dhcpcd 9.x adds privelege seperation by creating a chroot and running parts of the client not as root.
Signed-off-by: Arne Fitzenreiter arne_f@ipfire.org --- config/etc/group | 1 + config/etc/passwd | 1 + src/initscripts/system/mountkernfs | 5 +++++ 3 files changed, 7 insertions(+)
diff --git a/config/etc/group b/config/etc/group index 4855214be..f1767b30c 100644 --- a/config/etc/group +++ b/config/etc/group @@ -20,6 +20,7 @@ dip:x:40: ftp:x:45: rsyncd:x:48: stunnel:x:51: +dhcpcd:x:52: lock:x:54: sshd:x:74: pcap:x:77: diff --git a/config/etc/passwd b/config/etc/passwd index 7893b43c9..cb0428085 100644 --- a/config/etc/passwd +++ b/config/etc/passwd @@ -7,6 +7,7 @@ ntp:x:38:38::/etc/ntp:/bin/false ftp:x:45:45:anonymous_user:/home/ftp:/bin/false rsyncd:x:48:48:rsyncd Daemon:/home/rsync:/bin/false stunnel:x:51:51:stunnel Daemon:/var/lib/stunnel:/bin/false +dhcpcd:x:52:52:dhcpcd privsep user:/run/dhcpcd/chroot:/bin/false sshd:x:74:74:sshd:/var/empty:/bin/false nobody:x:99:99:Nobody:/home/nobody:/bin/false postfix:x:100:100::/var/spool/postfix:/bin/false diff --git a/src/initscripts/system/mountkernfs b/src/initscripts/system/mountkernfs index f7be82d01..f0bfc5289 100644 --- a/src/initscripts/system/mountkernfs +++ b/src/initscripts/system/mountkernfs @@ -34,6 +34,11 @@ case "${1}" in mount -n -t tmpfs -o nosuid,nodev,mode=755,size=8M /run /run || failed=1 fi
+ # create folder for dhcpcd changeroot + mkdir -p /run/dhcpcd/chroot + chown dhcpcd:dhcpcd /run/dhcpcd/chroot + chmod 750 /run/dhcpcd/chroot + boot_mesg "" ${NORMAL}
(exit ${failed})