Improved temporary directory checking in installer and updater. (#9797)
Update temporary directory checking in installer. This updates the checks that our installer and updater make to choose what to use for a temporary directory to be both more robust and more portable. The new checks use the following logic: * For each directory to be checked, verify that it is both writable by the current user, and that the current user can execute files they write there. * If `$TMPDIR` is set, preferentially use that. * If that fials, try `/tmp`. * If that also fails, fall back to `$PWD`. * If all checks fail, bail early with an explanation instead of failing when we first tryto do things with the directory. It also adds the same checks to the `netdata-installer.sh` script, which was previously completely missing them.
Austin S. Hemmelgarn committed
Aug 27, 2020 at 07:17 UTC
9c3b49ee99c1cbadff983a362733cd283a4fc783
6 files changed
+182
-54
netdata-installer.sh
+41
@@ -41,6 +41,43 @@ fi
41
# make sure /etc/profile does not change our current directory
42
cd "${NETDATA_SOURCE_DIR}" || exit 1
43
44
+# -----------------------------------------------------------------------------
45
+# figure out an appropriate temporary directory
46
+_cannot_use_tmpdir() {
47
+ local testfile ret
48
+ testfile="$(TMPDIR="${1}" mktemp -q -t netdata-test.XXXXXXXXXX)"
49
+ ret=0
50
+
51
+ if [ -z "${testfile}" ] ; then
52
+ return "${ret}"
53
+ fi
54
+
55
+ if /bin/echo -e '#!/bin/sh\necho SUCCESS\n' > "${testfile}" ; then
56
+ if chmod +x "${testfile}" ; then
57
+ if [ "$("${testfile}")" = "SUCCESS" ] ; then
58
+ ret=1
59
+ fi
60
+ fi
61
+ fi
62
+
63
+ rm -f "${testfile}"
64
+ return "${ret}"
65
+}
66
+
67
+if [ -z "${TMPDIR}" ] || _cannot_use_tmpdir "${TMPDIR}" ; then
68
+ if _cannot_use_tmpdir /tmp ; then
69
+ if _cannot_use_tmpdir "${PWD}" ; then
70
+ echo >&2
71
+ echo >&2 "Unable to find a usable temprorary directory. Please set \$TMPDIR to a path that is both writable and allows execution of files and try again."
72
+ exit 1
73
+ else
74
+ TMPDIR="${PWD}"
75
+ fi
76
+ else
77
+ TMPDIR="/tmp"
78
+ fi
79
+fi
80
+
81
# -----------------------------------------------------------------------------
82
# set up handling for deferred error messages
83
NETDATA_DEFERRED_ERRORS=""
@@ -324,6 +361,10 @@ cat << BANNER1
361
362
You are about to build and install netdata to your system.
363
364
+ The build process will use ${TPUT_CYAN}${TMPDIR}${TPUT_RESET} for
365
+ any temporary files. You can override this by setting \$TMPDIR to a
366
+ writable directory where you can execute files.
367
+
368
It will be installed at these locations:
369
370
- the daemon at ${TPUT_CYAN}${NETDATA_PREFIX}/usr/sbin/netdata${TPUT_RESET}
packaging/installer/kickstart-static64.sh
+34
-6
@@ -121,15 +121,43 @@ fatal() {
121
exit 1
122
}
123
124
+_cannot_use_tmpdir() {
125
+ local testfile ret
126
+ testfile="$(TMPDIR="${1}" mktemp -q -t netdata-test.XXXXXXXXXX)"
127
+ ret=0
128
+
129
+ if [ -z "${testfile}" ] ; then
130
+ return "${ret}"
131
+ fi
132
+
133
+ if /bin/echo -e '#!/bin/sh\necho SUCCESS\n' > "${testfile}" ; then
134
+ if chmod +x "${testfile}" ; then
135
+ if [ "$("${testfile}")" = "SUCCESS" ] ; then
136
+ ret=1
137
+ fi
138
+ fi
139
+ fi
140
+
141
+ rm -f "${testfile}"
142
+ return "${ret}"
143
+}
144
+
145
create_tmp_directory() {
125
- # Check if tmp is mounted as noexec
126
- if grep -Eq '^[^ ]+ /tmp [^ ]+ ([^ ]*,)?noexec[, ]' /proc/mounts; then
127
- pattern="$(pwd)/netdata-kickstart-XXXXXX"
128
- else
129
- pattern="/tmp/netdata-kickstart-XXXXXX"
146
+ if [ -z "${TMPDIR}" ] || _cannot_use_tmpdir "${TMPDIR}" ; then
147
+ if _cannot_use_tmpdir /tmp ; then
148
+ if _cannot_use_tmpdir "${PWD}" ; then
149
+ echo >&2
150
+ echo >&2 "Unable to find a usable temprorary directory. Please set \$TMPDIR to a path that is both writable and allows execution of files and try again."
