Sunyard/cisd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix

Browse Source
This commit is contained in:
waner
2026-05-18 15:10:40 +08:00
parent 60002f6c31
commit 5891a510c7
22 changed files with 737 additions and 167 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/cisd_init_precheck.sh
+80 -4
View File
@@ -12,6 +12,9 @@ PRODUCT_TYPE="${PRODUCT_TYPE:-${TMS_CISD_PRESET_PRODUCT_TYPE:-UNKNOWN}}"
MODE="${TMS_INIT_EXECUTOR_MODE:-SIMULATE}"
LOG_DIR="${TMS_INIT_EXECUTOR_LOG_DIR:-/tmp/tms-init-logs}"
STANDARD_CPCONFIG_PATH="${TMS_INIT_EXECUTOR_STANDARD_CPCONFIG_PATH:-/home/cmep4i/cpconfig.cfg}"
STANDARD_HOME_DIR="${TMS_INIT_EXECUTOR_STANDARD_HOME_DIR:-/home/cmep4i}"
STANDARD_RUN_USER="${TMS_INIT_EXECUTOR_STANDARD_RUN_USER:-cmep4i}"
TMS_RUN_USER="${TMS_RUN_USER:-tms}"
DIRECT_DB_SCRIPT_DIR="${TMS_INIT_EXECUTOR_DIRECT_DB_SCRIPT_DIR:-/opt/CAE_Install_Base_Resource/DB}"
DIRECT_TLQ_INIT_CFG_DIR="${TMS_INIT_EXECUTOR_DIRECT_TLQ_INIT_CFG_DIR:-/opt/CAE_Install_App_Resource/CAE}"
APP_PATTERN_1="${TMS_INIT_EXECUTOR_STANDARD_RABBIT_APP_CONFIG_PATTERN_1:-/home/cmep4i/cmsp/application-prd*.properties}"
@@ -87,6 +90,68 @@ check_pattern_match() {
fi
}
run_test_as_user() {
local user="$1"
shift
if [[ "$(id -un 2>/dev/null || true)" == "$user" ]]; then
test "$@"
return $?
fi
if [[ "$(id -u)" == "0" ]] && command -v runuser >/dev/null 2>&1; then
runuser -u "$user" -- test "$@" 2>/dev/null
return $?
fi
if command -v sudo >/dev/null 2>&1; then
sudo -n -u "$user" test "$@" 2>/dev/null
return $?
fi
return 125
}
check_user_path_access() {
local user="$1"
local mode="$2"
local path="$3"
local flag=""
case "$mode" in
r) flag="-r" ;;
w) flag="-w" ;;
x) flag="-x" ;;
rw) flag="-r" ;;
rx) flag="-r" ;;
*) fail "unknown access mode ${mode} for ${path}"; return ;;
esac
if ! id "$user" >/dev/null 2>&1; then
fail "user missing: ${user}"
return
fi
if run_test_as_user "$user" "$flag" "$path"; then
if [[ "$mode" == *w* ]] && ! run_test_as_user "$user" -w "$path"; then
fail "path not writable by ${user}: ${path}"
return
fi
if [[ "$mode" == *x* ]] && ! run_test_as_user "$user" -x "$path"; then
fail "path not executable/searchable by ${user}: ${path}"
return
fi
pass "path ${mode} by ${user}: ${path}"
else
local rc=$?
