From: bigmike160 <bigmike160>
Date: Sun, 28 Oct 2007 23:49:49 +0000 (+0000)
Subject: apache-sync-logs: Really fix permissions issues this time
X-Git-Url: http://git.hcoop.net/clinton/scripts.git/commitdiff_plain/5541426eb2a9606127871cf3813675f5d726ac8f

apache-sync-logs: Really fix permissions issues this time
---

diff --git a/apache-sync-logs b/apache-sync-logs
index f56b08a..229cf20 100755
--- a/apache-sync-logs
+++ b/apache-sync-logs
@@ -11,12 +11,17 @@ unlog
 #VERBOSE=true
 VERBOSE=false
 
-LOCAL_LOG_DIR=/var/log/apache2
+LOCAL_LOG_DIR=/var/log/apache2/user
 KEYTAB_DIR=/etc/keytabs/user.daemon
 AFS_USER_DIR=/afs/hcoop.net/user
 ERROR=no
 
-for A in $(find $LOCAL_LOG_DIR/user -mindepth 3 -maxdepth 3 -print); do
+# Sanify permissions so that we can safely create tmp directories and
+# run rsync.
+chmod -R u=rwX,g=rX,o=X $LOCAL_LOG_DIR
+
+# Iterate through logs for each user
+for A in $(find $LOCAL_LOG_DIR -mindepth 3 -maxdepth 3 -print); do
     USER=`basename $A`
     PATHBITS=`echo $USER | head -c 1`/`echo $USER | head -c 2`/$USER
     LOG_SRC=$A/apache/log
@@ -36,17 +41,10 @@ for A in $(find $LOCAL_LOG_DIR/user -mindepth 3 -maxdepth 3 -print); do
     else
         rm -fr $TMP_DEST
         cp -r $LOG_SRC $TMP_DEST
+        chown -R $USER:nogroup $TMP_DEST
         chmod -R u=rwX,go=X $TMP_DEST
-        # There is an issue here.  With nocelic and magnus, doing su
-        # $USER will cause rsync to not be able to read $LOG_DEST,
-        # even if it is first chown'ed to $USER.  So we have to just
-        # be root, and not change ownership or group when copying the
-        # files.  This makes group be root on AFS, but that shouldn't
-        # matter for anything important.  Perhaps some PAM issue is
-        # related to this, since even read/write to local filesystem
-        # is screwed up.
         k5start -qtU -f $KEYTAB_DIR/$USER \
-            -- rsync -a --no-o --no-g $TMP_DEST/ $LOG_DEST/
+            -- su $USER -c "rsync -a $TMP_DEST/ $LOG_DEST/"
         rm -fr $TMP_DEST
         [ "$VERBOSE" = "true" ] && echo "  done."
     fi