diff options
| author |   Sam James (sam_c) <sam@cmpct.info> | 2020-03-04 04:49:58 +0000 |
|---|---|---|
| committer |   Thomas Deutschmann <whissi@gentoo.org> | 2020-03-30 20:36:43 +0200 |
| commit | 5eefb61d11a77c123475fec73db819fa6121b7f2 (patch) | |
| tree | 5a776b039043126c217f9b027f5c4cae3d68570a /net-misc/chrony/chrony-9999.ebuild | |
| parent | media-radio/ax25-tools: Minor version bump (diff) | |
| download | gentoo-5eefb61d11a77c123475fec73db819fa6121b7f2.tar.gz gentoo-5eefb61d11a77c123475fec73db819fa6121b7f2.tar.bz2 gentoo-5eefb61d11a77c123475fec73db819fa6121b7f2.zip | |
net-misc/chrony: Run as non-root when USE=caps, revbump
When caps is enabled, drop to the user ntp (acct-user/ntp),
as opposed to remaining root.
Adds a tmpfile.d entry for /run/chrony to ensure correct permissions.
Closes: https://bugs.gentoo.org/711058
Signed-off-by: Sam James (sam_c) <sam@cmpct.info>
Signed-off-by: Thomas Deutschmann <whissi@gentoo.org>
Diffstat (limited to 'net-misc/chrony/chrony-9999.ebuild')
| -rw-r--r-- | net-misc/chrony/chrony-9999.ebuild | 29 |
1 files changed, 26 insertions, 3 deletions
diff --git a/net-misc/chrony/chrony-9999.ebuild b/net-misc/chrony/chrony-9999.ebuild index e939129a01ac..5b03ec4fe426 100644 --- a/net-misc/chrony/chrony-9999.ebuild +++ b/net-misc/chrony/chrony-9999.ebuild @@ -1,8 +1,8 @@ -# Copyright 1999-2019 Gentoo Authors +# Copyright 1999-2020 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 EAPI=7 -inherit git-r3 systemd toolchain-funcs +inherit git-r3 tmpfiles systemd toolchain-funcs DESCRIPTION="NTP client and server programs" HOMEPAGE="https://chrony.tuxfamily.org/" @@ -27,6 +27,7 @@ CDEPEND=" " DEPEND=" ${CDEPEND} + caps? ( acct-group/ntp acct-user/ntp ) dev-ruby/asciidoctor pps? ( net-misc/pps-tools ) " @@ -47,6 +48,16 @@ src_prepare() { sed -i \ -e 's:/etc/chrony\.conf:/etc/chrony/chrony.conf:g' \ doc/* examples/* || die + + # Copy for potential user fixup + cp "${FILESDIR}"/chronyd.conf "$T"/chronyd.conf + + # Set config for privdrop + if ! use caps; then + sed -i \ + -e 's/-u ntp//' \ + "${T}"/chronyd.conf || die + fi } src_configure() { @@ -102,7 +113,7 @@ src_install() { default newinitd "${FILESDIR}"/chronyd.init-r2 chronyd - newconfd "${FILESDIR}"/chronyd.conf chronyd + newconfd "${T}"/chronyd.conf chronyd insinto /etc/${PN} newins examples/chrony.conf.example1 chrony.conf @@ -110,6 +121,8 @@ src_install() { docinto examples dodoc examples/*.example* + newtmpfiles - chronyd.conf <<<"d /run/chrony 0750 $(usex caps 'ntp ntp' 'root root')" + docinto html dodoc doc/*.html @@ -121,3 +134,13 @@ src_install() { systemd_dounit examples/{chronyd,chrony-wait}.service systemd_enable_ntpunit 50-chrony chronyd.service } + +pkg_preinst() { + if use caps && has_version net-misc/chrony[-caps]; then + elog "/run/chronyd needs ntp:ntp permissions; please check." + elog "The safest option is reboot, but you may chown manually." + elif ! use caps && has_version net-misc/chrony[caps]; then + elog "/run/chronyd needs root:root permissions; please check." + elog "The safest option is reboot, but you may chown manually." + fi +} |