|
|
Personal tools |
|
|
/User Guide/Environments
From AnnvixSystem Configuration with Environment Directories and Files
Environment DirectoriesEnvironment directories are special directories that contain configuration items for particular services. An environment directory is particularly useful with the chpst tool to set environment variables for run scripts and other scripts. Environment directories are more secure than sysconfig files as, usually, a sysconfig file is sourced from a shell script. Sysconfig files are supposed to be configuration files that set variables for a script to use. Unfortunately, these scripts can also cause the execution of code. A short example: $ cat test.sh #!/bin/sh echo "pre" . ./test.sysconfig echo $FOO echo "post" $ cat test.sysconfig # some comment FOO="hello" echo test $ sh test.sh pre test hello post The above is not at all what you would expect when running test.sh; an extra command was executed that wasn't in the actual script. No validation of data is done (usually it isn't). The scary thing is that a lot of traditional initscripts do this, as do a number of other scripts. By and large this isn't a problem, until someone managed to modify a sysconfig file they shouldn't have access to. It's not a stretch to piggy back the modification of a sysconfig file to another vulnerability that could allow for the overwriting of such a file; think of the numerous temporary file vulnerabilities that have been fixed in the past. One could easily exploit one of these to overwrite data in a sysconfig file that could later be used by a script and execute arbitrary code as (more often than not) the root user. Using environment directories where a single file corresponds to a variable name and the contents of the file are the contents of the variable is much safer and prevents these problems. For example: $ cat test.sh #!/bin/sh echo "pre" FOO=`cat FOO|head -1` echo $FOO echo "post" $ cat FOO hello echo foo $ sh test.sh pre hello post In this case, there is no unexpected code execution and the code is much cleaner. Here you know precisely what you're assigning to what and you know what variables are being set at all times. Annvix is slowly starting to move away from sysconfig files to the much-preferred environment directory format for configuration. A number of services already utilize environment directories. NOTE: An environment file can contain only one line. This line is the sole content of the variable. Any lines beyond the first line are completely ignored. runitThe /etc/sysconfig/env/runit directory controls some aspects of runit shutdowns and contains the following files:
tcpsvdThe /etc/sysconfig/env/tcpsvd directory contains files that are the default settings for tcpsvd-controlled services (such as sshd or rsync):
Note that these are system-wide defaults. Services that use tcpsvd can be individually configured via local environment directories (ie. /service/sshd/env). networkThe /etc/sysconfig/env/network directory contains files that impact networking defaults. These were originally defined in /etc/sysconfig/networking:
clockThe /etc/sysconfig/env/clock directory contains files that impact the system clock settings. These were originally defined in /etc/sysconfig/clock:
USBThe /etc/sysconfig/env/usb directory contains files that impact what the usb initscript will load (if anything). These were originally defined in /etc/sysconfig/usb:
ulimitsThe /etc/sysconfig/env/ulimits directory contains files that impact the default ulimit settings. These were originally defined in /etc/sysconfig/ulimits:
kudzuThe /etc/sysconfig/env/kudzu directory contains files pertaining to kudzu settings. These were originally defined in /etc/sysconfig/kudzu:
hdparmThe /etc/sysconfig/env/hdparm directory contains sub-directories named after a device, such as /etc/sysconfig/hdparm/hda in which are defined the hdparm options to be passed at boot for that particular device. This replaces the /etc/sysconfig/harddiskhdX files.
By default, this directory is empty so there are no optimizations being done on hard drives. To enable hdparm optimizations on a particular device, do: # mkdir /etc/sysconfig/env/hdparm/hde # echo "-d1 -m16 -X67" >/etc/sysconfig/env/hdparm/hde/OPTS For all of the options you can pass to hdparm, check the hdparm(8) manpage. nfsThere are a number of NFS-related services and they share the same environment directory. For this reason, the environment directory is located at /etc/sysconfig/env/nfs rather than in an ./env subdirectory of any given service. These were originally defined in /etc/sysconfig/nfs:
For more information on tuning NFS, refer to the NFS HOWTO. NOTE: If you wish to use the rpc.rquotad daemon to export quota information, you can use the following additional option:
Note that you must install the quota package and you must explicitly add the service (i.e. srv --add rpc.rquotad) for it to be used. NFS runs fine with or without rpc.rquotad so if you wish to export that information, be sure to install quota and add the service. Application Environment DirectoriesEnvironment directories are also used by some applications to setup how they are executed. These applications are typically daemon services. amdThe environment directory /var/service/amd/env contains the following files:
mysqldThe enviroment directory /var/service/mysqld/env contains the following files:
portmapThe environment directory /var/service/portmap/env contains the following files:
dhcpdThe environment directory /var/service/dhcpd/env contains the following files:
By default, dhcpd is executed via the run script as: /usr/sbin/dhcpd -d -user dhcp -group dhcp -cf ${CONFIGFILE} -lf ${LEASEFILE} ${OPTIONS} ${INTERFACES} System Configuration with /etc/sysconfigLike Mandriva Linux and many other Linux distributions, the /etc directory is home to many configuration files. Of particular interest is the /etc/sysconfig directory. This directory contains a number of miscellaneous files that are sourced by various run and init scripts. Unlike Mandriva Linux, most of the configuration files here have been converted to Environment Directories. The few that remain are documented below. Examining and possibly modifying some of these files can be to your advantage. Here we look at the various configuration files to determine what their use is and how to configure them. To edit any of these files, use vim or any other text editor you may have installed: # cd /etc/sysconfig # vim installkernel Sysconfig FileshwconfThis file is created by kudzu and lists all of the devices installed on the system, including moule information (the driver keyword), a description, vendor idenfication information, etc. This file is not meant to be user-modified. i18nThis file sets the locale information on the system. Since Annvix only uses the english locale as of 2.0-RELEASE, this file should not be altered (i.e. changing the LANG option to something other than "en_US" probably will not accomplish what you want since all non-english locale files are removed at build). installkernelThis file controls some aspects of how the installkernel helper script works. The defaults are sufficient for most and the file is heavily commented to show what each option does. |
 |
|
|
| |||