[SOLVED] Bash script to change ACL for Splunk on RHEL

r34per · 01-20-2020, 08:20 AM

Hi All,

Looking for a bit of help. I am a novice script writer and I am currently working on setting ACLs for the splunk user on a RHEL server.

My aim is to first search the splunkd.log to identify any permission errors, then to write these errors to a file (/tmp/aclperm) using the 'awk' command to strip it down to show only the file pathway. Then I need to run 'setfacl' against all the files identified in /tmp/aclperm.

This is what I have so far:

Code:

#! /bin/bash

################

exec 3>&1 4>&2
trap 'exec 2>&4 1>&3' 0 1 2 3
exec 1>/tmp/acllog 2>&1

# Everything below will go to the file '/tmp/acllog'

touch /tmp/aclperm
touch /tmp/aclresults

SUF="/opt/splunkforwarder/var/log/splunk/"

FILES="/tmp/aclperm"
rFILES="/tmp/aclresults"

INPUT='cat $FILES'

# To see full before and after results per file set value to 1
DEBUG=1

# To initialize a test run and verify correct files set value to 1
TEST=0

################

grep permissions $SUF/splunkd.log | grep -v "No such file or directory" | awk -F "'" '{print $2}' >> $FILES

echo `date` >> $rFILES

for f in $INPUT
do
        if [ ! -s $FILES ]
        then
          	echo `date` " Processing splunk user rights for $f" >> $rFILES
	if [ $DEBUG -eq 1 ]
	then
		echo "File and Folder update - Before:" >> $rFILES
		getfacl $f >> $rFILES
	fi
	if [ $TEST -eq 0 ]
	then
		echo "This is not a test run for $f" >> $rFILES
            
		setfacl -m u:splunk:rx $f
          
	else
		echo "This is a test run for $f" >> $rFILES
	fi
	if [ $DEBUG -eq 1 ]
	then
		echo "File and Folder update - After:" >> $rFILES
		getfacl $f >> $rFILES
	fi
	else
		echo `date` "Splunk user rights for $f not needed" >> $rFILES
	fi
done

The above script generates the files in the /tmp directory and /tmp/aclperm is populated with the correct list however it does not apply the ACL to the files listed in /tmp/aclperm - it instead updates the ACL for /tmp/aclperm itself.

I do not know why this is happening - Can someone please help??

bt101 · 01-21-2020, 07:02 PM

I'll give it a go

Two things.

First, do you mean for this to be using backticks so it is actually grabbing the contents of that file?

Code:

INPUT='cat $FILES'

If I cut/paste it to my editor, it appears to be in quotes, in which case INPUT will literally contain "cat /tmp/aclperm". If so, then in your loop below, it will not be pulling the contents of the file but it will apply the permissions against "cat /tmp/aclperm". Part of which is an actual file name /tmp/aclperm.

Second thing is... if you are indeed trying to populate INPUT with the contents of file $FILES with the above statement, that is done near the start of you script and then you run the grep/awk command to then populate the $FILES file. Did you want to grep/awk populate the $FILES file first (before populating INPUT with the contents of the file)?