#!/bin/bash
# This script is part of Acronis Backup
# It is supported by Acronis only as part of the entire solution in accordance with http://www.acronis.com/support/eula-corp.html
# By using this script you accept the terms of the EULA http://www.acronis.com/support/eula-corp.html
# Use outside of the solution is done at your own risk and will not be supported by Acronis
# Contact http://www.acronis.com/en-us/support/ with any questions or concerns
# Copyright (C) Acronis

# Restricts access to Acronis Linux log directory roots to root and group
# "acronis". Idempotent - safe to run on every component install/upgrade.
# Invoked from register_service.sh, so it runs on every postinst without
# every component needing its own call.
#
# Registry format below: <operation> <path>
#
#   harden  - chown root:acronis, chmod 2770 on this single directory
#             (created first if missing). Use for log trees whose
#             ownership/mode we fully own.
#   tighten - chmod o-rwx on this single directory, only if it already
#             exists; never chown/chgrp. Use for shared product roots
#             whose group ownership is managed elsewhere (e.g. by
#             Security::SetupServerEnvironment at service start) and must
#             not be widened to group "acronis" by this script.
#
# Paths are literal, not $(brand_name)-templated: TEXT_BRAND_NAME (text\
# brand.txt\english.txt) is explicitly flagged "Do not change" and no
# customization in this repo overrides it, so $(brand_name) is always
# "Acronis" in practice. Every path below is handled non-recursively and
# never through a symlink - only the listed directory entry itself is ever
# touched.

GROUP=acronis

getent group "$GROUP" >/dev/null 2>&1 || groupadd -f "$GROUP" >/dev/null 2>&1

harden_dir()
{
  local dir="$1"

  if [ -L "$dir" ]; then
    echo "harden_log_dirs: refusing to follow symlink $dir" >&2
    return 1
  fi

  if [ ! -e "$dir" ]; then
    mkdir -p "$dir" >/dev/null 2>&1 || return 1
  fi

  if [ ! -d "$dir" ]; then
    echo "harden_log_dirs: $dir is not a directory, skipping" >&2
    return 1
  fi

  chown root:"$GROUP" "$dir" >/dev/null 2>&1
  chmod 2770 "$dir" >/dev/null 2>&1
}

tighten_dir()
{
  local dir="$1"

  if [ -L "$dir" ]; then
    echo "harden_log_dirs: refusing to follow symlink $dir" >&2
    return 1
  fi

  # Not our directory to create - if it is not there yet, there is nothing
  # to tighten, and we must not bring it into existence ourselves.
  [ -d "$dir" ] || return 0

  chmod o-rwx "$dir" >/dev/null 2>&1
}

while read -r op path; do
  case "$op" in
    ''|'#'*)
      continue
      ;;
  esac

  case "$op" in
    harden)
      harden_dir "$path"
      ;;
    tighten)
      tighten_dir "$path"
      ;;
  esac
done <<'LOG_DIRS'
harden   /var/log/Acronis
harden   /opt/acronis/var/log
harden   /opt/site-agent/var/log

# Shared agent-data root: group "acronis" ownership here is actively
# maintained by AMS's own privilege-drop step (ProcessCommonFile in
# lx_srv_setup.cpp) whenever AMS is installed, so we only ever remove the
# leftover world-readable bit and never touch owner/group ourselves.
tighten  /var/lib/Acronis
LOG_DIRS

exit 0