if [[ "$rc" == "125" ]]; then
warn "cannot verify access as ${user}: ${path} (run as root or configure sudo -n)"
else
fail "path not ${mode} by ${user}: ${path}"
fi
fi
}
check_product_type() {
case "$PRODUCT_TYPE" in
ENTERPRISE|INDIRECT|DIRECT)
@@ -126,11 +191,22 @@ check_encryption_config() {
}
check_standard_assets() {
local standard_media="${STANDARD_HOME_DIR}/cpackage"
check_file "$STANDARD_CPCONFIG_PATH"
check_file "/home/cmep4i/cpackage/toolsh/setfraq.sh"
check_file "/home/cmep4i/cpackage/toolsh/setftq.sh"
check_file "/home/cmep4i/cpackage/toolsh/setsql.sh"
check_file "/home/cmep4i/cpackage/toolsh/setsptp.sh"
check_dir "$standard_media"
check_file "${standard_media}/toolsh/setfraq.sh"
check_file "${standard_media}/toolsh/setftq.sh"
check_file "${standard_media}/toolsh/setsql.sh"
check_file "${standard_media}/toolsh/setsptp.sh"
check_user_path_access "$STANDARD_RUN_USER" rx "${standard_media}/toolsh/setfraq.sh"
check_user_path_access "$STANDARD_RUN_USER" rx "${standard_media}/toolsh/setftq.sh"
check_user_path_access "$STANDARD_RUN_USER" rx "${standard_media}/toolsh/setsptp.sh"
check_user_path_access "$STANDARD_RUN_USER" rw "${standard_media}/cmsp/01/application-prd-ci01.properties"
check_user_path_access "$STANDARD_RUN_USER" rw "${standard_media}/cmsp/02/application-prd-ci02.properties"
check_user_path_access "$STANDARD_RUN_USER" rw "${standard_media}/cmtp/01/application-prd-ci01.properties"
check_user_path_access "$STANDARD_RUN_USER" rw "${standard_media}/cmtp/02/application-prd-ci02.properties"
check_user_path_access "$TMS_RUN_USER" r "${standard_media}/software/nginx.conf"
check_user_path_access "$TMS_RUN_USER" r "${standard_media}/front/front.zip"
check_pattern_match "$APP_PATTERN_1"
check_pattern_match "$APP_PATTERN_2"
check_cmd "rabbitmqctl"
scripts/resource-restore/apply-resource-backup.sh
+3 -1
View File
@@ -87,7 +87,9 @@ restore_files() {
local source_file="${PAYLOAD_DIR}/${entry_path}"
[[ -f "${source_file}" ]] || fail "restore source file not found: ${entry_path}" "FILE"
mkdir -p "$(dirname "${restore_path}")"
cp -f "${source_file}" "${restore_path}"
if ! cp -f "${source_file}" "${restore_path}" >> "${LOG_FILE}" 2>&1; then
fail "restore file failed: ${restore_path}" "FILE"
fi
log "restored file: ${restore_path}"
done < "${FILES_PLAN}"
}
scripts/standard-init/root-sbin/tms-prepare-standard-permissions
Executable
+106
View File
@@ -0,0 +1,106 @@
#!/bin/bash
set -euo pipefail
# Normalize permissions required by TMS standard CISD initialization.
# Run as root after the standard receiver media has been placed under /home/cmep4i.
STANDARD_HOME_DIR="${STANDARD_HOME_DIR:-/home/cmep4i}"
STANDARD_RUN_USER="${STANDARD_RUN_USER:-cmep4i}"
TMS_RUN_USER="${TMS_RUN_USER:-tms}"
if [ "$(id -u)" != "0" ]; then
echo "this script must be executed as root" >&2
exit 77
fi
id "${STANDARD_RUN_USER}" >/dev/null 2>&1 || {
echo "standard run user not found: ${STANDARD_RUN_USER}" >&2
exit 66
}
id "${TMS_RUN_USER}" >/dev/null 2>&1 || {
echo "tms run user not found: ${TMS_RUN_USER}" >&2
exit 66
}
require_dir() {
local dir="$1"
if [ ! -d "${dir}" ]; then
echo "required directory not found: ${dir}" >&2
exit 66
fi
}
apply_acl() {
local path="$1"
if command -v setfacl >/dev/null 2>&1; then
setfacl -R -m "u:${STANDARD_RUN_USER}:rwX,u:${TMS_RUN_USER}:rX" "${path}"
find "${path}" -type d -exec setfacl -m "d:u:${STANDARD_RUN_USER}:rwX,d:u:${TMS_RUN_USER}:rX" {} +
else
echo "setfacl not found; falling back to group-readable mode only" >&2
chmod -R g+rX "${path}"
fi
}
standard_media="${STANDARD_HOME_DIR}/cpackage"
