mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-30 07:37:36 +00:00
Johnathan Corgan
a76c5b0966
fips-dns-setup wrote the .fips server= drop-in for standalone dnsmasq and then ran `systemctl reload dnsmasq`. A reload is a SIGHUP, and dnsmasq does not re-read its configuration on SIGHUP, so the forward was never loaded: .fips names did not resolve until dnsmasq was restarted by hand, even though the reload reported success. The removal paths had the mirror defect and left the forward live after the drop-in was deleted. The FreeBSD scripts behaved the same way, since the port's rc script implements reload as a SIGHUP. Setup now restarts dnsmasq. fips-dns-teardown, the Debian postrm and uninstall.sh use try-restart, which acts only on a running dnsmasq. The FreeBSD setup uses onerestart, and its teardown restarts dnsmasq only when onestatus reports it running. The dns-resolver suite's standalone dnsmasq case only checked that the file was written, and its reload always failed in the container because the image lacked /bin/kill. The image now has procps and dig, runs a stand-in .fips responder on ::1#5354, and the case asserts that a query through dnsmasq is forwarded after setup and no longer forwarded after teardown, dumping the dnsmasq unit status and journal when it is not. The teardown check is skipped when the setup check failed, and fails if the stand-in no longer answers directly, so it cannot pass without testing anything. The image tag changes with the Dockerfile so a concurrent run of the old Dockerfile cannot overwrite it. The packaging text test now pins `try-restart dnsmasq` in postrm and uninstall.sh.
74 lines
2.8 KiB
Bash
Executable File
74 lines
2.8 KiB
Bash
Executable File
#!/bin/sh
|
|
# FIPS post-removal script for Debian/Ubuntu
|
|
set -e
|
|
|
|
case "$1" in
|
|
remove|purge)
|
|
# Remove the DNS routing fips-dns-setup may have written, in case
|
|
# fips-dns-teardown did not run (prerm's stop runs it only when
|
|
# fips-dns.service was active), and make the resolver drop it. This
|
|
# runs on remove as well as purge: a removed package leaves nothing
|
|
# listening behind the routing, and purging a package already removed
|
|
# runs only postrm purge. On a purge of an installed package the
|
|
# purge pass finds nothing left and restarts nothing. The paths match
|
|
# packaging/common/fips-dns-teardown, which dpkg has already removed,
|
|
# so it cannot be called from here.
|
|
restart_resolved=0
|
|
if [ -f /etc/systemd/dns-delegate.d/fips.dns-delegate ]; then
|
|
rm -f /etc/systemd/dns-delegate.d/fips.dns-delegate
|
|
restart_resolved=1
|
|
fi
|
|
if [ -f /etc/systemd/resolved.conf.d/fips.conf ]; then
|
|
rm -f /etc/systemd/resolved.conf.d/fips.conf
|
|
restart_resolved=1
|
|
fi
|
|
# Only pre-v0.3.0 development builds wrote this path, and systemd
|
|
# never read it.
|
|
rm -f /etc/systemd/dns-delegate/fips.dns-delegate
|
|
if [ "$restart_resolved" = 1 ] && [ -d /run/systemd/system ] \
|
|
&& systemctl is-active --quiet systemd-resolved.service; then
|
|
systemctl restart systemd-resolved \
|
|
|| echo "fips: warning: could not restart systemd-resolved; restart it to drop the .fips route"
|
|
fi
|
|
if [ -f /etc/dnsmasq.d/fips.conf ]; then
|
|
rm -f /etc/dnsmasq.d/fips.conf
|
|
if [ -d /run/systemd/system ] \
|
|
&& systemctl is-active --quiet dnsmasq.service; then
|
|
systemctl try-restart dnsmasq \
|
|
|| echo "fips: warning: could not restart dnsmasq; restart it to drop the .fips route"
|
|
fi
|
|
fi
|
|
if [ -f /etc/NetworkManager/dnsmasq.d/fips.conf ]; then
|
|
rm -f /etc/NetworkManager/dnsmasq.d/fips.conf
|
|
if [ -d /run/systemd/system ] \
|
|
&& systemctl is-active --quiet NetworkManager.service \
|
|
&& command -v nmcli >/dev/null 2>&1; then
|
|
nmcli general reload \
|
|
|| echo "fips: warning: could not reload NetworkManager; reload it to drop the .fips route"
|
|
fi
|
|
fi
|
|
;;
|
|
esac
|
|
|
|
case "$1" in
|
|
purge)
|
|
# Remove configuration and identity keys
|
|
rm -rf /etc/fips/
|
|
|
|
# Remove tmpfiles.d entry
|
|
rm -f /usr/lib/tmpfiles.d/fips.conf
|
|
|
|
# Remove runtime directory
|
|
rm -rf /run/fips/
|
|
|
|
# Remove fips system group
|
|
if getent group fips >/dev/null 2>&1; then
|
|
groupdel fips 2>/dev/null || true
|
|
fi
|
|
;;
|
|
esac
|
|
|
|
#DEBHELPER#
|
|
|
|
exit 0
|