From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 70040138350 for ; Mon, 30 Mar 2020 18:36:58 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 8CAFCE09D0; Mon, 30 Mar 2020 18:36:57 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 5BE93E09D0 for ; Mon, 30 Mar 2020 18:36:57 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 15F4634F077 for ; Mon, 30 Mar 2020 18:36:56 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 191562B for ; Mon, 30 Mar 2020 18:36:54 +0000 (UTC) From: "Thomas Deutschmann" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Thomas Deutschmann" Message-ID: <1585593403.5eefb61d11a77c123475fec73db819fa6121b7f2.whissi@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: net-misc/chrony/files/, net-misc/chrony/ X-VCS-Repository: repo/gentoo X-VCS-Files: net-misc/chrony/chrony-3.5-r3.ebuild net-misc/chrony/chrony-9999.ebuild net-misc/chrony/files/chronyd.conf X-VCS-Directories: net-misc/chrony/files/ net-misc/chrony/ X-VCS-Committer: whissi X-VCS-Committer-Name: Thomas Deutschmann X-VCS-Revision: 5eefb61d11a77c123475fec73db819fa6121b7f2 X-VCS-Branch: master Date: Mon, 30 Mar 2020 18:36:54 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: 5aba4114-1562-45fe-821d-60aedb8e08c0 X-Archives-Hash: 74fe4b73ca6b5b662aa9bf76f9fe9f6f commit: 5eefb61d11a77c123475fec73db819fa6121b7f2 Author: Sam James (sam_c) cmpct info> AuthorDate: Wed Mar 4 04:49:58 2020 +0000 Commit: Thomas Deutschmann gentoo org> CommitDate: Mon Mar 30 18:36:43 2020 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5eefb61d net-misc/chrony: Run as non-root when USE=caps, revbump When caps is enabled, drop to the user ntp (acct-user/ntp), as opposed to remaining root. Adds a tmpfile.d entry for /run/chrony to ensure correct permissions. Closes: https://bugs.gentoo.org/711058 Signed-off-by: Sam James (sam_c) cmpct.info> Signed-off-by: Thomas Deutschmann gentoo.org> .../{chrony-9999.ebuild => chrony-3.5-r3.ebuild} | 45 +++++++++++++++++----- net-misc/chrony/chrony-9999.ebuild | 29 ++++++++++++-- net-misc/chrony/files/chronyd.conf | 2 +- 3 files changed, 63 insertions(+), 13 deletions(-) diff --git a/net-misc/chrony/chrony-9999.ebuild b/net-misc/chrony/chrony-3.5-r3.ebuild similarity index 70% copy from net-misc/chrony/chrony-9999.ebuild copy to net-misc/chrony/chrony-3.5-r3.ebuild index e939129a01a..3f11f8dd951 100644 --- a/net-misc/chrony/chrony-9999.ebuild +++ b/net-misc/chrony/chrony-3.5-r3.ebuild @@ -1,16 +1,16 @@ -# Copyright 1999-2019 Gentoo Authors +# Copyright 1999-2020 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 EAPI=7 -inherit git-r3 systemd toolchain-funcs +inherit systemd tmpfiles toolchain-funcs DESCRIPTION="NTP client and server programs" HOMEPAGE="https://chrony.tuxfamily.org/" -EGIT_REPO_URI="https://git.tuxfamily.org/chrony/chrony.git/" +SRC_URI="https://download.tuxfamily.org/${PN}/${P/_/-}.tar.gz" LICENSE="GPL-2" SLOT="0" -KEYWORDS="" +KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ppc ~ppc64 ~sparc ~x86" IUSE=" +adns caps +cmdmon html ipv6 libedit +ntp +phc pps readline +refclock +rtc seccomp selinux @@ -27,14 +27,17 @@ CDEPEND=" " DEPEND=" ${CDEPEND} - dev-ruby/asciidoctor + caps? ( acct-group/ntp acct-user/ntp ) + html? ( dev-ruby/asciidoctor ) pps? ( net-misc/pps-tools ) " RDEPEND=" ${CDEPEND} selinux? ( sec-policy/selinux-chronyd ) " + RESTRICT=test + S="${WORKDIR}/${P/_/-}" PATCHES=( @@ -47,6 +50,16 @@ src_prepare() { sed -i \ -e 's:/etc/chrony\.conf:/etc/chrony/chrony.conf:g' \ doc/* examples/* || die + + # Copy for potential user fixup + cp "${FILESDIR}"/chronyd.conf "$T"/chronyd.conf + + # Set config for privdrop + if ! use caps; then + sed -i \ + -e 