Development March 2023

development@lists.ipfire.org

11 participants
72 discussions

Re: IPFire 2.27 - Core Update 164 is available for testing
by Adolf Belka 28 May '24

28 May '24

Hi All, Just tested out CU164 on my vm testbed system. The update went without any problems. You see the pakfire log status again on the wui page during the update. OpenVPN RW setup ran without any issues. Connection successfully made. IPS has the multiple providers option successfully in place. I eventually found the Force Update of rules button, which was very useful for my vm testbed as it is not running all the time and so the rules were a bit out of date. As far as I can tell everything is working fine on it. No issues detected. I will let it run over the next few days during the daytime and see how things go. Regards, Adolf. On 20/02/2022 18:35, IPFire Project wrote: > IPFire Logo > > there is a new post from Michael Tremer on the IPFire Blog: > > *IPFire 2.27 - Core Update 164 is available for testing* > > It is time to test another release for IPFire: IPFire 2.27 - Core Update 164. It comes with a vastly improved firewall engine, a new kernel and various security and bug fixes. Please help us testing this release and if you would like to support us, please donate. > > Click Here To Read More <https://blog.ipfire.org/post/ipfire-2-27-core-update-164-is-available-for-t…> > > The IPFire Project > Don't like these emails? Unsubscribe <https://people.ipfire.org/unsubscribe>. >

4 8

[PATCH] squid-asnbl: Fix for bug#13023 - squid-asnbl-helper segfaulting and shutdown squid
by Adolf Belka 01 Jul '23

