KumiSystems/openwrtv3
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

lldpd: bump to v0.6.1, enable privilege separation and chrooting

Browse source 
SVN-Revision: 33729
This commit is contained in:
Jo-Philipp Wich 2012-10-12 11:58:19 +00:00
parent f248332d52
commit 0019b39001
4 changed files with 18 additions and 45 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
package/network/services/lldpd/Makefile
View file

@ -8,12 +8,12 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=lldpd
PKG_VERSION:=0.6.0
PKG_VERSION:=0.6.1
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=http://media.luffy.cx/files/lldpd
PKG_MD5SUM:=77279577e3b6d85a33dc0afe7c960b27
PKG_MD5SUM:=d2f9ae67e0bcce0206a3a501a81d0738
PKG_MAINTAINER:=Jo-Philipp Wich <jow@openwrt.org>
@ -43,8 +43,9 @@ endef
define Package/lldpd/install
$(INSTALL_DIR) $(1)/etc/init.d
$(INSTALL_DIR) $(1)/etc/config
$(INSTALL_DIR) $(1)/usr/sbin
$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/lldp{ctl,d} $(1)/usr/sbin/
$(INSTALL_DIR) $(1)/usr/lib $(1)/usr/sbin
$(CP) $(PKG_INSTALL_DIR)/usr/sbin/lldp{ctl,d} $(1)/usr/sbin/
$(CP) $(PKG_INSTALL_DIR)/usr/lib/liblldpctl.so* $(1)/usr/lib/
$(INSTALL_BIN) ./files/lldpd.init $(1)/etc/init.d/lldpd
$(INSTALL_DATA) ./files/lldpd.config $(1)/etc/config/lldpd
endef
@ -53,4 +54,9 @@ define Package/lldpd/conffiles
/etc/config/lldpd
endef
CONFIGURE_ARGS += \
--with-privsep-user=lldp \
--with-privsep-group=lldp \
--with-privsep-chroot=/var/run/lldp
$(eval $(call BuildPackage,lldpd))

7
package/network/services/lldpd/files/lldpd.init
View file

@ -26,6 +26,12 @@ start() {
[ $enable_sonmp -gt 0 ] && append args '-s'
[ $enable_edp -gt 0 ] && append args '-e'
user_exists lldp 121 || user_add lldp 121 129
group_exists lldp 129 || group_add lldp 129
mkdir -p /var/run/lldp
chown lldp:lldp /var/run/lldp
service_start /usr/sbin/lldpd $args \
${lldp_class:+ -M $lldp_class}
@ -37,4 +43,5 @@ start() {
stop() {
service_stop /usr/sbin/lldpd
rm -f /var/run/lldpd.socket /var/run/lldpd.pid
}

40
package/network/services/lldpd/patches/001-no-multiuser.patch
View file

@ -1,40 +0,0 @@
--- a/src/priv.c
+++ b/src/priv.c
@@ -518,12 +518,14 @@ priv_init(char *chrootdir)
fatal("[priv]: unable to create socket pair for privilege separation");
/* Get users */
+ /*
if ((user = getpwnam(PRIVSEP_USER)) == NULL)
fatal("[priv]: no " PRIVSEP_USER " user for privilege separation");
uid = user->pw_uid;
if ((group = getgrnam(PRIVSEP_GROUP)) == NULL)
fatal("[priv]: no " PRIVSEP_GROUP " group for privilege separation");
gid = group->gr_gid;
+ */
/* Spawn off monitor */
if ((monitored = fork()) < 0)
@@ -534,17 +536,17 @@ priv_init(char *chrootdir)
if (RUNNING_ON_VALGRIND)
LLOG_WARNX("[priv]: running on valgrind, keep privileges");
else {
- if (chroot(chrootdir) == -1)
- fatal("[priv]: unable to chroot");
- if (chdir("/") != 0)
+ /*if (chroot(chrootdir) == -1)
+ fatal("[priv]: unable to chroot");*/
+ if (chdir("/tmp") != 0)
fatal("[priv]: unable to chdir");
gidset[0] = gid;
- if (setresgid(gid, gid, gid) == -1)
+ /*if (setresgid(gid, gid, gid) == -1)
fatal("[priv]: setresgid() failed");
if (setgroups(1, gidset) == -1)
fatal("[priv]: setgroups() failed");
if (setresuid(uid, uid, uid) == -1)
- fatal("[priv]: setresuid() failed");
+ fatal("[priv]: setresuid() failed");*/
}
remote = pair[0];
close(pair[1]);

2
package/network/services/lldpd/patches/002-no-stack-protector.patch
View file

@ -1,6 +1,6 @@
--- a/configure.ac
+++ b/configure.ac
@@ -48,7 +48,6 @@ AX_CFLAGS_GCC_OPTION([-Wformat])
@@ -62,7 +62,6 @@ AX_CFLAGS_GCC_OPTION([-Wformat])
AX_CFLAGS_GCC_OPTION([-Wformat-security])
AX_CFLAGS_GCC_OPTION([-Wcast-align])
AX_CFLAGS_GCC_OPTION([-Winline])