diff options
Diffstat (limited to 'base')
-rw-r--r-- | base/ra/CMakeLists.txt | 18 | ||||
-rw-r--r-- | base/ra/apache/conf/httpd.conf | 22 | ||||
-rw-r--r-- | base/ra/apache/conf/perl.conf | 6 | ||||
-rw-r--r-- | base/ra/lib/systemd/system/pki-rad.target | 6 | ||||
-rw-r--r-- | base/ra/lib/systemd/system/pki-rad@.service | 12 | ||||
-rw-r--r-- | base/ra/setup/pkidaemon_registry | 2 | ||||
-rw-r--r-- | base/ra/setup/registry_instance | 2 | ||||
-rw-r--r-- | base/selinux/src/pki.if | 2 | ||||
-rwxr-xr-x | base/setup/pkicreate | 21 | ||||
-rwxr-xr-x | base/setup/scripts/pki_apache_initscript | 9 | ||||
-rw-r--r-- | base/tps/CMakeLists.txt | 18 | ||||
-rw-r--r-- | base/tps/apache/conf/httpd.conf | 35 | ||||
-rw-r--r-- | base/tps/apache/conf/perl.conf | 6 | ||||
-rw-r--r-- | base/tps/lib/systemd/system/pki-tpsd.target | 6 | ||||
-rw-r--r-- | base/tps/lib/systemd/system/pki-tpsd@.service | 12 | ||||
-rw-r--r-- | base/tps/setup/pkidaemon_registry | 2 | ||||
-rw-r--r-- | base/tps/setup/registry_instance | 2 |
17 files changed, 117 insertions, 64 deletions
diff --git a/base/ra/CMakeLists.txt b/base/ra/CMakeLists.txt index 59910fe95..79152e291 100644 --- a/base/ra/CMakeLists.txt +++ b/base/ra/CMakeLists.txt @@ -3,6 +3,19 @@ project(ra) add_subdirectory(doc) add_subdirectory(setup) +# install systemd scripts +install( + FILES + lib/systemd/system/pki-rad.target + lib/systemd/system/pki-rad@.service + DESTINATION + ${SYSTEMD_LIB_INSTALL_DIR} + PERMISSIONS + OWNER_EXECUTE OWNER_WRITE OWNER_READ + GROUP_EXECUTE GROUP_READ + WORLD_EXECUTE WORLD_READ +) + # install init script install( FILES @@ -74,3 +87,8 @@ install( ${VAR_INSTALL_DIR}/run/pki/ra ) +install( + DIRECTORY + DESTINATION + ${SYSTEMD_ETC_INSTALL_DIR}/pki-rad.target.wants +) diff --git a/base/ra/apache/conf/httpd.conf b/base/ra/apache/conf/httpd.conf index f89e43b33..180c08de0 100644 --- a/base/ra/apache/conf/httpd.conf +++ b/base/ra/apache/conf/httpd.conf @@ -232,8 +232,13 @@ Listen [PORT] # LoadModule foo_module modules/mod_foo.so # -# Required modules for command 'Order': +# MPM worker module is a loadable module as of 2.4 +LoadModule mpm_worker_module /etc/httpd/modules/mod_mpm_worker.so + +LoadModule authz_core_module /etc/httpd/modules/mod_authz_core.so [FORTITUDE_AUTH_MODULES] +# Module for User and Group +LoadModule unixd_module /etc/httpd/modules/mod_unixd.so # Required module for command 'UserDir': LoadModule userdir_module [FORTITUDE_LIB_DIR]/modules/mod_userdir.so # Required module for command 'DirectoryIndex': @@ -394,8 +399,7 @@ DocumentRoot "[SERVER_ROOT]/docroot" # # Controls who can get stuff from this server. # - Order allow,deny - Allow from all + Require all granted </Directory> @@ -444,8 +448,7 @@ AccessFileName .htaccess # viewed by Web clients. # <Files ~ "^\.ht"> - Order allow,deny - Deny from all + Require all denied </Files> # @@ -592,8 +595,7 @@ Alias /icons/ "[SERVER_ROOT]/icons/" <Directory "[SERVER_ROOT]/icons"> Options Indexes MultiViews AllowOverride None - Order allow,deny - Allow from all + Require all granted </Directory> # @@ -606,8 +608,7 @@ AliasMatch ^/manual(?:/(?:de|en|es|fr|ja|ko|ru))?(/.*)?$ "[SERVER_ROOT]/manual$1 <Directory "[SERVER_ROOT]/manual"> Options Indexes AllowOverride None - Order allow,deny - Allow from all + Require all granted <Files *.html> SetHandler type-map @@ -642,8 +643,7 @@ ScriptAlias /cgi-bin/ "[SERVER_ROOT]/cgi-bin/" <Directory "[SERVER_ROOT]/cgi-bin"> AllowOverride None Options ExecCGI - Order allow,deny - Allow from all + Require all granted </Directory> # diff --git a/base/ra/apache/conf/perl.conf b/base/ra/apache/conf/perl.conf index 50139cdab..02a503f74 100644 --- a/base/ra/apache/conf/perl.conf +++ b/base/ra/apache/conf/perl.conf @@ -58,15 +58,13 @@ PerlSetEnv PKI_ROOT [SERVER_ROOT] <Location /ra/admin/console/config/wizard> SetHandler perl-script PerlHandler PKI::RA::Wizard - Order deny,allow - Allow from all + Require all granted </Location> <Location /ra/admin/console/config/login> SetHandler perl-script PerlHandler PKI::RA::Login - Order deny,allow - Allow from all + Require all granted </Location> PerlModule ModPerl::PerlRun diff --git a/base/ra/lib/systemd/system/pki-rad.target b/base/ra/lib/systemd/system/pki-rad.target new file mode 100644 index 000000000..e1a4f808e --- /dev/null +++ b/base/ra/lib/systemd/system/pki-rad.target @@ -0,0 +1,6 @@ +[Unit] +Description=PKI Registration Authority Server +After=syslog.target network.target + +[Install] +WantedBy=multi-user.target diff --git a/base/ra/lib/systemd/system/pki-rad@.service b/base/ra/lib/systemd/system/pki-rad@.service new file mode 100644 index 000000000..5432c62b2 --- /dev/null +++ b/base/ra/lib/systemd/system/pki-rad@.service @@ -0,0 +1,12 @@ +[Unit] +Description=PKI Registration Authority Server %i +After=pki-rad.target +BindTo=pki-rad.target + +[Service] +Type=forking +ExecStart=/usr/bin/pkicontrol start ra %i +ExecStop=/usr/bin/pkicontrol stop ra %i + +[Install] +WantedBy=multi-user.target diff --git a/base/ra/setup/pkidaemon_registry b/base/ra/setup/pkidaemon_registry index 8d23dda05..2e81158ef 100644 --- a/base/ra/setup/pkidaemon_registry +++ b/base/ra/setup/pkidaemon_registry @@ -62,7 +62,7 @@ export RESTART_SERVER # available, but does not work with some modules (such as PHP). # The service must be stopped before changing this variable. # -PKI_HTTPD=${PKI_FORTITUDE_DIR}/sbin/httpd.worker +PKI_HTTPD=${PKI_FORTITUDE_DIR}/sbin/httpd export PKI_HTTPD # diff --git a/base/ra/setup/registry_instance b/base/ra/setup/registry_instance index f8cae5a43..5be7a4de0 100644 --- a/base/ra/setup/registry_instance +++ b/base/ra/setup/registry_instance @@ -59,7 +59,7 @@ export RESTART_SERVER # available, but does not work with some modules (such as PHP). # The service must be stopped before changing this variable. # -PKI_HTTPD=${PKI_FORTITUDE_DIR}/sbin/httpd.worker +PKI_HTTPD=${PKI_FORTITUDE_DIR}/sbin/httpd export PKI_HTTPD # diff --git a/base/selinux/src/pki.if b/base/selinux/src/pki.if index b456ac995..4272bd0c5 100644 --- a/base/selinux/src/pki.if +++ b/base/selinux/src/pki.if @@ -168,7 +168,7 @@ template(`pki_tomcat_template',` miscfiles_read_localization($1_t) miscfiles_read_hwdata($1_t) - miscfiles_manage_cert_dirs($1_t) + miscfiles_manage_generic_cert_dirs($1_t) miscfiles_manage_generic_cert_files($1_t) logging_send_syslog_msg($1_t) diff --git a/base/setup/pkicreate b/base/setup/pkicreate index cc4ee703f..e3ee5a0ab 100755 --- a/base/setup/pkicreate +++ b/base/setup/pkicreate @@ -2870,6 +2870,17 @@ sub process_pki_files_and_symlinks "${db_password}\n", $default_file_permissions, $pki_user, $pki_group); + ## Populate systemd links + if ($use_systemd) { + return 0 if !create_symlink( + "${pki_subsystem_systemd_wants_path}/${pki_instance_systemd_service_name}", + "$pki_subsystem_systemd_service_path", + $root_user, $root_group); + + # reload systemd configuration + run_command("/bin/systemctl --system daemon-reload"); + } + ## Populate instances (RA, TPS instances) if ($subsystem_type eq $RA || $subsystem_type eq $TPS) { # create an empty file called "pwcache.conf" for this @@ -2893,16 +2904,6 @@ sub process_pki_files_and_symlinks # to find our tomcat6 configuration file in /etc/sysconfig return 0 if !create_symlink($pki_instance_initscript_path, $tomcat6_initscript_path, $root_user, $root_group); - if ($use_systemd) { - return 0 if !create_symlink( - "${pki_subsystem_systemd_wants_path}/${pki_instance_systemd_service_name}", - "$pki_subsystem_systemd_service_path", - $root_user, $root_group); - - # reload systemd configuration - run_command("/bin/systemctl --system daemon-reload"); - - } return 0 if !create_directory($webinf_lib_instance_path, $default_dir_permissions, $pki_user, $pki_group); diff --git a/base/setup/scripts/pki_apache_initscript b/base/setup/scripts/pki_apache_initscript index e51231065..c50c812a4 100755 --- a/base/setup/scripts/pki_apache_initscript +++ b/base/setup/scripts/pki_apache_initscript @@ -62,11 +62,6 @@ start() fi fi - touch ${pidfile} - chown ${PKI_USER}:${PKI_GROUP} ${pidfile} - chmod 00600 ${pidfile} - [ -x /sbin/restorecon ] && /sbin/restorecon ${pidfile} - # restore context for ncipher hsm [ -x /sbin/restorecon ] && [ -d /dev/nfast ] && /sbin/restorecon -R /dev/nfast @@ -74,13 +69,13 @@ start() rv=$? if [ ${rv} = 0 ] ; then if [ ${ARCHITECTURE} = "i386" ] ; then - LANG=${PKI_HTTPD_LANG} daemon runcon -t ${PKI_SELINUX_TYPE} -- ${httpd} ${PKI_OPTIONS} + LANG=${PKI_HTTPD_LANG} daemon runcon -t ${PKI_SELINUX_TYPE} -r system_r -- ${httpd} ${PKI_OPTIONS} rv=$? # overwrite output from "daemon" echo -n $"Starting ${prog}: " elif [ ${ARCHITECTURE} = "x86_64" ] ; then # NOTE: "daemon" is incompatible with "httpd" on 64-bit architectures - LANG=${PKI_HTTPD_LANG} runcon -t ${PKI_SELINUX_TYPE} -- ${httpd} ${PKI_OPTIONS} + LANG=${PKI_HTTPD_LANG} runcon -t ${PKI_SELINUX_TYPE} -r system_r -- ${httpd} ${PKI_OPTIONS} rv=$? fi else diff --git a/base/tps/CMakeLists.txt b/base/tps/CMakeLists.txt index 96d23fefa..10c4d8efd 100644 --- a/base/tps/CMakeLists.txt +++ b/base/tps/CMakeLists.txt @@ -43,6 +43,19 @@ add_subdirectory(tools) add_subdirectory(doc) add_subdirectory(setup) +# install systemd scripts +install( + FILES + lib/systemd/system/pki-tpsd.target + lib/systemd/system/pki-tpsd@.service + DESTINATION + ${SYSTEMD_LIB_INSTALL_DIR} + PERMISSIONS + OWNER_EXECUTE OWNER_WRITE OWNER_READ + GROUP_EXECUTE GROUP_READ + WORLD_EXECUTE WORLD_READ +) + # install init script install( FILES @@ -206,3 +219,8 @@ install( ${SHARE_INSTALL_PREFIX}/${APPLICATION_NAME}/${PROJECT_NAME}/docroot/tps/admin/console/js ) +install( + DIRECTORY + DESTINATION + ${SYSTEMD_ETC_INSTALL_DIR}/pki-tpsd.target.wants +) diff --git a/base/tps/apache/conf/httpd.conf b/base/tps/apache/conf/httpd.conf index 372066afc..a9410849c 100644 --- a/base/tps/apache/conf/httpd.conf +++ b/base/tps/apache/conf/httpd.conf @@ -78,7 +78,7 @@ ServerRoot "[SERVER_ROOT]" # identification number when it starts. # <IfModule !mpm_netware.c> -PidFile run/[PKI_INSTANCE_ID].pid +PidFile /var/run/pki/tps/[PKI_INSTANCE_ID].pid </IfModule> # @@ -232,8 +232,13 @@ Listen [PORT] # LoadModule foo_module modules/mod_foo.so # -# Required modules for command 'Order': +# MPM worker module is a loadable module as of 2.4 +LoadModule mpm_worker_module /etc/httpd/modules/mod_mpm_worker.so + +LoadModule authz_core_module /etc/httpd/modules/mod_authz_core.so [FORTITUDE_AUTH_MODULES] +# Module for User and Group +LoadModule unixd_module /etc/httpd/modules/mod_unixd.so # Required module for command 'UserDir': LoadModule userdir_module [FORTITUDE_LIB_DIR]/modules/mod_userdir.so # Required module for command 'DirectoryIndex': @@ -398,8 +403,7 @@ DocumentRoot "[SERVER_ROOT]/docroot" # # Controls who can get stuff from this server. # - Order allow,deny - Allow from all + Require all granted </Directory> @@ -448,8 +452,7 @@ AccessFileName .htaccess # viewed by Web clients. # <Files ~ "^\.ht"> - Order allow,deny - Deny from all + Require all denied </Files> # @@ -459,17 +462,6 @@ AccessFileName .htaccess TypesConfig conf/mime.types # -# DefaultType is the default MIME type the server