Djam/dhcp
1
0
Fork 0
mirror of https://abf.rosa.ru/djam/dhcp.git synced 2025-02-23 13:32:48 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fixes of systemd security capabilities. Remove isc-dhcp-client user.

Browse source
This commit is contained in:
Mikhail Novosyolov 2018-10-08 14:52:23 +03:00
parent 3c7ee5f3d3
commit 7a76ea3532
4 changed files with 13 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
ROSA-NEWS
View file

@ -11,7 +11,6 @@ https://www.freedesktop.org/wiki/Software/systemd/syslog/ says:
* dhcpd user was added on package installation (dhcp-server), but dhcpd was actually ran from root, not dhcpd * dhcpd user was added on package installation (dhcp-server), but dhcpd was actually ran from root, not dhcpd
* use sysusers.d(5) (config isc-dhcpd.conf) instaed of manually created dhcpd user * use sysusers.d(5) (config isc-dhcpd.conf) instaed of manually created dhcpd user
* migration: delete dhcpd user on package uninstallation * migration: delete dhcpd user on package uninstallation
* the same for dhclient (isc-dhcp-client.conf) (will it work from not root?)
* /etc/sysconfig/dhcp6 called in dhcpd6.service did not exist (dhcpd6.service was broken); * /etc/sysconfig/dhcp6 called in dhcpd6.service did not exist (dhcpd6.service was broken);
let's use copy /etc/sysconfig/dhcpd to /etc/sysconfig/dhcpd6 let's use copy /etc/sysconfig/dhcpd to /etc/sysconfig/dhcpd6

13
dhclient@.service
View file

@ -6,12 +6,15 @@ Before=network.target
[Service] [Service]
ExecStart=/usr/sbin/dhclient -lf /var/lib/dhclient/dhclient.leases -pf /run/dhclient@%i/dhclient.pid -d %I ExecStart=/usr/sbin/dhclient -lf /var/lib/dhclient/dhclient.leases -pf /run/dhclient@%i/dhclient.pid -d %I
RuntimeDirectory=dhclient@%i RuntimeDirectory=dhclient@%i
User=isc-dhcp-client # https://www.freedesktop.org/software/systemd/man/systemd.exec.html#ProtectSystem=
ProtectSystem=yes # /var is not read-only
ProtectHome=yes ProtectSystem=true
ReadWritePaths=/var/lib/dhclient/ ProtectHome=true
RestartSec=2s RestartSec=2s
Restart=on-failure Restart=on-failure
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_RAW
# https://www.freedesktop.org/software/systemd/man/systemd.exec.html#ReadWritePaths=
CapabilityBoundingSet=~CAP_SYS_ADMIN
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target

8
dhcp.spec
View file

@ -28,7 +28,7 @@ Source18: dhclient.tmpfiles
Source19: dhcrelay.tmpfiles Source19: dhcrelay.tmpfiles
# sysusers.d(5) (systemd-sysusers) # sysusers.d(5) (systemd-sysusers)
Source20: isc-dhcpd.conf Source20: isc-dhcpd.conf
Source21: isc-dhcp-client.conf #Source21: isc-dhcp-client.conf
# Per-interface dhclient service from Arch Linux (modified) # Per-interface dhclient service from Arch Linux (modified)
Source22: dhclient@.service Source22: dhclient@.service
Source100: ROSA-NEWS Source100: ROSA-NEWS
@ -209,7 +209,7 @@ install -D -p -m 644 %{SOURCE19} %{buildroot}%{_tmpfilesdir}/dhcrelay.conf
install -d %{buildroot}%{_sysusersdir} install -d %{buildroot}%{_sysusersdir}
install -m 644 %{SOURCE20} %{buildroot}%{_sysusersdir}/ install -m 644 %{SOURCE20} %{buildroot}%{_sysusersdir}/
install -m 644 %{SOURCE21} %{buildroot}%{_sysusersdir}/ #install -m 644 %{SOURCE21} %{buildroot}%{_sysusersdir}/
install -m 755 %{SOURCE7} %{SOURCE8} %{buildroot}%{_sbindir} install -m 755 %{SOURCE7} %{SOURCE8} %{buildroot}%{_sbindir}
install -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir} install -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}
@ -313,10 +313,10 @@ EOF
%post client %post client
# migrate from root:root as it was before ROSA package v4.4.1 # migrate from root:root as it was before ROSA package v4.4.1
# create this directory if it does not esist and then chmod it to allow dhcpd to work properly # create this directory if it does not esist and then chmod it to allow dhcpd to work properly
%sysusers_create isc-dhcp-client.conf #%sysusers_create isc-dhcp-client.conf
[ ! -d %{var_dhclient}/ ] && mkdir -p %{var_dhclient}/ [ ! -d %{var_dhclient}/ ] && mkdir -p %{var_dhclient}/
touch %{var_dhclient}/dhclient.leases || true touch %{var_dhclient}/dhclient.leases || true
[ -d %{var_dhclient} ] && chown -R isc-dhcp-client:isc-dhcp-client %{var_dhclient}/ #[ -d %{var_dhclient} ] && chown -R isc-dhcp-client:isc-dhcp-client %{var_dhclient}/
%tmpfiles_create dhclient.conf %tmpfiles_create dhclient.conf
%postun client %postun client

2
dhcpd.service
View file

@ -14,7 +14,7 @@ PIDFile=/run/dhcpd/dhcpd.pid
User=isc-dhcpd User=isc-dhcpd
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_RAW AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_RAW
ProtectSystem=full ProtectSystem=full
ProtectHome=on ProtectHome=true
KillSignal=SIGINT KillSignal=SIGINT
# We pull in network-online.target for a configured network connection. # We pull in network-online.target for a configured network connection.
# However this is not guaranteed to be the network connection our # However this is not guaranteed to be the network connection our