1#!/bin/sh 2# 3# CDDL HEADER START 4# 5# The contents of this file are subject to the terms of the 6# Common Development and Distribution License (the "License"). 7# You may not use this file except in compliance with the License. 8# 9# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10# or http://www.opensolaris.org/os/licensing. 11# See the License for the specific language governing permissions 12# and limitations under the License. 13# 14# When distributing Covered Code, include this CDDL HEADER in each 15# file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16# If applicable, add the following below this CDDL HEADER, with the 17# fields enclosed by brackets "[]" replaced with your own identifying 18# information: Portions Copyright [yyyy] [name of copyright owner] 19# 20# CDDL HEADER END 21# 22# i.rbac 23# 24# Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved. 25# 26# class action script for "rbac" class files 27# installed by pkgadd 28# 29# Files in "rbac" class: 30# 31# /etc/security/{prof_attr,exec_attr,auth_attr} 32# /etc/user_attr 33# 34# Allowable exit codes 35# 36# 0 - success 37# 2 - warning or possible error condition. Installation continues. A warning 38# message is displayed at the time of completion. 39# 40 41umask 022 42 43tmp_dir=${TMPDIR:-/tmp} 44 45PATH="/usr/bin:/usr/sbin:${PATH}" 46export PATH 47 48basename_cmd=basename 49cp_cmd=cp 50egrep_cmd=egrep 51mv_cmd=mv 52nawk_cmd=nawk 53rm_cmd=rm 54sed_cmd=sed 55sort_cmd=sort 56 57# $1 is the type 58# $2 is the "old/existing file" 59# $3 is the "new (to be merged)" file 60# $4 is the output file 61# returns 0 on success 62# returns 2 on failure if nawk fails with non-zero exit status 63# 64dbmerge() { 65# 66# Remove the ident lines. 67# 68 ${egrep_cmd} -v '^#[pragma ]*ident' $2 > $4.old 2>/dev/null 69# 70# If the new file has a Sun copyright, remove the Sun copyright from the old 71# file. 72# 73 newcr=`${egrep_cmd} '^# Copyright.*Sun Microsystems, Inc.' $3 \ 74 2>/dev/null` 75 if [ -n "${newcr}" ]; then 76 $sed_cmd -e '/^# Copyright.*Sun Microsystems, Inc./d' \ 77 -e '/^# All rights reserved./d' \ 78 -e '/^# Use is subject to license terms./d' \ 79 $4.old > $4.$$ 2>/dev/null 80 $mv_cmd $4.$$ $4.old 81 fi 82# 83# If the new file has an Oracle copyright, remove both the Sun and Oracle 84# copyrights from the old file. 85# 86 oracle_cr=`${egrep_cmd} '^# Copyright.*Oracle and/or its affiliates.' \ 87 $3 2>/dev/null` 88 if [ -n "${oracle_cr}" ]; then 89 $sed_cmd -e '/^# Copyright.*Sun Microsystems, Inc./d' \ 90 -e '/^# All rights reserved./d' \ 91 -e '/^# Use is subject to license terms./d' \ 92 -e '/^# Copyright.*Oracle and\/or its affiliates./d' \ 93 $4.old > $4.$$ 2>/dev/null 94 $mv_cmd $4.$$ $4.old 95 fi 96# 97# If the new file has the CDDL, remove it from the old file. 98# 99 newcr=`${egrep_cmd} '^# CDDL HEADER START' $3 2>/dev/null` 100 if [ -n "${newcr}" ]; then 101 $sed_cmd -e '/^# CDDL HEADER START/,/^# CDDL HEADER END/d' \ 102 $4.old > $4.$$ 2>/dev/null 103 $mv_cmd $4.