mirror of
https://github.com/gentoo-mirror/guru.git
synced 2026-10-12 17:51:11 -04:00
net-*/*: stop exporting $pidfile in OpenRC service scripts (insecure)
Say it with me: the pidfile and its parent directories should only be writable by root unless you use supervise-daemon ;) With `checkpath -o someuser:someuser $pidfile` in start_pre(), it can cause DOS attacks because the now unprivelaged process can replace the pidfile with some other pid number in it like pid 1 and cause the host machine to crash when the daemon finally stops. Supervise-daemon can supervise without the daemon creating a pidfile so don't export the variable at all. That assumes the scripts *are* using supervise-daemon, if supervise-daemon fails to start (due to maybe some incorrect config option *wink wink*) then OpenRC falls back to the older start-stop-daemon and that *does* use the $pidfile. If thats the case then the daemon will simply fail to start (yes I haven't tested if any these packages work without $pidfile which they should since they are specifying `supervisor=supervise-daemon`). IMO failing to start is better than running in a potentially vulnerable configuration. Merges: https://codeberg.org/gentoo/guru/pulls/92 Part-off: https://codeberg.org/gentoo/guru/pulls/92 Signed-off-by: zyxhere💭 <zyx@envs.net>
This commit is contained in:
10 files changed
+541
No files matched your search
@@ -0,0 +1,20 @@
|
||||
#!/sbin/openrc-run
|
||||
# shellcheck shell=sh
|
||||
#
|
||||
# Copyright 1999-2026 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
description="Matrix-Signal puppeting bridge"
|
||||
supervisor="supervise-daemon"
|
||||
command="/usr/bin/mautrix-signal"
|
||||
command_args="-c ${MAUTRIX_SIGNAL_CONFIG} ${MAUTRIX_SIGNAL_OPTS}"
|
||||
command_user="mautrix-signal:mautrix"
|
||||
|
||||
depend() {
|
||||
need net
|
||||
use dns postgresql
|
||||
}
|
||||
|
||||
start_pre() {
|
||||
checkpath -d -o "${command_user}" /run/mautrix-signal
|
||||
}
|
||||
@@ -0,0 +1,95 @@
|
||||
# Copyright 2022-2026 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=8
|
||||
|
||||
inherit go-module systemd toolchain-funcs
|
||||
|
||||
MY_PV="0.$(ver_rs 1 '')"
|
||||
DESCRIPTION="Matrix-Signal puppeting bridge"
|
||||
HOMEPAGE="https://github.com/mautrix/signal"
|
||||
SRC_URI="https://github.com/mautrix/signal/archive/refs/tags/v${MY_PV}.tar.gz -> ${P}.tar.gz
|
||||
https://github.com/gentoo-golang-dist/signal/releases/download/v${MY_PV}/signal-${MY_PV}-vendor.tar.xz"
|
||||
S="${WORKDIR}/signal-${MY_PV}"
|
||||
|
||||
LICENSE="AGPL-3+"
|
||||
# Go dependency licenses
|
||||
LICENSE+=" AGPL-3 Apache-2.0 BSD GPL-3+ ISC MIT MPL-2.0 public-domain"
|
||||
SLOT="0"
|
||||
KEYWORDS="~amd64"
|
||||
|
||||
RDEPEND="
|
||||
acct-user/mautrix-signal
|
||||
dev-libs/olm
|
||||
virtual/zlib:=
|
||||
"
|
||||
DEPEND="${RDEPEND}
|
||||
~dev-libs/libsignal-ffi-0.87.5
|
||||
"
|
||||
|
||||
DOCS=( {CHANGELOG,README,ROADMAP}.md )
|
||||
|
||||
pkg_setup() {
|
||||
[[ ${MERGE_TYPE} == "binary" ]] && return 0
|
||||
|
||||
# https://github.com/mautrix/signal/issues/595
|
||||
tc-is-clang && die "Clang compiler is not supported"
|
||||
}
|
||||
|
||||
src_compile() {
|
||||
local MAUTRIX_VERSION=$(awk '/maunium\.net\/go\/mautrix / { print $2 }' go.mod)
|
||||
local BUILD_TIME=$(date -Iseconds)
|
||||
local go_ldflags=(
|
||||
-X "main.Tag=v${MY_PV}"
|
||||
-X "main.BuildTime=${BUILD_TIME}"
|
||||
-X "maunium.net/go/mautrix.GoModVersion=${MAUTRIX_VERSION}"
|
||||
)
|
||||
|
||||
ego build -ldflags "${go_ldflags[*]}" ./cmd/mautrix-signal
|
||||
}
|
||||
|
||||
src_install() {
|
||||
dobin mautrix-signal
|
||||
einstalldocs
|
||||
|
||||
newinitd "${FILESDIR}"/mautrix-signal.initd-r2 mautrix-signal
|
||||
newconfd "${FILESDIR}"/mautrix-signal.confd mautrix-signal
|
||||
systemd_dounit "${FILESDIR}"/mautrix-signal.service
|
||||
|
||||
local dir
|
||||
for dir in /var/log/mautrix /etc/mautrix; do
|
||||
keepdir "${dir}"
|
||||
fowners -R root:mautrix "${dir}"
|
||||
fperms 770 "${dir}"
|
||||
done
|
||||
|
||||
keepdir /var/lib/mautrix/signal
|
||||
fowners -R mautrix-signal:mautrix /var/lib/mautrix/signal
|
||||
}
|
||||
|
||||
src_test() {
|
||||
ego test -vet=off ./...
