fix

2026-05-18 15:10:40 +08:00
parent 60002f6c31
commit 5891a510c7
22 changed files with 737 additions and 167 deletions
@@ -0,0 +1,106 @@
+#!/bin/bash
+set -euo pipefail
+
+# Normalize permissions required by TMS standard CISD initialization.
+# Run as root after the standard receiver media has been placed under /home/cmep4i.
+
+STANDARD_HOME_DIR="${STANDARD_HOME_DIR:-/home/cmep4i}"
+STANDARD_RUN_USER="${STANDARD_RUN_USER:-cmep4i}"
+TMS_RUN_USER="${TMS_RUN_USER:-tms}"
+
+if [ "$(id -u)" != "0" ]; then
+    echo "this script must be executed as root" >&2
+    exit 77
+fi
+
+id "${STANDARD_RUN_USER}" >/dev/null 2>&1 || {
+    echo "standard run user not found: ${STANDARD_RUN_USER}" >&2
+    exit 66
+}
+
+id "${TMS_RUN_USER}" >/dev/null 2>&1 || {
+    echo "tms run user not found: ${TMS_RUN_USER}" >&2
+    exit 66
+}
+
+require_dir() {
+    local dir="$1"
+    if [ ! -d "${dir}" ]; then
+        echo "required directory not found: ${dir}" >&2
+        exit 66
+    fi
+}
+
+apply_acl() {
+    local path="$1"
+    if command -v setfacl >/dev/null 2>&1; then
+        setfacl -R -m "u:${STANDARD_RUN_USER}:rwX,u:${TMS_RUN_USER}:rX" "${path}"
+        find "${path}" -type d -exec setfacl -m "d:u:${STANDARD_RUN_USER}:rwX,d:u:${TMS_RUN_USER}:rX" {} +
+    else
+        echo "setfacl not found; falling back to group-readable mode only" >&2
+        chmod -R g+rX "${path}"
+    fi
+}
+
+standard_media="${STANDARD_HOME_DIR}/cpackage"
+require_dir "${standard_media}"
+
+chown -R "${STANDARD_RUN_USER}:${STANDARD_RUN_USER}" "${standard_media}"
+chmod -R u+rwX,go-rwx "${standard_media}"
+apply_acl "${standard_media}"
+
+if [ -d "${standard_media}/toolsh" ]; then
+    find "${standard_media}/toolsh" -type f -name "*.sh" -exec chmod 750 {} +
+fi
+
+if [ -d "${standard_media}/rabq" ]; then
+    find "${standard_media}/rabq" -type f -name "*.sh" -exec chmod 750 {} +
+    find "${standard_media}/rabq" -type f -name "rabbitmqadmin" -exec chmod 755 {} +
+fi
+
+for config in \
+    "${standard_media}/cmsp/01/application-prd-ci01.properties" \
+    "${standard_media}/cmsp/02/application-prd-ci02.properties" \
+    "${standard_media}/cmtp/01/application-prd-ci01.properties" \
+    "${standard_media}/cmtp/02/application-prd-ci02.properties"
+do
+    if [ -f "${config}" ]; then
+        chown "${STANDARD_RUN_USER}:${STANDARD_RUN_USER}" "${config}"
+        chmod 640 "${config}"
+        if command -v setfacl >/dev/null 2>&1; then
+            setfacl -m "u:${STANDARD_RUN_USER}:rw,u:${TMS_RUN_USER}:r" "${config}"
+        fi
+    else
+        echo "warning: standard template config not found: ${config}" >&2
+    fi
+done
+
+for dir in \