01 Jul '23

- Patch provided by bug reporter. Here is the description of the problem from the bug. First I discovered that the helper only sometimes throwing the error and quits even for the same values and queries. Also the timespan until the error happens was quite different for every restart of squid (minutes to hours). And it does not depend on the traffic on the proxy, even one connection could cause a crash while ten or hundrets won't. After a few days of testing different solutions and done a lot of debugging, redesigning the function did not fully solve the problem. Such standard things like checking the result variable for NULL (or it's equivalent "is None" in python) before evaluating it's subfunction produces the exact same error message. But with that knowledge it more and more turns out that python3 sometimes 'detects' the local return variable if it was a misused global. So for a full fix, the return variable also has to be initialized that python3 won't detect it's usage as an 'UnboundLocalError' to succesfully fix this bug. - LFS file updated to run patch before copying helper into place. - Update of rootfile not needed. - Bug reporter has been requested to raise this issue at the git repo for squid-asnbl. Fixes: Bug#13023 Tested-by: Nicolas Pӧhlmann <business(a)hardcoretec.com> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/squid-asnbl | 1 + ...les_to_make_compatible_with_python_3.patch | 100 ++++++++++++++++++ 2 files changed, 101 insertions(+) create mode 100644 src/patches/squid/squid-asnbl-0.2.4_initialise_global_variables_to_make_compatible_with_python_3.patch diff --git a/lfs/squid-asnbl b/lfs/squid-asnbl index 130b28460..b003d605b 100644 --- a/lfs/squid-asnbl +++ b/lfs/squid-asnbl @@ -75,6 +75,7 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zvxf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/squid/squid-asnbl-0.2.4_initialise_global_variables_to_make_compatible_with_python_3.patch # Install ASNBL helper script cd $(DIR_APP) && install -o root -g root -m 0755 asnbl-helper.py /usr/bin/asnbl-helper.py diff --git a/src/patches/squid/squid-asnbl-0.2.4_initialise_global_variables_to_make_compatible_with_python_3.patch b/src/patches/squid/squid-asnbl-0.2.4_initialise_global_variables_to_make_compatible_with_python_3.patch new file mode 100644 index 000000000..e540d4e76 --- /dev/null +++ b/src/patches/squid/squid-asnbl-0.2.4_initialise_global_variables_to_make_compatible_with_python_3.patch @@ -0,0 +1,100 @@ +--- squid-asnbl-0.2.4/asnbl-helper_orig.py ++++ squid-asnbl-0.2.4/asnbl-helper.py +@@ -172,17 +172,19 @@ + return parsedasns + + +-def resolve_asn(ipaddr: str, asndb): +- """ Function call: resolve_asn(IP address to be resolved, +- ASN database instance object) +- This function looks up the Autonomous System for the given IP address. It expects +- an IPFire location database object to be passed as a second parameter, hence relying +- on another function to set that up. """ ++def resolve_asn(ipaddr: str): ++ """ Function call: resolve_asn(IP address to be resolved) ++ This function looks up the Autonomous System for the given IP address. """ ++ ++ # Fix for #13023 ++ # Initialize the result variable before it's first use, otherwise python3 ++ # will sometimes detect a 'mismatch' using global and local variables ++ lookup_result = None + + # libloc cannot handle ipaddress objects here, so casting into a string is necessary + # for good measure, to avoid exceptions here... + try: +- result = asndb.lookup(str(ipaddr)) ++ lookup_result = ASNDB.lookup(str(ipaddr)) + except BlockingIOError: + # XXX: Prevent likely libloc bug from causing this helper to crash + # (see upstream bug https://bugzilla.ipfire.org/show_bug.cgi?id=13023) +@@ -190,21 +192,25 @@ + + # In case nothing was returned above, satisfy result expectation to this function... + try: +- if not result.asn: ++ if not lookup_result.asn: + return 0 + except AttributeError: + return 0 + +- return result.asn +- +- +-def asndb_response_tests(testdata: str, asndb): +- """ Function call: asndb_response_tests(response rest data, +- ASN database instance object) ++ return lookup_result.asn ++ ++ ++def asndb_response_tests(testdata: str): ++ """ Function call: asndb_response_tests(response rest data) + + This function asserts the given ASN database to return expected ASNs for + given IP addresses in order to be considered operational. It returns + True if this test succeeds, and False otherwise. """ ++ ++ # Fix for #13023 ++ # Initialize the result variable before it's first use, otherwise python3 ++ # will sometimes detect a 'mismatch' using global and local variables ++ lookup_result_test = None + + tresult = True + +@@ -216,13 +222,13 @@ + + for stestdata in ptdata: + LOGIT.debug("Running response test for '%s' against ASNDB '%s' ...", +- stestdata, asndb) +- +- returndata = resolve_asn(stestdata[0], asndb) +- +- if returndata != int(stestdata[1]): ++ stestdata, ASNDB) ++ ++ lookup_result_test = resolve_asn(stestdata[0]) ++ ++ if lookup_result_test != int(stestdata[1]): + LOGIT.error("Response test failed for ASNDB '%s' (tuple: %s), aborting", +- asndb, stestdata) ++ ASNDB, stestdata) + tresult = False + break + +@@ -428,7 +434,7 @@ + ASNDB = set_up_location_database(config["GENERAL"]["ASNDB_PATH"]) + + LOGIT.debug("Running ASN database response tests...") +-if asndb_response_tests(config["GENERAL"]["TESTDATA"], ASNDB): ++if asndb_response_tests(config["GENERAL"]["TESTDATA"]): + LOGIT.debug("ASN database operational - excellent. Waiting for input...") + else: + LOGIT.error("ASN database response tests failed, aborting") +@@ -490,7 +496,7 @@ + ASNS = [] + for singleip in IPS: + # Enumerate ASN for this IP address... +- resolvedasn = resolve_asn(singleip, ASNDB) ++ resolvedasn = resolve_asn(singleip) + + # In case protection against destinations without public AS announcements for their + # IP addresses is desired, the query will be denied in case ASN = 0 appears in an -- 2.39.2

2 3

[PATCH] libcap: Update to version 2.67
by Adolf Belka 18 Apr '23

18 Apr '23

- Update from version 2.66 to 2.67 - Update of rootfile - Changelog Release notes for 2.67 Replace use of fgrep with grep -F (POSIX grep flags preferred by GNU grep) - patch from David Seifert. Added SPDX identifiers to License file(s). Hopefully this will help the various robots out there correctly identify the longstanding licenses for libcap and friends. (Bug: 216609 reported by Günther Noack) Started down the rabbit hole of trying to address (Bug: 216610 reported by Günther Noack on behalf of Michael Stapelberg) The basic issue is how to link C code with Go psx without using CGo. This is all a low level hackery. If you are interested, browse the source. Correct for bad whatis entries in man pages (this was throwing a Debian build test, detail) Also reviewed man pages and addressed cross linkage issues (Bug: 216585) Cleaned up some README.md files (made a github mirror now just so I can automatically render them). Changed meaning of DYNAMIC=no builds. This now builds everything with static linking except for libc. The reason for this exception is explained in the commit message. Inserted demonstration exploit code in capso.so to support article. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/libcap | 9 +++++++-- lfs/libcap | 8 ++++---- 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/config/rootfiles/common/libcap b/config/rootfiles/common/libcap index f0518d6aa..194fc7f19 100644 --- a/config/rootfiles/common/libcap +++ b/config/rootfiles/common/libcap @@ -1,8 +1,8 @@ lib/libcap.so.2 -lib/libcap.so.2.66 +lib/libcap.so.2.67 #lib/libpsx.so #lib/libpsx.so.2 -lib/libpsx.so.2.66 +lib/libpsx.so.2.67 #lib/pkgconfig/libcap.pc #lib/pkgconfig/libpsx.pc lib/security/pam_cap.so @@ -32,6 +32,7 @@ usr/lib/libcap.so #usr/share/man/man3/cap_get_file.3 #usr/share/man/man3/cap_get_flag.3 #usr/share/man/man3/cap_get_mode.3 +#usr/share/man/man3/cap_get_nsowner.3 #usr/share/man/man3/cap_get_pid.3 #usr/share/man/man3/cap_get_proc.3 #usr/share/man/man3/cap_get_secbits.3 @@ -59,10 +60,14 @@ usr/lib/libcap.so #usr/share/man/man3/cap_mode.3 #usr/share/man/man3/cap_mode_name.3 #usr/share/man/man3/cap_new_launcher.3 +#usr/share/man/man3/cap_prctl.3 +#usr/share/man/man3/cap_prctlw.3 +#usr/share/man/man3/cap_proc_root.3 #usr/share/man/man3/cap_set_fd.3 #usr/share/man/man3/cap_set_file.3 #usr/share/man/man3/cap_set_flag.3 #usr/share/man/man3/cap_set_mode.3 +#usr/share/man/man3/cap_set_nsowner.3 #usr/share/man/man3/cap_set_proc.3 #usr/share/man/man3/cap_set_secbits.3 #usr/share/man/man3/cap_setgroups.3 diff --git a/lfs/libcap b/lfs/libcap index f81b13c99..9eab679ff 100644 --- a/lfs/libcap +++ b/lfs/libcap @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2022 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.66 +VER = 2.67 THISAPP = libcap-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = e79bf10c6a3dbffe96dc97aad0bed67caa0b3805d9dcaff1e4a8a833396ee5c6da4f7f0d321b254e99a00073bc39021b9f3a4b350d93094d0df4d74889b3ca56 +$(DL_FILE)_BLAKE2 = bd9be22e439397a3c1726093cfee2410df93773b3139d50a1cdc10daecb666ddb9b64daded6e0ec9f2fd6defd16ea156dbd66bd55360ea266131f31ea0f0e989 install : $(TARGET) @@ -75,7 +75,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && make GOLANG=no cd $(DIR_APP) && make install GOLANG=no rm -vf /lib/libcap.so - ln -svf /lib/libcap.so.2.66 /usr/lib/libcap.so + ln -svf /lib/libcap.so.2.67 /usr/lib/libcap.so chmod +x /lib/libcap.so.* @rm -rf $(DIR_APP) @$(POSTBUILD) -- 2.40.0

