From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4jJDjP24Cdz2xWP for ; Mon, 02 Nov 2026 14:34:01 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4jJDjP1kvPz2xHk for ; Mon, 02 Nov 2026 14:34:01 +0000 (UTC) Received: from people01.haj.ipfire.org (people01.haj.ipfire.org [IPv6:2001:678:b28::161]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bit raw public key) server-digest SHA256 client-signature ECDSA (secp384r1) client-digest SHA384) (Client CN "people01.haj.ipfire.org", Issuer "YE1" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4jJDjM6Mqdz1F5 for ; Mon, 02 Nov 2026 14:33:59 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1793630039; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=UEycGP+e4E4frGffC7WS2vVi5+/epHj1ujNZxCdl180=; b=8McWTUADx3zFlAHBadwIphPeXTSCgEgZe3nssLdQU0wYRqa6kOThKuvZHyOmGzGAXcpzOQ LjgRc6k4b1UHWWCQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1793630039; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=UEycGP+e4E4frGffC7WS2vVi5+/epHj1ujNZxCdl180=; b=uEaYz9KRhLMaR6QBl0eTtKmCwPIoNoyW6ShgTYmTCntJkWGhgXfGRcsd0JInzTFtR7V/bn U5kY0+uuU36C/fo7eiC52uE+BA1DIsS90n6ZH1U7LzxKMtvVz7mUz7elFgZaXeb4tfRkRH VjK+trJYABfxUoCi13xqB4oxKjAhaeJ4IX7LlQ53v0RV1JtnKqF/b7WFPstoACNIIk3brf RnUBA7UPInpETN5Fzpktq9fZ123R9HGRwjuVU4l+iEKNoPWFBQYOEoDupWhgJpEAwECvA9 sMJSPPffOz6G9MzkjtiyKfXpL2+iL9xQu0QrcdmS2927Dwfty2CTb9RKe28V+Q== Received: by people01.haj.ipfire.org (Postfix, from userid 1000) id 4jJDjM0GCSz2xpC; Mon, 02 Nov 2026 14:33:59 +0000 (UTC) To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, next, updated. d2515da87434eee3a74a979750eb5e2f0e5b520e X-Git-Refname: refs/heads/next X-Git-Reftype: branch X-Git-Oldrev: e233b1bf4368cb401137a71dcfe2de907c44d2e3 X-Git-Newrev: d2515da87434eee3a74a979750eb5e2f0e5b520e Message-Id: <4jJDjM0GCSz2xpC@people01.haj.ipfire.org> Date: Mon, 02 Nov 2026 14:33:58 +0000 (UTC) From: Michael Tremer Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via d2515da87434eee3a74a979750eb5e2f0e5b520e (commit) via 71df1578a64c07fab0b0abc24211301347de44cb (commit) via 399402eb605765e4857c8547475920dfe9014c25 (commit) from e233b1bf4368cb401137a71dcfe2de907c44d2e3 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit d2515da87434eee3a74a979750eb5e2f0e5b520e Author: Michael Tremer Date: Mon Nov 2 14:15:44 2026 +0000 core207: Allow telemetryd to talk to Knot Resolver telemetryd has lost CAP_DAC_OVERRIDE which allowed it to connect to the socket of Knot Resolver's API. It is now a member of the group of Knot Resolver and Knot Resolver is restarted so that the socket is accessible for that group. Signed-off-by: Michael Tremer commit 71df1578a64c07fab0b0abc24211301347de44cb Author: Michael Tremer Date: Mon Nov 2 14:15:44 2026 +0000 initscripts: Start processes with the primary group of the user setpriv only changed the user and initialised the supplementary groups. The process kept running with the group root, and any files that it created belonged to root's group. Signed-off-by: Michael Tremer commit 399402eb605765e4857c8547475920dfe9014c25 Author: Michael Tremer Date: Mon Nov 2 14:15:44 2026 +0000 knot-resolver: Make the socket of the API accessible for its group The manager creates the socket for its API with the umask of the process which makes it mode 755. Only the owner is allowed to connect to it then, but other processes in the group of the daemon (like telemetryd) need to do that, too. Knot Resolver does not provide any option to set the permissions of the socket, so we have to set them after the socket has been created. Signed-off-by: Michael Tremer ----------------------------------------------------------------------- Summary of changes: config/etc/group | 2 +- config/rootfiles/core/207/filelists/files | 1 + .../{oldcore/203 => core/207}/filelists/knot-resolver | 0 config/rootfiles/core/207/update.sh | 7 +++++++ lfs/knot-resolver | 1 + src/initscripts/system/functions | 2 +- .../knot-resolver-6.4.2-api-socket-permissions.patch | 14 ++++++++++++++ 7 files