI instance
+ $pki_instance_registry = new FileHandle;
+ $pki_instance_registry_entry = $pki_registry_subsystem_path
+ . "/" . $pki_instance_name;
+
+ # create this PKI instance's registry entry
+ $pki_instance_registry->open( ">$pki_instance_registry_entry" ) or
+ die "Could not open $pki_instance_registry_entry\n";
+
+ # publish the appropriate contents to this PKI instance's registry entry
+ if( $subsystem_type eq $CA ||
+ $subsystem_type eq $KRA ||
+ $subsystem_type eq $OCSP ||
+ $subsystem_type eq $TKS ) {
+ $pki_instance_registry->print( "# Establish PKI Variable \"Slot\" "
+ . "Substitutions\n\n" );
+ $pki_instance_registry->print( "PKI_FLAVOR=$pki_flavor\n" );
+ $pki_instance_registry->print( "export PKI_FLAVOR\n\n" );
+ $pki_instance_registry->print( "PKI_GROUP=$pki_group\n" );
+ $pki_instance_registry->print( "export PKI_GROUP\n\n" );
+ $pki_instance_registry->print( "PKI_INSTANCE_ID=$pki_instance_name\n" );
+ $pki_instance_registry->print( "export PKI_INSTANCE_ID\n\n" );
+ $pki_instance_registry->print( "PKI_INSTANCE_PATH="
+ . "$pki_instance_path\n" );
+ $pki_instance_registry->print( "export PKI_INSTANCE_PATH\n\n" );
+ $pki_instance_registry->print( "PKI_SERVER_XML_CONF="
+ . "$server_xml_instance_file_path\n" );
+ $pki_instance_registry->print( "export PKI_SERVER_XML_CONF\n\n" );
+ $pki_instance_registry->print( "PKI_SUBSYSTEM_TYPE=$subsystem_type\n" );
+ $pki_instance_registry->print( "export PKI_SUBSYSTEM_TYPE\n\n" );
+ $pki_instance_registry->print( "PKI_USER=$pki_user\n" );
+ $pki_instance_registry->print( "export PKI_USER\n\n" );
+ $pki_instance_registry->print( "# Use CATALINA_BASE\n\n" );
+ $pki_instance_registry->print( "CATALINA_BASE="
+ . "\${PKI_INSTANCE_PATH}\n" );
+ $pki_instance_registry->print( "export CATALINA_BASE\n\n" );
+ $pki_instance_registry->print( "# Get Tomcat config\n\n" );
+ $pki_instance_registry->print( "TOMCAT_CFG=\"\${PKI_INSTANCE_PATH}/"
+ . "conf/tomcat5.conf\"\n" );
+ $pki_instance_registry->print( "export TOMCAT_CFG\n\n" );
+ $pki_instance_registry->print( "[ -r \"\$TOMCAT_CFG\" ] && "
+ . ". \"\${TOMCAT_CFG}\"\n\n" );
+ $pki_instance_registry->print( "# Path to the tomcat launch script "
+ . "(direct don't use wrapper)\n" );
+ $pki_instance_registry->print( "TOMCAT_SCRIPT=/usr/bin/"
+ . "dtomcat5-\${PKI_INSTANCE_ID}\n" );
+ $pki_instance_registry->print( "export TOMCAT_SCRIPT\n\n" );
+ $pki_instance_registry->print( "# Path to the script that will "
+ . "refresh jar symlinks on startup\n" );
+ $pki_instance_registry->print( "if [ \${OS} = \"Linux\" ] ; then\n" );
+ $pki_instance_registry->print( " TOMCAT_RELINK_SCRIPT=\"/usr/share/"
+ . "tomcat5/bin/relink\"\n" );
+ $pki_instance_registry->print( " export TOMCAT_RELINK_SCRIPT\n" );
+ $pki_instance_registry->print( "fi\n\n" );
+ $pki_instance_registry->print( "# Tomcat name :)\n" );
+ $pki_instance_registry->print( "TOMCAT_PROG=\${PKI_INSTANCE_ID}\n" );
+ $pki_instance_registry->print( "export TOMCAT_PROG\n\n" );
+ $pki_instance_registry->print( "# if TOMCAT_USER is not set, use "
+ . "tomcat5 like Apache HTTP server\n" );
+ $pki_instance_registry->print( "if [ -z \"\$TOMCAT_USER\" ]; then\n" );
+ $pki_instance_registry->print( " TOMCAT_USER=\"\${PKI_USER}\"\n" );
+ $pki_instance_registry->print( " export TOMCAT_USER\n" );
+ $pki_instance_registry->print( "fi\n\n" );
+ $pki_instance_registry->print( "# if TOMCAT_GROUP is not set, use "
+ . "tomcat5 like Apache HTTP server\n" );