2 5

[PATCH] addon rsnapshot
by Gerd Hoerst 05 Apr '23

05 Apr '23

Signed-off-by: Gerd Hoerst <gerd(a)hoerst.net> --- config/rootfiles/packages/rsnapshot | 6 ++ lfs/rsnapshot | 86 +++++++++++++++++++++++++++++ make.sh | 1 + src/paks/rsnapshot/install.sh | 27 +++++++++ src/paks/rsnapshot/uninstall.sh | 26 +++++++++ src/paks/rsnapshot/update.sh | 26 +++++++++ 6 files changed, 172 insertions(+) create mode 100644 config/rootfiles/packages/rsnapshot create mode 100644 lfs/rsnapshot create mode 100644 src/paks/rsnapshot/install.sh create mode 100644 src/paks/rsnapshot/uninstall.sh create mode 100644 src/paks/rsnapshot/update.sh diff --git a/config/rootfiles/packages/rsnapshot b/config/rootfiles/packages/rsnapshot new file mode 100644 index 000000000..023498e2c --- /dev/null +++ b/config/rootfiles/packages/rsnapshot @@ -0,0 +1,6 @@ +usr/bin/rsnapshot +usr/bin/rsnapshot-diff +etc/rsnapshot.conf +#etc/rsnapshot.conf.default +#usr/share/man/man1/rsnapshot-diff.1 +#usr/share/man/man1/rsnapshot.1 diff --git a/lfs/rsnapshot b/lfs/rsnapshot new file mode 100644 index 000000000..0445471be --- /dev/null +++ b/lfs/rsnapshot @@ -0,0 +1,86 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +############################################################################### +# Definitions +############################################################################### + +include Config + +VER = 1.4.5 + +THISAPP = rsnapshot-$(VER) +DL_FILE = $(THISAPP).tar.gz +DL_FROM = https://github.com/rsnapshot/rsnapshot/releases/download/1.4.5 +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP) +PROG = rsnapshot +PAK_VER = 1 +DEPS = "rsync" +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_BLAKE2 = 2a668aa16991b2b4e611c6204cdcd0e8c9593e5f0af5ea89e787a578e73b6f5987514cd7d0252bb78aea1b157ef85aea947686111ca9e3befdb2a8cef0aa9ecd + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) +b2 : $(subst %,%_BLAKE2,$(objects)) + +dist: + @$(PAK) +############################################################################### +# Downloading, checking, md5sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_MD5,$(objects)) : + @$(MD5) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && \ + ./configure \ + --prefix=/usr \ + --sysconfdir=/etc \ + --bindir=/usr/bin \ + + cd $(DIR_APP) && make $(MAKETUNING) + cd $(DIR_APP) && make install + cp -avfr $(DIR_CONF)/$(PROG)/* / + @rm -rf $(DIR_APP) + @$(POSTBUILD) diff --git a/make.sh b/make.sh index 3b7f9850c..59d2971da 100755 --- a/make.sh +++ b/make.sh @@ -1478,6 +1478,7 @@ buildipfire() { lfsmake2 libmpeg2 lfsmake2 gnump3d lfsmake2 rsync + lfsmake2 rsnapshot lfsmake2 rpcbind lfsmake2 keyutils lfsmake2 nfs diff --git a/src/paks/rsnapshot/install.sh b/src/paks/rsnapshot/install.sh new file mode 100644 index 000000000..9aafb0d56 --- /dev/null +++ b/src/paks/rsnapshot/install.sh @@ -0,0 +1,27 @@ +#!/bin/bash +############################################################################ +# # +# This file is part of the IPFire Firewall. # +# # +# IPFire is free software; you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation; either version 2 of the License, or # +# (at your option) any later version. # +# # +# IPFire is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with IPFire; if not, write to the Free Software # +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # +# # +# Copyright (C) 2007 IPFire-Team <info(a)ipfire.org>. # +# # +############################################################################ +# +. /opt/pakfire/lib/functions.sh + +extract_files +restore_backup ${NAME} diff --git a/src/paks/rsnapshot/uninstall.sh b/src/paks/rsnapshot/uninstall.sh new file mode 100644 index 000000000..66f4344eb --- /dev/null +++ b/src/paks/rsnapshot/uninstall.sh @@ -0,0 +1,26 @@ +#!/bin/bash +############################################################################ +# # +# This file is part of the IPFire Firewall. # +# # +# IPFire is free software; you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation; either version 2 of the License, or # +# (at your option) any later version. # +# # +# IPFire is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with IPFire; if not, write to the Free Software # +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # +# # +# Copyright (C) 2007 IPFire-Team <info(a)ipfire.org>. # +# # +############################################################################ +# +. /opt/pakfire/lib/functions.sh +make_backup ${NAME} +remove_files diff --git a/src/paks/rsnapshot/update.sh b/src/paks/rsnapshot/update.sh new file mode 100644 index 000000000..89c40d0d7 --- /dev/null +++ b/src/paks/rsnapshot/update.sh @@ -0,0 +1,26 @@ +#!/bin/bash +############################################################################ +# # +# This file is part of the IPFire Firewall. # +# # +# IPFire is free software; you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation; either version 2 of the License, or # +# (at your option) any later version. # +# # +# IPFire is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with IPFire; if not, write to the Free Software # +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # +# # +# Copyright (C) 2007 IPFire-Team <info(a)ipfire.org>. # +# # +############################################################################ +# +. /opt/pakfire/lib/functions.sh +./uninstall.sh +./install.sh -- 2.25.1

3 5

Zabbix addon
by Adolf Belka 30 Mar '23

30 Mar '23

Hi Robin, I have noticed that the zabbix_agentd addon is at 6.0.6 (LTS) but the LTS branch is now at 6.0.14 Could you look at doing an update patch for it. Regards, Adolf.

