Solr
  1. Solr
  2. SOLR-8101

Installation script permission issues and other scripts fixes

    Details

    • Type: Improvement Improvement
    • Status: Closed
    • Priority: Major Major
    • Resolution: Fixed
    • Affects Version/s: 5.3.1
    • Fix Version/s: 5.4
    • Component/s: scripts and tools
    • Labels:
    • Flags:
      Patch, Important

      Description

      Until https://issues.apache.org/jira/browse/SOLR-7871 is fixed, I suggest to improve current shell scripts. Provided patch:

      • changes $SOLR_ENV default to /etc/default/$SOLR_SERVICE.in.sh . This is security issue. If solr.in.sh is placed in directory which is writable by $SOLR_USER, solr process is able to write to it, and than it will be run by root on start/shutdown.
      • changes permissions. $SOLR_USER should only be able to write to $SOLR_VAR_DIR. This directory should not be readable by other users as it may contain personal information.
      • sets $SOLR_USER home directory to $SOLR_VAR_DIR . As I can see there is no need in /home/solr directory.
      • adds -f option to install_solr_service.sh. It should be used to safely upgrade Solr.
      • adds quotes to unquoted variables
      • adds leading zero to chmod commands
      • removes group from chown commands (uses ":")

      Tested on ubuntu 14.04 amd64, but changes are pretty system-independent.

      1. solr-5.3.1.patch
        8 kB
        Sergey Urushkin
      2. SOLR-8101.patch
        11 kB
        Timothy Potter
      3. solr-scripts-v2.patch
        11 kB
        Sergey Urushkin
      4. solr-scripts-v3.patch
        11 kB
        Sergey Urushkin

        Activity

        Hide
        Sergey Urushkin added a comment -

        Patch attached.

        Show
        Sergey Urushkin added a comment - Patch attached.
        Hide
        Timothy Potter added a comment -

        Thanks for the patch - I didn't go through the patch in detail yet, but how does this change to using /etc/default support multiple Solr instances per server? The whole point of keeping solr.in.sh in /var/solr is to support multiple Solr nodes per server, such as: /var/solr1 and /var/solr2 ... each will need a separate solr.in.sh

        Show
        Timothy Potter added a comment - Thanks for the patch - I didn't go through the patch in detail yet, but how does this change to using /etc/default support multiple Solr instances per server? The whole point of keeping solr.in.sh in /var/solr is to support multiple Solr nodes per server, such as: /var/solr1 and /var/solr2 ... each will need a separate solr.in.sh
        Hide
        Sergey Urushkin added a comment - - edited

        There is no problem with it now - updated patch creates /etc/default/$SOLR_SERVICE.in.sh. Thanks for advice.

        Show
        Sergey Urushkin added a comment - - edited There is no problem with it now - updated patch creates /etc/default/$SOLR_SERVICE.in.sh . Thanks for advice.
        Hide
        Shawn Heisey added a comment -

        I think it needs to look for the include script in the solr home first, for compatibility with existing installations.

        If we want to avoid that because of the potential security implications, then we must have explicit upgrade instructions that discuss moving the include script and changing its permissions. I would like to see an upgrade script that does all the heavy lifting for an upgrade, including looking for the include script in the solr home, moving it to /etc, renaming it, and setting the permissions.

        Show
        Shawn Heisey added a comment - I think it needs to look for the include script in the solr home first, for compatibility with existing installations. If we want to avoid that because of the potential security implications, then we must have explicit upgrade instructions that discuss moving the include script and changing its permissions. I would like to see an upgrade script that does all the heavy lifting for an upgrade, including looking for the include script in the solr home, moving it to /etc, renaming it, and setting the permissions.
        Hide
        Sergey Urushkin added a comment -

        I've added -f option to install_solr_service.sh. So, it could be used to safely upgrade Solr. See my new patch.

        Show
        Sergey Urushkin added a comment - I've added -f option to install_solr_service.sh . So, it could be used to safely upgrade Solr. See my new patch.
        Hide
        Timothy Potter added a comment -

        Thanks for the updated patch Sergey Urushkin. I'll try this out soon and work to get it committed for the next release.

        Show
        Timothy Potter added a comment - Thanks for the updated patch Sergey Urushkin . I'll try this out soon and work to get it committed for the next release.
        Hide
        Sergey Urushkin added a comment - - edited

        It seems that solr v.5.3.1 doesn't need rw permissions to $SOLR_INSTALL_DIR/server/solr-webapp and $SOLR_INSTALL_DIR/server/logs, so whole $SOLR_INSTALL_DIR should only be readable by $SOLR_USER. Attached patch v3.

        Show
        Sergey Urushkin added a comment - - edited It seems that solr v.5.3.1 doesn't need rw permissions to $SOLR_INSTALL_DIR/server/solr-webapp and $SOLR_INSTALL_DIR/server/logs , so whole $SOLR_INSTALL_DIR should only be readable by $SOLR_USER . Attached patch v3.
        Hide
        Timothy Potter added a comment -

        I've tried this out on Amazon Linux (CentOS based) and looks good. I'm hoping to commit this soon unless there are other concerns?

        Show
        Timothy Potter added a comment - I've tried this out on Amazon Linux (CentOS based) and looks good. I'm hoping to commit this soon unless there are other concerns?
        Hide
        Timothy Potter added a comment -

        Here's a patch for trunk with the correct paths to the affected files.

        Show
        Timothy Potter added a comment - Here's a patch for trunk with the correct paths to the affected files.
        Hide
        ASF subversion and git services added a comment -

        Commit 1716506 from Timothy Potter in branch 'dev/trunk'
        [ https://svn.apache.org/r1716506 ]

        SOLR-8101: Improve Linux service installation script

        Show
        ASF subversion and git services added a comment - Commit 1716506 from Timothy Potter in branch 'dev/trunk' [ https://svn.apache.org/r1716506 ] SOLR-8101 : Improve Linux service installation script
        Hide
        ASF subversion and git services added a comment -

        Commit 1716507 from Timothy Potter in branch 'dev/branches/branch_5x'
        [ https://svn.apache.org/r1716507 ]

        SOLR-8101: Improve Linux service installation script

        Show
        ASF subversion and git services added a comment - Commit 1716507 from Timothy Potter in branch 'dev/branches/branch_5x' [ https://svn.apache.org/r1716507 ] SOLR-8101 : Improve Linux service installation script
        Hide
        ASF subversion and git services added a comment -

        Commit 1716509 from Timothy Potter in branch 'dev/branches/lucene_solr_5_4'
        [ https://svn.apache.org/r1716509 ]

        SOLR-8101: Improve Linux service installation script

        Show
        ASF subversion and git services added a comment - Commit 1716509 from Timothy Potter in branch 'dev/branches/lucene_solr_5_4' [ https://svn.apache.org/r1716509 ] SOLR-8101 : Improve Linux service installation script
        Hide
        Timothy Potter added a comment -

        Thanks Sergey!

        Show
        Timothy Potter added a comment - Thanks Sergey!

          People

          • Assignee:
            Timothy Potter
            Reporter:
            Sergey Urushkin
          • Votes:
            1 Vote for this issue
            Watchers:
            6 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Development