JezK
Edit File: cl-linksafe-reconfigure
#!/bin/bash # CloudLinux Links Traversal Protection configure utility set -o pipefail PARAM_ALLOW_SGID="fs.protected_symlinks_allow_gid" PARAM_ALLOW_HGID="fs.protected_hardlinks_allow_gid" PARAM_S_CREATE="fs.protected_symlinks_create" PARAM_H_CREATE="fs.protected_hardlinks_create" SYSCTL_FILE="/etc/sysctl.d/cloudlinux-linksafe.conf" SYSTEM_LINKSAFE_GID="$(getent group linksafe | cut -d: -f3)" MAIN_SYSCTL_FILE="/etc/sysctl.conf" CONVERT="" if [[ $EUID -ne 0 ]]; then echo "This script must be run as root" exit 1 fi function fix_linksafe { # fix permissions for alt-php packages installed without linksafe group find /opt/alt/php* \( -user root -a ! -group root -a ! -group linksafe \) -exec chown -h root:linksafe {} \; &> /dev/null # fix permissions for alt-python packages installed without linksafe group find /opt/alt/python* \( -user root -a ! -group root -a ! -group linksafe \) -exec chown -h root:linksafe {} \; &> /dev/null # fix permissions for alt-ruby packages installed without linksafe group find /opt/alt/ruby* \( -user root -a ! -group root -a ! -group linksafe \) -exec chown -h root:linksafe {} \; &> /dev/null # fix permissions for native php chown root:linksafe /usr/selector.etc/php.ini &> /dev/null chown root:linksafe /usr/selector/lsphp &> /dev/null chown root:linksafe /usr/selector/php &> /dev/null chown root:linksafe /usr/selector/php-cli &> /dev/null if [ -e /usr/sbin/cagefsctl ] && [ -e /usr/share/cagefs-skeleton/bin ]; then if /usr/sbin/cagefsctl --setup-cl-selector &> /dev/null; then if [ -e /usr/share/cagefs/need.remount ]; then if /usr/sbin/cagefsctl --remount-all &> /dev/null; then rm -f /usr/share/cagefs/need.remount &> /dev/null fi fi fi fi } function check_params_in_sysctl_file { local ret_code=0 if ! grep "$PARAM_ALLOW_SGID" "$SYSCTL_FILE" > /dev/null; then let ret_code+=1 fi if ! grep "$PARAM_ALLOW_HGID" "$SYSCTL_FILE" > /dev/null; then let ret_code+=1 fi if ! grep "$PARAM_S_CREATE" "$SYSCTL_FILE" > /dev/null; then let ret_code+=1 fi if ! grep "$PARAM_H_CREATE" "$SYSCTL_FILE" > /dev/null; then let ret_code+=1 fi echo ${ret_code} return ${ret_code} } function migrate_linksafe_params { if [ -n "$SYSTEM_LINKSAFE_GID" ]; then if ! grep "# SecureLinks Link Traversal" "${SYSCTL_FILE}" > /dev/null; then echo "# SecureLinks Link Traversal Protection Section" >> "${SYSCTL_FILE}" fi if grep "$PARAM_S_CREATE" "$MAIN_SYSCTL_FILE" > /dev/null; then migrate_symlink_value=$(grep "$PARAM_S_CREATE" ${MAIN_SYSCTL_FILE} | awk -F "=" '{print $2}' | sed "s/\ //g") fi if ! grep "$PARAM_S_CREATE" "${SYSCTL_FILE}" > /dev/null; then if [[ 1 != "$migrate_symlink_value" ]]; then echo "$PARAM_S_CREATE = 0" >> "${SYSCTL_FILE}" else echo "$PARAM_S_CREATE = 1" >> "${SYSCTL_FILE}" fi fi if grep "$PARAM_H_CREATE" "$MAIN_SYSCTL_FILE" > /dev/null; then migrate_hardlink_value=$(grep "$PARAM_H_CREATE" ${MAIN_SYSCTL_FILE} | awk -F "=" '{print $2}' | sed "s/\ //g") fi if ! grep "$PARAM_H_CREATE" "${SYSCTL_FILE}" > /dev/null; then if [[ 1 != "$migrate_hardlink_value" ]]; then echo "$PARAM_H_CREATE = 0" >> "${SYSCTL_FILE}" else echo "$PARAM_H_CREATE = 1" >> "${SYSCTL_FILE}" fi fi if ! grep "$PARAM_ALLOW_SGID" "${SYSCTL_FILE}" > /dev/null; then echo "$PARAM_ALLOW_SGID = $SYSTEM_LINKSAFE_GID" >> "${SYSCTL_FILE}" fi if ! grep "$PARAM_ALLOW_HGID" "${SYSCTL_FILE}" > /dev/null; then echo "$PARAM_ALLOW_HGID = $SYSTEM_LINKSAFE_GID" >> "${SYSCTL_FILE}" fi fi } TEMP=$(getopt -o c --long convert -- "$@") eval set -- "$TEMP" while true; do case "$1" in -c | --convert ) CONVERT="true"; shift ;; * ) break ;; esac done if [[ "$SYSTEM_LINKSAFE_GID" == "" ]]; then groupadd -r linksafe SYSTEM_LINKSAFE_GID="$(getent group linksafe | cut -d: -f3)" fi if id mailman &> /dev/null; then usermod -a -G linksafe mailman &> /dev/null fi if [ ! -e "$SYSCTL_FILE" ] && [ -e /proc/sys/fs/protected_symlinks_allow_gid -o ! -z "$CONVERT" ]; then touch "$SYSCTL_FILE" fi if [ -e /proc/sys/fs/protected_symlinks_allow_gid -o ! -z "$CONVERT" ]; then SYSCTL_LINKSAFE_GID=$(grep -F "$PARAM_ALLOW_SGID" "$SYSCTL_FILE" | awk '{print $3}') if [[ 0 != "$(check_params_in_sysctl_file)" ]]; then migrate_linksafe_params fi if [[ "$SYSCTL_LINKSAFE_GID" != "$SYSTEM_LINKSAFE_GID" ]]; then sed -i -e "s/${PARAM_ALLOW_SGID}\s*=.*/${PARAM_ALLOW_SGID} = ${SYSTEM_LINKSAFE_GID}/" "$SYSCTL_FILE" &> /dev/null sed -i -e "s/${PARAM_ALLOW_HGID}\s*=.*/${PARAM_ALLOW_HGID} = ${SYSTEM_LINKSAFE_GID}/" "$SYSCTL_FILE" &> /dev/null fi fix_linksafe /usr/bin/plesk_configure "$CONVERT" /usr/share/cloudlinux-linksafe/cpanel/hooks/cpanel-linksafe-install-hooks "$CONVERT" sysctl --system &> /dev/null else fix_linksafe fi