+ $pki_instance_registry->print( "if [ -z \"\$TOMCAT_GROUP\" ]; then\n" );
+ $pki_instance_registry->print( " TOMCAT_GROUP=\"\${PKI_GROUP}\"\n" );
+ $pki_instance_registry->print( " export TOMCAT_GROUP\n" );
+ $pki_instance_registry->print( "fi\n\n" );
+ $pki_instance_registry->print( "# Since the daemon function will "
+ . "sandbox \$tomcat\n" );
+ $pki_instance_registry->print( "# no environment stuff should be "
+ . "defined here anymore.\n" );
+ $pki_instance_registry->print( "# Please use the "
+ . "\${PKI_INSTANCE_PATH}/conf/"
+ . "tomcat5.conf\n" );
+ $pki_instance_registry->print( "# file instead ; it will be read by "
+ . "the \$tomcat script\n\n" );
+ $pki_instance_registry->print( "PKI_LOCKDIR="
+ . "\"/var/lock/$pki_flavor/"
+ . "$subsystem_type\"\n" );
+ $pki_instance_registry->print( "export PKI_LOCKDIR\n" );
+ $pki_instance_registry->print( "PKI_LOCKFILE="
+ . "\"\${PKI_LOCKDIR}/"
+ . "\${PKI_INSTANCE_ID}.pid\"\n" );
+ $pki_instance_registry->print( "export PKI_LOCKFILE\n" );
+ $pki_instance_registry->print( "PKI_PIDFILE="
+ . "\"\${PKI_INSTANCE_ID}.pid\"\n" );
+ $pki_instance_registry->print( "export PKI_PIDFILE\n" );
+ $pki_instance_registry->print( "pki_instance_configuration_file="
+ . "\${PKI_INSTANCE_PATH}/conf/CS.cfg\n" );
+ $pki_instance_registry->print( "export "
+ . "pki_instance_configuration_file\n\n" );
+ $pki_instance_registry->print( "RESTART_SERVER=\${PKI_INSTANCE_PATH}/"
+ . "conf/"
+ . "restart_server_after_configuration\n" );
+ $pki_instance_registry->print( "export RESTART_SERVER\n\n" );
+# } elsif( $subsystem_type eq $RA ||
+# $subsystem_type eq $TPS ) {
+ }
+
+ # close and save this PKI instance's registry entry
+ $pki_instance_registry->close();
+
+ $result = give_file_to( $pki_instance_registry_entry,
+ $root_user,
+ $root_group );
+ if( !$result ) {
+ emit( "$pki_instance_registry_entry ownership problems!",
+ "error" );
+ return 0;
+ }
+
+ chmod( $default_file_permissions,
+ $pki_instance_registry_entry );
+
+ push( @installed_files,
+ $pki_instance_registry_entry );
+
+ return 1;
+}
+
+# no args
+# return 1 - success, or
+# return 0 - failure
+sub register_pki_instance()
+{
+ my $result = 0;
+
+ $result = build_pki_registry_subsystem_path();
+ if( !$result ) {
+ return 0;
+ }
+
+ $result = construct_pki_instance_registry();
+ if( !$result ) {
+ return 0;
+ }
+
+ return 1;
+}
+
sub parse_selinux_ports()
{
open SM, '/usr/sbin/semanage port -l |grep tcp |sed \'s/tcp/___/g\'|sed \'s/\s//g\'|';
@@ -3233,13 +3599,17 @@ sub process_pki_selinux_setup()
system("$restorecon -F -R /usr/bin/dtomcat5-$pki_instance_name");
}
- # set file context for /etc/rc.d/init.d/$pki_instance_name"
- if ($pki_instance_name ne $default_inst_name) {
- &add_selinux_file_context($setype . "_script_exec_t",
- "/etc/rc\\.d/init\\.d/$pki_instance_name", "f");
- }
- emit("Restorecon file context for /etc/rc.d/init.d/$pki_instance_name\n");
- system("$restorecon -F -R /etc/rc.d/init.d/$pki_instance_name");
+ # BEGIN Legacy Start/Stop Implementation
+ if( $subsystem_type ne $CA ) {
+ # set file context for /etc/rc.d/init.d/$pki_instance_name"
+ if ($pki_instance_name ne $default_inst_name) {
+ &add_selinux_file_context($setype . "_script_exec_t",
+ "/etc/rc\\.d/init\\.d/$pki_instance_name", "f");
+ }
+ emit("Restorecon file context for /etc/rc.d/init.d/$pki_instance_name\n");
+ system("$restorecon -F -R /etc/rc.d/init.d/$pki_instance_name");
+ }
+ # END Legacy Start/Stop Implementation
