replaced --with-gid/uid by --with-group/user
using named users, groups fixed capability dropping in pluto
This commit is contained in:
Martin Willi
+10
-10
@@ -31,14 +31,14 @@ defs.o: $(PLUTODIR)/defs.c $(PLUTODIR)/defs.h
|
||||
$(COMPILE) -c -o $@ $<
|
||||
|
||||
install-exec-local :
|
||||
test -e "$(DESTDIR)${sysconfdir}/ipsec.d" || $(MKDIR_P) "$(DESTDIR)$(sysconfdir)/ipsec.d"
|
||||
test -e "$(DESTDIR)${sysconfdir}/ipsec.d/cacerts" || $(MKDIR_P) "$(DESTDIR)$(sysconfdir)/ipsec.d/cacerts"
|
||||
test -e "$(DESTDIR)${sysconfdir}/ipsec.d/ocspcerts" || $(MKDIR_P) "$(DESTDIR)$(sysconfdir)/ipsec.d/ocspcerts"
|
||||
test -e "$(DESTDIR)${sysconfdir}/ipsec.d/certs" || $(MKDIR_P) "$(DESTDIR)$(sysconfdir)/ipsec.d/certs"
|
||||
test -e "$(DESTDIR)${sysconfdir}/ipsec.d/acerts" || $(MKDIR_P) "$(DESTDIR)$(sysconfdir)/ipsec.d/acerts"
|
||||
test -e "$(DESTDIR)${sysconfdir}/ipsec.d/aacerts" || $(MKDIR_P) "$(DESTDIR)$(sysconfdir)/ipsec.d/aacerts"
|
||||
test -e "$(DESTDIR)${sysconfdir}/ipsec.d/crls" || $(MKDIR_P) "$(DESTDIR)$(sysconfdir)/ipsec.d/crls"
|
||||
test -e "$(DESTDIR)${sysconfdir}/ipsec.d/reqs" || $(MKDIR_P) "$(DESTDIR)$(sysconfdir)/ipsec.d/reqs"
|
||||
test -e "$(DESTDIR)${sysconfdir}/ipsec.d/private" || $(MKDIR_P) -m 700 "$(DESTDIR)$(sysconfdir)/ipsec.d/private"
|
||||
test -e "$(DESTDIR)$(sysconfdir)/ipsec.conf" || $(INSTALL) -m 644 ipsec.conf $(DESTDIR)$(sysconfdir)/ipsec.conf
|
||||
test -e "$(DESTDIR)${sysconfdir}/ipsec.d" || $(INSTALL) -o ${ipsecuser} -g ${ipsecgroup} -d "$(DESTDIR)$(sysconfdir)/ipsec.d"
|
||||
test -e "$(DESTDIR)${sysconfdir}/ipsec.d/cacerts" || $(INSTALL) -o ${ipsecuser} -g ${ipsecgroup} -d "$(DESTDIR)$(sysconfdir)/ipsec.d/cacerts"
|
||||
test -e "$(DESTDIR)${sysconfdir}/ipsec.d/ocspcerts" || $(INSTALL) -o ${ipsecuser} -g ${ipsecgroup} -d "$(DESTDIR)$(sysconfdir)/ipsec.d/ocspcerts"
|
||||
test -e "$(DESTDIR)${sysconfdir}/ipsec.d/certs" || $(INSTALL) -o ${ipsecuser} -g ${ipsecgroup} -d "$(DESTDIR)$(sysconfdir)/ipsec.d/certs"
|
||||
test -e "$(DESTDIR)${sysconfdir}/ipsec.d/acerts" || $(INSTALL) -o ${ipsecuser} -g ${ipsecgroup} -d "$(DESTDIR)$(sysconfdir)/ipsec.d/acerts"
|
||||
test -e "$(DESTDIR)${sysconfdir}/ipsec.d/aacerts" || $(INSTALL) -o ${ipsecuser} -g ${ipsecgroup} -d "$(DESTDIR)$(sysconfdir)/ipsec.d/aacerts"
|
||||
test -e "$(DESTDIR)${sysconfdir}/ipsec.d/crls" || $(INSTALL) -o ${ipsecuser} -g ${ipsecgroup} -d "$(DESTDIR)$(sysconfdir)/ipsec.d/crls"
|
||||