2 2

Fresh Install of CU174 Testing from iso gives "No bootable medium found!" message.
by Adolf Belka 29 Mar '23

29 Mar '23

Hi everyone, I needed to do an install of CU174 Testing and after pressing Reboot I got the following message:- No bootable medium found! Please insert a bootable medium and reboot. Raised a bug for this #13073 Regards, Adolf.

1 0

[PATCH] setup: Use systemd sysusers mechanism to create users/groups
by Stefan Schantl 29 Mar '23

29 Mar '23

The sysusers files will be generated by the corresponding script file, based on the passwd and group file in the source directory. So we easily can edit the files stored in git and the changes will be taken. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- dbus/dbus.sysusers | 7 +++++++ setup/generate-sysusers-fragments.sh | 31 ++++++++++++++++++++++++++++ setup/setup.nm | 7 ++++++- 3 files changed, 44 insertions(+), 1 deletion(-) create mode 100644 dbus/dbus.sysusers create mode 100755 setup/generate-sysusers-fragments.sh diff --git a/dbus/dbus.sysusers b/dbus/dbus.sysusers new file mode 100644 index 000000000..2ed994442 --- /dev/null +++ b/dbus/dbus.sysusers @@ -0,0 +1,7 @@ +#Type Name ID REMARK Home directory Shell + +# Dbus group +g dbus 61 + +# Dbus user +u dbus 61 "User for dbus service" / /usr/sbin/nologin diff --git a/setup/generate-sysusers-fragments.sh b/setup/generate-sysusers-fragments.sh new file mode 100755 index 000000000..194c7204b --- /dev/null +++ b/setup/generate-sysusers-fragments.sh @@ -0,0 +1,31 @@ +#!/usr/bin/env bash +#SPDX-License-Identifier: 0BSD + +set -euo pipefail + +test -f group +test -f passwd + +mkdir -p sysusers.d + +while read -r line; do + groupname=$(echo "${line}" | cut -d: -f1) + gid=$(echo "${line}" | cut -d: -f3) + echo "g ${groupname} ${gid}" +done <group >sysusers.d/20-setup-groups.conf + +while read -r line; do + username=$(echo "${line}" | cut -d: -f1) + uid=$(echo "${line}" | cut -d: -f3) + gid=$(echo "${line}" | cut -d: -f4) + gecos=$(echo "${line}" | cut -d: -f5) + homedir=$(echo "${line}" | cut -d: -f6) + if [ "${homedir}" == "/" ]; then + homedir="-" + fi + shell=$(echo "${line}" | cut -d: -f7) + if [ "${shell}" == "/usr/sbin/nologin" ]; then + shell="-" + fi + echo "u ${username} ${uid}:${gid} \"${gecos}\" ${homedir} ${shell}" +done <passwd >sysusers.d/20-setup-users.conf diff --git a/setup/setup.nm b/setup/setup.nm index cee66fab4..d4fd041ec 100644 --- a/setup/setup.nm +++ b/setup/setup.nm @@ -5,7 +5,7 @@ name = setup version = 3.0 -release = 18 +release = 19 arch = noarch groups = Base Build System/Base @@ -29,6 +29,7 @@ build end build + bash ./generate-sysusers-fragments.sh bash ./shadowconvert.sh end @@ -69,6 +70,10 @@ build echo "d /run/motd.d 0755 root root -" >> %{BUILDROOT}%{tmpfilesdir}/%{name}.conf chmod 0644 %{BUILDROOT}%{tmpfilesdir}/%{name}.conf + # Install generated sysusers files. + mkdir -pv %{BUILDROOT}%{sysusersdir} + install -v -m 0644 %{DIR_APP}/sysusers.d/*.conf %{BUILDROOT}%{sysusersdir} + mkdir -pv %{BUILDROOT}%{sysconfdir}/sysctl.d install -m 644 %{DIR_APP}/sysctl/printk.conf \ %{BUILDROOT}%{sysconfdir}/sysctl.d/printk.conf -- 2.30.2

1 0

[PATCH 1/2] dbus-broker: Do not longer create user/group
by Stefan Schantl 29 Mar '23