151
+ exit 1
152
+ else
153
+ TMPDIR="${PWD}"
154
+ fi
155
+ else
156
+ TMPDIR="/tmp"
157
+ fi
158
fi
159
132
- mktemp -d $pattern
160
+ mktemp -d -t netdata-kickstart-XXXXXXXXXX
161
}
162
163
download() {
packaging/installer/kickstart.sh
+51
-21
@@ -19,6 +19,7 @@
19
#
20
# Environment options:
21
#
22
+# TMPDIR specify where to save temporary files
23
# NETDATA_TARBALL_BASEURL set the base url for downloading the dist tarball
24
#
25
# This script will:
@@ -152,15 +153,43 @@ warning() {
153
fi
154
}
155
156
+_cannot_use_tmpdir() {
157
+ local testfile ret
158
+ testfile="$(TMPDIR="${1}" mktemp -q -t netdata-test.XXXXXXXXXX)"
159
+ ret=0
160
+
161
+ if [ -z "${testfile}" ] ; then
162
+ return "${ret}"
163
+ fi
164
+
165
+ if /bin/echo -e '#!/bin/sh\necho SUCCESS\n' > "${testfile}" ; then
166
+ if chmod +x "${testfile}" ; then
167
+ if [ "$("${testfile}")" = "SUCCESS" ] ; then
168
+ ret=1
169
+ fi
170
+ fi
171
+ fi
172
+
173
+ rm -f "${testfile}"
174
+ return "${ret}"
175
+}
176
+
177
create_tmp_directory() {
156
- # Check if tmp is mounted as noexec
157
- if grep -Eq '^[^ ]+ /tmp [^ ]+ ([^ ]*,)?noexec[, ]' /proc/mounts > /dev/null 2>&1; then
158
- pattern="$(pwd)/netdata-kickstart-XXXXXX"
159
- else
160
- pattern="/tmp/netdata-kickstart-XXXXXX"
178
+ if [ -z "${TMPDIR}" ] || _cannot_use_tmpdir "${TMPDIR}" ; then
179
+ if _cannot_use_tmpdir /tmp ; then
180
+ if _cannot_use_tmpdir "${PWD}" ; then
181
+ echo >&2
182
+ echo >&2 "Unable to find a usable temprorary directory. Please set \$TMPDIR to a path that is both writable and allows execution of files and try again."
183
+ exit 1
184
+ else
185
+ TMPDIR="${PWD}"
186
+ fi
187
+ else
188
+ TMPDIR="/tmp"
189
+ fi
190
fi
191
163
- mktemp -d $pattern
192
+ mktemp -d -t netdata-kickstart-XXXXXXXXXX
193
}
194
195
download() {
@@ -236,19 +265,19 @@ dependencies() {
265
progress "Fetching script to detect required packages..."
266
if [ -n "${NETDATA_LOCAL_TARBALL_OVERRIDE_DEPS_SCRIPT}" ]; then
267
if [ -f "${NETDATA_LOCAL_TARBALL_OVERRIDE_DEPS_SCRIPT}" ]; then
239
- run cp "${NETDATA_LOCAL_TARBALL_OVERRIDE_DEPS_SCRIPT}" "${TMPDIR}/install-required-packages.sh"
268
+ run cp "${NETDATA_LOCAL_TARBALL_OVERRIDE_DEPS_SCRIPT}" "${ndtmpdir}/install-required-packages.sh"
269
else
270
fatal "Invalid given dependency file, please check your --local-files parameter options and try again"
271
fi
272
else
244
- download "${PACKAGES_SCRIPT}" "${TMPDIR}/install-required-packages.sh"
273
+ download "${PACKAGES_SCRIPT}" "${ndtmpdir}/install-required-packages.sh"
274
fi
275
247
- if [ ! -s "${TMPDIR}/install-required-packages.sh" ]; then
276
+ if [ ! -s "${ndtmpdir}/install-required-packages.sh" ]; then
277
warning "Downloaded dependency installation script is empty."
278
else
279
progress "Running downloaded script to detect required packages..."
251
- run ${sudo} "${bash}" "${TMPDIR}/install-required-packages.sh" ${PACKAGES_INSTALLER_OPTIONS}
280
+ run ${sudo} "${bash}" "${ndtmpdir}/install-required-packages.sh" ${PACKAGES_INSTALLER_OPTIONS}
281
# shellcheck disable=SC2181
282
if [ $? -ne 0 ]; then
283
warning "It failed to install all the required packages, but installation might still be possible."