# set file context for $pki_instance_root/$pki_instance_name
if (($pki_instance_name ne $default_inst_name) || ($pki_instance_root ne $default_inst_root)) {
@@ -3370,6 +3740,18 @@ sub install_pki_instance()
return 0;
}
+ if( $subsystem_type eq $CA ) {
+ $result = register_pki_instance();
+ if( !$result ) {
+ return 0;
+ }
+# BEGIN Legacy Start/Stop Implementation
+# } else {
+# # Instance Registration ONLY applies
+# # to the new Start/Stop Implementation
+# END Legacy Start/Stop Implementation
+ }
+
if (($^O eq "linux") && ( is_Fedora() || (is_RHEL() && (! is_RHEL4())))){
$result = process_pki_selinux_setup();
if (!result ) {
@@ -3469,6 +3851,20 @@ sub cleanup()
}
}
+ # If empty, remove the PKI subsystem-level registry
+ if( directory_exists( $pki_registry_subsystem_path ) ) {
+ if( is_directory_empty( $pki_registry_subsystem_path ) ) {
+ remove_directory( $pki_registry_subsystem_path );
+ }
+ }
+
+ # If empty, remove the PKI-level registry
+ if( directory_exists( $pki_registry_path ) ) {
+ if( is_directory_empty( $pki_registry_path ) ) {
+ remove_directory( $pki_registry_path );
+ }
+ }
+
return;
}
@@ -3559,36 +3955,61 @@ ASK_AGAIN:
exit 255;
}
- # Register this instance with "chkconfig"
- if( $^O eq "linux" ) {
- my $runlevel = $DEFAULT_RUNLEVEL;
- my $start_priority = $DEFAULT_START_PRIORITY;
- my $stop_priority = $DEFAULT_STOP_PRIORITY;
+ # BEGIN Legacy Start/Stop Implementation
+ if( $subsystem_type ne $CA ) {
+ # Register this instance with "chkconfig"
+ if( $^O eq "linux" ) {
+ my $runlevel = $DEFAULT_RUNLEVEL;
+ my $start_priority = $DEFAULT_START_PRIORITY;
+ my $stop_priority = $DEFAULT_STOP_PRIORITY;
- # Extract "chkconfig" parameters from instance start/stop script
- ( $runlevel, $start_priority, $stop_priority ) =
- extract_chkconfig_parameters_from_start_stop_script(
- $pki_start_stop_script_instance_file_path );
- emit( "Setting '$pki_instance_name' runlevel "
- . "to '$runlevel'\n" );
- emit( "Setting '$pki_instance_name' start priority "
- . "to '$start_priority'\n" );
- emit( "Setting '$pki_instance_name' stop priority "
- . "to '$stop_priority'\n" );
+ # Extract "chkconfig" parameters from instance start/stop script
+ ( $runlevel, $start_priority, $stop_priority ) =
+ extract_chkconfig_parameters_from_start_stop_script(
+ $pki_start_stop_script_instance_file_path );
+ emit( "Setting '$pki_instance_name' runlevel "
+ . "to '$runlevel'\n" );
+ emit( "Setting '$pki_instance_name' start priority "
+ . "to '$start_priority'\n" );
+ emit( "Setting '$pki_instance_name' stop priority "
+ . "to '$stop_priority'\n" );
- # Register this instance with '/sbin/chkconfig'
- register_pki_instance_with_chkconfig( $pki_instance_name );
+ # Register this instance with '/sbin/chkconfig'
+ register_pki_instance_with_chkconfig( $pki_instance_name );
+ }
}
+ # END Legacy Start/Stop Implementation
# Activate this instance
if( $^O eq "linux" ) {
- $pki_start_stop_command = "/sbin/service" . " " . $pki_instance_name;
+ if( $subsystem_type ne $CA ) {
+ # BEGIN Legacy Start/Stop Implementation
+ $pki_init_script_command = "/sbin/service"
+ . " " . $pki_instance_name
+ . " " . "restart";
+ # END Legacy Start/Stop Implementation
+ } else {
+ $pki_init_script_command = "/sbin/service"
+ . " " . $pki_init_script
+ . " " . "restart"
+ . " " . $pki_instance_name;
+ }
} else {
# default case: e. g. - ( $^O eq "solaris" )
- $pki_start_stop_command = $pki_start_stop_script_instance_file_path;
