From: Mark Wooding <mdw@distorted.org.uk>
Date: Mon, 19 Apr 2010 21:00:59 +0000 (+0100)
Subject: debian: Run the server as `tripe' rather than `root'.
X-Git-Tag: 1.0.0pre8~12
X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~mdw/git/tripe/commitdiff_plain/a5c4dd60c89a65d24df1dc1603632c9c97f6ac98

debian: Run the server as `tripe' rather than `root'.

We have the fancy privilege separation machinery now, so we might as
well actually use it.  This involves (a) slightly hacking the
/etc/default/tripe file to set the user and group, and (b) actually
creating the necessary user and group accounts in the postinst script.
---

diff --git a/debian/control b/debian/control
index b451153f..fe30c909 100644
--- a/debian/control
+++ b/debian/control
@@ -9,7 +9,7 @@ Standards-Version: 3.1.1
 
 Package: tripe
 Architecture: any
-Depends: ${shlibs:Depends}, makedev (>= 2.3.1-63)
+Depends: ${shlibs:Depends}, makedev (>= 2.3.1-63), adduser
 Recommends: catacomb-bin
 Suggests: pkstream
 Description: Trivial IP Encryption: a simple virtual private network
diff --git a/debian/rules b/debian/rules
index 0a422e83..7cc8074b 100755
--- a/debian/rules
+++ b/debian/rules
@@ -38,7 +38,8 @@ binary-install/python-tripe::
 
 install/tripe::
 	cp $(DEB_BUILDDIR)/init/tripe-init debian/tripe.init
-	cp $(DEB_SRCDIR)/init/tripe.conf debian/tripe.default
+	sed 's/^#\(user\|group\)/\1/' \
+		$(DEB_SRCDIR)/init/tripe.conf >debian/tripe.default
 
 cleanbuilddir::
 	rm -f debian/tripe.init debian/tripe.default
diff --git a/debian/tripe.postinst b/debian/tripe.postinst
index 468f1969..29946902 100644
--- a/debian/tripe.postinst
+++ b/debian/tripe.postinst
@@ -2,8 +2,24 @@
 
 set -e
 
-if [ ! -c /dev/.devfsd ] && [ ! -c /dev/net/tun ]; then
+## Make sure that /dev/net/tun exists.  Don't do anything special if devfs or
+## udev is running.
+if [ ! -c /dev/.devfsd ] &&
+   [ ! -d /dev/.udev ] &&
+   [ ! -c /dev/net/tun ]
+then
+  echo "/dev/net/tun not present: invoking MAKEDEV to create it."
   (cd /dev && /sbin/MAKEDEV tun)
 fi
 
+## Make sure that the `tripe' user and group exist.
+getent group tripe >/dev/null ||
+	addgroup --system tripe
+getent passwd tripe >/dev/null || \
+	adduser --system \
+		--ingroup tripe \
+		--home /etc/tripe \
+		--gecos "TrIPE server" \
+		tripe
+
 #DEBHELPER#