require_dir "${standard_media}"
chown -R "${STANDARD_RUN_USER}:${STANDARD_RUN_USER}" "${standard_media}"
chmod -R u+rwX,go-rwx "${standard_media}"
apply_acl "${standard_media}"
if [ -d "${standard_media}/toolsh" ]; then
find "${standard_media}/toolsh" -type f -name "*.sh" -exec chmod 750 {} +
fi
if [ -d "${standard_media}/rabq" ]; then
find "${standard_media}/rabq" -type f -name "*.sh" -exec chmod 750 {} +
find "${standard_media}/rabq" -type f -name "rabbitmqadmin" -exec chmod 755 {} +
fi
for config in \
"${standard_media}/cmsp/01/application-prd-ci01.properties" \
"${standard_media}/cmsp/02/application-prd-ci02.properties" \
"${standard_media}/cmtp/01/application-prd-ci01.properties" \
"${standard_media}/cmtp/02/application-prd-ci02.properties"
do
if [ -f "${config}" ]; then
chown "${STANDARD_RUN_USER}:${STANDARD_RUN_USER}" "${config}"
chmod 640 "${config}"
if command -v setfacl >/dev/null 2>&1; then
setfacl -m "u:${STANDARD_RUN_USER}:rw,u:${TMS_RUN_USER}:r" "${config}"
fi
else
echo "warning: standard template config not found: ${config}" >&2
fi
done
for dir in \
"${STANDARD_HOME_DIR}/cmsp" \
"${STANDARD_HOME_DIR}/cmtp" \
"${STANDARD_HOME_DIR}/cmep/license" \
"${STANDARD_HOME_DIR}/mysql/loadfilepath"
do
mkdir -p "${dir}"
chown -R "${STANDARD_RUN_USER}:${STANDARD_RUN_USER}" "${dir}"
chmod 750 "${dir}"
if command -v setfacl >/dev/null 2>&1; then
setfacl -m "u:${STANDARD_RUN_USER}:rwx,u:${TMS_RUN_USER}:rwx" "${dir}"
setfacl -m "d:u:${STANDARD_RUN_USER}:rwX,d:u:${TMS_RUN_USER}:rwX" "${dir}"
fi
done
if [ -f "${STANDARD_HOME_DIR}/cpconfig.cfg" ]; then
chown "${STANDARD_RUN_USER}:${STANDARD_RUN_USER}" "${STANDARD_HOME_DIR}/cpconfig.cfg"
chmod 640 "${STANDARD_HOME_DIR}/cpconfig.cfg"
else
touch "${STANDARD_HOME_DIR}/cpconfig.cfg"
chown "${STANDARD_RUN_USER}:${STANDARD_RUN_USER}" "${STANDARD_HOME_DIR}/cpconfig.cfg"
chmod 640 "${STANDARD_HOME_DIR}/cpconfig.cfg"
fi
if command -v setfacl >/dev/null 2>&1; then
setfacl -m "u:${STANDARD_RUN_USER}:rw,u:${TMS_RUN_USER}:rw" "${STANDARD_HOME_DIR}/cpconfig.cfg"
fi
echo "standard permissions prepared under ${STANDARD_HOME_DIR}"
scripts/standard-init/root-sbin/tms-run-standard-vendor-step
Executable
+57
View File
@@ -0,0 +1,57 @@
#!/bin/bash
set -euo pipefail
STANDARD_HOME_DIR="${STANDARD_HOME_DIR:-/home/cmep4i}"
STANDARD_RUN_USER="${STANDARD_RUN_USER:-cmep4i}"
STANDARD_JAVA_HOME="${STANDARD_JAVA_HOME:-${STANDARD_HOME_DIR}/jdk}"
step="${1:-}"
case "${step}" in
setfraq)
script="${STANDARD_HOME_DIR}/cpackage/toolsh/setfraq.sh"
;;
setftq)
script="${STANDARD_HOME_DIR}/cpackage/toolsh/setftq.sh"
;;
settlq)
script="${STANDARD_HOME_DIR}/cpackage/toolsh/settlq.sh"
;;
setsptp)
script="${STANDARD_HOME_DIR}/cpackage/toolsh/setsptp.sh"
;;
*)
echo "unsupported standard vendor step: ${step}" >&2
exit 64
;;
esac
if [ "$(id -u)" != "0" ]; then
echo "this wrapper must be executed as root through sudo" >&2
exit 77
fi
if [ ! -f "${script}" ]; then
echo "standard vendor script not found: ${script}" >&2
exit 66
fi
run_payload='
set -euo pipefail
standard_home="$1"
java_home="$2"
script="$3"
cd "${standard_home}"
export JAVA_HOME="${java_home}"
export PATH="${JAVA_HOME}/bin:/usr/local/bin:/usr/bin:/bin:${PATH:-}"
exec /bin/bash "${script}"
'
if command -v runuser >/dev/null 2>&1; then
exec runuser -u "${STANDARD_RUN_USER}" -- /bin/bash -lc "${run_payload}" -- \
"${STANDARD_HOME_DIR}" "${STANDARD_JAVA_HOME}" "${script}"
fi
exec sudo -n -u "${STANDARD_RUN_USER}" /bin/bash -lc "${run_payload}" -- \
"${STANDARD_HOME_DIR}" "${STANDARD_JAVA_HOME}" "${script}"