$$ $4.old 104 fi 105# 106# Remove empty lines and multiple instances of these comments: 107# 108 $sed_cmd -e '/^# \/etc\/security\/exec_attr/d' -e '/^#$/d' \ 109 -e '/^# execution attributes for profiles./d' \ 110 -e '/^# See exec_attr(4)/d' \ 111 -e '/^# \/etc\/user_attr/d' \ 112 -e '/^# user attributes. see user_attr(4)/d' \ 113 -e '/^# \/etc\/security\/prof_attr/d' \ 114 -e '/^# profiles attributes. see prof_attr(4)/d' \ 115 -e '/^# See prof_attr(4)/d' \ 116 -e '/^# \/etc\/security\/auth_attr/d' \ 117 -e '/^# authorizations. see auth_attr(4)/d' \ 118 -e '/^# authorization attributes. see auth_attr(4)/d' \ 119 $4.old > $4.$$ 120 $mv_cmd $4.$$ $4.old 121# 122# Retain old and new header comments. 123# 124 $sed_cmd -n -e '/^[^#]/,$d' -e '/^##/,$d' -e p $4.old > $4 125 $rm_cmd $4.old 126 $sed_cmd -n -e '/^[^#]/,$d' -e '/^##/,$d' -e p $3 >> $4 127# 128# If the output file now has both Sun and Oracle copyrights, remove 129# the Sun copyright. 130# 131 sun_cr=`${egrep_cmd} '^# Copyright.*Sun Microsystems, Inc.' \ 132 $4 2>/dev/null` 133 oracle_cr=`${egrep_cmd} '^# Copyright.*Oracle and/or its affiliates.' \ 134 $4 2>/dev/null` 135 if [ -n "${sun_cr}" ] && [ -n "${oracle_cr}" ]; then 136 $sed_cmd -e '/^# Copyright.*Sun Microsystems, Inc./d' \ 137 -e '/^# All rights reserved./d' \ 138 -e '/^# Use is subject to license terms./d' \ 139 $4 > $4.$$ 2>/dev/null 140 $mv_cmd $4.$$ $4 141 fi 142# 143# Handle line continuations (trailing \) 144# 145 $sed_cmd \ 146 -e '/\\$/{N;s/\\\n//;}' -e '/\\$/{N;s/\\\n//;}' \ 147 -e '/\\$/{N;s/\\\n//;}' -e '/\\$/{N;s/\\\n//;}' \ 148 -e '/\\$/{N;s/\\\n//;}' -e '/\\$/{N;s/\\\n//;}' \ 149 $2 > $4.old 150 $sed_cmd \ 151 -e '/\\$/{N;s/\\\n//;}' -e '/\\$/{N;s/\\\n//;}' \ 152 -e '/\\$/{N;s/\\\n//;}' -e '/\\$/{N;s/\\\n//;}' \ 153 -e '/\\$/{N;s/\\\n//;}' -e '/\\$/{N;s/\\\n//;}' \ 154 $3 > $4.new 155# 156# The nawk script below processes the old and new files using up to 157# three passes. If the old file is empty, only the final pass over 158# the new file is required. 159# 160 if [ -s $4.old ]; then 161 nawk_pass1=$4.old 162 nawk_pass2=$4.new 163 nawk_pass3=$4.new 164 else 165 nawk_pass1= 166 nawk_pass2= 167 nawk_pass3=$4.new 168 fi 169# 170#!/usr/bin/nawk -f 171# 172# dbmerge type=[auth|prof|user|exec] [ old-file new-file ] new-file 173# 174# Merge two versions of an RBAC database file. The output 175# consists of the lines from the new-file, while preserving 176# user customizations in the old-file. 177# 178# Entries in the new-file replace corresponding entries in the 179# old-file, except as follows: For exec_attr, all old entries 180# for profiles contained in the new-file are discarded. For 181# user_attr, the "root" entry from the old-file is retained, 182# and new keywords from the new-file are merged into it. 183# 184# Records with the same key field(s) are merged, so that the 185# keyword/value section of each output record contains the union 186# of the keywords found in all input records with the same key 187# field(s). For selected multi-value keywords [1] the values from 188# the new-file are merged with retained values from the old-file. 189# Otherwise, the value for each keyword is the final value found 190# in the new-file, except for keywords in the user_attr entry for 191# "root" where values from the old-file are always retained. 192# 193# [1] The following file type and keyword combinations are merged: 194# prof_attr: auths, profiles, privs 195# user_attr: auths, profiles, roles 196# 197# The output is run through sort except for the comments 198# which will appear first in the output. 