From 7a035f5f8435962072157f46031e73855fe4a875 Mon Sep 17 00:00:00 2001 From: Jason Tedor Date: Mon, 28 Aug 2017 20:47:42 -0400 Subject: [PATCH] setgid on /etc/elasticearch on package install When creating the keystore explicitly (from executing elasticsearch-keystore create) or implicitly (for plugins that require the keystore to be created on install) on an Elasticsearch package installation, we are running as the root user. This leaves /etc/elasticsearch/elasticsearch.keystore having the wrong ownership (root:root) so that the elasticsearch user can not read the keystore on startup. This commit adds setgid to /etc/elasticsearch on package installation so that when executing this directory (as we would when creating the keystore), we will end up with the correct ownership (root:elasticsearch). Additionally, we set the permissions on the keystore to be 660 so that the elasticsearch user via its group can read this file on startup. Relates #26412 --- .../java/org/elasticsearch/common/settings/KeyStoreWrapper.java | 2 +- distribution/src/main/packaging/scripts/postinst | 1 + qa/vagrant/src/test/resources/packaging/utils/packages.bash | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/core/src/main/java/org/elasticsearch/common/settings/KeyStoreWrapper.java b/core/src/main/java/org/elasticsearch/common/settings/KeyStoreWrapper.java index 1176ed28cb8..441bb131f03 100644 --- a/core/src/main/java/org/elasticsearch/common/settings/KeyStoreWrapper.java +++ b/core/src/main/java/org/elasticsearch/common/settings/KeyStoreWrapper.java @@ -330,7 +330,7 @@ public class KeyStoreWrapper implements SecureSettings { PosixFileAttributeView attrs = Files.getFileAttributeView(keystoreFile, PosixFileAttributeView.class); if (attrs != null) { // don't rely on umask: ensure the keystore has minimal permissions - attrs.setPermissions(PosixFilePermissions.fromString("rw-------")); + attrs.setPermissions(PosixFilePermissions.fromString("rw-rw----")); } } diff --git a/distribution/src/main/packaging/scripts/postinst b/distribution/src/main/packaging/scripts/postinst index f2bf4c083ce..a7ffda92d1e 100644 --- a/distribution/src/main/packaging/scripts/postinst +++ b/distribution/src/main/packaging/scripts/postinst @@ -100,6 +100,7 @@ fi chown -R elasticsearch:elasticsearch /var/lib/elasticsearch chown -R elasticsearch:elasticsearch /var/log/elasticsearch chown -R root:elasticsearch /etc/elasticsearch +chmod g+s /etc/elasticsearch chmod 0750 /etc/elasticsearch if [ -f /etc/default/elasticsearch ]; then diff --git a/qa/vagrant/src/test/resources/packaging/utils/packages.bash b/qa/vagrant/src/test/resources/packaging/utils/packages.bash index bcd4ec8f52c..86e182dbbff 100644 --- a/qa/vagrant/src/test/resources/packaging/utils/packages.bash +++ b/qa/vagrant/src/test/resources/packaging/utils/packages.bash @@ -94,7 +94,7 @@ verify_package_installation() { assert_file "$ESHOME/bin/elasticsearch-plugin" f root root 755 assert_file "$ESHOME/bin/elasticsearch-translog" f root root 755 assert_file "$ESHOME/lib" d root root 755 - assert_file "$ESCONFIG" d root elasticsearch 750 + assert_file "$ESCONFIG" d root elasticsearch 2750 assert_file "$ESCONFIG/elasticsearch.yml" f root elasticsearch 660 assert_file "$ESCONFIG/jvm.options" f root elasticsearch 660 assert_file "$ESCONFIG/log4j2.properties" f root elasticsearch 660