Add platform upgrade script for Tizen3.0

'Platform upgrade image' has only RO partition(rootfs). And RW
partition should be updated by several scripts(/usr/share/upgrade/
scripts). This upgrade script for security feature performs below things.

 * Remove non used directories/files
  ex. security-server data directories, rules db
 * Make directories/files in RW partition for 3.0 security services
  ex. /opt/var/security-manager
 * Init Cynara and security-manager db
 * Set file permission, Smack labeling

Change-Id: I163405710685c2f1873bee35d97ef35a519d6ce7
Signed-off-by: jooseong lee <jooseong.lee@samsung.com>

diff --git a/CMakeLists.txt b/CMakeLists.txt
index f51059da1441ceeba6fd4ec87d0b5454f8c6ccff..37d50d0df13bee35f7de446b82fd281eee333831 100755 (executable)
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -9,11 +9,12 @@ SET(VERSION_MAJOR 0)
 SET(VERSION "${VERSION_MAJOR}.0.2")
 
 INSTALL(FILES ${CMAKE_SOURCE_DIR}/config/group_id_setting DESTINATION /usr/share/security-config)
-INSTALL(FILES ${CMAKE_SOURCE_DIR}/labeling/set_label DESTINATION /usr/share/security-config)
+INSTALL(FILES ${CMAKE_SOURCE_DIR}/config/set_label DESTINATION /usr/share/security-config)
 INSTALL(FILES ${CMAKE_SOURCE_DIR}/config/set_capability DESTINATION /usr/share/security-config)
 INSTALL(FILES ${CMAKE_SOURCE_DIR}/config/security-config.conf DESTINATION /usr/lib/tmpfiles.d/)
 INSTALL(FILES ${CMAKE_SOURCE_DIR}/config/90_user-content-permissions.post DESTINATION ${SYSCONF_INSTALL_DIR}/gumd/useradd.d)
 INSTALL(FILES ${CMAKE_SOURCE_DIR}/config/91_user-dbspace-permissions.post DESTINATION ${SYSCONF_INSTALL_DIR}/gumd/useradd.d)
+INSTALL(FILES ${CMAKE_SOURCE_DIR}/upgrade/10.security.upgrade.sh DESTINATION /usr/share/upgrade/scripts)
 
 IF("${PROFILE}" STREQUAL "mobile" OR "${PROFILE}" STREQUAL "wearable")
 INSTALL(FILES ${CMAKE_SOURCE_DIR}/smack/onlycap DESTINATION /etc/smack)

diff --git a/config/set_label b/config/set_label
new file mode 100755 (executable)
index 0000000..b7ba6de
--- /dev/null
+++ b/config/set_label
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+PATH=/bin:/usr/bin:/sbin:/usr/sbin
+
+if [ ! -d /opt/dbspace ]
+then
+    mkdir -p /opt/dbspace
+fi
+
+chown :system_share /opt/dbspace
+chmod 775 /opt/dbspace
+
+if [ ! -d /opt/etc ]
+then
+    mkdir -p /opt/etc
+fi
+
+chown :system_share /opt/etc
+chmod 775 /opt/etc

diff --git a/labeling/set_label b/labeling/set_label
deleted file mode 100755 (executable)
index b7ba6de..0000000
--- a/labeling/set_label
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/bin/sh
-
-PATH=/bin:/usr/bin:/sbin:/usr/sbin
-
-if [ ! -d /opt/dbspace ]
-then
-    mkdir -p /opt/dbspace
-fi
-
-chown :system_share /opt/dbspace
-chmod 775 /opt/dbspace
-
-if [ ! -d /opt/etc ]
-then
-    mkdir -p /opt/etc
-fi
-
-chown :system_share /opt/etc
-chmod 775 /opt/etc

diff --git a/packaging/security-config.spec b/packaging/security-config.spec
index 99a2188e8af66cd277f0447c80ffae9f4ed1e96a..319768b091629c84af5b453cd32d94b0a7d07bfe 100755 (executable)
--- a/packaging/security-config.spec
+++ b/packaging/security-config.spec
@@ -59,6 +59,7 @@ mkdir -p /usr/share/security-config/log
 %attr(755,root,root) /usr/share/security-config/test/path_check_test/*
 %attr(755,root,root) /usr/share/security-config/test/smack_basic_test/*
 %attr(755,root,root) /usr/share/security-config/test/security_mount_option_test/*
+%attr(755,root,root) /usr/share/upgrade/scripts/10.security.upgrade.sh
 %attr(755,root,root) %{_sysconfdir}/gumd/useradd.d/90_user-content-permissions.post
 %attr(755,root,root) %{_sysconfdir}/gumd/useradd.d/91_user-dbspace-permissions.post
 %if ("%{?profile}" == "mobile" || "%{?profile}" == "wearable")

