#!/usr/local/cpanel/3rdparty/bin/perl
# cpanel - scripts/initacls Copyright 2022 cPanel, L.L.C.
# All rights reserved.
# copyright@cpanel.net http://cpanel.net
# This code is subject to the cPanel license. Unauthorized copying is prohibited
package Cpanel::Script::Initacls;
use cPstrict;
use Cpanel::Binaries ();
use Cpanel::SafeRun::Simple ();
use Cpanel::SafeRun::Errors ();
use Cpanel::Config::CpConfGuard ();
use Cpanel::Logger ();
use Cpanel::OSSys ();
use Cpanel::SafeFile ();
use Cpanel::TempFile ();
our $aclsonfs = 0;
our $fstab = "/etc/fstab";
our $fileprotect_touch = '/var/cpanel/fileprotect';
my $logger;
exit main() unless caller();
sub main {
$logger = Cpanel::Logger->new();
my ( $system, undef, $release ) = Cpanel::OSSys::uname();
my $mount_bin = Cpanel::Binaries::path('mount');
my $mount = Cpanel::SafeRun::Simple::saferun($mount_bin);
chomp($mount);
if ( $mount =~ /acl/ ) { $aclsonfs = 1; }
unless ( -x Cpanel::Binaries::path('setfacl') ) {
acldeath("Unable to locate setfacl: your distribution may not support acls\n");
}
$release =~ /^(\d+\.\d+)/;
my $nversion = $1;
if ( $system =~ /linux/i && $nversion < 2.6 ) { acldeath("You must be running at least a 2.6 kernel to use this script."); }
setuplinuxfstab();
acltestandsetup();
return 0;
}
sub setuplinuxfstab () {
my $mount_bin = Cpanel::Binaries::path('mount');
#Check if the system is XFS (we only support XFS and ext3/4 as of this writing)
my $is_xfs = Cpanel::SafeRun::Errors::saferunallerrors( $mount_bin, '-l' );
chomp $is_xfs;
if ( $is_xfs =~ m/on \/ type xfs/i ) {
print "XFS requires no mount alterations to enable ACLs, skipping...\n";
return 1;
}
if ( !$aclsonfs ) {
my $acltest = Cpanel::SafeRun::Errors::saferunallerrors( $mount_bin, "-o", "remount,acl", "/" );
chomp($acltest);
if ( $acltest ne "" ) {
acldeath("System error: $acltest when testing for acl support. Your kernel may not support POSIX acls\n");
}
}
my $modtab = 0;
my (@FSTAB);
my (@REMOUNT);
local $| = 1;
my $fstablock = Cpanel::SafeFile::safeopen( \*FT, "+<", $fstab );
if ( !$fstablock ) {
$logger->die("Could not edit $fstab");
}
while (<FT>) {
chomp();
if ( !/^[\s\t]*[\#\;]+/ ) {
my (@FSLINE) = split( /[\s\t]+/, $_ );
my @OPTS = $FSLINE[3] ? split( /\,/, $FSLINE[3] ) : ();
if ( ( $FSLINE[2] && $FSLINE[2] =~ /^ext\d+$/ ) && !grep( /^acl$/, @OPTS ) ) {
push( @OPTS, 'acl' );
$FSLINE[3] = join( ",", @OPTS );
push( @FSTAB, join( "\t", @FSLINE ) );
push( @REMOUNT, $FSLINE[0] );
$modtab = 1;
}
else {
push( @FSTAB, $_ );
}
}
else {
push( @FSTAB, $_ );
}
}
if ($modtab) {
seek( FT, 0, 0 );
print FT join( "\n", @FSTAB ) . "\n";
truncate( FT, tell(FT) );
}
foreach (@REMOUNT) {
my $res = Cpanel::SafeRun::Errors::saferunallerrors( $mount_bin, '-o', 'remount', $_ );
chomp $res;
acldeath("System error: $res could not remount $_ with ACLs enabled!") if $res;
}
return Cpanel::SafeFile::safeclose( \*FT, $fstablock );
}
sub acltestandsetup () {
my $cfiler = Cpanel::TempFile->new();
my $randfile = $cfiler->file();
open( my $ACLTESTFILE, ">", $randfile ) or die("Couldn't open ACL test file $randfile for writing!");
close($ACLTESTFILE);
my $acltest = Cpanel::SafeRun::Errors::saferunallerrors( Cpanel::Binaries::path('setfacl'), "-m", "user:nobody:r", "--", $randfile );
my $acltest2 = Cpanel::SafeRun::Errors::saferunnoerror( Cpanel::Binaries::path('getfacl'), $randfile );
chomp($acltest);
if ( $acltest ne "" ) {
acldeath("System error: setfacl: $acltest when testing for acl support. Your kernel may not support POSIX acls.\n");
}
chomp($acltest2);
if ( $acltest2 !~ /nobody/i ) {
acldeath("System error: setfacl did not set the permissions that were requested. Your kernel may not support POSIX acls.\n");
}
print "ACLS are now on\n";
return setacls(1);
}
sub acldeath ($err) {
print "ACLS are now off\n";
setacls(0);
return die($err);
}
sub setacls ($val) {
my $cpconf_guard = Cpanel::Config::CpConfGuard->new();
$cpconf_guard->{'data'}->{'acls'} = $val;
$cpconf_guard->save();
print "Updating Permissions.....";
if ( -e $fileprotect_touch ) {
Cpanel::SafeRun::Errors::saferunnoerror('/usr/local/cpanel/scripts/enablefileprotect');
}
else {
Cpanel::SafeRun::Errors::saferunnoerror('/usr/local/cpanel/scripts/disablefileprotect');
}
print "Done\n";
return 1;
}
Mini Shell