#!/bin/bash
# CloudLinux Links Traversal Protection configure utility


set -o pipefail

PARAM_ALLOW_SGID="fs.protected_symlinks_allow_gid"
PARAM_ALLOW_HGID="fs.protected_hardlinks_allow_gid"
PARAM_S_CREATE="fs.protected_symlinks_create"
PARAM_H_CREATE="fs.protected_hardlinks_create"
SYSCTL_FILE="/etc/sysctl.d/cloudlinux-linksafe.conf"
SYSTEM_LINKSAFE_GID="$(getent group linksafe | cut -d: -f3)"
MAIN_SYSCTL_FILE="/etc/sysctl.conf"
CONVERT=""

if [[ $EUID -ne 0 ]]; then
   echo "This script must be run as root" 
   exit 1
fi

function fix_linksafe {
    # fix permissions for alt-php packages installed without linksafe group
    find /opt/alt/php* \( -user root -a ! -group root -a ! -group linksafe \) -exec chown -h root:linksafe {} \; &> /dev/null
    # fix permissions for alt-python packages installed without linksafe group
    find /opt/alt/python* \( -user root -a ! -group root -a ! -group linksafe \) -exec chown -h root:linksafe {} \; &> /dev/null
    # fix permissions for alt-ruby packages installed without linksafe group
    find /opt/alt/ruby* \( -user root -a ! -group root -a ! -group linksafe \) -exec chown -h root:linksafe {} \; &> /dev/null
    # fix permissions for native php
    chown root:linksafe /usr/selector.etc/php.ini &> /dev/null
    chown root:linksafe /usr/selector/lsphp &> /dev/null
    chown root:linksafe /usr/selector/php &> /dev/null
    chown root:linksafe /usr/selector/php-cli &> /dev/null
    if [ -e /usr/sbin/cagefsctl ] && [ -e /usr/share/cagefs-skeleton/bin ]; then
        if /usr/sbin/cagefsctl --setup-cl-selector &> /dev/null; then
            if [ -e /usr/share/cagefs/need.remount ]; then
                if /usr/sbin/cagefsctl --remount-all &> /dev/null; then
                    rm -f /usr/share/cagefs/need.remount &> /dev/null
                fi
            fi
        fi
    fi
}

function check_params_in_sysctl_file {
    local ret_code=0
    if ! grep "$PARAM_ALLOW_SGID" "$SYSCTL_FILE" > /dev/null; then
        let ret_code+=1
    fi
    if ! grep "$PARAM_ALLOW_HGID" "$SYSCTL_FILE" > /dev/null; then
        let ret_code+=1
    fi
    if ! grep "$PARAM_S_CREATE" "$SYSCTL_FILE" > /dev/null; then
        let ret_code+=1
    fi
    if ! grep "$PARAM_H_CREATE" "$SYSCTL_FILE" > /dev/null; then
        let ret_code+=1
    fi
    echo ${ret_code}
    return ${ret_code}
}

function migrate_linksafe_params {

    if [ -n "$SYSTEM_LINKSAFE_GID" ]; then
        if ! grep "# SecureLinks Link Traversal" "${SYSCTL_FILE}" > /dev/null; then
            echo "# SecureLinks Link Traversal Protection Section" >> "${SYSCTL_FILE}"
        fi
        if grep "$PARAM_S_CREATE" "$MAIN_SYSCTL_FILE" > /dev/null; then
            migrate_symlink_value=$(grep "$PARAM_S_CREATE" ${MAIN_SYSCTL_FILE} | awk -F "=" '{print $2}' | sed "s/\ //g")
        fi
        if ! grep "$PARAM_S_CREATE" "${SYSCTL_FILE}" > /dev/null; then
            if [[ 1 != "$migrate_symlink_value" ]]; then
                echo "$PARAM_S_CREATE = 0" >> "${SYSCTL_FILE}"
            else
                echo "$PARAM_S_CREATE = 1" >> "${SYSCTL_FILE}"
            fi
        fi
        if grep "$PARAM_H_CREATE" "$MAIN_SYSCTL_FILE" > /dev/null; then
            migrate_hardlink_value=$(grep "$PARAM_H_CREATE" ${MAIN_SYSCTL_FILE} | awk -F "=" '{print $2}' | sed "s/\ //g")
        fi
        if ! grep "$PARAM_H_CREATE" "${SYSCTL_FILE}" > /dev/null; then
            if [[ 1 != "$migrate_hardlink_value" ]]; then
                echo "$PARAM_H_CREATE = 0" >> "${SYSCTL_FILE}"
            else
                echo "$PARAM_H_CREATE = 1" >> "${SYSCTL_FILE}"
            fi
        fi
        if ! grep "$PARAM_ALLOW_SGID" "${SYSCTL_FILE}" > /dev/null; then
            echo "$PARAM_ALLOW_SGID = $SYSTEM_LINKSAFE_GID" >> "${SYSCTL_FILE}"
        fi
        if ! grep "$PARAM_ALLOW_HGID" "${SYSCTL_FILE}" > /dev/null; then
            echo "$PARAM_ALLOW_HGID = $SYSTEM_LINKSAFE_GID" >> "${SYSCTL_FILE}"
        fi
    fi
}

TEMP=$(getopt -o c --long convert -- "$@")
eval set -- "$TEMP"
while true; do
    case "$1" in
        -c | --convert ) CONVERT="true"; shift ;;
        * )  break ;;
    esac
done

if [[ "$SYSTEM_LINKSAFE_GID" == "" ]]; then
    groupadd -r linksafe
    SYSTEM_LINKSAFE_GID="$(getent group linksafe | cut -d: -f3)"
fi

if id mailman &> /dev/null; then
    usermod -a -G linksafe mailman &> /dev/null
fi

if [ ! -e "$SYSCTL_FILE" ] && [ -e /proc/sys/fs/protected_symlinks_allow_gid -o ! -z "$CONVERT"  ]; then
    touch "$SYSCTL_FILE"
fi

if [ -e /proc/sys/fs/protected_symlinks_allow_gid -o ! -z "$CONVERT"  ]; then
    SYSCTL_LINKSAFE_GID=$(grep -F "$PARAM_ALLOW_SGID" "$SYSCTL_FILE" | awk '{print $3}')
    if [[ 0 != "$(check_params_in_sysctl_file)" ]]; then
        migrate_linksafe_params
    fi
    if [[ "$SYSCTL_LINKSAFE_GID" != "$SYSTEM_LINKSAFE_GID" ]]; then
        sed -i -e "s/${PARAM_ALLOW_SGID}\s*=.*/${PARAM_ALLOW_SGID} = ${SYSTEM_LINKSAFE_GID}/" "$SYSCTL_FILE" &> /dev/null
        sed -i -e "s/${PARAM_ALLOW_HGID}\s*=.*/${PARAM_ALLOW_HGID} = ${SYSTEM_LINKSAFE_GID}/" "$SYSCTL_FILE" &> /dev/null
    fi
    fix_linksafe
    /usr/bin/plesk_configure "$CONVERT"
    /usr/share/cloudlinux-linksafe/cpanel/hooks/cpanel-linksafe-install-hooks "$CONVERT"
    sysctl --system &> /dev/null
else
    fix_linksafe
fi