From 6e1ee76e05ffda9c445ee4268e00ea285b45622f Mon Sep 17 00:00:00 2001
From: Viktor Ashirov <vashirov@redhat.com>
Date: May 14 2018 11:20:45 +0000
Subject: Issue 49106 - Move ds_* scripts to libexec


Bug Description:
Binaries like
/usr/sbin/ds_selinux_enabled
/usr/sbin/ds_selinux_port_query
/usr/sbin/ds_systemd_ask_password_acl

are not user-runnable, they are executed by other programs (setup-ds.pl
for example). They should not reside in /usr/sbin, since it's used for
storing binaries for system administration. Instead they should be placed
in /usr/libexec/dirsrv/ which is designed to store binaries that are
executed by other programs.

Fix Description:
Change install path to libexec.

https://pagure.io/389-ds-base/issue/49106

Reviewed by: mhonek, wibrown (Thanks!)

---

diff --git a/Makefile.am b/Makefile.am
index dc80bef..32b7b2b 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -753,12 +753,12 @@ systemschema_DATA = $(srcdir)/ldap/schema/00core.ldif \
 
 schema_DATA = $(srcdir)/ldap/schema/99user.ldif
 
-sbin_SCRIPTS = ldap/admin/src/scripts/ds_selinux_enabled \
+libexec_SCRIPTS = ldap/admin/src/scripts/ds_selinux_enabled \
 	ldap/admin/src/scripts/ds_selinux_port_query \
 	wrappers/ds_systemd_ask_password_acl
 
 if ENABLE_PERL
-sbin_SCRIPTS += ldap/admin/src/scripts/setup-ds.pl \
+sbin_SCRIPTS = ldap/admin/src/scripts/setup-ds.pl \
 	ldap/admin/src/scripts/migrate-ds.pl \
 	ldap/admin/src/scripts/remove-ds.pl \
 	ldap/admin/src/scripts/start-dirsrv \
@@ -2249,6 +2249,7 @@ fixupcmd = sed \
 	-e 's,@bindir\@,$(bindir),g' \
 	-e 's,@sbindir\@,$(sbindir),g' \
 	-e 's,@libdir\@,$(libdir),g' \
+	-e 's,@libexecdir\@,$(libexecdir),g' \
 	-e 's,@nspr_libdir\@,$(nspr_libdir),g' \
 	-e 's,@nss_libdir\@,$(nss_libdir),g' \
 	-e 's,@ldapsdk_libdir\@,$(ldapsdk_libdir),g' \
diff --git a/ldap/admin/src/scripts/DSCreate.pm.in b/ldap/admin/src/scripts/DSCreate.pm.in
index 71db353..248b65d 100644
--- a/ldap/admin/src/scripts/DSCreate.pm.in
+++ b/ldap/admin/src/scripts/DSCreate.pm.in
@@ -991,7 +991,7 @@ sub updateSelinuxPolicy {
 
     # if selinux is not available, do nothing
     # In perl, exit(1) is 256 from system. ds_selinux_enable returns 1 on true, 0 on false.
-    if ((getLogin() eq 'root') and "@with_selinux@" and system("$inf->{slapd}->{sbindir}/ds_selinux_enabled") == 256 ) {
+    if ((getLogin() eq 'root') and "@with_selinux@" and system("$inf->{slapd}->{libexecdir}/ds_selinux_enabled") == 256 ) {
         debug(1, "Selinux is enabled or permissive, fixing contexts\n");
         # -f "@sbindir@/sestatus" and !system ("@sbindir@/sestatus | egrep -i \"selinux status:\\s*enabled\" > $mydevnull 2>&1")) {
         my $localstatedir = $inf->{slapd}->{localstatedir};
@@ -1021,7 +1021,7 @@ sub updateSelinuxPolicy {
         # label the selected port as ldap_port_t
         # We should be doing this for secure port too .....
         if ($inf->{slapd}->{ServerPort} != 0 and not $ENV{DS_SKIP_LABEL}) {
-            my $port_query_cmd = ("$inf->{slapd}->{sbindir}/ds_selinux_port_query $inf->{slapd}->{ServerPort} ldap_port_t 2> $mydevnull");
+            my $port_query_cmd = ("$inf->{slapd}->{libexecdir}/ds_selinux_port_query $inf->{slapd}->{ServerPort} ldap_port_t 2> $mydevnull");
             my $need_label = 0;
             my $result = system($port_query_cmd);
 
@@ -1034,7 +1034,7 @@ sub updateSelinuxPolicy {
                 $need_label = 0;
                 debug(0, "Port $inf->{slapd}->{ServerPort} already belongs to another selinux type.\n");
                 debug(0, " The command below will show you the current type that owns the port.\n");
-                debug(0, "sudo $inf->{slapd}->{sbindir}/ds_selinux_port_query $inf->{slapd}->{ServerPort} ldap_port_t\n");
+                debug(0, "sudo $inf->{slapd}->{libexecdir}/ds_selinux_port_query $inf->{slapd}->{ServerPort} ldap_port_t\n");
                 debug(0, " It is highly likely your server will fail to start ... \n");
             }
             if ($result == 131072) {
@@ -1443,12 +1443,12 @@ sub removeDSInstance {
 