test -e "$(DESTDIR)${sysconfdir}/ipsec.d/reqs" || $(INSTALL) -o ${ipsecuser} -g ${ipsecgroup} -d "$(DESTDIR)$(sysconfdir)/ipsec.d/reqs"
|
||||
test -e "$(DESTDIR)${sysconfdir}/ipsec.d/private" || $(INSTALL) -o ${ipsecuser} -g ${ipsecgroup} -d -m 750 "$(DESTDIR)$(sysconfdir)/ipsec.d/private"
|
||||
test -e "$(DESTDIR)$(sysconfdir)/ipsec.conf" || $(INSTALL) -o ${ipsecuser} -g ${ipsecgroup} -m 644 ipsec.conf $(DESTDIR)$(sysconfdir)/ipsec.conf
|
||||
|
||||
|
||||
@@ -103,8 +103,8 @@ starter_stop_charon (void)
|
||||
int
|
||||
starter_start_charon (starter_config_t *cfg, bool debug)
|
||||
{
|
||||
int pid, i;
|
||||
struct stat stb;
|
||||
int pid, i;
|
||||
char buffer[BUF_LEN];
|
||||
int argc = 1;
|
||||
char *arg[] = {
|
||||
@@ -159,34 +159,6 @@ starter_start_charon (starter_config_t *cfg, bool debug)
|
||||
unlink(CHARON_CTL_FILE);
|
||||
_stop_requested = 0;
|
||||
|
||||
/* if ipsec.secrets file is missing then generate RSA default key pair */
|
||||
if (stat(SECRETS_FILE, &stb) != 0)
|
||||
{
|
||||
mode_t oldmask;
|
||||
FILE *f;
|
||||
|
||||
plog("no %s file, generating RSA key", SECRETS_FILE);
|
||||
seteuid(IPSEC_UID);
|
||||
setegid(IPSEC_GID);
|
||||
system("ipsec scepclient --out pkcs1 --out cert-self --quiet");
|
||||
seteuid(0);
|
||||
setegid(0);
|
||||
|
||||
/* ipsec.secrets is root readable only */
|
||||
oldmask = umask(0066);
|
||||
|
||||
f = fopen(SECRETS_FILE, "w");
|
||||
if (f)
|
||||
{
|
||||
fprintf(f, "# /etc/ipsec.secrets - strongSwan IPsec secrets file\n");
|
||||
fprintf(f, "\n");
|
||||
fprintf(f, ": RSA myKey.der\n");
|
||||
fclose(f);
|
||||
}
|
||||
chown(SECRETS_FILE, IPSEC_UID, IPSEC_GID);
|
||||
umask(oldmask);
|
||||
}
|
||||
|
||||
pid = fork();
|
||||
switch (pid)
|
||||
{
|
||||
|
||||
@@ -106,8 +106,8 @@ starter_stop_pluto (void)
|
||||
int
|
||||
starter_start_pluto (starter_config_t *cfg, bool debug)
|
||||
{
|
||||
int i;
|
||||
struct stat stb;
|
||||
int i;
|
||||
pid_t pid;
|
||||
char **l;
|
||||
int argc = 2;
|
||||
@@ -218,34 +218,6 @@ starter_start_pluto (starter_config_t *cfg, bool debug)
|
||||
if (cfg->setup.prepluto)
|
||||
system(cfg->setup.prepluto);
|
||||
|
||||
/* if ipsec.secrets file is missing then generate RSA default key pair */
|
||||
if (stat(SECRETS_FILE, &stb) != 0)
|
||||
{
|
||||
mode_t oldmask;
|
||||
FILE *f;
|
||||
|
||||
plog("no %s file, generating RSA key", SECRETS_FILE);
|
||||
seteuid(IPSEC_UID);
|
||||
setegid(IPSEC_GID);
|
||||
system("ipsec scepclient --out pkcs1 --out cert-self --quiet");
|
||||
seteuid(0);
|
||||
setegid(0);
|
