Return to systemd_config_check.piml CVS log

Up to [LON-CAPA] / doc / loncapafiles

- Include script to check ProtectHome value for systemd service for web
  server, and modify/set new value as needed, when using ./UPDATE to
  install/update a LON-CAPA instance.

<!DOCTYPE piml PUBLIC "-//TUX/DTD piml 1.0 Final//EN"
        "http://lpml.sourceforge.net/DTD/piml.dtd">
<!-- systemd_config_check.piml -->

<!-- $Id: systemd_config_check.piml,v 1.1 2024/07/28 19:40:59 raeburn Exp $ -->

<!--

This file is part of the LearningOnline Network with CAPA (LON-CAPA).

LON-CAPA is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.

LON-CAPA is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with LON-CAPA; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

/home/httpd/html/adm/gpl.txt

http://www.lon-capa.org/

-->

<piml>
<targetroot>/</targetroot>
<files>
<file>
<target dist="default">/home/httpd/perl</target>
<perlscript mode="fg">

use strict;

my $service = 'apache2.service';
my $use_systemctl;
my ($dist,$version) = ('<DIST />' =~ /^([A-Za-z]+)([\d\.]+)$/);
if (($dist eq 'sles') || ($dist eq 'suse')) {
    if ($version &gt;= 12) {
        $use_systemctl = 1;
    }
} elsif ($dist eq 'fedora') {
    if ($version &gt;= 16) {
        $use_systemctl = 1;
    }
    $service = 'httpd.service';
} elsif ($dist =~ /^(centos|rhes|scientific|oracle|rocky|alma)$/) {
    if ($version &gt;= 7) {
        $use_systemctl = 1;
    }
    $service = 'httpd.service';
} elsif ($dist eq 'ubuntu') {
    if ($version &gt;= 16) {
        $use_systemctl = 1;
    }
} elsif ($dist eq 'debian') {
    if ($version &gt;= 9) {
        $use_systemctl = 1;
    }
}

if ($use_systemctl) {
    system('systemctl daemon-reload');
    if (open(PIPE,"systemctl show $service --property=ProtectHome 2&gt;/dev/null |")) {
        my $protection = &lt;PIPE&gt;;
        close(PIPE);
        chomp($protection);
        if ($protection =~ /^ProtectHome=(read-only|yes)$/i) {
            if (!-d '/etc/systemd/system/'.$service.'.d') {
                mkdir '/etc/systemd/system/'.$service.'.d', 0755;
            }
            if (-d '/etc/systemd/system/'.$service.'.d') {
                if (-e '/etc/systemd/system/'.$service.'.d/override.conf') {
                    if (open(my $fh,'&lt;','/etc/systemd/system/'.$service.'.d/override.conf')) {
                        my ($inservice,$addservice,$protectoff,$linenum,$change,@lines);
                        while (my $entry = &lt;$fh&gt;) {
                            $linenum ++;
                            chomp($entry);
                            if ($entry eq '[Service]') {
                                if (!$protectoff) {
                                    $inservice = $linenum;
                                    push(@lines,$entry);
                                } else {
                                    $addservice = 1;
                                    next;
                                }
                            }
                            if ($entry =~ /^ProtectHome\s*=\s*([\w-]+)\s*$/) {
                                my $value = $1;
                                if ($protectoff) {
                                    next;
                                    if (lc($value) eq 'no') {
                                        $protectoff = $linenum;
                                        push(@lines,$entry);
                                    } else {
                                        if ($protectoff) {
                                            next;
                                        } else {
                                            push(@lines,'ProtectHome=no');
                                            $protectoff = $linenum;
                                            $change = $linenum;
                                        }
                                    }
                                }
                            }
                        }
                        close($fh);
                        if ($addservice || $change || !$protectoff) {
                            if (open(my $fh,'&gt;','/etc/systemd/system/'.$service.'.d/override.conf')) {
                                if ($addservice) {
                                    print $fh "[Service]\n";
                                }
                                foreach my $entry (@lines) {
                                    print $fh "$entry\n";
                                }
                                close($fh);
                                print 'Updated /etc/systemd/system/'.$service.'.d/override.conf'."\n";
                                system('systemctl daemon-reload');
                            } else {
                                print '**** ERROR: Could not open /etc/systemd/system/'.$service.'.d/override.conf to write ProtectHome=no.'."\n".
                                      'LON-CAPA web interface will not be usable.'."\n"; 
                            }
                        }
                    }
                } else {
                    if (open(my $fh,'&gt;','/etc/systemd/system/'.$service.'.d/override.conf')) {
                        print $fh '[Service]'."\n".'ProtectHome=no'."\n";
                        close($fh);
                        print 'Created /etc/systemd/system/'.$service.'.d/override.conf'."\n";
                        system('systemctl daemon-reload');
                    } else {
                        print '**** ERROR: Could not open /etc/systemd/system/'.$service.'.d/override.conf to write ProtectHome=no.'."\n".
                              'LON-CAPA web interface will not be usable.'."\n";
                    }
                }
            } else {
                print '**** ERROR: No /etc/systemd/system/'.$service.'.d directory exists and creating one failed.'."\n".
                      'LON-CAPA web interface will not be usable.'."\n";
            }
        }
    } else {
        print '**** WARNING *** Could not determine status of ProtectHome property for systemd '.$service.".\n".
              'It was not possible to determine whether LON-CAPA web interface will be usable.'."\n";
    }
}

</perlscript>
</file>
</files>
</piml>