From 7a6b89591732f872db38821c00ec3ce89ef57e7a Mon Sep 17 00:00:00 2001 From: Ade Lee Date: Mon, 13 Aug 2012 14:01:02 -0400 Subject: Changes to get TPS and RA running on dogtag 10 Added systemd scripts for RA and TPS. Modified init scripts and configuration files to use correct directives for httpd 2.4. TPS and RA subsystems are now installable using pkicreate --- base/ra/CMakeLists.txt | 18 ++++++++++++++ base/ra/apache/conf/httpd.conf | 22 ++++++++--------- base/ra/apache/conf/perl.conf | 6 ++--- base/ra/lib/systemd/system/pki-rad.target | 6 +++++ base/ra/lib/systemd/system/pki-rad@.service | 12 +++++++++ base/ra/setup/pkidaemon_registry | 2 +- base/ra/setup/registry_instance | 2 +- base/selinux/src/pki.if | 2 +- base/setup/pkicreate | 21 ++++++++-------- base/setup/scripts/pki_apache_initscript | 9 ++----- base/tps/CMakeLists.txt | 18 ++++++++++++++ base/tps/apache/conf/httpd.conf | 35 +++++++++------------------ base/tps/apache/conf/perl.conf | 6 ++--- base/tps/lib/systemd/system/pki-tpsd.target | 6 +++++ base/tps/lib/systemd/system/pki-tpsd@.service | 12 +++++++++ base/tps/setup/pkidaemon_registry | 2 +- base/tps/setup/registry_instance | 2 +- 17 files changed, 117 insertions(+), 64 deletions(-) create mode 100644 base/ra/lib/systemd/system/pki-rad.target create mode 100644 base/ra/lib/systemd/system/pki-rad@.service create mode 100644 base/tps/lib/systemd/system/pki-tpsd.target create mode 100644 base/tps/lib/systemd/system/pki-tpsd@.service (limited to 'base') diff --git a/base/ra/CMakeLists.txt b/base/ra/CMakeLists.txt index 59910fe95..79152e291 100644 --- a/base/ra/CMakeLists.txt +++ b/base/ra/CMakeLists.txt @@ -3,6 +3,19 @@ project(ra) add_subdirectory(doc) add_subdirectory(setup) +# install systemd scripts +install( + FILES + lib/systemd/system/pki-rad.target + lib/systemd/system/pki-rad@.service + DESTINATION + ${SYSTEMD_LIB_INSTALL_DIR} + PERMISSIONS + OWNER_EXECUTE OWNER_WRITE OWNER_READ + GROUP_EXECUTE GROUP_READ + WORLD_EXECUTE WORLD_READ +) + # install init script install( FILES @@ -74,3 +87,8 @@ install( ${VAR_INSTALL_DIR}/run/pki/ra ) +install( + DIRECTORY + DESTINATION + ${SYSTEMD_ETC_INSTALL_DIR}/pki-rad.target.wants +) diff --git a/base/ra/apache/conf/httpd.conf b/base/ra/apache/conf/httpd.conf index f89e43b33..180c08de0 100644 --- a/base/ra/apache/conf/httpd.conf +++ b/base/ra/apache/conf/httpd.conf @@ -232,8 +232,13 @@ Listen [PORT] # LoadModule foo_module modules/mod_foo.so # -# Required modules for command 'Order': +# MPM worker module is a loadable module as of 2.4 +LoadModule mpm_worker_module /etc/httpd/modules/mod_mpm_worker.so + +LoadModule authz_core_module /etc/httpd/modules/mod_authz_core.so [FORTITUDE_AUTH_MODULES] +# Module for User and Group +LoadModule unixd_module /etc/httpd/modules/mod_unixd.so # Required module for command 'UserDir': LoadModule userdir_module [FORTITUDE_LIB_DIR]/modules/mod_userdir.so # Required module for command 'DirectoryIndex': @@ -394,8 +399,7 @@ DocumentRoot "[SERVER_ROOT]/docroot" # # Controls who can get stuff from this server. # - Order allow,deny - Allow from all + Require all granted @@ -444,8 +448,7 @@ AccessFileName .htaccess # viewed by Web clients. # - Order allow,deny - Deny from all + Require all denied # @@ -592,8 +595,7 @@ Alias /icons/ "[SERVER_ROOT]/icons/" Options Indexes MultiViews AllowOverride None - Order allow,deny - Allow from all + Require all granted # @@ -606,8 +608,7 @@ AliasMatch ^/manual(?:/(?:de|en|es|fr|ja|ko|ru))?(/.*)?