     # remove the selinux label from the ports if needed
     my $mydevnull = (-c "/dev/null" ? " /dev/null " : " NUL ");
-    if ((getLogin() eq 'root') and "@with_selinux@" and system("@sbindir@/ds_selinux_enabled") == 256 and not $ENV{DS_SKIP_UNLABEL}) {
+    if ((getLogin() eq 'root') and "@with_selinux@" and system("@libexecdir@/ds_selinux_enabled") == 256 and not $ENV{DS_SKIP_UNLABEL}) {
         foreach my $port (@{$entry->{"nsslapd-port"}}) 
         {
 
             my $need_remove_label = 0;
-            my $port_query_cmd = ("@sbindir@/ds_selinux_port_query $port ldap_port_t 2> $mydevnull");
+            my $port_query_cmd = ("@libexecdir@/ds_selinux_port_query $port ldap_port_t 2> $mydevnull");
             my $result = system($port_query_cmd);
 
             if ($result == 256) {
@@ -1487,7 +1487,7 @@ sub removeDSInstance {
         foreach my $secureport (@{$entry->{"nsslapd-secureport"}})
         {
             my $need_remove_label = 0;
-            my $port_query_cmd = ("@sbindir@/ds_selinux_port_query $secureport ldap_port_t 2> $mydevnull");
+            my $port_query_cmd = ("@libexecdir@/ds_selinux_port_query $secureport ldap_port_t 2> $mydevnull");
             my $result = system($port_query_cmd);
 
             if ($result == 256) {
diff --git a/rpm/389-ds-base.spec.in b/rpm/389-ds-base.spec.in
index 0e6bbc5..d5fcc23 100644
--- a/rpm/389-ds-base.spec.in
+++ b/rpm/389-ds-base.spec.in
@@ -346,6 +346,7 @@ autoreconf -fiv
            --with-systemdsystemunitdir=%{_unitdir} \
            --with-systemdsystemconfdir=%{_sysconfdir}/systemd/system \
            --with-systemdgroupname=%{groupname} \
+           --libexecdir=%{_libexecdir}/%{pkgname} \
            $NSSARGS $TCMALLOC_FLAGS $ASAN_FLAGS $MSAN_FLAGS $TSAN_FLAGS $UBSAN_FLAGS $RUST_FLAGS $PERL_FLAGS $CLANG_FLAGS \
            --enable-cmocka
 
@@ -548,9 +549,9 @@ fi
 %{_sbindir}/dsidm
 %{_sbindir}/ds-cockpit-setup
 %endif
-%{_sbindir}/ds_selinux_enabled
-%{_sbindir}/ds_selinux_port_query
-%{_sbindir}/ds_systemd_ask_password_acl
+%{_libexecdir}/%{pkgname}/ds_selinux_enabled
+%{_libexecdir}/%{pkgname}/ds_selinux_port_query
+%{_libexecdir}/%{pkgname}/ds_systemd_ask_password_acl
 %if %{use_perl}
 %{_sbindir}/monitor
 %{_sbindir}/bak2db
diff --git a/wrappers/systemd.template.service.in b/wrappers/systemd.template.service.in
index 0d88900..3c1d368 100644
--- a/wrappers/systemd.template.service.in
+++ b/wrappers/systemd.template.service.in
@@ -26,7 +26,7 @@ TimeoutStopSec=600
 EnvironmentFile=@initconfigdir@/@package_name@
 EnvironmentFile=@initconfigdir@/@package_name@-%i
 PIDFile=@localstatedir@/run/@package_name@/slapd-%i.pid
-ExecStartPre=@sbindir@/ds_systemd_ask_password_acl @instconfigdir@/slapd-%i/dse.ldif
+ExecStartPre=@libexecdir@/ds_systemd_ask_password_acl @instconfigdir@/slapd-%i/dse.ldif
 ExecStart=@sbindir@/ns-slapd -D @instconfigdir@/slapd-%i -i @localstatedir@/run/@package_name@/slapd-%i.pid
 
 # Hardening options:
diff --git a/wrappers/systemd.template.xsan.service.in b/wrappers/systemd.template.xsan.service.in
index 9a6b01f..1a4d7dc 100644
--- a/wrappers/systemd.template.xsan.service.in
+++ b/wrappers/systemd.template.xsan.service.in
@@ -32,7 +32,7 @@ Environment=TSAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i
 Environment=MSAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.msan:print_stacktrace=1
 Environment=UBSAN_OPTIONS=log_path=@localstatedir@/run/@package_name@/ns-slapd-%i.ubsan:print_stacktrace=1
 LimitCORE=infinity
-ExecStartPre=@sbindir@/ds_systemd_ask_password_acl @instconfigdir@/slapd-%i/dse.ldif
+ExecStartPre=@libexecdir@/ds_systemd_ask_password_acl @instconfigdir@/slapd-%i/dse.ldif
 ExecStart=@sbindir@/ns-slapd -D @instconfigdir@/slapd-%i -i @localstatedir@/run/@package_name@/slapd-%i.pid
 
 # Hardening options:

