先帝创业未半而中道崩殂，今天下三分，益州疲弊，此诚危急存亡之秋也。然侍卫之臣不懈于内，忠志之士忘身于外者，盖追先帝之殊遇，欲报之于陛下也。诚宜开张圣听，以光先帝遗德，恢弘志士之气，不宜妄自菲薄，引喻失义，以塞忠谏之路也先帝は天下を興す志半ばにして志半ばにして崩御されました。今、天下は三つに分かれ、益州は疲弊しており、まさに存亡の危機に瀕しております。しかしながら、宮中で職務に励む臣下や、外地で身を顧みず尽力する志士たちがいるのは、ひとえに先帝から受けた格別な恩義を思い、陛下に報いようとする志があるからです。今こそ陛下には広く臣下の意見に耳を傾け、先帝の遺徳を輝かせ、志士たちの士気を高めるべきです。決して自らを卑下したり、不適切な例えを用いて忠言の道を閉ざしたりしてはなりません。鍏堝笣鍒涗笟鏈崐鑰屼腑閬撳穿娈傦紝浠婂ぉ涓嬩笁鍒嗭紝鐩婂窞鐤插紛锛屾璇氬嵄鎬ュ瓨浜′箣绉嬩篃銆傜劧渚嶅崼涔嬭嚕涓嶆噲浜庡唴锛屽繝蹇椾箣澹繕韬簬澶栬€咃紝鐩栬拷鍏堝笣涔嬫畩閬囷紝娆叉姤涔嬩簬闄涗笅涔熴€傝瘹瀹滃紑寮犲湥鍚紝浠ュ厜鍏堝笣閬楀痉锛屾仮寮樺織澹箣姘旓紝涓嶅疁濡勮嚜鑿茶杽锛屽紩鍠诲け涔夛紝浠ュ蹇犺皬涔嬭矾涔🌌 SpectraShell

🌌 SpectraShell

Current path: usr/bin/


⬆️ Go up: /usr

📄 Viewing: cl-linksafe-reconfigure

#!/bin/bash
# CloudLinux Links Traversal Protection configure utility


set -o pipefail

source /opt/cloudlinux-linksafe/lib.sh

# just exit if it is solo edition
skip_on_cl_solo

PARAM_ALLOW_SGID="fs.protected_symlinks_allow_gid"
PARAM_ALLOW_HGID="fs.protected_hardlinks_allow_gid"
PARAM_S_CREATE="fs.protected_symlinks_create"
PARAM_H_CREATE="fs.protected_hardlinks_create"
SYSCTL_FILE="/etc/sysctl.d/cloudlinux-linksafe.conf"
SYSTEM_LINKSAFE_GID="$(getent group linksafe | cut -d: -f3)"
MAIN_SYSCTL_FILE="/etc/sysctl.conf"

if [[ $EUID -ne 0 ]]; then
   echo "This script must be run as root" 
   exit 1
fi

function fix_linksafe {
    # fix permissions for alt-php packages installed without linksafe group
    find /opt/alt/php* \( -user root -a ! -group root -a ! -group linksafe \) -exec chown -h root:linksafe {} \; &> /dev/null
    # fix permissions for alt-python packages installed without linksafe group
    find /opt/alt/python* \( -user root -a ! -group root -a ! -group linksafe \) -exec chown -h root:linksafe {} \; &> /dev/null
    # fix permissions for alt-ruby packages installed without linksafe group
    find /opt/alt/ruby* \( -user root -a ! -group root -a ! -group linksafe \) -exec chown -h root:linksafe {} \; &> /dev/null
    # fix permissions for native php
    chown root:linksafe /usr/selector.etc/php.ini &> /dev/null
    chown root:linksafe /usr/selector/lsphp &> /dev/null
    chown root:linksafe /usr/selector/php &> /dev/null
    chown root:linksafe /usr/selector/php-cli &> /dev/null
    if [ -e /usr/sbin/cagefsctl ] && [ -e /usr/share/cagefs-skeleton/bin ]; then
        if /usr/sbin/cagefsctl --skip-php-reload --setup-cl-selector &> /dev/null; then
            if [ -e /usr/share/cagefs/need.remount ]; then
                if /usr/sbin/cagefsctl --remount-all &> /dev/null; then
                    rm -f /usr/share/cagefs/need.remount &> /dev/null
                fi
            fi
        fi
    fi
}

function check_params_in_sysctl_file {
    local ret_code=0
    if ! grep "$PARAM_ALLOW_SGID" "$SYSCTL_FILE" > /dev/null; then
        let ret_code+=1
    fi
    if ! grep "$PARAM_ALLOW_HGID" "$SYSCTL_FILE" > /dev/null; then
        let ret_code+=1
    fi
    if ! grep "$PARAM_S_CREATE" "$SYSCTL_FILE" > /dev/null; then
        let ret_code+=1
    fi
    if ! grep "$PARAM_H_CREATE" "$SYSCTL_FILE" > /dev/null; then
        let ret_code+=1
    fi
    echo ${ret_code}
    return ${ret_code}
}

function migrate_linksafe_params {

    if [ -n "$SYSTEM_LINKSAFE_GID" ]; then
        if ! grep "# SecureLinks Link Traversal" "${SYSCTL_FILE}" > /dev/null; then
            echo "# SecureLinks Link Traversal Protection Section" >> "${SYSCTL_FILE}"
        fi
        if grep "$PARAM_S_CREATE" "$MAIN_SYSCTL_FILE" > /dev/null; then
            migrate_symlink_value=$(grep "$PARAM_S_CREATE" ${MAIN_SYSCTL_FILE} | awk -F "=" '{print $2}' | sed "s/\ //g")
        fi
        if ! grep "$PARAM_S_CREATE" "${SYSCTL_FILE}" > /dev/null; then
            if [[ 1 != "$migrate_symlink_value" ]]; then
                echo "$PARAM_S_CREATE = 0" >> "${SYSCTL_FILE}"
            else
                echo "$PARAM_S_CREATE = 1" >> "${SYSCTL_FILE}"
            fi
        fi
        if grep "$PARAM_H_CREATE" "$MAIN_SYSCTL_FILE" > /dev/null; then
            migrate_hardlink_value=$(grep "$PARAM_H_CREATE" ${MAIN_SYSCTL_FILE} | awk -F "=" '{print $2}' | sed "s/\ //g")
        fi
        if ! grep "$PARAM_H_CREATE" "${SYSCTL_FILE}" > /dev/null; then
            if [[ 1 != "$migrate_hardlink_value" ]]; then
                echo "$PARAM_H_CREATE = 0" >> "${SYSCTL_FILE}"
            else
                echo "$PARAM_H_CREATE = 1" >> "${SYSCTL_FILE}"
            fi
        fi
        if ! grep "$PARAM_ALLOW_SGID" "${SYSCTL_FILE}" > /dev/null; then
            echo "$PARAM_ALLOW_SGID = $SYSTEM_LINKSAFE_GID" >> "${SYSCTL_FILE}"
        fi
        if ! grep "$PARAM_ALLOW_HGID" "${SYSCTL_FILE}" > /dev/null; then
            echo "$PARAM_ALLOW_HGID = $SYSTEM_LINKSAFE_GID" >> "${SYSCTL_FILE}"
        fi
    fi
}

if [[ "$SYSTEM_LINKSAFE_GID" == "" ]]; then
    groupadd -r linksafe
    SYSTEM_LINKSAFE_GID="$(getent group linksafe | cut -d: -f3)"
fi

if id mailman &> /dev/null; then
    usermod -a -G linksafe mailman &> /dev/null
fi

if [ ! -e "$SYSCTL_FILE" ]; then
    touch "$SYSCTL_FILE"
fi

SYSCTL_LINKSAFE_GID=$(grep -F "$PARAM_ALLOW_SGID" "$SYSCTL_FILE" | awk '{print $3}')
if [[ 0 != "$(check_params_in_sysctl_file)" ]]; then
    migrate_linksafe_params
fi
if [[ "$SYSCTL_LINKSAFE_GID" != "$SYSTEM_LINKSAFE_GID" ]]; then
    sed -i -e "s/${PARAM_ALLOW_SGID}\s*=.*/${PARAM_ALLOW_SGID} = ${SYSTEM_LINKSAFE_GID}/" "$SYSCTL_FILE" &> /dev/null
    sed -i -e "s/${PARAM_ALLOW_HGID}\s*=.*/${PARAM_ALLOW_HGID} = ${SYSTEM_LINKSAFE_GID}/" "$SYSCTL_FILE" &> /dev/null
fi
fix_linksafe
/usr/bin/plesk_configure
/usr/share/cloudlinux-linksafe/cpanel/hooks/cpanel-linksafe-install-hooks
sysctl --system &> /dev/null

📁