[gentoo-commits] repo/gentoo:master commit in: games-util/joycond/, games-util/joycond/files/

[gentoo-commits] repo/gentoo:master commit in: games-util/joycond/, games-util/joycond/files/

[James Le Cuirot]

commit:     854bcc4eb92704b189020c527dd9f24f1c8f02f2
Author:     James Le Cuirot <chewi <AT> gentoo <DOT> org>
AuthorDate: Sun Mar 20 22:54:58 2022 +0000
Commit:     James Le Cuirot <chewi <AT> gentoo <DOT> org>
CommitDate: Sun Mar 20 22:54:58 2022 +0000
URL:        https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=854bcc4e

games-util/joycond: Patch to lock down the systemd service

Thanks to Andrew Udvare.

Closes: https://bugs.gentoo.org/833792
Signed-off-by: James Le Cuirot <chewi <AT> gentoo.org>

 .../joycond/files/joycond-systemd-paranoia.patch   | 45 ++++++++++++++++++++++
 ...d-systemd.patch => joycond-systemd-paths.patch} |  0
 .../joycond/joycond-0.1.0_p20210730-r1.ebuild      |  3 +-
 3 files changed, 47 insertions(+), 1 deletion(-)

diff --git a/games-util/joycond/files/joycond-systemd-paranoia.patch b/games-util/joycond/files/joycond-systemd-paranoia.patch
new file mode 100644
index 000000000000..f6803d074f17
--- /dev/null
+++ b/games-util/joycond/files/joycond-systemd-paranoia.patch
@@ -0,0 +1,45 @@
+From d39ce9de9420560494d92519f4e29a40d685a5b4 Mon Sep 17 00:00:00 2001
+From: Andrew Udvare <audvare@gmail.com>
+Date: Sun, 12 Dec 2021 22:02:00 -0500
+Subject: [PATCH] systemd service: paranoia mode
+
+---
+ systemd/joycond.service | 24 +++++++++++++++++++-----
+ 1 file changed, 19 insertions(+), 5 deletions(-)
+
+diff --git a/systemd/joycond.service b/systemd/joycond.service
+index cc8e408..5a8b045 100644
+--- a/systemd/joycond.service
++++ b/systemd/joycond.service
+@@ -4,12 +4,26 @@ After=network.target
+ 
+ [Service]
+ ExecStart=/usr/bin/joycond
+-WorkingDirectory=/root
+-StandardOutput=inherit
+-StandardError=inherit
+ Restart=always
+-User=root
++
++DeviceAllow=char-input
++DevicePolicy=closed
++LockPersonality=yes
++MemoryDenyWriteExecute=yes
++NoNewPrivileges=yes
++ProtectClock=yes
++PrivateTmp=yes
++ProtectHome=yes
++ProtectHostname=yes
++ProtectControlGroups=yes
++ProtectKernelModules=yes
++ProtectProc=noaccess
++ProtectSystem=strict
++RestrictAddressFamilies=AF_NETLINK
++RestrictNetworkInterfaces=
++RestrictRealtime=yes
++RestrictSUIDSGID=yes
++SocketBindDeny=any
+ 
+ [Install]
+ WantedBy=multi-user.target
+-

diff --git a/games-util/joycond/files/joycond-systemd.patch b/games-util/joycond/files/joycond-systemd-paths.patch
similarity index 100%
rename from games-util/joycond/files/joycond-systemd.patch
rename to games-util/joycond/files/joycond-systemd-paths.patch

diff --git a/games-util/joycond/joycond-0.1.0_p20210730-r1.ebuild b/games-util/joycond/joycond-0.1.0_p20210730-r1.ebuild
index 85cfd03bba1c..89a5d6774449 100644
--- a/games-util/joycond/joycond-0.1.0_p20210730-r1.ebuild
+++ b/games-util/joycond/joycond-0.1.0_p20210730-r1.ebuild
@@ -32,7 +32,8 @@ CONFIG_CHECK="
 S="${WORKDIR}/${PN}-${COMMIT}"
 
 PATCHES=(
-	"${FILESDIR}"/${PN}-systemd.patch
+	"${FILESDIR}"/${PN}-systemd-paths.patch
+	"${FILESDIR}"/${PN}-systemd-paranoia.patch
 )
 
 src_install() {

[gentoo-commits] repo/gentoo:master commit in: games-util/joycond/, games-util/joycond/files/