199# 200# 201 $nawk_cmd ' 202 203# This script may be invoked with up to three file names. Each file 204# name corresponds to a separate processing pass. The passes are 205# defined as follows: 206# 207# Pass 1: Read existing data. 208# Data from the old-file is read into memory. 209# 210# Pass 2: Remove obsolete data. 211# Discard any data from the old-file that is part of profiles that 212# are also in the new-file. (As a special case, the user_attr entry 213# for 'root' is always retained.) 214# 215# Pass 3: Merge new data. 216# Data from the new-file is merged with the remaining old-file data. 217# (As a special case, exec_attr entries are replaced, not merged.) 218 219BEGIN { 220 # The variable 'pass' specifies which type of processing to perform. 221 # When processing only one file, skip passes 1 and 2. 222 if (ARGC == 3) 223 pass += 2; 224 225 # The array 'keyword_behavior' specifies the special treatment of 226 # [type, keyword] combinations subject to value merging. 227 keyword_behavior["prof", "auths"] = "merge"; 228 keyword_behavior["prof", "profiles"] = "merge"; 229 keyword_behavior["prof", "privs"] = "merge"; 230 keyword_behavior["user", "auths"] = "merge"; 231 keyword_behavior["user", "profiles"] = "merge"; 232 keyword_behavior["user", "roles"] = "merge"; 233 234 FS=":" 235} 236 237# When FNR (current file record number) is 1 it indicates that nawk 238# is starting to read the next file specified on its command line, 239# and is beginning the next processing pass. 240FNR == 1 { 241 pass++; 242} 243 244/^#/ || /^$/ { 245 next; 246} 247 248{ 249 # For each input line, nawk automatically assigns the complete 250 # line to $0 and also splits the line at field separators and 251 # assigns each field to a variable $1..$n. Assignment to $0 252 # re-splits the line into the field variables. Conversely, 253 # assgnment to a variable $1..$n will cause $0 to be recomputed 254 # from the field variable values. 255 # 256 # This code adds awareness of escaped field separators by using 257 # a custom function to split the line into a temporary array. 258 # It assigns the empty string to $0 to clear any excess field 259 # variables, and assigns the desired elements of the temporary 260 # array back to the field variables $1..$7. 261 # 262 # Subsequent code must not assign directly to $0 or the fields 263 # will be re-split without regard to escaped field separators. 264 split_escape($0, f, ":"); 265 $0 = ""; 266 $1 = f[1]; 267 $2 = f[2]; 268 $3 = f[3]; 269 $4 = f[4]; 270 $5 = f[5]; 271 $6 = f[6]; 272 $7 = f[7]; 273} 274 275type == "auth" { 276 key = $1 ":" $2 ":" $3 ; 277 if (pass == 1) { 278 short_comment[key] = $4 ; 279 long_comment[key] = $5; 280 record[key] = $6; 281 } else if (pass == 2) { 282 delete short_comment[key]; 283 delete long_comment[key]; 284 delete record[key]; 285 } else if (pass == 3) { 286 if ( $4 != "" ) { 287 short_comment[key] = $4 ; 288 } 289 if ( $5 != "" ) { 290 long_comment[key] = $5 ; 291 } 292 record[key] = merge_attrs(record[key], $6); 293 } 294} 295 296type == "prof" { 297 key = $1 ":" $2 ":" $3 ; 298 if (pass == 1) { 299 comment[key] = $4; 300 record[key] = $5; 301 } else if (pass == 2) { 302 delete comment[key]; 303 delete record[key]; 304 } else if (pass == 3) { 305 if ( $4 != "" ) { 306 comment[key] = $4 ; 307 } 308 if (key != "::") { 309 record[key] = merge_attrs(record[key], $5); 310 } 311 } 312} 313 314type == "exec" { 315 key = $1 ":" $2 ":" $3 ":" $4 ":" $5 ":" $6 ; 316 if (pass == 1) { 317 record[key] = $7; 318 } else if (pass == 2) { 319 # For exec_attr, deletion is based on the 'name' field only, 320 # so that all old entries for the profile are removed. 