denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

replaced --with-gid/uid by --with-group/user

Browse Source 
using named users, groups
fixed capability dropping in pluto
This commit is contained in:
Martin Willi
2008-05-08 10:58:04 +00:00
parent 97e820f5fd
commit 25b12c696b
12 changed files with 190 additions and 97 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/starter/invokepluto.c
+1 -29
View File
@@ -106,8 +106,8 @@ starter_stop_pluto (void)
int
starter_start_pluto (starter_config_t *cfg, bool debug)
{
int i;
struct stat stb;
int i;
pid_t pid;
char **l;
int argc = 2;
@@ -218,34 +218,6 @@ starter_start_pluto (starter_config_t *cfg, bool debug)
if (cfg->setup.prepluto)
system(cfg->setup.prepluto);
/* if ipsec.secrets file is missing then generate RSA default key pair */
if (stat(SECRETS_FILE, &stb) != 0)
{
mode_t oldmask;
FILE *f;
plog("no %s file, generating RSA key", SECRETS_FILE);
seteuid(IPSEC_UID);
setegid(IPSEC_GID);
system("ipsec scepclient --out pkcs1 --out cert-self --quiet");
seteuid(0);
setegid(0);
/* ipsec.secrets is root readable only */
oldmask = umask(0066);
f = fopen(SECRETS_FILE, "w");
if (f)
{
fprintf(f, "# /etc/ipsec.secrets - strongSwan IPsec secrets file\n");
fprintf(f, "\n");
fprintf(f, ": RSA myKey.der\n");
fclose(f);
}
chown(SECRETS_FILE, IPSEC_UID, IPSEC_GID);
umask(oldmask);
}
pid = fork();
switch (pid)
{