From f673c9f48019c0c41fe1ad3fcdefc07583b4446c Mon Sep 17 00:00:00 2001
From: Neal Gompa <ngompa13@gmail.com>
Date: Jun 07 2020 07:07:18 +0000
Subject: Move Ipsilon libexec content to a subdirectory


It's generally not a good idea to expose the entirety of /usr/libexec
through the web server, so move the needed binaries to be exposed to
a subdirectory.

Signed-off-by: Neal Gompa <ngompa13@gmail.com>

---

diff --git a/contrib/fedora/ipsilon.spec b/contrib/fedora/ipsilon.spec
index 56720ad..12f552e 100644
--- a/contrib/fedora/ipsilon.spec
+++ b/contrib/fedora/ipsilon.spec
@@ -261,13 +261,13 @@ CFLAGS="%{optflags}" %{__python} setup.py build
 %install
 %{__python} setup.py install --skip-build --root %{buildroot}
 mkdir -p %{buildroot}%{_sbindir}
-mkdir -p %{buildroot}%{_libexecdir}
+mkdir -p %{buildroot}%{_libexecdir}/ipsilon
 mkdir -p %{buildroot}%{_defaultdocdir}
 mkdir -p %{buildroot}%{_localstatedir}/cache/ipsilon
 # These 0700 permissions are because ipsilon will store private keys here
 install -d -m 0700 %{buildroot}%{_sharedstatedir}/ipsilon
 install -d -m 0700 %{buildroot}%{_sysconfdir}/ipsilon
-mv %{buildroot}/%{_bindir}/ipsilon %{buildroot}/%{_libexecdir}
+mv %{buildroot}/%{_bindir}/ipsilon %{buildroot}/%{_libexecdir}/ipsilon
 mv %{buildroot}/%{_bindir}/ipsilon-db2conf %{buildroot}/%{_sbindir}
 mv %{buildroot}/%{_bindir}/ipsilon-server-install %{buildroot}/%{_sbindir}
 mv %{buildroot}/%{_bindir}/ipsilon-upgrade-database %{buildroot}/%{_sbindir}
@@ -359,7 +359,7 @@ fi
 %{_datadir}/ipsilon/ui/js
 %{_datadir}/ipsilon/ui/fonts
 %{_datadir}/ipsilon/ui/fonts-local
-%{_libexecdir}/ipsilon
+%{_libexecdir}/ipsilon/
 %dir %attr(0751,root,root) %{_sharedstatedir}/ipsilon
 %dir %attr(0751,root,root) %{_sysconfdir}/ipsilon
 %dir %attr(0750,ipsilon,apache) %{_localstatedir}/cache/ipsilon
diff --git a/examples/apache.conf b/examples/apache.conf
index cacbf70..90ed11f 100644
--- a/examples/apache.conf
+++ b/examples/apache.conf
@@ -1,5 +1,5 @@
 Alias /idp/ui /usr/share/ipsilon/ui
-WSGIScriptAlias /idp /usr/libexec/ipsilon.py
+WSGIScriptAlias /idp /usr/libexec/ipsilon/ipsilon.py
 WSGIDaemonProcess idp maximum-requests=2 user=ipsilon group=ipsilon
 WSGIProcessGroup idp
 
@@ -15,7 +15,7 @@ WSGIProcessGroup idp
   ErrorDocument 500 /idp/login/gssapi/failed
 </Location>
 
-<Directory /usr/libexec>
+<Directory /usr/libexec/ipsilon>
     Order allow,deny
     Allow from all
     Require all granted
diff --git a/ipsilon/install/ipsilon-server-install b/ipsilon/install/ipsilon-server-install
index 5f896dd..b79db87 100755
--- a/ipsilon/install/ipsilon-server-install
+++ b/ipsilon/install/ipsilon-server-install
@@ -31,7 +31,7 @@ TEMPLATES = '/usr/share/ipsilon/templates/install'
 CONFDIR = '/etc/ipsilon'
 DATADIR = '/var/lib/ipsilon'
 HTTPDCONFD = '/etc/httpd/conf.d'
-BINDIR = '/usr/libexec'
+BINDIR = '/usr/libexec/ipsilon'
 STATICDIR = '/usr/share/ipsilon'
 CACHEDIR = '/var/cache/ipsilon'
 WSGI_SOCKET_PREFIX = None