| 293 | } |
| 294 | |
| 295 | apr_status_t md_store_fs_init(md_store_t **pstore, apr_pool_t *p, const char *path) |
| 296 | { |
| 297 | md_store_fs_t *s_fs; |
| 298 | apr_status_t rv = APR_SUCCESS; |
| 299 | |
| 300 | s_fs = apr_pcalloc(p, sizeof(*s_fs)); |
| 301 | |
| 302 | s_fs->s.load = fs_load; |
| 303 | s_fs->s.save = fs_save; |
| 304 | s_fs->s.remove = fs_remove; |
| 305 | s_fs->s.move = fs_move; |
| 306 | s_fs->s.rename = fs_rename; |
| 307 | s_fs->s.purge = fs_purge; |
| 308 | s_fs->s.iterate = fs_iterate; |
| 309 | s_fs->s.iterate_names = fs_iterate_names; |
| 310 | s_fs->s.get_fname = fs_get_fname; |
| 311 | s_fs->s.is_newer = fs_is_newer; |
| 312 | s_fs->s.get_modified = fs_get_modified; |
| 313 | s_fs->s.remove_nms = fs_remove_nms; |
| 314 | s_fs->s.lock_global = fs_lock_global; |
| 315 | s_fs->s.unlock_global = fs_unlock_global; |
| 316 | |
| 317 | /* by default, everything is only readable by the current user */ |
| 318 | s_fs->def_perms.dir = MD_FPROT_D_UONLY; |
| 319 | s_fs->def_perms.file = MD_FPROT_F_UONLY; |
| 320 | |
| 321 | /* Account information needs to be accessible to httpd child processes. |
| 322 | * private keys are, similar to staging, encrypted. */ |
| 323 | s_fs->group_perms[MD_SG_ACCOUNTS].dir = MD_FPROT_D_UALL_WREAD; |
| 324 | s_fs->group_perms[MD_SG_ACCOUNTS].file = MD_FPROT_F_UALL_WREAD; |
| 325 | s_fs->group_perms[MD_SG_STAGING].dir = MD_FPROT_D_UALL_WREAD; |
| 326 | s_fs->group_perms[MD_SG_STAGING].file = MD_FPROT_F_UALL_WREAD; |
| 327 | /* challenges dir and files are readable by all, no secrets involved */ |
| 328 | s_fs->group_perms[MD_SG_CHALLENGES].dir = MD_FPROT_D_UALL_WREAD; |
| 329 | s_fs->group_perms[MD_SG_CHALLENGES].file = MD_FPROT_F_UALL_WREAD; |
| 330 | /* OCSP data is readable by all, no secrets involved */ |
| 331 | s_fs->group_perms[MD_SG_OCSP].dir = MD_FPROT_D_UALL_WREAD; |
| 332 | s_fs->group_perms[MD_SG_OCSP].file = MD_FPROT_F_UALL_WREAD; |
| 333 | |
| 334 | s_fs->base = apr_pstrdup(p, path); |
| 335 | |
| 336 | rv = md_util_is_dir(s_fs->base, p); |
| 337 | if (APR_STATUS_IS_ENOENT(rv)) { |
| 338 | md_log_perror(MD_LOG_MARK, MD_LOG_INFO, rv, p, |
| 339 | "store directory does not exist, creating %s", s_fs->base); |
| 340 | rv = apr_dir_make_recursive(s_fs->base, s_fs->def_perms.dir, p); |
| 341 | if (APR_SUCCESS != rv) goto cleanup; |
| 342 | rv = apr_file_perms_set(s_fs->base, MD_FPROT_D_UALL_WREAD); |
| 343 | if (APR_STATUS_IS_ENOTIMPL(rv)) { |
| 344 | rv = APR_SUCCESS; |
| 345 | } |
| 346 | if (APR_SUCCESS != rv) goto cleanup; |
| 347 | } |
| 348 | else if (APR_SUCCESS != rv) { |
| 349 | md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, p, |
| 350 | "not a plain directory, maybe a symlink? %s", s_fs->base); |
| 351 | } |
| 352 |
no test coverage detected