||||
|
||||
/* ipsec.secrets is root readable only */
|
||||
oldmask = umask(0066);
|
||||
|
||||
f = fopen(SECRETS_FILE, "w");
|
||||
if (f)
|
||||
{
|
||||
fprintf(f, "# /etc/ipsec.secrets - strongSwan IPsec secrets file\n");
|
||||
fprintf(f, "\n");
|
||||
fprintf(f, ": RSA myKey.der\n");
|
||||
fclose(f);
|
||||
}
|
||||
chown(SECRETS_FILE, IPSEC_UID, IPSEC_GID);
|
||||
umask(oldmask);
|
||||
}
|
||||
|
||||
pid = fork();
|
||||
switch (pid)
|
||||
{
|
||||
|
||||
@@ -26,6 +26,8 @@
|
||||
#include <string.h>
|
||||
#include <errno.h>
|
||||
#include <fcntl.h>
|
||||
#include <pwd.h>
|
||||
#include <grp.h>
|
||||
|
||||
#include <freeswan.h>
|
||||
|
||||
@@ -139,6 +141,64 @@ fsig(int signal)
|
||||
}
|
||||
}
|
||||
|
||||
static void generate_selfcert()
|
||||
{
|
||||
struct stat stb;
|
||||
|
||||
/* if ipsec.secrets file is missing then generate RSA default key pair */
|
||||
if (stat(SECRETS_FILE, &stb) != 0)
|
||||
{
|
||||
mode_t oldmask;
|
||||
FILE *f;
|
||||
uid_t uid = 0;
|
||||
gid_t gid = 0;
|
||||
|
||||
#ifdef IPSEC_GROUP
|
||||
{
|
||||
char buf[1024];
|
||||
struct group group, *grp;
|
||||
|
||||
if (getgrnam_r(IPSEC_GROUP, &group, buf, sizeof(buf), &grp) == 0 &&
|
||||
grp)
|
||||
{
|
||||
gid = grp->gr_gid;
|
||||
}
|
||||
}
|
||||
#endif
|
||||
#ifdef IPSEC_USER
|
||||
{
|
||||
char buf[1024];
|
||||
struct passwd passwd, *pwp;
|
||||
|
||||
if (getpwnam_r(IPSEC_USER, &passwd, buf, sizeof(buf), &pwp) == 0 &&
|
||||
pwp)
|
||||
{
|
||||
uid = pwp->pw_uid;
|
||||
}
|
||||
}
|
||||
#endif
|
||||
setegid(gid);
|
||||
seteuid(uid);
|
||||
system("ipsec scepclient --out pkcs1 --out cert-self --quiet");
|
||||
seteuid(0);
|
||||
setegid(0);
|
||||
|
||||
/* ipsec.secrets is root readable only */
|
||||
oldmask = umask(0066);
|
||||
|
||||
f = fopen(SECRETS_FILE, "w");
|
||||
if (f)
|
||||
{
|
||||
fprintf(f, "# /etc/ipsec.secrets - strongSwan IPsec secrets file\n");
|
||||
fprintf(f, "\n");
|
||||
fprintf(f, ": RSA myKey.der\n");
|
||||
fclose(f);
|
||||
}
|
||||
chown(SECRETS_FILE, uid, gid);
|
||||
umask(oldmask);
|
||||
}
|
||||
}
|
||||
|
||||
static void
|
||||
usage(char *name)
|
||||
{
|
||||
@@ -274,6 +334,8 @@ int main (int argc, char **argv)
|
||||
plog("starter is already running (%s exists) -- no fork done", STARTER_PID_FILE);
|
||||
exit(LSB_RC_SUCCESS);
|
||||
}
|
||||
|
||||
generate_selfcert();
|
||||
|
||||
/* fork if we're not debugging stuff */
|
||||
if (!no_fork)
|
||||
|
||||
Reference in New Issue
Block a user