debian: Run the server as `tripe' rather than `root'.

We have the fancy privilege separation machinery now, so we might as
well actually use it.  This involves (a) slightly hacking the
/etc/default/tripe file to set the user and group, and (b) actually
creating the necessary user and group accounts in the postinst script.

diff --git a/debian/control b/debian/control
index b451153f0ca7f61840ed0df9016178c4b926418a..fe30c9099a4981e7cc0418bd4b9c784b2903469b 100644 (file)
--- a/debian/control
+++ b/debian/control
@@ -9,7 +9,7 @@ Standards-Version: 3.1.1
 
 Package: tripe
 Architecture: any
 
 Package: tripe
 Architecture: any

-Depends: ${shlibs:Depends}, makedev (>= 2.3.1-63)
+Depends: ${shlibs:Depends}, makedev (>= 2.3.1-63), adduser

 Recommends: catacomb-bin
 Suggests: pkstream
 Description: Trivial IP Encryption: a simple virtual private network
 Recommends: catacomb-bin
 Suggests: pkstream
 Description: Trivial IP Encryption: a simple virtual private network

diff --git a/debian/rules b/debian/rules
index 0a422e834aa2651b19a83c2aa9ed068b79f8bcfd..7cc8074bf3aa7eb34fdd07dfc8853f8ee215699e 100755 (executable)
--- a/debian/rules
+++ b/debian/rules
@@ -38,7 +38,8 @@ binary-install/python-tripe::
 
 install/tripe::
        cp $(DEB_BUILDDIR)/init/tripe-init debian/tripe.init
 
 install/tripe::
        cp $(DEB_BUILDDIR)/init/tripe-init debian/tripe.init

-       cp $(DEB_SRCDIR)/init/tripe.conf debian/tripe.default
+       sed 's/^#\(user\|group\)/\1/' \
+               $(DEB_SRCDIR)/init/tripe.conf >debian/tripe.default

 
 cleanbuilddir::
        rm -f debian/tripe.init debian/tripe.default
 
 cleanbuilddir::
        rm -f debian/tripe.init debian/tripe.default

diff --git a/debian/tripe.postinst b/debian/tripe.postinst
index 468f19691699dc52b6a84f305afbdf4d3cb90337..2994690257f4bdb6f5d4e83fed9848f16b2cb914 100644 (file)
--- a/debian/tripe.postinst
+++ b/debian/tripe.postinst
@@ -2,8 +2,24 @@
 
 set -e
 
 
 set -e
 

-if [ ! -c /dev/.devfsd ] && [ ! -c /dev/net/tun ]; then
+## Make sure that /dev/net/tun exists.  Don't do anything special if devfs or
+## udev is running.
+if [ ! -c /dev/.devfsd ] &&
+   [ ! -d /dev/.udev ] &&
+   [ ! -c /dev/net/tun ]
+then
+  echo "/dev/net/tun not present: invoking MAKEDEV to create it."

   (cd /dev && /sbin/MAKEDEV tun)
 fi
 
   (cd /dev && /sbin/MAKEDEV tun)
 fi
 

+## Make sure that the `tripe' user and group exist.
+getent group tripe >/dev/null ||
+       addgroup --system tripe
+getent passwd tripe >/dev/null || \
+       adduser --system \
+               --ingroup tripe \
+               --home /etc/tripe \
+               --gecos "TrIPE server" \
+               tripe
+

 #DEBHELPER#
 #DEBHELPER#