From a5c4dd60c89a65d24df1dc1603632c9c97f6ac98 Mon Sep 17 00:00:00 2001 Message-Id: From: Mark Wooding Date: Mon, 19 Apr 2010 22:00:59 +0100 Subject: [PATCH] debian: Run the server as `tripe' rather than `root'. Organization: Straylight/Edgeware From: Mark Wooding We have the fancy privilege separation machinery now, so we might as well actually use it. This involves (a) slightly hacking the /etc/default/tripe file to set the user and group, and (b) actually creating the necessary user and group accounts in the postinst script. --- debian/control | 2 +- debian/rules | 3 ++- debian/tripe.postinst | 18 +++++++++++++++++- 3 files changed, 20 insertions(+), 3 deletions(-) diff --git a/debian/control b/debian/control index b451153f..fe30c909 100644 --- a/debian/control +++ b/debian/control @@ -9,7 +9,7 @@ Standards-Version: 3.1.1 Package: tripe Architecture: any -Depends: ${shlibs:Depends}, makedev (>= 2.3.1-63) +Depends: ${shlibs:Depends}, makedev (>= 2.3.1-63), adduser Recommends: catacomb-bin Suggests: pkstream Description: Trivial IP Encryption: a simple virtual private network diff --git a/debian/rules b/debian/rules index 0a422e83..7cc8074b 100755 --- a/debian/rules +++ b/debian/rules @@ -38,7 +38,8 @@ binary-install/python-tripe:: install/tripe:: cp $(DEB_BUILDDIR)/init/tripe-init debian/tripe.init - cp $(DEB_SRCDIR)/init/tripe.conf debian/tripe.default + sed 's/^#\(user\|group\)/\1/' \ + $(DEB_SRCDIR)/init/tripe.conf >debian/tripe.default cleanbuilddir:: rm -f debian/tripe.init debian/tripe.default diff --git a/debian/tripe.postinst b/debian/tripe.postinst index 468f1969..29946902 100644 --- a/debian/tripe.postinst +++ b/debian/tripe.postinst @@ -2,8 +2,24 @@ set -e -if [ ! -c /dev/.devfsd ] && [ ! -c /dev/net/tun ]; then +## Make sure that /dev/net/tun exists. Don't do anything special if devfs or +## udev is running. +if [ ! -c /dev/.devfsd ] && + [ ! -d /dev/.udev ] && + [ ! -c /dev/net/tun ] +then + echo "/dev/net/tun not present: invoking MAKEDEV to create it." (cd /dev && /sbin/MAKEDEV tun) fi +## Make sure that the `tripe' user and group exist. +getent group tripe >/dev/null || + addgroup --system tripe +getent passwd tripe >/dev/null || \ + adduser --system \ + --ingroup tripe \ + --home /etc/tripe \ + --gecos "TrIPE server" \ + tripe + #DEBHELPER# -- [mdw]