will use for a document -# if it cannot otherwise determine one, such as from filename extensions. -# If your server contains mostly text or HTML documents, "text/plain" is -# a good value. If most of your content is binary, such as applications -# or images, you may want to use "application/octet-stream" instead to -# keep browsers from trying to display binary files as though they are -# text. -# -DefaultType text/plain - -# # The mod_mime_magic module allows the server to use various hints from the # contents of the file itself to determine its type. The MIMEMagicFile # directive tells the module where the hint definitions are located. @@ -596,8 +588,7 @@ Alias /icons/ "[SERVER_ROOT]/icons/" <Directory "[SERVER_ROOT]/icons"> Options Indexes MultiViews AllowOverride None - Order allow,deny - Allow from all + Require all granted </Directory> # @@ -610,8 +601,7 @@ AliasMatch ^/manual(?:/(?:de|en|es|fr|ja|ko|ru))?(/.*)?$ "[SERVER_ROOT]/manual$1 <Directory "[SERVER_ROOT]/manual"> Options Indexes AllowOverride None - Order allow,deny - Allow from all + Require all granted <Files *.html> SetHandler type-map @@ -646,8 +636,7 @@ ScriptAlias /cgi-bin/ "[SERVER_ROOT]/cgi-bin/" <Directory "[SERVER_ROOT]/cgi-bin"> AllowOverride None Options ExecCGI - Order allow,deny - Allow from all + Require all granted </Directory> # diff --git a/base/tps/apache/conf/perl.conf b/base/tps/apache/conf/perl.conf index feb51e860..a1a98c6a0 100644 --- a/base/tps/apache/conf/perl.conf +++ b/base/tps/apache/conf/perl.conf @@ -58,13 +58,11 @@ PerlSetEnv PKI_ROOT [SERVER_ROOT] <Location /tps/admin/console/config/wizard> SetHandler perl-script PerlHandler PKI::TPS::Wizard - Order deny,allow - Allow from all + Require all granted </Location> <Location /tps/admin/console/config/login> SetHandler perl-script PerlHandler PKI::TPS::Login - Order deny,allow - Allow from all + Require all granted </Location> diff --git a/base/tps/lib/systemd/system/pki-tpsd.target b/base/tps/lib/systemd/system/pki-tpsd.target new file mode 100644 index 000000000..37c693b08 --- /dev/null +++ b/base/tps/lib/systemd/system/pki-tpsd.target @@ -0,0 +1,6 @@ +[Unit] +Description=PKI Token Processing Server +After=syslog.target network.target + +[Install] +WantedBy=multi-user.target diff --git a/base/tps/lib/systemd/system/pki-tpsd@.service b/base/tps/lib/systemd/system/pki-tpsd@.service new file mode 100644 index 000000000..6a0d6a343 --- /dev/null +++ b/base/tps/lib/systemd/system/pki-tpsd@.service @@ -0,0 +1,12 @@ +[Unit] +Description=PKI Token Processing Server %i +After=pki-tpsd.target +BindTo=pki-tpsd.target + +[Service] +Type=forking +ExecStart=/usr/bin/pkicontrol start tps %i +ExecStop=/usr/bin/pkicontrol stop tps %i + +[Install] +WantedBy=multi-user.target diff --git a/base/tps/setup/pkidaemon_registry b/base/tps/setup/pkidaemon_registry index 6c13a4955..b74c84317 100644 --- a/base/tps/setup/pkidaemon_registry +++ b/base/tps/setup/pkidaemon_registry @@ -62,7 +62,7 @@ export RESTART_SERVER # available, but does not work with some modules (such as PHP). # The service must be stopped before changing this variable. # -PKI_HTTPD=${PKI_FORTITUDE_DIR}/sbin/httpd.worker +PKI_HTTPD=${PKI_FORTITUDE_DIR}/sbin/httpd export PKI_HTTPD # diff --git a/base/tps/setup/registry_instance b/base/tps/setup/registry_instance index a77b75f4f..cb907eb61 100644 --- a/base/tps/setup/registry_instance +++ b/base/tps/setup/registry_instance @@ -59,7 +59,7 @@ export RESTART_SERVER # available, but does not work with some modules (such as PHP). # The service must be stopped before changing this variable. # -PKI_HTTPD=${PKI_FORTITUDE_DIR}/sbin/httpd.worker +PKI_HTTPD=${PKI_FORTITUDE_DIR}/sbin/httpd export PKI_HTTPD # |