+ if( $subsystem_type ne $CA ) {
+ # BEGIN Legacy Start/Stop Implementation
+ $pki_init_script_command = $pki_start_stop_script_instance_file_path
+ . " " . "restart";
+ # END Legacy Start/Stop Implementation
+ } else {
+ $pki_init_script_command = $default_init_scripts_path
+ . "/" . $pki_init_script
+ . " " . "restart"
+ . " " . $pki_instance_name;
+ }
}
- $command = "$pki_start_stop_command start";
+ $command = "$pki_init_script_command";
system( "$command" );
@@ -3641,11 +4062,9 @@ ASK_AGAIN:
print( STDOUT
"After configuration, the server can be operated by the command:\n\n"
- . " $pki_start_stop_command "
- . "start | stop | restart\n\n" );
+ . " $pki_init_script_command\n\n" );
emit( "After configuration, the server can be operated by the command:\n"
- . "$pki_start_stop_command "
- . "start | stop | restart\n",
+ . "$pki_init_script_command\n",
"log" );
# If it exists, close the log file
diff --git a/pki/base/setup/pkiremove b/pki/base/setup/pkiremove
index 74393cc2c..206716cd7 100755
--- a/pki/base/setup/pkiremove
+++ b/pki/base/setup/pkiremove
@@ -155,16 +155,40 @@ my $force = 0;
my $pki_instance_path = "";
my $subsystem_type = "";
+# PKI init script variables
+my $default_init_scripts_path = "";
+my $pki_init_script = "";
+my $pki_init_script_command = "";
+
+# PKI registry variables
+my $default_registry_path = "";
+my $pki_registry_path = "";
+my $pki_registry_subsystem_path = "";
##############################################################
# Platform-Dependent Data Initialization
##############################################################
+if( $^O eq "linux" ) {
+ $default_init_scripts_path = "/etc/rc\\.d/init\\.d";
+ $default_registry_path = "/etc/sysconfig";
+} elsif( $^O eq "solaris" ) {
+ $default_init_scripts_path = "/etc/init\\.d";
+ $default_registry_path = "/etc/inet";
+} else {
+ print( STDERR
+ "ERROR: Unsupported platform '$^O'!\n" );
+ print( STDOUT "\n" );
+ exit 255;
+}
##############################################################
# Local Data Initialization
##############################################################
+# Establish PKI-level registry
+$pki_registry_path = $default_registry_path
+ . "/" . $pki_flavor;
##############################################################
# PKI Instance Removal Subroutines
@@ -196,7 +220,7 @@ sub usage()
print( STDOUT
"Example: pkiremove -pki_instance_root=/var/lib "
- . "-pki_instance_name=$pki_flavor-ca1\n\n " );
+ . "-pki_instance_name=pki-ca\n\n " );
print( STDOUT
"IMPORTANT: Must be run as root!\n\n" );
@@ -377,10 +401,14 @@ sub remove_selinux_fcontexts()
"/usr/bin/dtomcat5-$pki_instance_name", "f");
}
- # remove context for /etc/rc.d/init.d/$pki_instance_name
- if ($pki_instance_name ne $default_inst_name) {
- &remove_fcontext($setype . "_script_exec_t",
- "/etc/rc\\.d/init\\.d/$pki_instance_name", "f");
+ # For backwards compatibility, support removal of instances
+ # which use the legacy start/stop implementation
+ if( entity_exists( "$default_init_scripts_path/$pki_instance_name" ) ) {
+ # remove context for "$default_init_scripts_path/$pki_instance_name"
+ if( $pki_instance_name ne $default_inst_name ) {
+ &remove_fcontext( $setype . "_script_exec_t",
+ "/etc/rc\\.d/init\\.d/$pki_instance_name", "f" );
+ }
}
# remove context for $pki_instance_root/$pki_instance_name
@@ -508,10 +536,12 @@ sub remove_instance()
. "/" . $saved_cleanup_file_name;
my @files;
my @directories;
- my $pki_start_stop_command = "";