+    "${STANDARD_HOME_DIR}/cmsp" \
+    "${STANDARD_HOME_DIR}/cmtp" \
+    "${STANDARD_HOME_DIR}/cmep/license" \
+    "${STANDARD_HOME_DIR}/mysql/loadfilepath"
+do
+    mkdir -p "${dir}"
+    chown -R "${STANDARD_RUN_USER}:${STANDARD_RUN_USER}" "${dir}"
+    chmod 750 "${dir}"
+    if command -v setfacl >/dev/null 2>&1; then
+        setfacl -m "u:${STANDARD_RUN_USER}:rwx,u:${TMS_RUN_USER}:rwx" "${dir}"
+        setfacl -m "d:u:${STANDARD_RUN_USER}:rwX,d:u:${TMS_RUN_USER}:rwX" "${dir}"
+    fi
+done
+
+if [ -f "${STANDARD_HOME_DIR}/cpconfig.cfg" ]; then
+    chown "${STANDARD_RUN_USER}:${STANDARD_RUN_USER}" "${STANDARD_HOME_DIR}/cpconfig.cfg"
+    chmod 640 "${STANDARD_HOME_DIR}/cpconfig.cfg"
+else
+    touch "${STANDARD_HOME_DIR}/cpconfig.cfg"
+    chown "${STANDARD_RUN_USER}:${STANDARD_RUN_USER}" "${STANDARD_HOME_DIR}/cpconfig.cfg"
+    chmod 640 "${STANDARD_HOME_DIR}/cpconfig.cfg"
+fi
+
+if command -v setfacl >/dev/null 2>&1; then
+    setfacl -m "u:${STANDARD_RUN_USER}:rw,u:${TMS_RUN_USER}:rw" "${STANDARD_HOME_DIR}/cpconfig.cfg"
+fi
+
+echo "standard permissions prepared under ${STANDARD_HOME_DIR}"
@@ -0,0 +1,57 @@
+#!/bin/bash
+set -euo pipefail
+
+STANDARD_HOME_DIR="${STANDARD_HOME_DIR:-/home/cmep4i}"
+STANDARD_RUN_USER="${STANDARD_RUN_USER:-cmep4i}"
+STANDARD_JAVA_HOME="${STANDARD_JAVA_HOME:-${STANDARD_HOME_DIR}/jdk}"
+
+step="${1:-}"
+case "${step}" in
+    setfraq)
+        script="${STANDARD_HOME_DIR}/cpackage/toolsh/setfraq.sh"
+        ;;
+    setftq)
+        script="${STANDARD_HOME_DIR}/cpackage/toolsh/setftq.sh"
+        ;;
+    settlq)
+        script="${STANDARD_HOME_DIR}/cpackage/toolsh/settlq.sh"
+        ;;
+    setsptp)
+        script="${STANDARD_HOME_DIR}/cpackage/toolsh/setsptp.sh"
+        ;;
+    *)
+        echo "unsupported standard vendor step: ${step}" >&2
+        exit 64
+        ;;
+esac
+
+if [ "$(id -u)" != "0" ]; then
+    echo "this wrapper must be executed as root through sudo" >&2
+    exit 77
+fi
+
+if [ ! -f "${script}" ]; then
+    echo "standard vendor script not found: ${script}" >&2
+    exit 66
+fi
+
+run_payload='
+set -euo pipefail
+standard_home="$1"
+java_home="$2"
+script="$3"
+
+cd "${standard_home}"
+export JAVA_HOME="${java_home}"
+export PATH="${JAVA_HOME}/bin:/usr/local/bin:/usr/bin:/bin:${PATH:-}"
+
+exec /bin/bash "${script}"
+'
+
+if command -v runuser >/dev/null 2>&1; then
+    exec runuser -u "${STANDARD_RUN_USER}" -- /bin/bash -lc "${run_payload}" -- \
+        "${STANDARD_HOME_DIR}" "${STANDARD_JAVA_HOME}" "${script}"
+fi
+
+exec sudo -n -u "${STANDARD_RUN_USER}" /bin/bash -lc "${run_payload}" -- \
+    "${STANDARD_HOME_DIR}" "${STANDARD_JAVA_HOME}" "${script}"