Mail archive
alpine-aports

Re: [alpine-aports] [PATCH] main/openntpd: fixes privelege seperation defaults

From: Sören Tempel <soeren_at_soeren-tempel.net>
Date: Thu, 27 Aug 2015 11:24:23 +0200

On 26.08.15, systmkor wrote:
> - compiles default privelege seperation user as ntp instead of _ntp
> - creates required chroot directory /var/empty in .pre-install script
> ---
> main/openntpd/APKBUILD | 3 ++-
> main/openntpd/openntpd.pre-install | 1 +
> 2 files changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/main/openntpd/APKBUILD b/main/openntpd/APKBUILD
> index d2de528..fd68e84 100644
> --- a/main/openntpd/APKBUILD
> +++ b/main/openntpd/APKBUILD
> _at_@ -2,7 +2,7 @@
> pkgname=openntpd
> pkgver=5.7_p4
> _myver=${pkgver/_/}
> -pkgrel=0
> +pkgrel=1
> pkgdesc="Lightweight NTP server ported from OpenBSD"
> url=http://www.openntpd.org/
> install="$pkgname.pre-install $pkgname.pre-upgrade $pkgname.post-upgrade"
> _at_@ -41,6 +41,7 @@ build() {
> --localstatedir=/var \
> --mandir=/usr/share/man \
> --sysconfdir=/etc \
> + --with-privsep-user=ntp \
> || return 1
> make || return 1
> }
> diff --git a/main/openntpd/openntpd.pre-install b/main/openntpd/openntpd.pre-install

The prepare function still substitutes _ntp with ntp in src/ntpd.h I am
assuming that this is no longer necessary? If so then please remove the
sed(1) invocation from the prepare function.

> index 0b2be06..36778a9 100644
> --- a/main/openntpd/openntpd.pre-install
> +++ b/main/openntpd/openntpd.pre-install
> _at_@ -2,6 +2,7 @@
>
> # this user should be included in alpine-baselayout-1.2.
> # included here for backward compability.
> +mkdir -p /var/empty
> adduser -H -h /var/empty -s /sbin/nologin -D ntp 2>/dev/null
>
> exit 0

The OpenSSH aports creates the /var/empty directory in its OpenRC
services[1], maybe it would be a good idea to do that here as well for
the sake of consistency?

[1]: http://git.alpinelinux.org/cgit/aports/tree/main/openssh/sshd.initd#n39

Sören.


---
Unsubscribe:  alpine-aports+unsubscribe_at_lists.alpinelinux.org
Help:         alpine-aports+help_at_lists.alpinelinux.org
---
Received on Thu Aug 27 2015 - 11:24:23 GMT