@@ -279,6 +308,7 @@ sudo=""
308
[ "${UID}" -ne "0" ] && sudo="sudo"
309
export PATH="${PATH}:/usr/local/bin:/usr/local/sbin"
310
311
+
312
# ---------------------------------------------------------------------------------------------------------------------
313
314
INTERACTIVE=1
@@ -412,8 +442,8 @@ fi
442
# ---------------------------------------------------------------------------------------------------------------------
443
# install required system packages
444
415
-TMPDIR=$(create_tmp_directory)
416
-cd "${TMPDIR}" || exit 1
445
+ndtmpdir=$(create_tmp_directory)
446
+cd "${ndtmpdir}" || exit 1
447
448
dependencies
449
@@ -423,16 +453,16 @@ dependencies
453
if [ -z "${NETDATA_LOCAL_TARBALL_OVERRIDE}" ]; then
454
set_tarball_urls "${RELEASE_CHANNEL}"
455
426
- download "${NETDATA_TARBALL_CHECKSUM_URL}" "${TMPDIR}/sha256sum.txt"
427
- download "${NETDATA_TARBALL_URL}" "${TMPDIR}/netdata-latest.tar.gz"
456
+ download "${NETDATA_TARBALL_CHECKSUM_URL}" "${ndtmpdir}/sha256sum.txt"
457
+ download "${NETDATA_TARBALL_URL}" "${ndtmpdir}/netdata-latest.tar.gz"
458
else
459
progress "Installation sources were given as input, running installation using \"${NETDATA_LOCAL_TARBALL_OVERRIDE}\""
430
- run cp "${NETDATA_LOCAL_TARBALL_OVERRIDE_CHECKSUM}" "${TMPDIR}/sha256sum.txt"
431
- run cp "${NETDATA_LOCAL_TARBALL_OVERRIDE}" "${TMPDIR}/netdata-latest.tar.gz"
460
+ run cp "${NETDATA_LOCAL_TARBALL_OVERRIDE_CHECKSUM}" "${ndtmpdir}/sha256sum.txt"
461
+ run cp "${NETDATA_LOCAL_TARBALL_OVERRIDE}" "${ndtmpdir}/netdata-latest.tar.gz"
462
fi
463
434
-if ! grep netdata-latest.tar.gz "${TMPDIR}/sha256sum.txt" | safe_sha256sum -c - > /dev/null 2>&1; then
435
- fatal "Tarball checksum validation failed. Stopping netdata installation and leaving tarball in ${TMPDIR}"
464
+if ! grep netdata-latest.tar.gz "${ndtmpdir}/sha256sum.txt" | safe_sha256sum -c - > /dev/null 2>&1; then
465
+ fatal "Tarball checksum validation failed. Stopping netdata installation and leaving tarball in ${ndtmpdir}"
466
fi
467
run tar -xf netdata-latest.tar.gz
468
rm -rf netdata-latest.tar.gz > /dev/null 2>&1
@@ -444,9 +474,9 @@ cd netdata-* || fatal "Cannot cd to netdata source tree"
474
if [ -x netdata-installer.sh ]; then
475
progress "Installing netdata..."
476
run ${sudo} ./netdata-installer.sh ${NETDATA_UPDATES} ${NETDATA_INSTALLER_OPTIONS} "${@}" || fatal "netdata-installer.sh exited with error"
447
- if [ -d "${TMPDIR}" ] && [ ! "${TMPDIR}" = "/" ]; then
448
- run ${sudo} rm -rf "${TMPDIR}" > /dev/null 2>&1
477
+ if [ -d "${ndtmpdir}" ] && [ ! "${ndtmpdir}" = "/" ]; then
478
+ run ${sudo} rm -rf "${ndtmpdir}" > /dev/null 2>&1
479
fi
480
else
451
- fatal "Cannot install netdata from source (the source directory does not include netdata-installer.sh). Leaving all files in ${TMPDIR}"
481
+ fatal "Cannot install netdata from source (the source directory does not include netdata-installer.sh). Leaving all files in ${ndtmpdir}"
482
fi
packaging/installer/methods/kickstart-64.md
+1
-1
@@ -78,7 +78,7 @@ To use `md5sum` to verify the intregity of the `kickstart-static64.sh` script yo
78
command above, run the following:
79
80
```bash
81
-[ "4940607945b1b92db96d4674b5bba7b3" = "$(curl -Ss https://my-netdata.io/kickstart-static64.sh | md5sum | cut -d ' ' -f 1)" ] && echo "OK, VALID" || echo "FAILED, INVALID"
81
+[ "2b0219a71a070853e9109eecebb4be92" = "$(curl -Ss https://my-netdata.io/kickstart-static64.sh | md5sum | cut -d ' ' -f 1)" ] && echo "OK, VALID" || echo "FAILED, INVALID"
82
```
83
84
If the script is valid, this command will return `OK, VALID`.
