From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 5FA9C138359 for ; Wed, 23 Sep 2020 03:34:58 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id D0725E0849; Wed, 23 Sep 2020 03:34:50 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 80C9BE0849 for ; Wed, 23 Sep 2020 03:34:50 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id BEB1333BDE6 for ; Wed, 23 Sep 2020 03:34:48 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 49D10353 for ; Wed, 23 Sep 2020 03:34:47 +0000 (UTC) From: "Michael Orlitzky" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Michael Orlitzky" Message-ID: <1600831401.20979a5933eff01400776082bbcec8d693006d26.mjo@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: app-antivirus/clamav/ X-VCS-Repository: repo/gentoo X-VCS-Files: app-antivirus/clamav/clamav-0.103.0.ebuild X-VCS-Directories: app-antivirus/clamav/ X-VCS-Committer: mjo X-VCS-Committer-Name: Michael Orlitzky X-VCS-Revision: 20979a5933eff01400776082bbcec8d693006d26 X-VCS-Branch: master Date: Wed, 23 Sep 2020 03:34:47 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: 31380904-38f2-4b67-add7-821f233e5c3e X-Archives-Hash: 9f27bc437644e38a92131ca2c54ce53b commit: 20979a5933eff01400776082bbcec8d693006d26 Author: Michael Orlitzky gentoo org> AuthorDate: Tue Sep 22 01:05:41 2020 +0000 Commit: Michael Orlitzky gentoo org> CommitDate: Wed Sep 23 03:23:21 2020 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=20979a59 app-antivirus/clamav: use tmpfiles.eclass for tmpfiles.d entries. This avoids the systemd-specific implementation, but also hides the tmpfiles entry behind USE=systemd for security reasons (the OpenRC implementation, opentmpfiles, is insecure). The OpenRC service scripts create their own directories anyway, at the expense of a tiny bit of duplication. Closes: https://bugs.gentoo.org/740622 Package-Manager: Portage-3.0.4, Repoman-3.0.1 Signed-off-by: Michael Orlitzky gentoo.org> app-antivirus/clamav/clamav-0.103.0.ebuild | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/app-antivirus/clamav/clamav-0.103.0.ebuild b/app-antivirus/clamav/clamav-0.103.0.ebuild index 16a7129ce1b..9a1d28f8920 100644 --- a/app-antivirus/clamav/clamav-0.103.0.ebuild +++ b/app-antivirus/clamav/clamav-0.103.0.ebuild @@ -3,7 +3,7 @@ EAPI=7 -inherit autotools flag-o-matic systemd +inherit autotools flag-o-matic systemd tmpfiles DESCRIPTION="Clam Anti-Virus Scanner" HOMEPAGE="https://www.clamav.net/" @@ -12,7 +12,7 @@ SRC_URI="https://www.clamav.net/downloads/production/${P}.tar.gz" LICENSE="GPL-2" SLOT="0" KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~sparc-solaris ~x86-solaris" -IUSE="bzip2 doc clamonacc clamdtop clamsubmit iconv ipv6 libclamav-only libressl milter metadata-analysis-api selinux test uclibc xml" +IUSE="bzip2 doc clamonacc clamdtop clamsubmit iconv ipv6 libclamav-only libressl milter metadata-analysis-api selinux systemd test uclibc xml" REQUIRED_USE="libclamav-only? ( !clamonacc !clamdtop !clamsubmit !milter !metadata-analysis-api )" @@ -118,10 +118,19 @@ src_install() { rm -rf "${ED}"/var/lib/clamav || die if ! use libclamav-only ; then - systemd_dotmpfilesd "${FILESDIR}/tmpfiles.d/clamav.conf" - systemd_newunit "${FILESDIR}/clamd_at.service" "clamd@.service" - systemd_dounit "${FILESDIR}/clamd.service" - systemd_dounit "${FILESDIR}/freshclamd.service" + if use systemd; then + # The tmpfiles entry is behind USE=systemd because the + # upstream OpenRC service files should (and do) ensure that + # the directories they need exist and have the correct + # permissions without the help of opentmpfiles. There are + # years-old root exploits in opentmpfiles, the design is + # fundamentally flawed, and the maintainer is not up to + # the task of fixing it. + dotmpfiles "${FILESDIR}/tmpfiles.d/clamav.conf" + systemd_newunit "${FILESDIR}/clamd_at.service" "clamd@.service" + systemd_dounit "${FILESDIR}/clamd.service" + systemd_dounit "${FILESDIR}/freshclamd.service" + fi insinto /etc/logrotate.d newins "${FILESDIR}"/clamav.logrotate clamav