main/openntpd: fixes privelege seperation defaults v1 PROPOSED

systmkor: 1
 main/openntpd: fixes privelege seperation defaults

 2 files changed, 3 insertions(+), 1 deletions(-)

> The prepare function still substitutes _ntp with ntp in src/ntpd.h I
> am assuming that this is no longer necessary? If so then please
> remove the sed(1) invocation from the prepare function.
I'll try removing the sed call in the prepare function and verify that
OpenNTPD still works.

[alpine-aports] [PATCH] main/openntpd: fixes privelege seperation defaults Export this patch

 - compiles default privelege seperation user as ntp instead of _ntp
 - creates required chroot directory /var/empty in .pre-install script
---
 main/openntpd/APKBUILD             | 3 ++-
 main/openntpd/openntpd.pre-install | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/main/openntpd/APKBUILD b/main/openntpd/APKBUILD
index d2de528..fd68e84 100644
--- a/main/openntpd/APKBUILD
+++ b/main/openntpd/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=openntpd
 pkgver=5.7_p4
 _myver=${pkgver/_/}
-pkgrel=0
+pkgrel=1
 pkgdesc="Lightweight NTP server ported from OpenBSD"
 url=http://www.openntpd.org/
 install="$pkgname.pre-install $pkgname.pre-upgrade $pkgname.post-upgrade"
@@ -41,6 +41,7 @@ build() {
 		--localstatedir=/var \
 		--mandir=/usr/share/man \
 		--sysconfdir=/etc \
+		--with-privsep-user=ntp \
 		|| return 1
 	make || return 1
 }
diff --git a/main/openntpd/openntpd.pre-install b/main/openntpd/openntpd.pre-install

Sören Tempel <soeren@soeren-tempel.net>

8 years ago

The prepare function still substitutes _ntp with ntp in src/ntpd.h I am
assuming that this is no longer necessary? If so then please remove the
sed(1) invocation from the prepare function.

Next

index 0b2be06..36778a9 100644
--- a/main/openntpd/openntpd.pre-install
+++ b/main/openntpd/openntpd.pre-install
@@ -2,6 +2,7 @@
 
 # this user should be included in alpine-baselayout-1.2.
 # included here for backward compability.
+mkdir -p /var/empty
 adduser -H -h /var/empty -s /sbin/nologin -D ntp  2>/dev/null
 
 exit 0

Sören Tempel <soeren@soeren-tempel.net>

8 years ago

The OpenSSH aports creates the /var/empty directory in its OpenRC
services[1], maybe it would be a good idea to do that here as well for
the sake of consistency?

Orion Miller <systmkor@gmail.com>

8 years ago

I thought if I did that it would cause a package ownership
contention over that specific file (i.e. a directory). I'll try it. :D

-- 
keybase.io/systmkor


---
Unsubscribe:  alpine-aports+unsubscribe@lists.alpinelinux.org
Help:         alpine-aports+help@lists.alpinelinux.org
---

[1]: http://git.alpinelinux.org/cgit/aports/tree/main/openssh/sshd.initd#n39

S�ren.


---
Unsubscribe:  alpine-aports+unsubscribe@lists.alpinelinux.org
Help:         alpine-aports+help@lists.alpinelinux.org
---

-- 
2.4.1



---
Unsubscribe:  alpine-aports+unsubscribe@lists.alpinelinux.org
Help:         alpine-aports+help@lists.alpinelinux.org
---