[LON-CAPA-cvs] cvs: doc /loncapafiles systemd_config_check.piml
raeburn
raeburn at source.lon-capa.org
Mon Aug 17 19:49:55 EDT 2026
raeburn Mon Aug 17 23:49:55 2026 EDT
Modified files:
/doc/loncapafiles systemd_config_check.piml
Log:
- Check RestrictNamespaces and MemoryDenyWriteExecute values for systemd
service for web server. If Accessibility Checker will be supported on
this server modify/set new values as needed, when using ./UPDATE to
install/update a LON-CAPA instance.
-------------- next part --------------
Index: doc/loncapafiles/systemd_config_check.piml
diff -u doc/loncapafiles/systemd_config_check.piml:1.2 doc/loncapafiles/systemd_config_check.piml:1.3
--- doc/loncapafiles/systemd_config_check.piml:1.2 Wed Nov 27 16:30:09 2024
+++ doc/loncapafiles/systemd_config_check.piml Mon Aug 17 23:49:55 2026
@@ -2,7 +2,7 @@
"http://lpml.sourceforge.net/DTD/piml.dtd">
<!-- systemd_config_check.piml -->
-<!-- $Id: systemd_config_check.piml,v 1.2 2024/11/27 16:30:09 raeburn Exp $ -->
+<!-- $Id: systemd_config_check.piml,v 1.3 2026/08/17 23:49:55 raeburn Exp $ -->
<!--
@@ -39,7 +39,14 @@
my $service = 'apache2.service';
my $use_systemctl;
-my ($dist,$version) = ('<DIST />' =~ /^([A-Za-z]+)([\d\.]+)$/);
+my $distro = '<DIST />';
+my ($dist,$version);
+if ($distro =~ /^centos(\d+)\-stream$/) {
+ $version = $1;
+ $dist = 'centos-stream';
+} else {
+ ($dist,$version) = ($distro =~ /^([A-Za-z]+)([\d\.]+)$/);
+}
if (($dist eq 'sles') || ($dist eq 'suse')) {
if ($version >= 12) {
$use_systemctl = 1;
@@ -49,7 +56,7 @@
$use_systemctl = 1;
}
$service = 'httpd.service';
-} elsif ($dist =~ /^(centos|rhes|scientific|oracle|rocky|alma)$/) {
+} elsif ($dist =~ /^(centos|rhes|scientific|oracle|rocky|alma|centos\-stream)$/) {
if ($version >= 7) {
$use_systemctl = 1;
}
@@ -66,18 +73,44 @@
if ($use_systemctl) {
system('systemctl daemon-reload');
- if (open(PIPE,"systemctl show $service --property=ProtectHome --property=RestrictSUIDSGID 2>/dev/null |")) {
- my ($protecthome,$suidsgid);
+ my $confdir = '/etc/httpd/conf/';
+ if ((($dist eq 'sles') && ($version > 9)) ||
+ (($dist eq 'suse') && ($version >= 10.1)) ||
+ ($dist eq 'debian') || ($dist eq 'ubuntu')) {
+ $confdir = '/etc/apache2/';
+ }
+ my $filename='loncapa.conf';
+ my $lonAxeUser;
+ if (-e "$confdir$filename") {
+ if (open(my $fh,'<',$confdir.$filename)) {
+ while (my $configline=<$fh>) {
+ next unless ($configline =~ /lonAxeUser/);
+ if ($configline =~ /^[^\#]*PerlSetVar/) {
+ my ($unused,$varname,$varvalue)=split(/\s+/,$configline);
+ chomp($varvalue);
+ $lonAxeUser=$varvalue if $varvalue!~/^\{\[\[\[\[/;
+ }
+ }
+ close($fh);
+ }
+ }
+
+ if (open(PIPE,"systemctl show $service --property=ProtectHome --property=RestrictSUIDSGID --property=RestrictNamespaces --property=MemoryDenyWriteExecute 2>/dev/null |")) {
+ my ($protecthome,$suidsgid,$restrictnames,$memorydeny);
while (my $line =<PIPE>) {
chomp($line);
if ($line =~ /^ProtectHome=(read-only|yes)$/i) {
$protecthome = 1;
} elsif ($line =~ /^RestrictSUIDSGID=yes$/i) {
$suidsgid = 1;
+ } elsif ($line =~ /^RestrictNamespaces=yes$/i) {
+ $restrictnames = 1;
+ } elsif ($line =~ /^MemoryDenyWriteExecute=yes$/i) {
+ $memorydeny = 1;
}
}
close(PIPE);
- if ($protecthome || $suidsgid) {
+ if (($protecthome || $suidsgid) || (($lonAxeUser eq 'Y') && (($restrictnames || $memorydeny)))) {
if (!-d '/etc/systemd/system/'.$service.'.d') {
mkdir '/etc/systemd/system/'.$service.'.d', 0755;
}
@@ -121,6 +154,27 @@
$needs_update = 1;
}
$is_no{$key} = $linenum;
+ } elsif (($entry =~ /^(RestrictNamespaces|MemoryDenyWriteExecute)\s*=\s*(\w+)\s*$/) &&
+ ($lonAxeUser eq 'Y')) {
+ my ($key,$value) = ($1,$2);
+ next if ($is_no{$key});
+ if (lc($value) eq 'no') {
+ if ($category =~ /^Service$/i) {
+ push(@{$lines{'Service'}},$entry);
+ } else {
+ push(@move,$entry);
+ $needs_update = 1;
+ }
+ } else {
+ my $offstr = $key.'=no';
