YunoHost-Apps/mygpo_ynh
1
0
Fork 0
mirror of https://github.com/YunoHost-Apps/mygpo_ynh.git synced 2024-09-03 19:55:52 +02:00
Code Issues Activity Actions

Restrict permissions on app directories

Browse source
This commit is contained in:
Jules Bertholet 2021-03-22 12:59:00 -04:00
parent 2b37659e7c
commit 4400e7072d
5 changed files with 40 additions and 20 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
manifest.json
View file

@ -6,7 +6,7 @@
"en": "Manage podcast subscriptions, and sync them between apps and devices",
"fr": "Gérez vos sousciptions balado, et sychronisez-lez entre vos applis et appareils"
},
"version": "2.11.0~ynh2",
"version": "2.11.0~ynh3",
"url": "https://github.com/gpodder/mygpo",
"license": "AGPL-3.0-only",
"maintainer": {

2
scripts/_common.sh
View file

@ -5,7 +5,7 @@
#=================================================
# dependencies used by the app
pkg_dependencies="python3 python3-pip python3-venv postgresql postgresql-contrib libpq-dev redis-server"
pkg_dependencies="acl python3 python3-pip python3-venv postgresql postgresql-contrib libpq-dev redis-server"
#=================================================
# PERSONAL HELPERS

16
scripts/install
View file

@ -152,7 +152,9 @@ mkdir $datadir
ynh_app_setting_set --app=$app --key=datadir --value="$datadir"
# Give permission to the datadir
chown -R "$app":"$app" "$datadir"
chown -R $app:$app $datadir
chmod o-rwx $datadir
setfacl -n -R -m user:www-data:rx -m default:user:www-data:rx $datadir
ynh_app_setting_set --app=$app --key=datadir --value="$datadir"
@ -165,7 +167,7 @@ ynh_script_progression --message="Setting up envdir..." --weight=1
env_path=$final_path/envs/prod
mkdir -p $env_path
mkdir -p $env_path
echo "$admin <$admin_email>" > $env_path/ADMINS
echo "None" > $env_path/BROKER_POOL_LIMIT
@ -189,8 +191,8 @@ pushd $final_path || ynh_die
python3 -m venv $final_path/venv
source $final_path/venv/bin/activate
python3 -m pip install -U wheel pip setuptools
python3 -m pip install --requirement $final_path/requirements.txt
python3 -m pip install --requirement $final_path/requirements-setup.txt
python3 -m pip install --requirement $final_path/requirements.txt
python3 -m pip install --requirement $final_path/requirements-setup.txt
deactivate 'dummy_arg'
popd || ynh_die
@ -240,7 +242,11 @@ systemctl daemon-reload --quiet
### that really need such authorization.
# Set permissions to app files
chown -R root: $final_path
chown -R root:$app $final_path
chmod -R o-rwx $final_path
chmod -R g-w $final_path
setfacl -n -R -m user:www-data:rx -m default:user:www-data:rx $final_path
setfacl -n -R -m user:www-data:- -m default:user:www-data:- $final_path/envs
#=================================================
# INTEGRATE SERVICE IN YUNOHOST

26
scripts/restore
View file

@ -76,16 +76,6 @@ ynh_script_progression --message="Restoring the app data directory..."
ynh_restore_file --origin_path="$datadir" --not_mandatory
#=================================================
# RESTORE USER RIGHTS
#=================================================
# Restore permissions on app files
mkdir -p $datadir
chown -R $app: $datadir
#=================================================
# SPECIFIC RESTORATION
#=================================================
# REINSTALL DEPENDENCIES
#=================================================
@ -94,6 +84,22 @@ ynh_script_progression --message="Reinstalling dependencies..." --weight=1
# Define and install dependencies
ynh_install_app_dependencies $pkg_dependencies
#=================================================
# RESTORE USER RIGHTS
#=================================================
# Restore permissions on app files
chown -R root:$app $final_path
chmod -R o-rwx $final_path
chmod -R g-w $final_path
setfacl -n -R -m user:www-data:rx -m default:user:www-data:rx $final_path
setfacl -n -R -m user:www-data:- -m default:user:www-data:- $final_path/envs
chown -R $app:$app $datadir
chmod o-rwx $datadir
setfacl -n -R -m user:www-data:rx -m default:user:www-data:rx $datadir
#=================================================
# SPECIFIC RESTORATION
#=================================================
# RESTORE THE POSTGRESQL DATABASE
#=================================================

14
scripts/upgrade
View file

@ -19,6 +19,7 @@ app=$YNH_APP_INSTANCE_NAME
domain=$(ynh_app_setting_get --app=$app --key=domain)
path_url=$(ynh_app_setting_get --app=$app --key=path)
final_path=$(ynh_app_setting_get --app=$app --key=final_path)
datadir=$(ynh_app_setting_get --app=$app --key=datadir)
#=================================================
# CHECK VERSION
@ -108,8 +109,8 @@ ynh_script_progression --message="Upgrading Python virtualenv..." --weight=2
pushd $final_path || ynh_die
source $final_path/venv/bin/activate
python3 -m pip install -U wheel pip setuptools
python3 -m pip install -U --requirement $final_path/requirements.txt
python3 -m pip install -U --requirement $final_path/requirements-setup.txt
python3 -m pip install -U --requirement $final_path/requirements.txt
python3 -m pip install -U --requirement $final_path/requirements-setup.txt
deactivate 'dummy_arg'
popd || ynh_die
@ -146,7 +147,14 @@ systemctl daemon-reload --quiet
#=================================================
# Set permissions on app files
chown -R root: $final_path
chown -R root:$app $final_path
chmod -R o-rwx $final_path
chmod -R g-w $final_path
setfacl -n -R -m user:www-data:rx -m default:user:www-data:rx $final_path
setfacl -n -R -m user:www-data:- -m default:user:www-data:- $final_path/envs
chown -R $app:$app $datadir
chmod o-rwx $datadir
setfacl -n -R -m user:www-data:rx -m default:user:www-data:rx $datadir
#=================================================
# INTEGRATE SERVICE IN YUNOHOST