packaging/installer/methods/kickstart.md
+1
-1
@@ -61,7 +61,7 @@ To use `md5sum` to verify the intregity of the `kickstart.sh` script you will do
61
run the following:
62
63
```bash
64
-[ "e08dfbc39c23bf8993861e19c7d32368" = "$(curl -Ss https://my-netdata.io/kickstart.sh | md5sum | cut -d ' ' -f 1)" ] && echo "OK, VALID" || echo "FAILED, INVALID"
64
+[ "0bfd0e5d8ac868ff09957f1d43e8a35a" = "$(curl -Ss https://my-netdata.io/kickstart.sh | md5sum | cut -d ' ' -f 1)" ] && echo "OK, VALID" || echo "FAILED, INVALID"
65
```
66
67
If the script is valid, this command will return `OK, VALID`.
packaging/installer/netdata-updater.sh
+54
-25
@@ -16,6 +16,7 @@
16
#
17
# Optional environment options:
18
#
19
+# - TMPDIR (set to a usable temporary directory)
20
# - NETDATA_TARBALL_BASEURL (set the base url for downloading the dist tarball)
21
#
22
# Copyright: SPDX-License-Identifier: GPL-3.0-or-later
@@ -57,20 +58,48 @@ cleanup() {
58
rm "${logfile}"
59
fi
60
60
- if [ -n "$tmpdir" ] && [ -d "$tmpdir" ]; then
61
- rm -rf "$tmpdir"
61
+ if [ -n "$ndtmpdir" ] && [ -d "$ndtmpdir" ]; then
62
+ rm -rf "$ndtmpdir"
63
fi
64
}
65
66
+_cannot_use_tmpdir() {
67
+ local testfile ret
68
+ testfile="$(TMPDIR="${1}" mktemp -q -t netdata-test.XXXXXXXXXX)"
69
+ ret=0
70
+
71
+ if [ -z "${testfile}" ] ; then
72
+ return "${ret}"
73
+ fi
74
+
75
+ if /bin/echo -e '#!/bin/sh\necho SUCCESS\n' > "${testfile}" ; then
76
+ if chmod +x "${testfile}" ; then
77
+ if [ "$("${testfile}")" = "SUCCESS" ] ; then
78
+ ret=1
79
+ fi
80
+ fi
81
+ fi
82
+
83
+ rm -f "${testfile}"
84
+ return "${ret}"
85
+}
86
+
87
create_tmp_directory() {
66
- # Check if tmp is mounted as noexec
67
- if grep -Eq '^[^ ]+ /tmp [^ ]+ ([^ ]*,)?noexec[, ]' /proc/mounts; then
68
- pattern="$(pwd)/netdata-updater-XXXXXX"
69
- else
70
- pattern="/tmp/netdata-updater-XXXXXX"
88
+ if [ -z "${TMPDIR}" ] || _cannot_use_tmpdir "${TMPDIR}" ; then
89
+ if _cannot_use_tmpdir /tmp ; then
90
+ if _cannot_use_tmpdir "${PWD}" ; then
91
+ echo >&2
92
+ echo >&2 "Unable to find a usable temprorary directory. Please set \$TMPDIR to a path that is both writable and allows execution of files and try again."