diff --git a/upgrade/10.security.upgrade.sh b/upgrade/10.security.upgrade.sh
new file mode 100644 (file)
index 0000000..b330e0d
--- /dev/null
+++ b/upgrade/10.security.upgrade.sh
@@ -0,0 +1,86 @@
+#!/bin/sh
+
+PATH=/bin:/usr/bin:/sbin:/usr/sbin
+
+#--------------------------------------
+# RW patch for FOTA/FUS upgrade
+#--------------------------------------
+# 2.x rw partition security directoy
+APPLICATION_RULES=/opt/dbspace/.rules_file
+PRIVILEGE_CONTROL_CACHE_DIR=/opt/data/privilege-control-cache
+SECURITY_SERVER_DB=/opt/dbspace/.rules-db.db3
+SECURITY_SERVER_DB_JOURNAL=/opt/dbspace/.rules-db.db3-journal
+SECURITY_SERVER_DIR=/opt/data/security-server
+
+# 3.0 rw partition security directoy
+AUTH_FW_DIR=/opt/data/auth-fw
+CYNARA_DIR=/opt/var/cynara
+SECURITY_MANAGER_DB=/opt/dbspace/.security-manager.db
+SECURITY_MANAGER_DB_JOURNAL=/opt/dbspace/.security-manager.db-journal
+SECURITY_MANAGER_DIR=/opt/var/security-manager
+
+
+#--------------------------------------
+# Start
+#--------------------------------------
+# remove non used directories/files
+rm $APPLICATION_RULES
+rm $SECURITY_SERVER_DB
+rm $SECURITY_SERVER_DB_JOURNAL
+if [ -d $PRIVILEGE_CONTROL_CACHE_DIR ]; then
+    rm -r $PRIVILEGE_CONTROL_CACHE_DIR
+fi
+
+# move 2.x password files managed by security-server to auth-fw directory
+mkdir $AUTH_FW_DIR
+mkdir $AUTH_FW_DIR/5001
+chmod 770 $AUTH_FW_DIR
+chmod 700 $AUTH_FW_DIR/5001
+if [ -d $SECURITY_SERVER_DIR ]; then
+    mv $SECURITY_SERVER_DIR/* $AUTH_FW_DIR/5001
+    chmod 600 $AUTH_FW_DIR/5001/*
+    rm -r $SECURITY_SERVER_DIR
+fi
+
+find $AUTH_FW_DIR -exec chown security_fw:security_fw {} +
+find $AUTH_FW_DIR -exec chsmack -a System {} +
+
+# make Cynara and Security-manager directories/files in rw partition
+mkdir $CYNARA_DIR
+chmod 700 $CYNARA_DIR
+chown cynara:cynara $CYNARA_DIR
+chsmack -a '_' $CYNARA_DIR
+
+mkdir $SECURITY_MANAGER_DIR
+mkdir $SECURITY_MANAGER_DIR/owner
+mkdir $SECURITY_MANAGER_DIR/rules
+mkdir $SECURITY_MANAGER_DIR/rules-merged
+touch $SECURITY_MANAGER_DIR/apps-names
+touch $SECURITY_MANAGER_DIR/owner/apps-names
+touch $SECURITY_MANAGER_DIR/rules-merged/rules.merged
+chmod 711 $SECURITY_MANAGER_DIR
+chmod 711 $SECURITY_MANAGER_DIR/owner
+chmod 700 $SECURITY_MANAGER_DIR/rules
+chmod 700 $SECURITY_MANAGER_DIR/rules-merged
+chmod 444 $SECURITY_MANAGER_DIR/apps-names
+chmod 444 $SECURITY_MANAGER_DIR/owner/apps-names
+chmod 644 $SECURITY_MANAGER_DIR/rules-merged/rules.merged
+
+find $SECURITY_MANAGER_DIR -exec chown root:root {} +
+find $SECURITY_MANAGER_DIR -exec chsmack -a '_' {} +
+
+# init Cynara and Security-manager database
+touch $SECURITY_MANAGER_DB
+touch $SECURITY_MANAGER_DB_JOURNAL
+
+/usr/sbin/cynara-db-migration install -t 0.14.0
+/usr/share/security-manager/db/update.sh
+/usr/bin/security-manager-policy-reload
+
+chmod 600 $SECURITY_MANAGER_DB
+chmod 600 $SECURITY_MANAGER_DB_JOURNAL
+chown root:root $SECURITY_MANAGER_DB
+chown root:root $SECURITY_MANAGER_DB_JOURNAL
+chsmack -a System $SECURITY_MANAGER_DB
+chsmack -a System $SECURITY_MANAGER_DB_JOURNAL
+