29 Mar '23

The dbus user and group will be created by the dbus-common packge which is a dependency of dbus-brocker. So no need for trying to doubble create them. --- dbus-broker/dbus-broker.nm | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) diff --git a/dbus-broker/dbus-broker.nm b/dbus-broker/dbus-broker.nm index a65a1e0d6..5a33f4ad7 100644 --- a/dbus-broker/dbus-broker.nm +++ b/dbus-broker/dbus-broker.nm @@ -5,7 +5,7 @@ name = dbus-broker version = 32 -release = 1 +release = 2 maintainer = Stefan Schantl <stefan.schantl(a)ipfire.org> groups = System/Daemons @@ -58,16 +58,6 @@ packages dbus-common end - prerequires += shadow-utils - - script prein - getent group dbus >/dev/null || groupadd -r dbus - getent passwd dbus >/dev/null || \ - useradd -r -g dbus -d / -s /sbin/nologin \ - -c "User for dbus service" dbus - exit 0 - end - # Just search for new unit files that were just installed. script postin systemctl daemon-reload >/dev/null 2>&1 || : -- 2.30.2

1 1

[PATCH] man-db: Use sysusers mechanism for user/group creation
by Stefan Schantl 29 Mar '23

29 Mar '23

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- man-db/man-db.nm | 20 ++++++++------------ man-db/man-db.sysusers | 6 ++++++ 2 files changed, 14 insertions(+), 12 deletions(-) create mode 100644 man-db/man-db.sysusers diff --git a/man-db/man-db.nm b/man-db/man-db.nm index 5d3240537..1f46ca8f0 100644 --- a/man-db/man-db.nm +++ b/man-db/man-db.nm @@ -5,7 +5,7 @@ name = man-db version = 2.11.2 -release = 1 +release = 2 groups = Documentation url = http://savannah.nongnu.org/projects/man-db @@ -13,9 +13,9 @@ license = GPL summary = man-db is an on-line manual database. description - man-db is an implementation of the standard Unix documentation \ - system accessed using the man command. It uses a Berkeley DB database \ - in place of the traditional flat-text whatis databases. man-db is \ + man-db is an implementation of the standard Unix documentation + system accessed using the man command. It uses a Berkeley DB database + in place of the traditional flat-text whatis databases. man-db is used by several popular GNU/Linux distributions. end @@ -28,6 +28,7 @@ build groff less libpipeline-devel >= 1.5.0 + systemd-basetools systemd-devel zlib-devel end @@ -54,14 +55,13 @@ build mkdir -pv %{BUILDROOT}/var/cache/man # Own the cache directory to the man user/group. - chown man:man %{BUILDROOT}/var/cache/man + chown -v man:man %{BUILDROOT}/var/cache/man end end create_user - getent group man >/dev/null || groupadd -r -g 15 man - getent passwd man >/dev/null || useradd -r -g 15 \ - -c "Manpage cache user" -d /var/cache/man -s /sbin/nologin man + cat %{DIR_SOURCE}/%{name}.sysusers | + systemd-sysusers --replace=%{sysusersdir}/%{name}.conf - end packages @@ -83,10 +83,6 @@ packages man end - script prein - %{create_user} - end - script posttransin # Update the database right now. rm -rf /var/cache/man/* diff --git a/man-db/man-db.sysusers b/man-db/man-db.sysusers new file mode 100644 index 000000000..3783bed2c --- /dev/null +++ b/man-db/man-db.sysusers @@ -0,0 +1,6 @@ +# Create the man group with GID 15 +g man 15 + +# Create the man user with UID 15, member of the man group +# with a remark, /var/cache/man as homedir and no login shell. +u man 15:15 "Manpage cache user" /var/cache/man /sbin/nologin -- 2.30.2

1 0

[PATCH 1/2] systemd: Build manpages again
by Stefan Schantl 29 Mar '23

29 Mar '23

This "optional" feature now has to be enabled. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- systemd/systemd.nm | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/systemd/systemd.nm b/systemd/systemd.nm index a898c6826..2c409694c 100644 --- a/systemd/systemd.nm +++ b/systemd/systemd.nm @@ -5,7 +5,7 @@ name = systemd version = 253 -release = 3 +release = 4 maintainer = Stefan Schantl <stefan.schantl(a)ipfire.org> groups = System/Base @@ -78,6 +78,7 @@ build -Dsysvinit-path= \ -Dsysvrcnd-path= \ -Dzlib=true \ + -Dman=true \ -Dsmack=false \ -Dbacklight=false \ -Dfirstboot=false \ -- 2.30.2

1 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development March 2023