|
||||
}
|
||||
|
||||
pkg_postinst() {
|
||||
einfo
|
||||
elog "Before you can use mautrix-signal, you need to configure it correctly."
|
||||
elog "To generate the configuration file, use the following command:"
|
||||
elog " # runuser -u mautrix-signal -g mautrix -- mautrix-signal -c /etc/mautrix/mautrix_signal.yaml -e"
|
||||
elog
|
||||
elog "Configure the /etc/mautrix/mautrix_signal.yaml file according to your"
|
||||
elog "homeserver. When done, run the following command:"
|
||||
elog " # emerge --config ${CATEGORY}/${PN}"
|
||||
elog
|
||||
elog "Then, you need to register the bridge with your homeserver."
|
||||
elog "Refer your homeserver's documentation for instructions."
|
||||
elog "The registration file is located at /var/lib/mautrix/signal/registration.yaml"
|
||||
elog
|
||||
elog "Finally, you may start the mautrix-signal daemon."
|
||||
einfo
|
||||
}
|
||||
|
||||
pkg_config() {
|
||||
runuser -u mautrix-signal -g mautrix -- \
|
||||
mautrix-signal -c /etc/mautrix/mautrix_signal.yaml -g -r /var/lib/mautrix/signal/registration.yaml
|
||||
}
|
||||
@@ -0,0 +1,21 @@
|
||||
#!/sbin/openrc-run
|
||||
# shellcheck shell=sh
|
||||
#
|
||||
# Copyright 1999-2026 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
: "${supervisor:=supervise-daemon}"
|
||||
|
||||
description="Matrix-Telegram Messenger puppeting bridge"
|
||||
command="/usr/bin/mautrix-telegram"
|
||||
command_args="-c ${MAUTRIX_TELEGRAM_CONFIG:-/etc/mautrix/mautrix_telegram.yaml} ${MAUTRIX_TELEGRAM_OPTS}"
|
||||
command_user="mautrix-telegram:mautrix"
|
||||
|
||||
depend() {
|
||||
need net
|
||||
use dns postgresql
|
||||
}
|
||||
|
||||
start_pre() {
|
||||
checkpath -d -o "${command_user}" /run/mautrix-telegram
|
||||
}
|
||||
@@ -0,0 +1,114 @@
|
||||
# Copyright 2022-2026 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=8
|
||||
|
||||
inherit go-module optfeature systemd
|
||||
|
||||
MY_PV="0.$(ver_rs 1-2 '').0"
|
||||
DESCRIPTION="Matrix-Telegram puppeting bridge"
|
||||
HOMEPAGE="https://github.com/mautrix/telegram"
|
||||
SRC_URI="https://github.com/mautrix/telegram/archive/refs/tags/v${MY_PV}.tar.gz -> ${P}.tar.gz
|
||||
https://github.com/sysrq-golang-dist/${PN}/releases/download/v${MY_PV}/${PN}-${MY_PV}-deps.tar.xz"
|
||||
S="${WORKDIR}/telegram-${MY_PV}"
|
||||
|
||||
LICENSE="AGPL-3+"
|
||||
# Go dependency licenses
|
||||
LICENSE+=" Apache-2.0 BSD GPL-3+ ISC MIT MPL-2.0"
|
||||
SLOT="0"
|
||||
KEYWORDS="~amd64"
|
||||
IUSE="+crypt"
|
||||
|
||||
RDEPEND="
|
||||
acct-user/mautrix-telegram
|
||||
dev-db/sqlite:3
|
||||
media-libs/libwebp:=
|
||||
crypt? ( dev-libs/olm )
|
||||
"
|
||||
DEPEND="${RDEPEND}"
|
||||
BDEPEND="
|
||||
>=dev-lang/go-1.25.0
|
||||
virtual/pkgconfig
|
||||
"
|
||||
|
||||
DOCS=( {CHANGELOG,README,ROADMAP}.md )
|
||||
|
||||
src_configure() {
|
||||
default
|
||||
|
||||
# https://github.com/mattn/go-sqlite3#linux
|
