Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(templates): set ownership and permissions on private files folder #82

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

feat(templates): set ownership and permissions on private files folder #82

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a169c63
feat(templates): set ownership and permissions on private files folder
ClassicCut Aug 28, 2020
ccad213
fix(templates): add root folder check for private files permissions s…
ClassicCut Sep 2, 2020
933ed5f
fix(permissions): use double bracket
minorOffense Dec 17, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 31 additions & 11 deletions templates/drupal-fix-permissions.sh.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,9 @@ if [ -z "${drupal_user}" ] || [[ $(id -un "${drupal_user}" 2> /dev/null) != "${d
fi

printf "Checking Drupal version at "${drupal_path}"... ";
dversion=$(drush core-status --format=json --root=${drupal_path} | jq '."drupal-version"' --raw-output | awk -F. '{print $1}')
dstatus=$(drush core-status --format=json --root=${drupal_path})
dversion=$(echo $dstatus | jq '."drupal-version"' --raw-output | awk -F. '{print $1}')
private_files_path=$(echo $dstatus | jq '."private"' --raw-output)
printf "Detected: "

# Check which version we have.
Expand All @@ -95,7 +97,7 @@ cd $drupal_path
# Composer vendor.
if [ -d "${drupal_path}/../vendor" ]; then
# Since there's a parent folder, revoke other's privileges.
printf "Revoking 'other' user access to parent directory "${drupal_path}/.." \n" && \
printf "Revoking other user access to parent directory "${drupal_path}/.." \n" && \
chmod -R o-rwx ${drupal_path}/.. &
# Set the right permissions.
printf "Grant access to apache to parent folder "${drupal_path}/.." \n" && \
Expand All @@ -104,21 +106,21 @@ if [ -d "${drupal_path}/../vendor" ]; then
chmod u=rwx,g=rx,o= ${drupal_path}/..
chmod u=rwx,g=rx,o= ${drupal_path}/../*

printf "Changing ownership of "vendor" directories in "${drupal_path}/../vendor" \n" && \
printf "Changing ownership of vendor directories in "${drupal_path}/../vendor" \n" && \
chown -R ${drupal_user}:${httpd_group} ${drupal_path}/../vendor
find ${drupal_path}/../vendor -type d ! -name . -exec chmod g=rx '{}' +
chmod g=rx ${drupal_path}/../vendor

if [ -d "${drupal_path}/../vendor/bin" ]; then
printf "Changing permissions of "vendor/bin" directories in "${drupal_path}/../vendor/bin" to "u+x"...\n" && \
printf "Changing permissions of vendor/bin directories in "${drupal_path}/../vendor/bin" to "u+x"...\n" && \
chmod -R u+x ${drupal_path}/../bin &
fi

fi

# Bin directories.
if [ -d "${drupal_path}/../bin" ]; then
printf "Changing permissions of "bin" directories in "${drupal_path}/../bin" to "u+x"...\n" && \
printf "Changing permissions of bin directories in "${drupal_path}/../bin" to "u+x"...\n" && \
chmod -R u+x ${drupal_path}/../bin &
# Set the right permissions.
printf "Grant access to apache to parent folder "${drupal_path}/.." \n" && \
Expand All @@ -129,7 +131,7 @@ fi

# Composer.json file.
if [ -f "${drupal_path}/../composer.json" ]; then
printf "Changing permissions of "composer.json" in "${drupal_path}/../" to "rw-r-----"...\n" && \
printf "Changing permissions of composer.json in "${drupal_path}/../" to "rw-r-----"...\n" && \
chmod 640 ${drupal_path}/../composer.json
chown ${drupal_user}:${httpd_group} ${drupal_path}/../composer.json
# Set the right permissions.
Expand All @@ -145,7 +147,7 @@ fi

# Load environment file.
if [ -f "${drupal_path}/../load.environment.php" ]; then
printf "Changing permissions of "load.environment.php" in "${drupal_path}/../" to "rw-r-----"...\n" && \
printf "Changing permissions of load.environment.php in "${drupal_path}/../" to "rw-r-----"...\n" && \
chmod 640 ${drupal_path}/../load.environment.php
chown ${drupal_user}:${httpd_group} ${drupal_path}/../load.environment.php
# Set the right permissions.
Expand Down Expand Up @@ -224,21 +226,39 @@ printf "Changing permissions of all directories inside "${drupal_path}" to "rwxr
find . -type d -not -path "./sites/*/files" ! -name . -exec chmod u=rwx,g=rx,o= '{}' +
chmod u=rwx,g=rx,o= $drupal_path

printf "Changing permissions of "files" directories in "${drupal_path}/sites" to "rwxrwx---"...\n"
printf "Changing permissions of files directories in "${drupal_path}/sites" to "rwxrwx---"...\n"

cd sites

# Todo: Ask drush where the files are and set the perms there.
printf "Changing permissions of all files inside all "files" directories in "${drupal_path}/sites" to "rw-rw----"...\n" && \
printf "Changing permissions of all directories inside all "files" directories in "${drupal_path}/sites" to "rwxrwx---"...\n" && \
printf "Changing permissions of all files inside all files directories in "${drupal_path}/sites" to "rw-rw----"...\n" && \
printf "Changing permissions of all directories inside all files directories in "${drupal_path}/sites" to "rwxrwx---"...\n" && \
for x in ./*/files; do
find ${x} -type d -exec chmod ug=rwx,o= '{}' +
# Don't need to set non-directory perms as they're already set above.
done


# Set permissions on private files path.
# Ask drush where the files directories are.
cd $drupal_path
if [ "$private_files_path" ] && [ -d "$private_files_path" ] && [[ "$private_files_path" == /var/www/* ]]; then
chown -R ${drupal_user}:${httpd_group} ${private_files_path} &
printf "Changing permissions of all files inside private files directory ${private_files_path} to rw-rw----...\n" && \
printf "Changing permissions of private files directory and all directories inside ${private_files_path} to rwxrwx---...\n" && \
chmod u=rwx,g=rwx,o= ${private_files_path}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Doesn't this line (248) become redundant if the two 'find' commands below apply the correct permissions to the same path?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@finalhow I wasn't sure if the find command would apply the permissions to the containing (top-level) directory, or if the find command would only return and apply permissions to only the directories contained within that top-level private files directory.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah makes sense. Well, either way its just one chmod extra on one directory and its not recursive so no big deal.

Easy way to test if ever you need to: Run the same find command without the 'exec' bit and 'head' the output:

find <path> -type d | head

Anyway ok perfect.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ClassicCut Forgot to @ mention my reply... bah

find ${private_files_path} -type d -exec chmod u=rwx,g=rwx,o= '{}' +
find ${private_files_path} -not -type d -exec chmod u=rw,g=rw,o= '{}' +
# Restore SELinux modes for private files directory.
command_exists restorecon && \
printf "Restoring SeLinux file contexts for ${private_files_path}, please wait...\n" && \
restorecon -RF ${private_files_path} &
fi


# Check permissions for supporting directories.
if [ "$dversion" -eq 7 ] && [ -d "${drupal_path}/sites/all/vendor/bin" ]; then
printf "Changing permissions of "vendor/bin" directories in "${drupal_path}/sites/all/vendor/bin" to "u+x"...\n" && \
printf "Changing permissions of vendor/bin directories in "${drupal_path}/sites/all/vendor/bin" to "u+x"...\n" && \
chmod -R u+x ${drupal_path}/sites/all/vendor/bin &
fi

Expand Down