's/-u ntp//' \ + "${T}"/chronyd.conf || die + fi } src_configure() { @@ -95,14 +108,14 @@ src_configure() { } src_compile() { - emake all docs + emake all docs $(usex html '' 'ADOC=true') } src_install() { default newinitd "${FILESDIR}"/chronyd.init-r2 chronyd - newconfd "${FILESDIR}"/chronyd.conf chronyd + newconfd "${T}"/chronyd.conf chronyd insinto /etc/${PN} newins examples/chrony.conf.example1 chrony.conf @@ -110,8 +123,12 @@ src_install() { docinto examples dodoc examples/*.example* - docinto html - dodoc doc/*.html + newtmpfiles - chronyd.conf <<<"d /run/chrony 0750 $(usex caps 'ntp ntp' 'root root')" + + if use html; then + docinto html + dodoc doc/*.html + fi keepdir /var/{lib,log}/chrony @@ -121,3 +138,13 @@ src_install() { systemd_dounit examples/{chronyd,chrony-wait}.service systemd_enable_ntpunit 50-chrony chronyd.service } + +pkg_preinst() { + if use caps && has_version net-misc/chrony[-caps]; then + elog "/run/chronyd needs ntp:ntp permissions; please check." + elog "The safest option is reboot, but you may chown manually." + elif ! use caps && has_version net-misc/chrony[caps]; then + elog "/run/chronyd needs root:root permissions; please check." + elog "The safest option is reboot, but you may chown manually." + fi +} diff --git a/net-misc/chrony/chrony-9999.ebuild b/net-misc/chrony/chrony-9999.ebuild index e939129a01a..5b03ec4fe42 100644 --- a/net-misc/chrony/chrony-9999.ebuild +++ b/net-misc/chrony/chrony-9999.ebuild @@ -1,8 +1,8 @@ -# Copyright 1999-2019 Gentoo Authors +# Copyright 1999-2020 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 EAPI=7 -inherit git-r3 systemd toolchain-funcs +inherit git-r3 tmpfiles systemd toolchain-funcs DESCRIPTION="NTP client and server programs" HOMEPAGE="https://chrony.tuxfamily.org/" @@ -27,6 +27,7 @@ CDEPEND=" " DEPEND=" ${CDEPEND} + caps? ( acct-group/ntp acct-user/ntp ) dev-ruby/asciidoctor pps? ( net-misc/pps-tools ) " @@ -47,6 +48,16 @@ src_prepare() { sed -i \ -e 's:/etc/chrony\.conf:/etc/chrony/chrony.conf:g' \ doc/* examples/* || die + + # Copy for potential user fixup + cp "${FILESDIR}"/chronyd.conf "$T"/chronyd.conf + + # Set config for privdrop + if ! use caps; then + sed -i \ + -e 's/-u ntp//' \ + "${T}"/chronyd.conf || die + fi } src_configure() { @@ -102,7 +113,7 @@ src_install() { default newinitd "${FILESDIR}"/chronyd.init-r2 chronyd - newconfd "${FILESDIR}"/chronyd.conf chronyd + newconfd "${T}"/chronyd.conf chronyd insinto /etc/${PN} newins examples/chrony.conf.example1 chrony.conf @@ -110,6 +121,8 @@ src_install() { docinto examples dodoc examples/*.example* + newtmpfiles - chronyd.conf <<<"d /run/chrony 0750 $(usex caps 'ntp ntp' 'root root')" + docinto html dodoc doc/*.html @@ -121,3 +134,13 @@ src_install() { systemd_dounit examples/{chronyd,chrony-wait}.service systemd_enable_ntpunit 50-chrony chronyd.service } + +pkg_preinst() { + if use caps && has_version net-misc/chrony[-caps]; then + elog "/run/chronyd needs ntp:ntp permissions; please check." + elog "The safest option is reboot, but you may chown manually." + elif ! use caps && has_version net-misc/chrony[caps]; then + elog "/run/chronyd needs root:root permissions; please check." + elog "The safest option is reboot, but you may chown manually." + fi +} diff --git a/net-misc/chrony/files/chronyd.conf b/net-misc/chrony/files/chronyd.conf index fc43a95c40f..c641d985e56 100644 --- a/net-misc/chrony/files/chronyd.conf +++ b/net-misc/chrony/files/chronyd.conf @@ -9,4 +9,4 @@ CFGFILE="/etc/chrony/chrony.conf" # The combination of "-s -r" allows chronyd to perform long term averaging of # the gain or loss rate across system reboots and shutdowns. -ARGS="" +ARGS="-u ntp"