321 for (oldkey in record) { 322 split_escape(oldkey, oldkey_fields, ":"); 323 if (oldkey_fields[1] == $1) 324 delete record[oldkey]; 325 } 326 } else if (pass == 3) { 327 # Substitute new entries, do not merge. 328 record[key] = $7; 329 } 330} 331 332type == "user" { 333 key = $1 ":" $2 ":" $3 ":" $4 ; 334 if (pass == 1) { 335 record[key] = $5; 336 } else if (pass == 2) { 337 if ($1 != "root") 338 delete record[key]; 339 } else if (pass == 3) { 340 record[key] = merge_attrs(record[key], $5); 341 } 342} 343 344END { 345 for (key in record) { 346 if (type == "prof") { 347 if (key != "::") { 348 print key ":" comment[key] ":" record[key]; 349 } 350 } else 351 if (type == "auth") { 352 print key ":" short_comment[key] ":" \ 353 long_comment[key] ":" record[key]; 354 } else 355 print key ":" record[key]; 356 } 357} 358 359function merge_attrs(old, new, cnt, new_cnt, i, j, list, new_list, keyword) 360{ 361 cnt = split_escape(old, list, ";"); 362 new_cnt = split_escape(new, new_list, ";"); 363 for (i = 1; i <= new_cnt; i++) { 364 keyword = substr(new_list[i], 1, index(new_list[i], "=")-1); 365 for (j = 1; j <= cnt; j++) { 366 if (match(list[j], "^" keyword "=")) { 367 list[j] = merge_values(keyword, list[j], 368 new_list[i]); 369 break; 370 } 371 } 372 if (j > cnt) 373 list[++cnt] = new_list[i]; 374 } 375 376 return unsplit(list, cnt, ";"); \ 377} 378 379function merge_values(keyword, old, new, cnt, new_cnt, i, j, list, new_list, d) 380{ 381 # Keywords with multivalued attributes that are subject to merging 382 # are processed by the algorithm implemented further below. 383 # Otherwise, the keyword is not subject to merging, and: 384 # For user_attr, the existing value is retained. 385 # For any other file, the new value is substituted. 386 if (keyword_behavior[type, keyword] != "merge") { 387 if (type == "user") { 388 return old; 389 } else { 390 return new; 391 } 392 } 393 394 cnt = split(substr(old, length(keyword)+2), list, ","); 395 new_cnt = split(substr(new, length(keyword)+2), new_list, ","); 396 397 # If the existing list contains "All", remove it and add it 398 # to the new list; that way "All" will appear at the only valid 399 # location, the end of the list. 400 if (keyword == "profiles") { 401 d = 0; 402 for (i = 1; i <= cnt; i++) { 403 if (list[i] != "All") 404 list[++d] = list[i]; 405 } 406 if (cnt != d) { 407 new_list[++new_cnt] = "All"; 408 cnt = d; 409 } 410 } 411 for (i = 1; i <= new_cnt; i++) { 412 for (j = 1; j <= cnt; j++) { 413 if (list[j] == new_list[i]) 414 break; 415 } 416 if (j > cnt) 417 list[++cnt] = new_list[i]; 418 } 419 420 return keyword "=" unsplit(list, cnt, ","); 421} 422 423# This function is similar to the nawk built-in split() function, 424# except that a "\" character may be used to escape any subsequent 425# character, so that the escaped character will not be treated as a 426# field separator or as part of a field separator regular expression. 