Admin/han-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Внедрение KESL на ВМ2 + замена CLAMAV на KESL

Browse Source
This commit is contained in:
mi
2026-09-08 01:39:37 +03:00
parent 85df788f2d
commit fdfdeaffb4
43 changed files with 2210 additions and 329 deletions
Download Patch File Download Diff File Expand all files Collapse all files
VM2_services/codebase/services/deployment/preflight.sh
+24 -2
View File
@@ -21,6 +21,24 @@ fail() {
fail "root-owned Message Safety mode file is missing; initialize standard mode"
/usr/bin/getent group han-message-safety | /usr/bin/awk -F: '$3 == 10001 {found=1} END {exit !found}' ||
fail "han-message-safety group with GID 10001 is missing"
[ -x /opt/kaspersky/kesl/bin/kesl-control ] ||
fail "KESL 12.4 control utility is missing"
/usr/bin/systemctl is-active --quiet kesl.service ||
fail "kesl.service is not active"
/usr/bin/systemctl is-active --quiet han-kesl-scan-broker.socket ||
fail "KESL scan broker socket is not active"
[ "$(/usr/bin/stat -c '%U:%G:%a' /run/han-kesl 2>/dev/null || true)" = \
"root:han-message-safety:750" ] ||
fail "KESL broker runtime directory must be root:han-message-safety 0750"
[ -S /run/han-kesl/scan.sock ] || fail "KESL scan broker Unix socket is missing"
if [ -S /run/han-kesl/scan.sock ]; then
[ "$(/usr/bin/stat -c '%U:%G:%a' /run/han-kesl/scan.sock)" = \
"root:han-message-safety:660" ] ||
fail "KESL broker socket must be root:han-message-safety 0660"
fi
[ -x /usr/local/libexec/han-kesl-scan-broker ] &&
/usr/local/libexec/han-kesl-scan-broker --probe >/dev/null ||
fail "KESL scan broker readiness probe failed"
public_tls_dir=/var/lib/han-chat/public-tls
/usr/bin/getent group han-nginx-tls | /usr/bin/awk -F: '$3 == 11001 {found=1} END {exit !found}' ||
@@ -59,7 +77,7 @@ if [ -f "$ENV_FILE" ]; then
true|false) ;;
*) fail "OTEL_REMOTE_TLS_INSECURE must be exactly true or false" ;;
esac
for image_key in MESSAGE_SAFETY_IMAGE BITRIX_SYNC_IMAGE NGINX_IMAGE REDIS_IMAGE CLAMAV_IMAGE OTEL_COLLECTOR_IMAGE REDIS_EXPORTER_IMAGE NGINX_EXPORTER_IMAGE; do
for image_key in MESSAGE_SAFETY_IMAGE BITRIX_SYNC_IMAGE NGINX_IMAGE REDIS_IMAGE OTEL_COLLECTOR_IMAGE REDIS_EXPORTER_IMAGE NGINX_EXPORTER_IMAGE; do
image=$(/usr/bin/awk -F= -v key="$image_key" '$1 == key {print substr($0, index($0, "=") + 1)}' "$ENV_FILE")
echo "$image" | /usr/bin/grep -Eq '@sha256:[0-9a-f]{64}$' ||
fail "$image_key must be pinned by sha256 digest"
@@ -224,7 +242,11 @@ fi
for protected in \
"$ROOT/docker-compose.yml" \
"$ROOT/deployment/han-message-safety-mode" \
"$ROOT/deployment/han-processing.service"
"$ROOT/deployment/han-processing.service" \
"$ROOT/deployment/kesl/kesl_scan_broker.py" \
"$ROOT/deployment/kesl/han-kesl-scan-broker.service" \
"$ROOT/deployment/kesl/han-kesl-scan-broker.socket" \
"$ROOT/deployment/kesl/han-kesl-scan-broker.tmpfiles.conf"
do
[ -f "$protected" ] || continue
owner=$(/usr/bin/stat -c '%U:%G' "$protected")