[git.ipfire.org] IPFire 2.x development tree branch, next, updated. d2515da87434eee3a74a979750eb5e2f0e5b520e

[Michael Tremer <git@ipfire.org>]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  d2515da87434eee3a74a979750eb5e2f0e5b520e (commit)
       via  71df1578a64c07fab0b0abc24211301347de44cb (commit)
       via  399402eb605765e4857c8547475920dfe9014c25 (commit)
      from  e233b1bf4368cb401137a71dcfe2de907c44d2e3 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit d2515da87434eee3a74a979750eb5e2f0e5b520e
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Mon Nov 2 14:15:44 2026 +0000

    core207: Allow telemetryd to talk to Knot Resolver
    
    telemetryd has lost CAP_DAC_OVERRIDE which allowed it to connect to the
    socket of Knot Resolver's API. It is now a member of the group of Knot
    Resolver and Knot Resolver is restarted so that the socket is accessible
    for that group.
    
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit 71df1578a64c07fab0b0abc24211301347de44cb
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Mon Nov 2 14:15:44 2026 +0000

    initscripts: Start processes with the primary group of the user
    
    setpriv only changed the user and initialised the supplementary groups.
    The process kept running with the group root, and any files that it
    created belonged to root's group.
    
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit 399402eb605765e4857c8547475920dfe9014c25
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Mon Nov 2 14:15:44 2026 +0000

    knot-resolver: Make the socket of the API accessible for its group
    
    The manager creates the socket for its API with the umask of the process
    which makes it mode 755. Only the owner is allowed to connect to it
    then, but other processes in the group of the daemon (like telemetryd)
    need to do that, too.
    
    Knot Resolver does not provide any option to set the permissions of the
    socket, so we have to set them after the socket has been created.
    
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 config/etc/group                                           |  2 +-
 config/rootfiles/core/207/filelists/files                  |  1 +
 .../{oldcore/203 => core/207}/filelists/knot-resolver      |  0
 config/rootfiles/core/207/update.sh                        |  7 +++++++
 lfs/knot-resolver                                          |  1 +
 src/initscripts/system/functions                           |  2 +-
 .../knot-resolver-6.4.2-api-socket-permissions.patch       | 14 ++++++++++++++
 7 files changed, 25 insertions(+), 2 deletions(-)
 copy config/rootfiles/{oldcore/203 => core/207}/filelists/knot-resolver (100%)
 create mode 100644 src/patches/knot-resolver-6.4.2-api-socket-permissions.patch

Difference in files:
diff --git a/config/etc/group b/config/etc/group
index f58cb1ffd..2aed2353c 100644
--- a/config/etc/group
+++ b/config/etc/group
@@ -42,7 +42,7 @@ nut:x:115:
 cdrom:x:116:
 usb:x:117:
 zabbix:x:118:
-knot-resolver:x:120:
+knot-resolver:x:120:telemetry
 telemetry:x:121:
 ipsec:x:122:telemetry
 samba:x:1000:
diff --git a/config/rootfiles/core/207/filelists/files b/config/rootfiles/core/207/filelists/files
index 39ce34e9d..7cbb6990c 100644
--- a/config/rootfiles/core/207/filelists/files
+++ b/config/rootfiles/core/207/filelists/files
@@ -1,6 +1,7 @@
 etc/httpd/conf/vhosts.d/ipfire-interface-ssl.conf
 etc/rc.d/init.d/apache
 etc/rc.d/init.d/firewall
+etc/rc.d/init.d/functions
 etc/rc.d/init.d/networking/red
 etc/rc.d/init.d/openvpn-n2n
 etc/rc.d/init.d/pakfire
diff --git a/config/rootfiles/core/207/filelists/knot-resolver b/config/rootfiles/core/207/filelists/knot-resolver
new file mode 120000
index 000000000..db15178a8
--- /dev/null
+++ b/config/rootfiles/core/207/filelists/knot-resolver
@@ -0,0 +1 @@
+../../../common/knot-resolver
\ No newline at end of file
diff --git a/config/rootfiles/core/207/update.sh b/config/rootfiles/core/207/update.sh
index 714535956..8a48da691 100644
--- a/config/rootfiles/core/207/update.sh
+++ b/config/rootfiles/core/207/update.sh
@@ -532,6 +532,9 @@ usermod -a -G ipsec telemetry
 # Allow telemetryd to read the counters of Suricata
 usermod -a -G suricata telemetry
 
+# Allow telemetryd to talk to Knot Resolver
+usermod -a -G knot-resolver telemetry
+
 # Move the iwlwifi firmware to its new location
 mkdir -p /lib/firmware/intel/iwlwifi
 for file in /lib/firmware/iwlwifi-*; do
@@ -577,6 +580,10 @@ if [ -d "/var/run/openvpn" ]; then
 	chmod 755 /var/run/openvpn
 fi
 
+# Restart Knot Resolver so that it runs in its own group and the socket of its
+# API is accessible for the members of that group
+/etc/init.d/knot-resolver restart
+
 # Load the D-Bus policy of telemetryd and start it
 /etc/init.d/messagebus reload
 /etc/init.d/telemetryd start
diff --git a/lfs/knot-resolver b/lfs/knot-resolver
index 0d3e0d2d0..3c9839d90 100644
--- a/lfs/knot-resolver
+++ b/lfs/knot-resolver
@@ -71,6 +71,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
 	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/knot-resolver-6.5-keep-dst-ip.patch
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/knot-resolver-6.4.2-api-socket-permissions.patch
 	cd $(DIR_APP) && meson setup \
 		--buildtype=release \
 		--prefix=/usr \
diff --git a/src/initscripts/system/functions b/src/initscripts/system/functions
index c9e23705c..744ed0bc2 100644
--- a/src/initscripts/system/functions
+++ b/src/initscripts/system/functions
@@ -522,7 +522,7 @@ loadproc()
 
 	# Start as a different user
 	if [ -n "${user}" ]; then
-		cmd=( "setpriv" "--reuid=${user}" "--init-groups" "--" "$@" )
+		cmd=( "setpriv" "--reuid=${user}" "--regid=$(id -g "${user}")" "--init-groups" "--" "$@" )
 	fi
 
 	if [ -n "${nicelevel}" ]; then
diff --git a/src/patches/knot-resolver-6.4.2-api-socket-permissions.patch b/src/patches/knot-resolver-6.4.2-api-socket-permissions.patch
new file mode 100644
index 000000000..81fdbb5f8
--- /dev/null
+++ b/src/patches/knot-resolver-6.4.2-api-socket-permissions.patch
@@ -0,0 +1,14 @@
+diff --git a/python/knot_resolver/manager/server.py b/python/knot_resolver/manager/server.py
+--- a/python/knot_resolver/manager/server.py
++++ b/python/knot_resolver/manager/server.py
+@@ -410,6 +410,10 @@ class Server:
+                 raise KresManagerBaseError("Requested API on unsupported configuration format.")
+             await nsite.start()
+ 
++            # Make the socket accessible for the owner and the group only
++            if mgn.unix_socket:
++                os.chmod(str(mgn.unix_socket), 0o660)
++
+             # stop the old listen
+             assert (self.listen is None) == (self.site is None)
+             if self.listen is not None and self.site is not None:


hooks/post-receive
--
IPFire 2.x development tree