427# The "\" characters will remain in the elements of the output array 428# variable upon completion. 429function split_escape(str, list, fs, cnt, saved, sep) 430{ 431 # default to global FS 432 if (fs == "") 433 fs = FS; 434 # initialize empty list, cnt, saved 435 split("", list, " "); 436 cnt = 0; 437 saved = ""; 438 # track whether last token was a field separator 439 sep = 0; 440 # nonzero str length indicates more string left to scan 441 while (length(str)) { 442 if (match(str, fs) == 1) { 443 # field separator, terminates current field 444 list[++cnt] = saved; 445 saved = ""; 446 str = substr(str, RLENGTH + 1); 447 sep = 1; 448 } else if (substr(str, 1, 1) == "\\") { 449 # escaped character 450 saved = saved substr(str, 1, 2); 451 str = substr(str, 3); 452 sep = 0; 453 } else { 454 # regular character 455 saved = saved substr(str, 1, 1); 456 str = substr(str, 2); 457 sep = 0; 458 } 459 } 460 # if required, append final field to list 461 if (sep || length(saved)) 462 list[++cnt] = saved; 463 464 return cnt; 465} 466 467function unsplit(list, cnt, delim, str) 468{ 469 str = list[1]; 470 for (i = 2; i <= cnt; i++) 471 str = str delim list[i]; 472 return str; 473}' \ 474 type=$1 $nawk_pass1 $nawk_pass2 $nawk_pass3 > $4.unsorted 475 rc=$? 476 $sort_cmd < $4.unsorted >> $4 477 return $rc 478} 479 480# $1 is the merged file 481# $2 is the target file 482# 483commit() { 484 # Make sure that the last mv uses rename(2) by first moving to 485 # the same filesystem. 486 $mv_cmd $1 $2.$$ 487 $mv_cmd $2.$$ $2 488 return $? 489} 490 491outfile="" 492type="" 493set_type_and_outfile() { 494 # 495 # Assumes basename $1 returns one of 496 # prof_attr, exec_attr, auth_attr, or user_attr 497 # 498 fname=`$basename_cmd $1` 499 type=`echo $fname | $sed_cmd -e s'/^\([a-z][a-z]*\)_attr$/\1/' ` 500 case "$type" in 501 "prof"|"exec"|"user"|"auth") ;; 502 *) return 2 ;; 503 esac 504 505 outfile=$tmp_dir/rbac_${PKGINST}_${fname}_merge.$$ 506 507 return 0 508} 509 510cleanup() { 511 $rm_cmd -f $outfile $outfile.old $outfile.new $outfile.unsorted 512 513 return 0 514} 515 516exit_status=0 517 518# main 519 520while read newfile oldfile ; do 521 if [ -n "$PKGINST" ] 522 then 523 # Install the file in the "fragment" directory. 524 mkdir -m 755 -p ${oldfile}.d 525 rm -f ${oldfile}.d/"$PKGINST" 526 cp $newfile ${oldfile}.d/"$PKGINST" 527 528 # Make sure that it is marked read-only. 529 chmod a-w,a+r ${oldfile}.d/"$PKGINST" 530 531 # We also execute the rest of the i.rbac script. 532 fi 533 534 if [ ! -f $oldfile ]; then 535 cp $newfile $oldfile 536 else 537 set_type_and_outfile $newfile || 538 set_type_and_outfile $oldfile 539 if [ $? -ne 0 ]; then 540 echo "$0 : $newfile not one of" \ 541 " prof_attr, exec_attr, auth_attr, user_attr" 542 exit_status=2 543 continue 544 fi 545 546 dbmerge $type $oldfile $newfile $outfile 547 if [ $? -ne 0 ]; then 548 echo "$0 : failed to merge $newfile with $oldfile" 549 cleanup 550 exit_status=2 551 continue 552 fi 553 554 commit $outfile $oldfile 555 if [ $? -ne 0 ]; then 556 echo "$0 : failed to mv $outfile to $2" 557 cleanup 558 exit_status=2 559 continue 560 fi 561 562 cleanup 563 fi 564done 565 566if [ "$1" = "ENDOFCLASS" ]; then 567 exit 0 568fi 569 570exit $exit_status 571