- my $pki_start_stop_script_instance_file_path = "";
my $confirm = "Y";
+ # For backwards compatibility, support removal of instances
+ # which use the legacy start/stop implementation
+ my $pki_start_stop_script_instance_file_path = "";
+
ASK_AGAIN:
if( !$force ) {
$confirm = prompt( "You have elected to remove the instance "
@@ -570,8 +600,12 @@ ASK_AGAIN:
@file_split = split( '/', $line );
my $last = @file_split;
- if( $file_split[$last -1] eq $pki_instance_name ) {
- $pki_start_stop_script_instance_file_path = $line;
+ # For backwards compatibility, support removal of instances
+ # which use the legacy start/stop implementation
+ if( entity_exists( "$default_init_scripts_path/$pki_instance_name" ) ) {
+ if( $file_split[$last -1] eq $pki_instance_name ) {
+ $pki_start_stop_script_instance_file_path = $line;
+ }
}
}
@@ -582,31 +616,75 @@ ASK_AGAIN:
$cleanup->close();
- if( $pki_start_stop_script_instance_file_path eq "" ) {
- print( STDERR
- "ERROR: Can't locate start script of "
- . "instance to be cleaned up!\n" );
- return $result;
+ # For backwards compatibility, support removal of instances
+ # which use the legacy start/stop implementation
+ if( entity_exists( "$default_init_scripts_path/$pki_instance_name" ) ) {
+ if( $pki_start_stop_script_instance_file_path eq "" ) {
+ print( STDERR
+ "ERROR: Can't locate start script of "
+ . "instance to be cleaned up!\n" );
+ return $result;
+ }
}
# De-register this instance with "chkconfig"
if( $^O eq "linux" ) {
- # De-register this instance with '/sbin/chkconfig'
- print( STDOUT "\n" );
- print( STDOUT
- "De-registering '$pki_instance_name' from "
- . "'/sbin/chkconfig'.\n" );
- deregister_pki_instance_with_chkconfig( $pki_instance_name );
+ # For backwards compatibility, support removal of instances
+ # which use the legacy start/stop implementation
+ if( entity_exists( "$default_init_scripts_path/$pki_instance_name" ) ) {
+ # De-register this instance with '/sbin/chkconfig'
+ print( STDOUT "\n" );
+ print( STDOUT
+ "De-registering '$pki_instance_name' from "
+ . "'/sbin/chkconfig'.\n" );
+ deregister_pki_instance_with_chkconfig( $pki_instance_name );
+ }
}
+ if( $subsystem_type eq $CA ) {
+ $pki_init_script = $CA_INIT_SCRIPT;
+ } elsif( $subsystem_type eq $KRA ) {
+ $pki_init_script = $KRA_INIT_SCRIPT;
+ } elsif( $subsystem_type eq $OCSP ) {
+ $pki_init_script = $OCSP_INIT_SCRIPT;
+ } elsif( $subsystem_type eq $RA ) {
+ $pki_init_script = $RA_INIT_SCRIPT;
+ } elsif( $subsystem_type eq $TKS ) {
+ $pki_init_script = $TKS_INIT_SCRIPT;
+ } elsif( $subsystem_type eq $TPS ) {
+ $pki_init_script = $TPS_INIT_SCRIPT;
+ }
+
+ # Shutdown this instance
if( $^O eq "linux" ) {
- $pki_start_stop_command = "/sbin/service" . " " . $pki_instance_name;
+ if( entity_exists( "$default_init_scripts_path/$pki_instance_name" ) ) {
+ # For backwards compatibility, support removal of instances
+ # which use the legacy start/stop implementation
+ $pki_init_script_command = "/sbin/service"
+ . " " . $pki_instance_name
+ . " " . "stop";
+ } else {
+ $pki_init_script_command = "/sbin/service"
+ . " " . $pki_init_script
+ . " " . "stop"
+ . " " . $pki_instance_name;
+ }
} else {
# default case: e. g. - ( $^O eq "solaris" )
- $pki_start_stop_command = $pki_start_stop_script_instance_file_path;
+ if( entity_exists( "$default_init_scripts_path/$pki_instance_name" ) ) {
+ # For backwards compatibility, support removal of instances
+ # which use the legacy start/stop implementation
