diff options
| author |   Michael Orlitzky <mjo@gentoo.org> | 2020-09-21 21:05:41 -0400 |
|---|---|---|
| committer | Michael Orlitzky <mjo@gentoo.org> | 2020-09-22 23:23:21 -0400 |
| commit | 20979a5933eff01400776082bbcec8d693006d26 (patch) | |
| tree | fb1e2975f6ac335b43f03bd2710304d4b4243974 | |
| parent | dev-util/rustup: add ~arm64 keyword (diff) | |
| download | gentoo-20979a5933eff01400776082bbcec8d693006d26.tar.gz gentoo-20979a5933eff01400776082bbcec8d693006d26.tar.bz2 gentoo-20979a5933eff01400776082bbcec8d693006d26.zip | |
app-antivirus/clamav: use tmpfiles.eclass for tmpfiles.d entries.
This avoids the systemd-specific implementation, but also hides the
tmpfiles entry behind USE=systemd for security reasons (the OpenRC
implementation, opentmpfiles, is insecure). The OpenRC service scripts
create their own directories anyway, at the expense of a tiny bit of
duplication.
Closes: https://bugs.gentoo.org/740622
Package-Manager: Portage-3.0.4, Repoman-3.0.1
Signed-off-by: Michael Orlitzky <mjo@gentoo.org>
| -rw-r--r-- | app-antivirus/clamav/clamav-0.103.0.ebuild | 21 |
1 files changed, 15 insertions, 6 deletions
diff --git a/app-antivirus/clamav/clamav-0.103.0.ebuild b/app-antivirus/clamav/clamav-0.103.0.ebuild index 16a7129ce1b4..9a1d28f89203 100644 --- a/app-antivirus/clamav/clamav-0.103.0.ebuild +++ b/app-antivirus/clamav/clamav-0.103.0.ebuild @@ -3,7 +3,7 @@ EAPI=7 -inherit autotools flag-o-matic systemd +inherit autotools flag-o-matic systemd tmpfiles DESCRIPTION="Clam Anti-Virus Scanner" HOMEPAGE="https://www.clamav.net/" @@ -12,7 +12,7 @@ SRC_URI="https://www.clamav.net/downloads/production/${P}.tar.gz" LICENSE="GPL-2" SLOT="0" KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~sparc-solaris ~x86-solaris" -IUSE="bzip2 doc clamonacc clamdtop clamsubmit iconv ipv6 libclamav-only libressl milter metadata-analysis-api selinux test uclibc xml" +IUSE="bzip2 doc clamonacc clamdtop clamsubmit iconv ipv6 libclamav-only libressl milter metadata-analysis-api selinux systemd test uclibc xml" REQUIRED_USE="libclamav-only? ( !clamonacc !clamdtop !clamsubmit !milter !metadata-analysis-api )" @@ -118,10 +118,19 @@ src_install() { rm -rf "${ED}"/var/lib/clamav || die if ! use libclamav-only ; then - systemd_dotmpfilesd "${FILESDIR}/tmpfiles.d/clamav.conf" - systemd_newunit "${FILESDIR}/clamd_at.service" "clamd@.service" - systemd_dounit "${FILESDIR}/clamd.service" - systemd_dounit "${FILESDIR}/freshclamd.service" + if use systemd; then + # The tmpfiles entry is behind USE=systemd because the + # upstream OpenRC service files should (and do) ensure that + # the directories they need exist and have the correct + # permissions without the help of opentmpfiles. There are + # years-old root exploits in opentmpfiles, the design is + # fundamentally flawed, and the maintainer is not up to + # the task of fixing it. + dotmpfiles "${FILESDIR}/tmpfiles.d/clamav.conf" + systemd_newunit "${FILESDIR}/clamd_at.service" "clamd@.service" + systemd_dounit "${FILESDIR}/clamd.service" + systemd_dounit "${FILESDIR}/freshclamd.service" + fi insinto /etc/logrotate.d newins "${FILESDIR}"/clamav.logrotate clamav |