remove world-readable permission from all files
Costa Tsaousis (ktsaou) committed
Nov 24, 2016 at 02:25 UTC
00e8ac2e676532aaec7b01f1e060100934e22d19
3 files changed
+60
-24
netdata-installer.sh
+59
-23
@@ -13,7 +13,7 @@ then
13
fi
14
15
LC_ALL=C
16
-umask 022
16
+umask 007
17
18
# Be nice on production environments
19
renice 19 $$ >/dev/null 2>/dev/null
@@ -547,6 +547,9 @@ do
547
fi
548
done
549
550
+echo >&2 "Fixing permissions ..."
551
+run find ./system/ -type f -a \! -name \*.in -a \! -name Makefile\* -exec chmod 755 {} \;
552
+
553
NETDATA_ADDED_TO_DOCKER=0
554
if [ ${UID} -eq 0 ]
555
then
@@ -609,17 +612,20 @@ config_option() {
612
echo "${value}"
613
}
614
612
-# user
613
-defuser="netdata"
614
-[ ! "${UID}" = "0" ] && defuser="${USER}"
615
-NETDATA_USER="$( config_option "run as user" "${defuser}" )"
615
+# the user netdata will run as
616
+if [ "${UID}" = "0" ]
617
+ then
618
+ NETDATA_USER="$( config_option "run as user" "netdata" )"
619
+else
620
+ NETDATA_USER="${USER}"
621
+fi
622
617
-NETDATA_WEB_USER="$( config_option "web files owner" "${defuser}" )"
623
+# the owners of the web files
624
+NETDATA_WEB_USER="$( config_option "web files owner" "${NETDATA_USER}" )"
625
NETDATA_WEB_GROUP="$( config_option "web files group" "${NETDATA_WEB_USER}" )"
626
627
# debug flags
621
-defdebug=0
622
-NETDATA_DEBUG="$( config_option "debug flags" ${defdebug} )"
628
+NETDATA_DEBUG="$( config_option "debug flags" 0 )"
629
630
# port
631
defport=19999
@@ -654,31 +660,57 @@ fi
660
661
echo >&2
662
echo >&2 "Fixing directories (user: ${NETDATA_USER})..."
657
-for x in "${NETDATA_WEB_DIR}" "${NETDATA_CONF_DIR}" "${NETDATA_CACHE_DIR}" "${NETDATA_LOG_DIR}" "${NETDATA_LIB_DIR}" "${NETDATA_CONF_DIR}/python.d" "${NETDATA_CONF_DIR}/charts.d" "${NETDATA_CONF_DIR}/node.d"
663
+
664
+# --- conf dir ----
665
+
666
+for x in "python.d" "charts.d" "node.d"
667
do
659
- if [ ! -d "${x}" ]
668
+ if [ ! -d "${NETDATA_CONF_DIR}/${x}" ]
669
then
661
- echo >&2 "Creating directory '${x}'"
662
- run mkdir -p "${x}" || exit 1
670
+ echo >&2 "Creating directory '${NETDATA_CONF_DIR}/${x}'"
671
+ run mkdir -p "${NETDATA_CONF_DIR}/${x}" || exit 1
672
fi
673
+done
674
+run chown --recursive "${NETDATA_USER}:${NETDATA_USER}" "${NETDATA_CONF_DIR}"
675
+run find "${NETDATA_CONF_DIR}" -type f -exec chmod 0660 {} \;
676
+run find "${NETDATA_CONF_DIR}" -type d -exec chmod 0775 {} \;
677
+
678
+# --- web dir ----
679
+
680
+if [ ! -d "${NETDATA_WEB_DIR}" ]
681
+ then
682
+ echo >&2 "Creating directory '${NETDATA_WEB_DIR}'"
683
+ run mkdir -p "${NETDATA_WEB_DIR}" || exit 1
684
+fi
685
+run chown --recursive "${NETDATA_WEB_USER}:${NETDATA_WEB_GROUP}" "${NETDATA_WEB_DIR}"
686
+run find "${NETDATA_WEB_DIR}" -type f -exec chmod 0664 {} \;
687
+run find "${NETDATA_WEB_DIR}" -type d -exec chmod 0775 {} \;
688
+
689
+# --- data dirs ----
690
665
- if [ ${UID} -eq 0 ]
691
+for x in "${NETDATA_LIB_DIR}" "${NETDATA_CACHE_DIR}" "${NETDATA_LOG_DIR}"
692
+do
693
+ if [ ! -d "${x}" ]
694
then
667
- if [ "${x}" = "${NETDATA_WEB_DIR}" ]
668
- then
669
- run chown -R "${NETDATA_WEB_USER}:${NETDATA_WEB_GROUP}" "${x}" || echo >&2 "WARNING: Cannot change the ownership of the files in directory ${x} to ${NETDATA_WEB_USER}:${NETDATA_WEB_GROUP}..."