||||
# -tags libsqlite3: use system sqlite3 instead of bundled
|
||||
GO_BUILD_TAGS="libsqlite3"
|
||||
use crypt || GO_BUILD_TAGS+=",nocrypto"
|
||||
}
|
||||
|
||||
src_prepare() {
|
||||
default
|
||||
|
||||
# unbundle libwebp
|
||||
cd "${GOMODCACHE}" || die
|
||||
rm go.mau.fi/webp@v0.3.0/z_*.c || die
|
||||
eapply "${FILESDIR}"/${PN}-26.07-unbundle-libwebp.patch
|
||||
}
|
||||
|
||||
src_compile() {
|
||||
local MAUTRIX_VERSION=$(awk '/maunium\.net\/go\/mautrix / { print $2 }' go.mod)
|
||||
local BUILD_TIME=$(date -Iseconds)
|
||||
local go_ldflags=(
|
||||
-X "main.Tag=v${MY_PV}"
|
||||
-X "main.Commit=unknown"
|
||||
-X "main.BuildTime=${BUILD_TIME}"
|
||||
-X "maunium.net/go/mautrix.GoModVersion=${MAUTRIX_VERSION}"
|
||||
)
|
||||
|
||||
ego build -tags "${GO_BUILD_TAGS}" -ldflags "${go_ldflags[*]}" ./cmd/mautrix-telegram
|
||||
}
|
||||
|
||||
src_test() {
|
||||
ego test -tags "${GO_BUILD_TAGS}" -vet=off \
|
||||
$(ego list ./... | grep -Fvx go.mau.fi/mautrix-telegram/pkg/gotd/tgerr)
|
||||
}
|
||||
|
||||
src_install() {
|
||||
dobin mautrix-telegram
|
||||
einstalldocs
|
||||
|
||||
newinitd "${FILESDIR}"/mautrix-telegram.initd-r3 mautrix-telegram
|
||||
newconfd "${FILESDIR}"/mautrix-telegram.confd mautrix-telegram
|
||||
systemd_newunit "${FILESDIR}"/mautrix-telegram.service-r1 mautrix-telegram.service
|
||||
|
||||
local dir
|
||||
for dir in /var/log/mautrix /etc/mautrix; do
|
||||
keepdir "${dir}"
|
||||
fowners -R root:mautrix "${dir}"
|
||||
fperms 770 "${dir}"
|
||||
done
|
||||
|
||||
keepdir /var/lib/mautrix/telegram
|
||||
fowners -R mautrix-telegram:mautrix /var/lib/mautrix/telegram
|
||||
}
|
||||
|
||||
pkg_postinst() {
|
||||
einfo
|
||||
elog "Before you can use mautrix-telegram, you need to configure it correctly."
|
||||
elog "To generate the configuration file, use the following command:"
|
||||
elog " # runuser -u mautrix-telegram -g mautrix -- mautrix-telegram -c /etc/mautrix/mautrix_telegram.yaml -e"
|
||||
elog
|
||||
elog "Configure the /etc/mautrix/mautrix_telegram.yaml file according to your"
|
||||
elog "homeserver. When done, run the following command:"
|
||||
elog " # emerge --config ${CATEGORY}/${PN}"
|
||||
elog
|
||||
elog "Then, you need to register the bridge with your homeserver."
|
||||
elog "Refer your homeserver's documentation for instructions."
|
||||
elog "The registration file is located at /var/lib/mautrix/telegram/registration.yaml"
|
||||
elog
|
||||
elog "Finally, you may start the mautrix-telegram daemon."
|
||||
einfo
|
||||
|
||||
optfeature "animated sticker support" "dev-util/lottieconverter media-video/ffmpeg[vpx,webp]"
|
||||
}
|
||||
|
||||
pkg_config() {
|
||||
runuser -u mautrix-telegram -g mautrix -- \
|
||||
mautrix-telegram -c /etc/mautrix/mautrix_telegram.yaml -g -r /var/lib/mautrix/telegram/registration.yaml
|
||||
}
|
||||
Reference in new issue
Block a user