File manager - Edit - /usr/local/cpanel/install/ServiceAuth_Fix_Permissions.pm
Back
package Install::ServiceAuth_Fix_Permissions; # Copyright 2026 WebPros International, LLC # All rights reserved. # copyright@cpanel.net http://cpanel.net # This code is subject to the cPanel license. Unauthorized copying is prohibited. use strict; use warnings; use base qw( Cpanel::Task ); use Cpanel::ServerTasks (); our $VERSION = '1.0'; # The IPC key files live here. Broken out as a package variable so tests # can point the remediation at a temporary directory. our $SERVICEAUTH_DIR = '/var/cpanel/serviceauth'; # Restarting these services regenerates any missing serviceauth keys with # the secure, umask-independent permissions. chksrvd regenerates the # exim/smtp keys. our @SERVICES_TO_RESTART = qw( chkservd dnsadmin cpsrvd cpdavd ); =head1 NAME Install::ServiceAuth_Fix_Permissions - Fix ServiceAuth key file permissions and ownership =head1 DESCRIPTION Remediates existing ServiceAuth IPC key files on upgraded systems, where a permissive umask may have left a key world-readable before ServiceAuth began writing keys with explicit modes. A chmod alone is not sufficient: a local user could already have copied an exposed secret. Instead this removes the existing key files and restarts the services that use them, so each service regenerates its keys with the secure permissions: - exim/smtp keys: 0640 root:mail - Other service keys: 0600 root:root =over 1 =item Type: Sanity =item Frequency: always =item EOL: 11.144 =back =cut exit __PACKAGE__->runtask() unless caller; sub new { my $proto = shift; my $self = $proto->SUPER::new; $self->set_internal_name('serviceauth_fix_permissions'); return $self; } sub perform { my $self = shift; # run_sub_once() (unlike do_once()) only records the task as complete # when the code returns true, so a failed remediation will be retried. $self->run_sub_once( version => 'serviceauth_fix_permissions_136', eol => '11.144', code => sub { return $self->_regenerate_keys(); } ); return 1; } sub _regenerate_keys { my $self = shift; return 1 if !-d $SERVICEAUTH_DIR; # Remove existing keys so they are regenerated with the secure # permissions. A chmod alone would not remediate the leak: a local user # could already have copied a world-readable secret, so the secret bytes # themselves have to be rotated. opendir( my $dh, $SERVICEAUTH_DIR ) or return; my @services = grep { $_ !~ /^\./ && -d "$SERVICEAUTH_DIR/$_" } readdir($dh); closedir($dh); foreach my $service (@services) { unlink "$SERVICEAUTH_DIR/$service/recv"; unlink "$SERVICEAUTH_DIR/$service/send"; } # Restart the affected services through queueprocd. Each restart # regenerates its own keys via generate_authkeys_if_missing(), so there # is no need to regenerate them here. Cpanel::ServerTasks::schedule_task( ['CpServicesTasks'], 1, map { "restartsrv $_" } @SERVICES_TO_RESTART ); return 1; } 1; __END__
| ver. 1.4 |
Github
|
.
| PHP 8.1.34 | Generation time: 0.05 |
proxy
|
phpinfo
|
Settings