670
- else
671
- run chown -R "${NETDATA_USER}:${NETDATA_USER}" "${x}" || echo >&2 "WARNING: Cannot change the ownership of the files in directory ${x} to ${NETDATA_USER}..."
672
- fi
695
+ echo >&2 "Creating directory '${x}'"
696
+ run mkdir -p "${x}" || exit 1
697
fi
698
675
- run chmod 0755 "${x}" || echo >&2 "WARNING: Cannot change the permissions of the directory ${x} to 0755..."
699
+ run chown --recursive "${NETDATA_USER}:${NETDATA_USER}" "${x}"
700
+ run find "${x}" -type f -exec chmod 0660 {} \;
701
+ run find "${x}" -type d -exec chmod 0770 {} \;
702
done
703
704
+# --- plugins ----
705
+
706
if [ ${UID} -eq 0 ]
707
then
680
- run chown root "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin"
681
- run chmod 0755 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin"
708
+ run chown --recursive root:root "${NETDATA_PREFIX}/usr/libexec/netdata"
709
+ run find "${NETDATA_PREFIX}/usr/libexec/netdata" -type d -exec chmod 0755 {} \;
710
+ run find "${NETDATA_PREFIX}/usr/libexec/netdata" -type f -exec chmod 0644 {} \;
711
+ run find "${NETDATA_PREFIX}/usr/libexec/netdata" -type f -a -name \*.plugin -exec chmod 0755 {} \;
712
+ run find "${NETDATA_PREFIX}/usr/libexec/netdata" -type f -a -name \*.sh -exec chmod 0755 {} \;
713
+
714
run setcap cap_dac_read_search,cap_sys_ptrace+ep "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin"
715
if [ $? -ne 0 ]
716
then
@@ -686,6 +718,10 @@ if [ ${UID} -eq 0 ]
718
run chown root "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin"
719
run chmod 4755 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin"
720
fi
721
+else
722
+ run chown --recursive "${NETDATA_USER}:${NETDATA_USER}" "${NETDATA_PREFIX}/usr/libexec/netdata"
723
+ run find "${NETDATA_PREFIX}/usr/libexec/netdata" -type f -exec chmod 0755 {} \;
724
+ run find "${NETDATA_PREFIX}/usr/libexec/netdata" -type d -exec chmod 0755 {} \;
725
fi
726
727
# -----------------------------------------------------------------------------
@@ -702,7 +738,7 @@ if [ ${DONOTSTART} -eq 1 ]
738
then
739
chown "${NETDATA_USER}" "${NETDATA_PREFIX}/etc/netdata/netdata.conf"
740
fi
705
- chmod 0664 "${NETDATA_PREFIX}/etc/netdata/netdata.conf"
741
+ chmod 0644 "${NETDATA_PREFIX}/etc/netdata/netdata.conf"
742
fi
743
banner "is installed now!"
744
echo >&2 " enjoy real-time performance and health monitoring..."
src/daemon.c
+1
-1
@@ -228,7 +228,7 @@ int become_daemon(int dont_fork, const char *user)
228
}
229
230
// Set new file permissions
231
- umask(0002);
231
+ umask(0007);
232
233
// adjust my Out-Of-Memory score
234
oom_score_adj(1000);