[James Le Cuirot]

commit:     e8468c7ce1130e455974c4d3ce0185d157753a6a
Author:     James Le Cuirot <chewi <AT> gentoo <DOT> org>
AuthorDate: Sun Mar 20 22:51:53 2022 +0000
Commit:     James Le Cuirot <chewi <AT> gentoo <DOT> org>
CommitDate: Sun Mar 20 22:51:53 2022 +0000
URL:        https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e8468c7c

games-util/joycond: Patch to install systemd files in the right locations

Closes: https://bugs.gentoo.org/833792
Signed-off-by: James Le Cuirot <chewi <AT> gentoo.org>

 games-util/joycond/files/joycond-systemd.patch     | 32 ++++++++++++++++++++++
 ...30.ebuild => joycond-0.1.0_p20210730-r1.ebuild} |  5 +++-
 2 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/games-util/joycond/files/joycond-systemd.patch b/games-util/joycond/files/joycond-systemd.patch
new file mode 100644
index 000000000000..8b8288350a3e
--- /dev/null
+++ b/games-util/joycond/files/joycond-systemd.patch
@@ -0,0 +1,32 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index f9d6e93..4e05976 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -28,12 +28,24 @@ add_subdirectory(src)
+ install(TARGETS joycond DESTINATION /usr/bin/
+         PERMISSIONS OWNER_WRITE OWNER_READ OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE
+         )
+-install(FILES udev/89-joycond.rules udev/72-joycond.rules DESTINATION /lib/udev/rules.d/
++
++pkg_get_variable(UDEV_RULES_PATH udev udevdir)
++install(FILES udev/89-joycond.rules udev/72-joycond.rules DESTINATION ${UDEV_RULES_PATH}/rules.d/
+         PERMISSIONS OWNER_WRITE OWNER_READ GROUP_READ WORLD_READ 
+         )
+-install(FILES systemd/joycond.service DESTINATION /etc/systemd/system
++
++execute_process(COMMAND systemd-path systemd-system-unit OUTPUT_VARIABLE SYSTEMD_SYSTEM_UNIT_PATH OUTPUT_STRIP_TRAILING_WHITESPACE RESULT_VARIABLE UNIT_RETVAL)
++if(NOT "${UNIT_RETVAL}" EQUAL 0)
++    set(SYSTEMD_SYSTEM_UNIT_PATH "/usr/lib/systemd/system")
++endif()
++install(FILES systemd/joycond.service DESTINATION ${SYSTEMD_SYSTEM_UNIT_PATH}
+         PERMISSIONS OWNER_WRITE OWNER_READ GROUP_READ WORLD_READ
+         )
+-install(FILES systemd/joycond.conf DESTINATION /etc/modules-load.d
++
++execute_process(COMMAND systemd-path modules-load OUTPUT_VARIABLE SYSTEMD_MODULES_LOAD_PATH OUTPUT_STRIP_TRAILING_WHITESPACE RESULT_VARIABLE MODULES_RETVAL)
++if(NOT "${MODULES_RETVAL}" EQUAL 0)
++    set(SYSTEMD_MODULES_LOAD_PATH "/usr/lib/modules-load.d")
++endif()
++install(FILES systemd/joycond.conf DESTINATION ${SYSTEMD_MODULES_LOAD_PATH}
+         PERMISSIONS OWNER_WRITE OWNER_READ GROUP_READ WORLD_READ
+         )

diff --git a/games-util/joycond/joycond-0.1.0_p20210730.ebuild b/games-util/joycond/joycond-0.1.0_p20210730-r1.ebuild
similarity index 93%
rename from games-util/joycond/joycond-0.1.0_p20210730.ebuild
rename to games-util/joycond/joycond-0.1.0_p20210730-r1.ebuild
index e06a319c6811..85cfd03bba1c 100644
--- a/games-util/joycond/joycond-0.1.0_p20210730.ebuild
+++ b/games-util/joycond/joycond-0.1.0_p20210730-r1.ebuild
@@ -31,9 +31,12 @@ CONFIG_CHECK="
 
 S="${WORKDIR}/${PN}-${COMMIT}"
 
+PATCHES=(
+	"${FILESDIR}"/${PN}-systemd.patch
+)
+
 src_install() {
 	cmake_src_install
-	rm -r "${ED}"/etc/modules-load.d/ || die
 	newinitd "${FILESDIR}"/${PN}.initd ${PN}
 	doman doc/${PN}.1
 }