changed, 25 insertions(+), 2 deletions(-) copy config/rootfiles/{oldcore/203 => core/207}/filelists/knot-resolver (100%) create mode 100644 src/patches/knot-resolver-6.4.2-api-socket-permissions.patch Difference in files: diff --git a/config/etc/group b/config/etc/group index f58cb1ffd..2aed2353c 100644 --- a/config/etc/group +++ b/config/etc/group @@ -42,7 +42,7 @@ nut:x:115: cdrom:x:116: usb:x:117: zabbix:x:118: -knot-resolver:x:120: +knot-resolver:x:120:telemetry telemetry:x:121: ipsec:x:122:telemetry samba:x:1000: diff --git a/config/rootfiles/core/207/filelists/files b/config/rootfiles/core/207/filelists/files index 39ce34e9d..7cbb6990c 100644 --- a/config/rootfiles/core/207/filelists/files +++ b/config/rootfiles/core/207/filelists/files @@ -1,6 +1,7 @@ etc/httpd/conf/vhosts.d/ipfire-interface-ssl.conf etc/rc.d/init.d/apache etc/rc.d/init.d/firewall +etc/rc.d/init.d/functions etc/rc.d/init.d/networking/red etc/rc.d/init.d/openvpn-n2n etc/rc.d/init.d/pakfire diff --git a/config/rootfiles/core/207/filelists/knot-resolver b/config/rootfiles/core/207/filelists/knot-resolver new file mode 120000 index 000000000..db15178a8 --- /dev/null +++ b/config/rootfiles/core/207/filelists/knot-resolver @@ -0,0 +1 @@ +../../../common/knot-resolver \ No newline at end of file diff --git a/config/rootfiles/core/207/update.sh b/config/rootfiles/core/207/update.sh index 714535956..8a48da691 100644 --- a/config/rootfiles/core/207/update.sh +++ b/config/rootfiles/core/207/update.sh @@ -532,6 +532,9 @@ usermod -a -G ipsec telemetry # Allow telemetryd to read the counters of Suricata usermod -a -G suricata telemetry +# Allow telemetryd to talk to Knot Resolver +usermod -a -G knot-resolver telemetry + # Move the iwlwifi firmware to its new location mkdir -p /lib/firmware/intel/iwlwifi for file in /lib/firmware/iwlwifi-*; do @@ -577,6 +580,10 @@ if [ -d "/var/run/openvpn" ]; then chmod 755 /var/run/openvpn fi +# Restart Knot Resolver so that it runs in its own group and the socket of its +# API is accessible for the members of that group +/etc/init.d/knot-resolver restart + # Load the D-Bus policy of telemetryd and start it /etc/init.d/messagebus reload /etc/init.d/telemetryd start diff --git a/lfs/knot-resolver b/lfs/knot-resolver index 0d3e0d2d0..3c9839d90 100644 --- a/lfs/knot-resolver +++ b/lfs/knot-resolver @@ -71,6 +71,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/knot-resolver-6.5-keep-dst-ip.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/knot-resolver-6.4.2-api-socket-permissions.patch cd $(DIR_APP) && meson setup \ --buildtype=release \ --prefix=/usr \ diff --git a/src/initscripts/system/functions b/src/initscripts/system/functions index c9e23705c..744ed0bc2 100644 --- a/src/initscripts/system/functions +++ b/src/initscripts/system/functions @@ -522,7 +522,7 @@ loadproc() # Start as a different user if [ -n "${user}" ]; then - cmd=( "setpriv" "--reuid=${user}" "--init-groups" "--" "$@" ) + cmd=( "setpriv" "--reuid=${user}" "--regid=$(id -g "${user}")" "--init-groups" "--" "$@" ) fi if [ -n "${nicelevel}" ]; then diff --git a/src/patches/knot-resolver-6.4.2-api-socket-permissions.patch b/src/patches/knot-resolver-6.4.2-api-socket-permissions.patch new file mode 100644 index 000000000..81fdbb5f8 --- /dev/null +++ b/src/patches/knot-resolver-6.4.2-api-socket-permissions.patch @@ -0,0 +1,14 @@ +diff --git a/python/knot_resolver/manager/server.py b/python/knot_resolver/manager/server.py +--- a/python/knot_resolver/manager/server.py ++++ b/python/knot_resolver/manager/server.py +@@ -410,6 +410,10 @@ class Server: + raise KresManagerBaseError("Requested API on unsupported configuration format.") + await nsite.start() + ++ # Make the socket accessible for the owner and the group only ++ if mgn.unix_socket: ++ os.chmod(str(mgn.unix_socket), 0o660) ++ + # stop the old listen + assert (self.listen is None) == (self.site is None) + if self.listen is not None and self.site is not None: hooks/post-receive -- IPFire 2.x development tree