+ if ($category =~ /^Service$/i) {
+ push(@{$lines{'Service'}},$offstr);
+ } else {
+ push(@move,$offstr);
+ }
+ $needs_update = 1;
+ }
+ $is_no{$key} = $linenum;
} else {
next if ($entry =~ /^\s*$/);
if ($category =~ /^Service$/i) {
@@ -143,6 +197,14 @@
$needs_update = 1;
}
}
+ if ($lonAxeUser eq 'Y') {
+ foreach my $item ('RestrictNamespaces','MemoryDenyWriteExecute') {
+ unless (exists($is_no{$item})) {
+ push(@{$lines{'Service'}},$item.'=no');
+ $needs_update = 1;
+ }
+ }
+ }
if ($addservice || $needs_update) {
if (open(my $fh,'>','/etc/systemd/system/'.$service.'.d/override.conf')) {
if (@ordered) {
@@ -161,6 +223,12 @@
unless (grep/^$key\s*=\s*no\s*$/i,@{$lines{$category}}) {
print $fh "$item\n";
}
+ } elsif (($item =~ /^(RestrictNamespaces|MemoryDenyWriteExecute)\s*=\s*no\s*$/i) &&
+ ($lonAxeUser eq 'Y')) {
+ my $key = $1;
+ unless (grep/^$key\s*=\s*no\s*$/i,@{$lines{$category}}) {
+ print $fh "$item\n";
+ }
} else {
print $fh "$item\n";
}
@@ -187,12 +255,25 @@
print '**** ERROR: Could not open /etc/systemd/system/'.$service.'.d/override.conf to write RestrictSUIDSGID=no.'."\n".
'Creation of sub-directories in Authoring Space will not be possible from the web interface.'."\n";
}
+ if (($lonAxeUser eq 'Y') && ($restrictnames || $memorydeny)) {
+ if (($restrictnames) && ($memorydeny)) {
+ print '**** ERROR: Could not open /etc/systemd/system/'.$service.'.d/override.conf to write RestrictNamespaces=no and MemoryDenyWriteExecute="no.'."\n";
+ } elsif ($restrictnames) {
+ print '**** ERROR: Could not open /etc/systemd/system/'.$service.'.d/override.conf to write RestrictNamespaces=no.'."\n";
+ } elsif ($memorydeny) {
+ print '**** ERROR: Could not open /etc/systemd/system/'.$service.'.d/override.conf to write MemoryDenyWriteExecute=no.'."\n";
+ }
+ print 'Accessibility Checker will be not usable.'."\n";
+ }
}
}
}
} else {
if (open(my $fh,'>','/etc/systemd/system/'.$service.'.d/override.conf')) {
print $fh '[Service]'."\n".'ProtectHome=no'."\n".'RestrictSUIDSGID=no'."\n";
+ if ($lonAxeUser) {
+ print $fh ('RestrictNamespaces=no','MemoryDenyWriteExecute=no')
+ }
close($fh);
print 'Created /etc/systemd/system/'.$service.'.d/override.conf'."\n";
system('systemctl daemon-reload');
@@ -205,6 +286,16 @@
print '**** ERROR: Could not open /etc/systemd/system/'.$service.'.d/override.conf to write RestrictSUIDSGID=no.'."\n".
'Creation of sub-directories in Authoring Space will not be possible from the web interface.'."\n";
}
+ if (($lonAxeUser eq 'Y') && ($restrictnames || $memorydeny)) {
+ if (($restrictnames) && ($memorydeny)) {
+ print '**** ERROR: Could not open /etc/systemd/system/'.$service.'.d/override.conf to write RestrictNamespaces=no and MemoryDenyWriteExecute="no.'."\n";
+ } elsif ($restrictnames) {
+ print '**** ERROR: Could not open /etc/systemd/system/'.$service.'.d/override.conf to write RestrictNamespaces=no.'."\n";
+ } elsif ($memorydeny) {
+ print '**** ERROR: Could not open /etc/systemd/system/'.$service.'.d/override.conf to write MemoryDenyWriteExecute=no.'."\n";
+ }
+ print 'Accessibility Checker will be not usable.'."\n";
+ }
}
}
} else {
@@ -215,11 +306,18 @@
if ($suidsgid) {
print 'Creation of sub-directories in Authoring Space will not be possible from the web interface.'."\n";
}
+ if (($lonAxeUser eq 'Y') && ($restrictnames || $memorydeny)) {
+ print 'Accessibility Checker will be not usable.'."\n";
+ }
}
}
} else {
print '**** WARNING *** Could not determine status of ProtectHome property for systemd '.$service.".\n".
'It was not possible to determine whether LON-CAPA web interface will be usable.'."\n";
+ if ($lonAxeUser eq 'Y') {
+ print '**** WARNING *** Could not determine status of RestrictNamespaces property for systemd '.$service.".\n".
+ 'It was not possible to determine whether Accessibility Checker will be usable.'."\n";
+ }
}
}
More information about the LON-CAPA-cvs
mailing list