#!/usr/bin/env bash
set -Eeuo pipefail
set +x
umask 077

readonly LABEL=REDIS02_Q132_RESUME_AFTER_ETC_MODE_CHANGE
readonly EXPECTED_HOST=sqjcredis02
readonly EXPECTED_IP=10.2.203.113
readonly ENGINE=/root/redis02-q132-selinux-acl-repair-activate-verify.sh
readonly ENGINE_SHA256=5ebb623df5246c868960ac962527a7b2f015a1cf1ae04707a208acade60599af
tmp_engine=''
patch_file=''

cleanup() { set +e; [[ -n "$tmp_engine" ]] && rm -f -- "$tmp_engine"; [[ -n "$patch_file" ]] && rm -f -- "$patch_file"; }
finish() {
    local rc=$?
    cleanup
    if [[ "$rc" -eq 0 ]]; then
        printf '%s\n' 'Q132_RESUME_AFTER_ETC_MODE_CHANGE=PASS_REDIS02_LOCAL_ROLE_ACTIVATED'
    else
        printf '%s\n' 'Q132_RESUME_AFTER_ETC_MODE_CHANGE=FAIL_STOP_CHILD_HANDLED_ROLLBACK'
    fi
    printf 'END|%s|RC=%s\n' "$LABEL" "$rc"
    exit "$rc"
}
trap finish EXIT

printf 'BEGIN|%s|%s\n' "$LABEL" "$(date '+%Y-%m-%dT%H:%M:%S%z')"
[[ $# -eq 0 && $(id -u) -eq 0 ]]
actual_host=$(hostname -s)
[[ "$actual_host" == "$EXPECTED_HOST" ]]
ip -o -4 addr show scope global | awk '{split($4,a,"/"); print a[1]}' | grep -Fxq "$EXPECTED_IP"
printf 'Q132_RESUME_TARGET_IDENTITY=PASS|host=%s|ip=%s\n' "$actual_host" "$EXPECTED_IP"
for command_name in patch sha256sum bash stat getfacl systemctl ss rpm install; do command -v "$command_name" >/dev/null; done
[[ -f "$ENGINE" && ! -L "$ENGINE" ]]
printf '%s  %s\n' "$ENGINE_SHA256" "$ENGINE" | sha256sum -c -
[[ $(stat -c '%U:%G:%a' /etc) == root:root:755 ]]
[[ $(stat -c '%U:%G:%a' /etc/redis) == root:root:750 ]]
! getfacl -cp /etc | grep -q '^user:redis:'
rpm -q policycoreutils-python-utils >/dev/null
for unit in redis5.service redis7.service sentinel5.service sentinel7.service orchestrator.service; do
    [[ $(systemctl is-enabled "$unit" 2>/dev/null || true) == disabled ]]
    [[ $(systemctl is-active "$unit" 2>/dev/null || true) == inactive ]]
done
! ss -lntupH | grep -E ':(6379|6387|26379|26387|3000|10008)([[:space:]]|$)' >/dev/null
printf 'Q132_RESUME_PREWRITE_GATE=PASS|etc=root:root:755|etc_redis=root:root:750|support=installed|units=quiet\n'

tmp_engine=$(mktemp /var/tmp/redis02-q132-engine-v2.XXXXXX.sh)
patch_file=$(mktemp /var/tmp/redis02-q132-engine-v2.XXXXXX.diff)
install -o root -g root -m 0700 "$ENGINE" "$tmp_engine"
cat >"$patch_file" <<'PATCH'
--- redis02-q132-selinux-acl-repair-activate-verify.sh
+++ redis02-q132-selinux-acl-repair-activate-verify-v2.sh
@@ -151,8 +151,9 @@
     [[ $(systemctl is-active "$unit" 2>/dev/null || true) == inactive ]]
 done
 ! ss -lntupH | grep -E ':(6379|6387|26379|26387|3000|10008)([[:space:]]|$)' >/dev/null
-[[ $(stat -c '%U:%G:%a' /etc) == root:root:750 ]]
+etc_mode=$(stat -c '%U:%G:%a' /etc)
+[[ "$etc_mode" == root:root:750 || "$etc_mode" == root:root:755 ]]
 [[ $(stat -c '%U:%G:%a' /etc/redis) == root:root:750 ]]
 ! getfacl -cp /etc | grep -q '^user:redis:'
 for config in /etc/redis/redis5.conf /etc/redis/redis7.conf; do
@@ -217,7 +219,11 @@
     printf 'FCONTEXT|%s|%s|%s\n' "${FCONTEXT_ACTIONS[$i]}" "${FCONTEXT_TYPES[$i]}" "${FCONTEXT_REGEXES[$i]}"
 done
 printf 'PORT_6387_ACTION=%s\n' "$PORT_6387_ACTION"
-printf 'ACL_ACTION=ADD_USER_REDIS_TRAVERSE_ONLY_TO_ETC\n'
+if [[ "$etc_mode" == root:root:750 ]]; then
+    printf 'ACL_ACTION=ADD_USER_REDIS_TRAVERSE_ONLY_TO_ETC\n'
+else
+    printf 'ACL_ACTION=KEEP_ETC_0755_TRAVERSE_ALREADY_AVAILABLE\n'
+fi
 printf 'Q132_SELINUX_ACL_REPAIR_PREWRITE_GATE=PASS\n'
 
 mutation_started=1
@@ -232,9 +238,11 @@
     port_added=1
 fi
 restorecon -RFv "${RESTORE_PATHS[@]}"
-setfacl -m u:redis:--x /etc
-acl_added=1
-getfacl -cp /etc | grep -Fxq 'user:redis:--x'
+if [[ "$etc_mode" == root:root:750 ]]; then
+    setfacl -m u:redis:--x /etc
+    acl_added=1
+    getfacl -cp /etc | grep -Fxq 'user:redis:--x'
+fi
 chgrp redis /etc/redis
 chmod 0750 /etc/redis
 [[ $(stat -c '%U:%G:%a' /etc/redis) == root:redis:750 ]]
PATCH
patch --batch --fuzz=0 "$tmp_engine" "$patch_file"
bash -n "$tmp_engine"
grep -Fq 'ACL_ACTION=KEEP_ETC_0755_TRAVERSE_ALREADY_AVAILABLE' "$tmp_engine"
grep -Fq 'Q132_SELINUX_ACL_REPAIR_ACTIVATE_VERIFY=PASS_REDIS02_LOCAL_ROLE_ACTIVATED' "$tmp_engine"
printf 'Q132_DERIVED_ENGINE_GATE=PASS|change=accept_etc_0755_and_skip_redundant_acl\n'
"$tmp_engine"