93
+ exit 1
94
+ else
95
+ TMPDIR="${PWD}"
96
+ fi
97
+ else
98
+ TMPDIR="/tmp"
99
+ fi
100
fi
101
73
- mktemp -d "$pattern"
102
+ mktemp -d -t netdata-updater-XXXXXXXXXX
103
}
104
105
download() {
@@ -140,10 +169,10 @@ update() {
169
[ -z "${logfile}" ] && info "Running on a terminal - (this script also supports running headless from crontab)"
170
171
RUN_INSTALLER=0
143
- tmpdir=$(create_tmp_directory)
144
- cd "$tmpdir" || exit 1
172
+ ndtmpdir=$(create_tmp_directory)
173
+ cd "$ndtmpdir" || exit 1
174
146
- download "${NETDATA_TARBALL_CHECKSUM_URL}" "${tmpdir}/sha256sum.txt" >&3 2>&3
175
+ download "${NETDATA_TARBALL_CHECKSUM_URL}" "${ndtmpdir}/sha256sum.txt" >&3 2>&3
176
177
current_version="$(command -v netdata > /dev/null && parse_version "$(netdata -v | cut -f 2 -d ' ')")"
178
latest_version="$(get_latest_version)"
@@ -162,9 +191,9 @@ update() {
191
elif [ -n "${NETDATA_TARBALL_CHECKSUM}" ] && grep "${NETDATA_TARBALL_CHECKSUM}" sha256sum.txt >&3 2>&3; then
192
info "Newest version is already installed"
193
else
165
- download "${NETDATA_TARBALL_URL}" "${tmpdir}/netdata-latest.tar.gz"
194
+ download "${NETDATA_TARBALL_URL}" "${ndtmpdir}/netdata-latest.tar.gz"
195
if ! grep netdata-latest.tar.gz sha256sum.txt | safe_sha256sum -c - >&3 2>&3; then
167
- fatal "Tarball checksum validation failed. Stopping netdata upgrade and leaving tarball in ${tmpdir}"
196
+ fatal "Tarball checksum validation failed. Stopping netdata upgrade and leaving tarball in ${ndtmpdir}"
197
fi
198
NEW_CHECKSUM="$(safe_sha256sum netdata-latest.tar.gz 2> /dev/null | cut -d' ' -f1)"
199
tar -xf netdata-latest.tar.gz >&3 2>&3
@@ -202,14 +231,14 @@ update() {
231
echo "${NEW_CHECKSUM}" > "${NETDATA_LIB_DIR}/netdata.tarball.checksum"
232
fi
233
205
- rm -rf "${tmpdir}" >&3 2>&3
234
+ rm -rf "${ndtmpdir}" >&3 2>&3
235
[ -n "${logfile}" ] && rm "${logfile}" && logfile=
236
237
return 0
238
}
239
240
logfile=
212
-tmpdir=
241
+ndtmpdir=
242
243
trap cleanup EXIT
244
@@ -264,24 +293,24 @@ fi
293
set_tarball_urls "${RELEASE_CHANNEL}" "${IS_NETDATA_STATIC_BINARY}"
294
295
if [ "${IS_NETDATA_STATIC_BINARY}" == "yes" ]; then
267
- TMPDIR="$(create_tmp_directory)"
296
+ ndtmpdir="$(create_tmp_directory)"
297
PREVDIR="$(pwd)"
298
270
- echo >&2 "Entering ${TMPDIR}"
271
- cd "${TMPDIR}" || exit 1
299
+ echo >&2 "Entering ${ndtmpdir}"
300
+ cd "${ndtmpdir}" || exit 1
301
273
- download "${NETDATA_TARBALL_CHECKSUM_URL}" "${TMPDIR}/sha256sum.txt"
274
- download "${NETDATA_TARBALL_URL}" "${TMPDIR}/netdata-latest.gz.run"
275
- if ! grep netdata-latest.gz.run "${TMPDIR}/sha256sum.txt" | safe_sha256sum -c - > /dev/null 2>&1; then
276
- fatal "Static binary checksum validation failed. Stopping netdata installation and leaving binary in ${TMPDIR}"
302
+ download "${NETDATA_TARBALL_CHECKSUM_URL}" "${ndtmpdir}/sha256sum.txt"
303
+ download "${NETDATA_TARBALL_URL}" "${ndtmpdir}/netdata-latest.gz.run"
304
+ if ! grep netdata-latest.gz.run "${ndtmpdir}/sha256sum.txt" | safe_sha256sum -c - > /dev/null 2>&1; then
305
+ fatal "Static binary checksum validation failed. Stopping netdata installation and leaving binary in ${ndtmpdir}"
306
fi
307
308
# Do not pass any options other than the accept, for now
309
# shellcheck disable=SC2086
281
- if sh "${TMPDIR}/netdata-latest.gz.run" --accept -- ${REINSTALL_OPTIONS}; then
282
- rm -r "${TMPDIR}"
310
+ if sh "${ndtmpdir}/netdata-latest.gz.run" --accept -- ${REINSTALL_OPTIONS}; then
311
+ rm -r "${ndtmpdir}"
312
else
284
- echo >&2 "NOTE: did not remove: ${TMPDIR}"
313
+ echo >&2 "NOTE: did not remove: ${ndtmpdir}"
314
fi
315
echo >&2 "Switching back to ${PREVDIR}"
316
cd "${PREVDIR}" || exit 1