net-*/*: stop exporting $pidfile in OpenRC service scripts (insecure)

Say it with me: the pidfile and its parent directories should
only be writable by root unless you use supervise-daemon ;)

With `checkpath -o someuser:someuser $pidfile` in start_pre(), it can
cause DOS attacks because the now unprivelaged process can replace the
pidfile with some other pid number in it like pid 1 and cause the host
machine to crash when the daemon finally stops. Supervise-daemon can
supervise without the daemon creating a pidfile so don't export the
variable at all.

That assumes the scripts *are* using supervise-daemon, if
supervise-daemon fails to start (due to maybe some incorrect config
option *wink wink*) then OpenRC falls back to the older
start-stop-daemon and that *does* use the $pidfile. If thats the case
then the daemon will simply fail to start (yes I haven't tested if any
these packages work without $pidfile which they should since they are
specifying `supervisor=supervise-daemon`).

IMO failing to start is better than running in a potentially vulnerable
configuration.

Merges: https://codeberg.org/gentoo/guru/pulls/92
Part-off: https://codeberg.org/gentoo/guru/pulls/92
Signed-off-by: zyxhere💭 <zyx@envs.net>

net-proxy/byedpi/byedpi-0.17.3-r1.ebuild

@@ -0,0 +1,45 @@
+# Copyright 2024-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit systemd toolchain-funcs
+
+DESCRIPTION="Bypass DPI SOCKS proxy"
+HOMEPAGE="https://github.com/hufrea/byedpi"
+
+if [[ ${PV} == *9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/hufrea/byedpi.git"
+else
+	SRC_URI="https://github.com/hufrea/${PN}/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~amd64"
+fi
+
+LICENSE="MIT"
+SLOT="0"
+
+RDEPEND="acct-user/byedpi"
+
+src_prepare() {
+	default
+
+	# respect optimization level
+	sed -i 's/ -O.\b/ /' Makefile || die
+}
+
+src_configure() {
+	tc-export CC
+}
+
+src_install() {
+	dobin ciadpi
+	einstalldocs
+
+	newinitd "${FILESDIR}"/byedpi.initd-r3 byedpi
+	newconfd "${FILESDIR}"/byedpi.confd byedpi
+	systemd_dounit dist/linux/byedpi.service
+
+	insinto /etc
+	doins dist/linux/byedpi.conf
+}

net-proxy/byedpi/files/byedpi.initd-r3

@@ -0,0 +1,31 @@
+#!/sbin/openrc-run
+# shellcheck shell=sh
+#
+# Copyright 2024-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+: "${BYEDPI_USER:=byedpi}"
+: "${BYEDPI_GROUP:=nobody}"
+
+: "${BYEDPI_BIND_IP:=0.0.0.0}"
+: "${BYEDPI_BIND_PORT:=1080}"
+: "${BYEDPI_OPTS:=--split 1 --disorder 3+s --mod-http=h,d --auto=torst --tlsrec 1+s}"
+
+description="Bypass DPI SOCKS proxy"
+supervisor="supervise-daemon"
+command="/usr/bin/ciadpi"
+pidfile="/run/byedpi/${RC_SVCNAME}.pid"
+command_user="${BYEDPI_USER}:${BYEDPI_GROUP}"
+command_args="--ip ${BYEDPI_BIND_IP} --port ${BYEDPI_BIND_PORT} ${BYEDPI_OPTS}"
+command_args_background="--daemon --pidfile ${pidfile}"
+output_logger="logger -p daemon.info -t byedpi --"
+error_logger="logger -p daemon.err -t byedpi --"
+
+depend() {
+	need net
+	use firewall logger
+}
+
+start_pre() {
+	checkpath -q -do "${BYEDPI_USER}":root /run/"${RC_SVCNAME}"
+}