$ "[SERVER_ROOT]/manual$1 Options Indexes AllowOverride None - Order allow,deny - Allow from all + Require all granted SetHandler type-map @@ -642,8 +643,7 @@ ScriptAlias /cgi-bin/ "[SERVER_ROOT]/cgi-bin/" AllowOverride None Options ExecCGI - Order allow,deny - Allow from all + Require all granted # diff --git a/base/ra/apache/conf/perl.conf b/base/ra/apache/conf/perl.conf index 50139cdab..02a503f74 100644 --- a/base/ra/apache/conf/perl.conf +++ b/base/ra/apache/conf/perl.conf @@ -58,15 +58,13 @@ PerlSetEnv PKI_ROOT [SERVER_ROOT] SetHandler perl-script PerlHandler PKI::RA::Wizard - Order deny,allow - Allow from all + Require all granted SetHandler perl-script PerlHandler PKI::RA::Login - Order deny,allow - Allow from all + Require all granted PerlModule ModPerl::PerlRun diff --git a/base/ra/lib/systemd/system/pki-rad.target b/base/ra/lib/systemd/system/pki-rad.target new file mode 100644 index 000000000..e1a4f808e --- /dev/null +++ b/base/ra/lib/systemd/system/pki-rad.target @@ -0,0 +1,6 @@ +[Unit] +Description=PKI Registration Authority Server +After=syslog.target network.target + +[Install] +WantedBy=multi-user.target diff --git a/base/ra/lib/systemd/system/pki-rad@.service b/base/ra/lib/systemd/system/pki-rad@.service new file mode 100644 index 000000000..5432c62b2 --- /dev/null +++ b/base/ra/lib/systemd/system/pki-rad@.service @@ -0,0 +1,12 @@ +[Unit] +Description=PKI Registration Authority Server %i +After=pki-rad.target +BindTo=pki-rad.target + +[Service] +Type=forking +ExecStart=/usr/bin/pkicontrol start ra %i +ExecStop=/usr/bin/pkicontrol stop ra %i + +[Install] +WantedBy=multi-user.target diff --git a/base/ra/setup/pkidaemon_registry b/base/ra/setup/pkidaemon_registry index 8d23dda05..2e81158ef 100644 --- a/base/ra/setup/pkidaemon_registry +++ b/base/ra/setup/pkidaemon_registry @@ -62,7 +62,7 @@ export RESTART_SERVER # available, but does not work with some modules (such as PHP). # The service must be stopped before changing this variable. # -PKI_HTTPD=${PKI_FORTITUDE_DIR}/sbin/httpd.worker +PKI_HTTPD=${PKI_FORTITUDE_DIR}/sbin/httpd export PKI_HTTPD # diff --git a/base/ra/setup/registry_instance b/base/ra/setup/registry_instance index f8cae5a43..5be7a4de0 100644 --- a/base/ra/setup/registry_instance +++ b/base/ra/setup/registry_instance @@ -59,7 +59,7 @@ export RESTART_SERVER # available, but does not work with some modules (such as PHP). # The service must be stopped before changing this variable. # -PKI_HTTPD=${PKI_FORTITUDE_DIR}/sbin/httpd.worker +PKI_HTTPD=${PKI_FORTITUDE_DIR}/sbin/httpd export PKI_HTTPD # diff --git a/base/selinux/src/pki.if b/base/selinux/src/pki.if index b456ac995..4272bd0c5 100644 --- a/base/selinux/src/pki.if +++ b/base/selinux/src/pki.if @@ -168,7 +168,7 @@ template(`pki_tomcat_template',` miscfiles_read_localization($1_t) miscfiles_read_hwdata($1_t) - miscfiles_manage_cert_dirs($1_t) + miscfiles_manage_generic_cert_dirs($1_t) miscfiles_manage_generic_cert_files($1_t) logging_send_syslog_msg($1_t) diff --git a/base/setup/pkicreate b/base/setup/pkicreate index cc4ee703f..e3ee5a0ab 100755 --- a/base/setup/pkicreate +++ b/base/setup/pkicreate @@ -2870,6 +2870,17 @@ sub process_pki_files_and_symlinks "${db_password}\n", $default_file_permissions, $pki_user, $pki_group); + ## Populate systemd links + if ($use_systemd) { + return 0 if !create_symlink( + "${pki_subsystem_systemd_wants_path}/${pki_instance_systemd_service_name}", + "$pki_subsystem_systemd_service_path", + $root_user, $root_group); + + # reload systemd configuration + run_command("/bin/systemctl --system daemon-reload"); + } + ## Populate instances (RA, TPS instances) if ($subsystem_type eq $RA || $subsystem_type eq $TPS) { # create an empty file called "pwcache.conf" for this @@ -2893,16 +2904,6 @@ sub process_pki_files_and_symlinks # to find our tomcat6 configuration file in /etc/sysconfig return 0 if !create_symlink($pki_instance_initscript_path, $tomcat6_initscript_path, $root_user, $root_group); - if ($use_systemd) { - return 0 if !create_symlink( - "${pki_subsystem_systemd_wants_path}/${pki_instance_systemd_service_name}", - "$pki_subsystem_systemd_service_path", - $root_user, $root_group); - - # reload systemd configuration - run_command("/bin/systemctl --system daemon-reload"); - - } return 0 if !create_directory($webinf_lib_instance_path, $default_dir_permissions, $pki_user, $pki_group); diff --git a/base/setup/scripts/pki_apache_initscript b/base/setup/scripts/pki_apache_initscript index e51231065..c50c812a4 100755 --- a/base/setup/scripts/pki_apache_initscript +++ b/base/setup/scripts/pki_apache_initscript @@ -62,11 +62,6 @@ start() fi fi - touch ${pidfile} - chown ${PKI_USER}:${PKI_GROUP} ${pidfile} - chmod 00600 ${pidfile} - [ -x /sbin/restorecon ] && /sbin/restorecon ${pidfile} - # restore context for ncipher hsm [ -x /sbin/restorecon ] && [ -d /dev/nfast ] && /sbin/restorecon -R /dev/nfast @@ -74,13 +69,13 @@ start() rv=$? if [ ${rv} = 0 ] ; then if [ ${ARCHITECTURE} = "i386" ] ; then - LANG=${PKI_HTTPD_LANG} daemon runcon -t ${PKI_SELINUX_TYPE} -- ${httpd} ${PKI_OPTIONS} + LANG=${PKI_HTTPD_LANG} daemon runcon -t ${PKI_SELINUX_TYPE} -r system_r -- ${httpd} ${PKI_OPTIONS} rv=$? # overwrite output from "daemon" echo -n $"Starting ${prog}: " elif [ ${ARCHITECTURE} = "x86_64" ] ; then # NOTE: "daemon" is incompatible with "httpd" on 64-bit architectures - LANG=${PKI_HTTPD_LANG} runcon -t ${PKI_SELINUX_TYPE} -- ${httpd} ${PKI_OPTIONS} + LANG=${PKI_HTTPD_LANG} runcon -t ${PKI_SELINUX_TYPE} -r system_r -- ${httpd} ${PKI_OPTIONS} rv=$? fi else diff --git a/base/tps/CMakeLists.txt b/base/tps/CMakeLists.txt index 96d23fefa..10c4d8efd 100644 --- a/base/tps/CMakeLists.txt +++ b/base/tps/CMakeLists.txt @@ -43,6 +43,19 @@ add_subdirectory(tools) add_subdirectory(doc) add_subdirectory(setup) +# install systemd scripts +install( + FILES + lib/systemd/system/pki-tpsd.target + lib/systemd/system/pki-tpsd@.service + DESTINATION + ${SYSTEMD_LIB_INSTALL_DIR} + PERMISSIONS + OWNER_EXECUTE OWNER_WRITE OWNER_READ + GROUP_EXECUTE GROUP_READ + WORLD_EXECUTE WORLD_READ +) + # install init script install( FILES @@ -206,3 +219,8 @@ install( ${SHARE_INSTALL_PREFIX}/${APPLICATION_NAME}/${PROJECT_NAME}/docroot/tps/admin/console/js ) +install( + DIRECTORY + DESTINATION + ${SYSTEMD_ETC_INSTALL_DIR}/pki-tpsd.target.wants +) diff --git a/base/tps/apache/conf/httpd.conf b/base/tps/apache/conf/httpd.conf index 372066afc..a9410849c 100644 --- a/base/tps/apache/conf/httpd.conf +++ b/base/tps/apache/conf/httpd.conf @@ -78,7 +78,7 @@ ServerRoot "[SERVER_ROOT]" # identification number when it starts. # -PidFile run/[PKI_INSTANCE_ID].pid +PidFile /var/run/pki/tps/[PKI_INSTANCE_ID].pid # @@ -232,8 +232,13 @@ Listen [PORT] # LoadModule foo_module modules/mod_foo.so # -# Required modules for command 'Order': +# MPM worker module is a loadable module as of 2.4 +LoadModule mpm_worker_module /etc/httpd/modules/mod_mpm_worker.so + +LoadModule authz_core_module /etc/httpd/modules/mod_authz_core.so [FORTITUDE_AUTH_MODULES] +# Module for User and Group +LoadModule unixd_module /etc/httpd/modules/mod_unixd.so # Required module for command 'UserDir': LoadModule userdir_module [FORTITUDE_LIB_DIR]/modules/mod_userdir.so # Required module for command 'DirectoryIndex': @@ -398,8 +403,7 @@ DocumentRoot "[SERVER_ROOT]/docroot" # # Controls who can get stuff from this server. # - Order allow,deny - Allow from all + Require all granted @@ -448,8 +452,7 @@ AccessFileName .htaccess # viewed by Web clients. # - Order allow,deny - Deny from all + Require all denied # @@ -458,17 +461,6 @@ AccessFileName .htaccess # TypesConfig conf/mime.types -# -# DefaultType is the default MIME type the server will use for a document -# if it cannot otherwise determine one, such as from filename extensions. -# If your server contains mostly text or HTML documents, "text/plain" is -# a good value. If most of your content is binary, such as applications -# or images, you may want to use "application/octet-stream" instead to -# keep browsers from trying to display binary files as though they are -# text. -# -DefaultType text/plain - # # The mod_mime_magic module allows the server to use various hints from the # contents of the file itself to determine its type. The MIMEMagicFile @@ -596,8 +588,7 @@ Alias /icons/ "[SERVER_ROOT]/icons/" Options Indexes MultiViews AllowOverride None - Order allow,deny - Allow from all + Require all granted # @@ -610,8 +601,7 @@ AliasMatch ^/manual(?:/(?:de|en|es|fr|ja|ko|ru))?(/.*)?$ "[SERVER_ROOT]/manual$1 Options Indexes AllowOverride None - Order allow,deny - Allow from all + Require all granted SetHandler type-map @@ -646,8 +636,7 @@ ScriptAlias /cgi-bin/ "[SERVER_ROOT]/cgi-bin/" AllowOverride None Options ExecCGI - Order allow,deny - Allow from all + Require all granted # diff --git a/base/tps/apache/conf/perl.conf b/base/tps/apache/conf/perl.conf index feb51e860..a1a98c6a0 100644 --- a/base/tps/apache/conf/perl.conf +++ b/base/tps/apache/conf/perl.conf @@ -58,13 +58,11 @@ PerlSetEnv PKI_ROOT [SERVER_ROOT] SetHandler perl-script PerlHandler PKI::TPS::Wizard - Order deny,allow - Allow from all + Require all granted SetHandler perl-script PerlHandler PKI::TPS::Login - Order deny,allow - Allow from all + Require all granted diff --git a/base/tps/lib/systemd/system/pki-tpsd.target b/base/tps/lib/systemd/system/pki-tpsd.target new file mode 100644 index 000000000..37c693b08 --- /dev/null +++ b/base/tps/lib/systemd/system/pki-tpsd.target @@ -0,0 +1,6 @@ +[Unit] +Description=PKI Token Processing Server +After=syslog.target network.target + +[Install] +WantedBy=multi-user.target diff --git a/base/tps/lib/systemd/system/pki-tpsd@.service b/base/tps/lib/systemd/system/pki-tpsd@.service new file mode 100644 index 000000000..6a0d6a343 --- /dev/null +++ b/base/tps/lib/systemd/system/pki-tpsd@.service @@ -0,0 +1,12 @@ +[Unit] +Description=PKI Token Processing Server %i +After=pki-tpsd.target +BindTo=pki-tpsd.target + +[Service] +Type=forking +ExecStart=/usr/bin/pkicontrol start tps %i +ExecStop=/usr/bin/pkicontrol stop tps %i + +[Install] +WantedBy=multi-user.target diff --git a/base/tps/setup/pkidaemon_registry b/base/tps/setup/pkidaemon_registry index 6c13a4955..b74c84317 100644 --- a/base/tps/setup/pkidaemon_registry +++ b/base/tps/setup/pkidaemon_registry @@ -62,7 +62,7 @@ export RESTART_SERVER # available, but does not work with some modules (such as PHP). # The service must be stopped before changing this variable. # -PKI_HTTPD=${PKI_FORTITUDE_DIR}/sbin/httpd.worker +PKI_HTTPD=${PKI_FORTITUDE_DIR}/sbin/httpd export PKI_HTTPD # diff --git a/base/tps/setup/registry_instance b/base/tps/setup/registry_instance index a77b75f4f..cb907eb61 100644 --- a/base/tps/setup/registry_instance +++ b/base/tps/setup/registry_instance @@ -59,7 +59,7 @@ export RESTART_SERVER # available, but does not work with some modules (such as PHP). # The service must be stopped before changing this variable. # -PKI_HTTPD=${PKI_FORTITUDE_DIR}/sbin/httpd.worker +PKI_HTTPD=${PKI_FORTITUDE_DIR}/sbin/httpd export PKI_HTTPD # -- cgit