mirror of
https://github.com/gentoo-mirror/guru.git
synced 2026-10-12 17:51:11 -04:00
zyxhere💭
3ed37b3ed5
Say it with me: the pidfile and its parent directories should only be writable by root unless you use supervise-daemon ;) With `checkpath -o someuser:someuser $pidfile` in start_pre(), it can cause DOS attacks because the now unprivelaged process can replace the pidfile with some other pid number in it like pid 1 and cause the host machine to crash when the daemon finally stops. Supervise-daemon can supervise without the daemon creating a pidfile so don't export the variable at all. That assumes the scripts *are* using supervise-daemon, if supervise-daemon fails to start (due to maybe some incorrect config option *wink wink*) then OpenRC falls back to the older start-stop-daemon and that *does* use the $pidfile. If thats the case then the daemon will simply fail to start (yes I haven't tested if any these packages work without $pidfile which they should since they are specifying `supervisor=supervise-daemon`). IMO failing to start is better than running in a potentially vulnerable configuration. Merges: https://codeberg.org/gentoo/guru/pulls/92 Part-off: https://codeberg.org/gentoo/guru/pulls/92 Signed-off-by: zyxhere💭 <zyx@envs.net>
61 lines
1.0 KiB
Bash
61 lines
1.0 KiB
Bash
# Copyright 2022-2026 Gentoo Authors
|
|
# Distributed under the terms of the GNU General Public License v2
|
|
|
|
EAPI=8
|
|
|
|
inherit edo toolchain-funcs
|
|
|
|
DESCRIPTION="Multi-client, TLS-only IRC bouncer"
|
|
HOMEPAGE="https://git.causal.agency/pounce/about/"
|
|
SRC_URI="https://git.causal.agency/${PN}/snapshot/${P}.tar.gz"
|
|
|
|
LICENSE="GPL-3"
|
|
SLOT="0"
|
|
KEYWORDS="~amd64"
|
|
IUSE="palaver"
|
|
|
|
DEPEND="
|
|
dev-libs/libretls:=
|
|
virtual/libcrypt:=
|
|
palaver? (
|
|
dev-db/sqlite:3
|
|
net-misc/curl
|
|
)
|
|
"
|
|
RDEPEND="${DEPEND}
|
|
acct-user/pounce
|
|
"
|
|
BDEPEND="virtual/pkgconfig"
|
|
|
|
DOCS=( {QUIRKS,README}.7 )
|
|
|
|
src_configure() {
|
|
tc-export CC
|
|
|
|
local confargs=(
|
|
--enable-notify
|
|
$(use_enable palaver)
|
|
|
|
--prefix="${EPREFIX}/usr"
|
|
--mandir="${EPREFIX}/usr/share/man"
|
|
)
|
|
|
|
# note: not an autoconf configure script
|
|
edo ./configure "${confargs[@]}"
|
|
}
|
|
|
|
src_compile() {
|
|
emake all
|
|
}
|
|
|
|
src_install() {
|
|
emake DESTDIR="${D}" install
|
|
einstalldocs
|
|
|
|
newinitd "${FILESDIR}"/pounce.initd-r2 pounce
|
|
newconfd "${FILESDIR}"/pounce.confd-r1 pounce
|
|
|
|
insinto /etc/pounce
|
|
doins "${FILESDIR}"/example.conf
|
|
}
|