KumiSystems/openwrtv3
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

dnsmasq: run as dedicated UID/GID

Browse source 
Running dnsmasq in a dedicated user/group allows matching its outgoing
traffic more easily using iptables' owner match.
Add UID/GID to the package metadata and append the user/group
parameters to the init script.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

SVN-Revision: 49252
This commit is contained in:
John Crispin 2016-04-26 11:44:10 +00:00
parent 1a1bb3aaff
commit 3481d0d793
2 changed files with 5 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
package/network/services/dnsmasq/Makefile
View file

@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=dnsmasq PKG_NAME:=dnsmasq
PKG_VERSION:=2.75 PKG_VERSION:=2.75
PKG_RELEASE:=6 PKG_RELEASE:=7
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
PKG_SOURCE_URL:=http://thekelleys.org.uk/dnsmasq PKG_SOURCE_URL:=http://thekelleys.org.uk/dnsmasq
@ -34,6 +34,7 @@ define Package/dnsmasq/Default
CATEGORY:=Base system CATEGORY:=Base system
TITLE:=DNS and DHCP server TITLE:=DNS and DHCP server
URL:=http://www.thekelleys.org.uk/dnsmasq/ URL:=http://www.thekelleys.org.uk/dnsmasq/
USERID:=dnsmasq=453:dnsmasq=453
endef endef
define Package/dnsmasq define Package/dnsmasq

4
package/network/services/dnsmasq/files/dnsmasq.init
View file

@ -218,6 +218,8 @@ dnsmasq() {
mkdir -p /tmp/hosts /tmp/dnsmasq.d mkdir -p /tmp/hosts /tmp/dnsmasq.d
xappend "--addn-hosts=/tmp/hosts" xappend "--addn-hosts=/tmp/hosts"
xappend "--conf-dir=/tmp/dnsmasq.d" xappend "--conf-dir=/tmp/dnsmasq.d"
xappend "--user=dnsmasq"
xappend "--group=dnsmasq"
echo >> $CONFIGFILE echo >> $CONFIGFILE
@ -592,7 +594,7 @@ start_service() {
if [ ! -f "$TIMESTAMPFILE" ]; then if [ ! -f "$TIMESTAMPFILE" ]; then
touch "$TIMESTAMPFILE" touch "$TIMESTAMPFILE"
chown nobody.nogroup "$TIMESTAMPFILE" chown dnsmasq.dnsmasq "$TIMESTAMPFILE"
fi fi
echo "# auto-generated config file from /etc/config/dhcp" > $CONFIGFILE echo "# auto-generated config file from /etc/config/dhcp" > $CONFIGFILE