+ $pki_init_script_command = $pki_start_stop_script_instance_file_path
+ . " " . "stop";
+ } else {
+ $pki_init_script_command = $default_init_scripts_path
+ . "/" . $pki_init_script
+ . " " . "stop"
+ . " " . $pki_instance_name;
+ }
}
- $command = "$pki_start_stop_command stop";
+ $command = "$pki_init_script_command";
system( "$command" );
@@ -721,6 +799,24 @@ sub main()
exit 255;
}
+ # Establish PKI subsystem-level registry
+ $pki_registry_subsystem_path = $pki_registry_path
+ . "/" . $subsystem_type;
+
+ # If empty, remove the PKI subsystem-level registry
+ if( directory_exists( $pki_registry_subsystem_path ) ) {
+ if( is_directory_empty( $pki_registry_subsystem_path ) ) {
+ remove_directory( $pki_registry_subsystem_path );
+ }
+ }
+
+ # If empty, remove the PKI-level registry
+ if( directory_exists( $pki_registry_path ) ) {
+ if( is_directory_empty( $pki_registry_path ) ) {
+ remove_directory( $pki_registry_path );
+ }
+ }
+
return $result;
}
diff --git a/pki/base/silent/LICENSE b/pki/base/silent/LICENSE
index e36f2269a..e281f4362 100644
--- a/pki/base/silent/LICENSE
+++ b/pki/base/silent/LICENSE
@@ -11,26 +11,6 @@ You should have received a copy of the GNU General Public License
along with this Program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
-In addition, as a special exception, Red Hat, Inc. gives You the additional
-right to link the code of this Program with code not covered under the GNU
-General Public License ("Non-GPL Code") and to distribute linked combinations
-including the two, subject to the limitations in this paragraph. Non-GPL
-Code permitted under this exception must only link to the code of this
-Program through those well defined interfaces identified in the file named
-EXCEPTION found in the source code files (the "Approved Interfaces").
-
-The files of Non-GPL Code may instantiate templates or use macros or inline
-functions from the Approved Interfaces without causing the resulting work to
-be covered by the GNU General Public License. Only Red Hat, Inc. may make
-changes or additions to the list of Approved Interfaces. You must obey the
-GNU General Public License in all respects for all of the Program code and
-other code used in conjunction with the Program except the Non-GPL Code
-covered by this exception. If you modify this file, you may extend this
-exception to your version of the file, but you are not obligated to do so.
-If you do not wish to provide this exception without modification, you must
-delete this exception statement from your version and license this file
-solely under the GPL without exception.
-
GNU GENERAL PUBLIC LICENSE
Version 2, June 1991
diff --git a/pki/base/silent/templates/subca_silent.template b/pki/base/silent/templates/subca_silent.template
index 06b930ef8..b37551099 100755
--- a/pki/base/silent/templates/subca_silent.template
+++ b/pki/base/silent/templates/subca_silent.template
@@ -139,7 +139,7 @@ pki_host=`hostname`
ca_subsystem_name="Certificate\ Authority"
## PKI Subsystem Instance Names
-subca_instance_name="pki-ca1"
+subca_instance_name="pki-subca"
##
## NOTE: Default PKI Instance Ports
@@ -158,7 +158,7 @@ subca_instance_name="pki-ca1"
## semanage port -l | grep pki
##
## pki_ca_port_t tcp 9180, 9701, 9443, 9444, 9445
-## pki_ca1_port_t tcp 9580, 9801, 9543, 9544, 9545
+## pki_subca_port_t tcp 9580, 9801, 9543, 9544, 9545
##
## CA ports
generated by cgit (git 2.34.1) at 2026-04-15 21:00:37 +0000