From owner-svn-ports-all@freebsd.org Wed Apr 11 13:01:28 2018 Return-Path: Delivered-To: svn-ports-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 17A76F92E79; Wed, 11 Apr 2018 13:01:28 +0000 (UTC) (envelope-from feld@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id B8C01700FA; Wed, 11 Apr 2018 13:01:27 +0000 (UTC) (envelope-from feld@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id B3B131C8F1; Wed, 11 Apr 2018 13:01:27 +0000 (UTC) (envelope-from feld@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id w3BD1RN1079888; Wed, 11 Apr 2018 13:01:27 GMT (envelope-from feld@FreeBSD.org) Received: (from feld@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id w3BD1RlZ079885; Wed, 11 Apr 2018 13:01:27 GMT (envelope-from feld@FreeBSD.org) Message-Id: <201804111301.w3BD1RlZ079885@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: feld set sender to feld@FreeBSD.org using -f From: Mark Felder Date: Wed, 11 Apr 2018 13:01:27 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-branches@freebsd.org Subject: svn commit: r467046 - in branches/2018Q2/net-mgmt/py-pdagent: . files X-SVN-Group: ports-branches X-SVN-Commit-Author: feld X-SVN-Commit-Paths: in branches/2018Q2/net-mgmt/py-pdagent: . files X-SVN-Commit-Revision: 467046 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Apr 2018 13:01:28 -0000 Author: feld Date: Wed Apr 11 13:01:27 2018 New Revision: 467046 URL: https://svnweb.freebsd.org/changeset/ports/467046 Log: MFH: r466569 r466572 net-mgmt/py-pdagent: Add dedicated user/group - Also add pkg-message informing how to permit users and services access net/py-pdagent: Further increase security Limit access to alert data files which could hold sensitive information PR: 227273 Added: branches/2018Q2/net-mgmt/py-pdagent/pkg-message - copied unchanged from r466569, head/net-mgmt/py-pdagent/pkg-message Modified: branches/2018Q2/net-mgmt/py-pdagent/Makefile branches/2018Q2/net-mgmt/py-pdagent/files/pdagentd.in Directory Properties: branches/2018Q2/ (props changed) Modified: branches/2018Q2/net-mgmt/py-pdagent/Makefile ============================================================================== --- branches/2018Q2/net-mgmt/py-pdagent/Makefile Wed Apr 11 12:45:34 2018 (r467045) +++ branches/2018Q2/net-mgmt/py-pdagent/Makefile Wed Apr 11 13:01:27 2018 (r467046) @@ -4,6 +4,7 @@ PORTNAME= pdagent PORTVERSION= 1.4 DISTVERSIONPREFIX=v +PORTREVISION= 2 CATEGORIES= net-mgmt python PKGNAMEPREFIX= ${PYTHON_PKGNAMEPREFIX} @@ -25,6 +26,9 @@ GH_ACCOUNT= PagerDuty SUB_LIST+= PYTHON_CMD="${PYTHON_CMD}" BINFILES= pd-queue pd-send pdagentd.py + +USERS= pdagent +GROUPS= pdagent do-patch: ${REINPLACE_CMD} -e 's|/var/lib/pdagent|/var/db/pdagent|' -e 's|/etc|${ETCDIR}|' ${WRKSRC}/pdagent/confdirs.py Modified: branches/2018Q2/net-mgmt/py-pdagent/files/pdagentd.in ============================================================================== --- branches/2018Q2/net-mgmt/py-pdagent/files/pdagentd.in Wed Apr 11 12:45:34 2018 (r467045) +++ branches/2018Q2/net-mgmt/py-pdagent/files/pdagentd.in Wed Apr 11 13:01:27 2018 (r467046) @@ -20,8 +20,8 @@ rcvar=pdagentd_enable load_rc_config $name : ${pdagentd_enable="NO"} -: ${pdagentd_user:="nobody"} -: ${pdagentd_group:="nogroup"} +: ${pdagentd_user:="pdagent"} +: ${pdagentd_group:="pdagent"} pidfile="/var/run/pdagent/pdagentd.pid" command="%%PREFIX%%/bin/pdagentd.py" @@ -34,15 +34,13 @@ pdagent_mkdirs="/var/db/pdagent /var/db/pdagent/outque pdagentd_precmd() { for i in ${pdagent_mkdirs}; do - install -d -o ${pdagentd_user} -g ${pdagentd_group} -m 775 ${i} + install -d -o ${pdagentd_user} -g ${pdagentd_group} -m 770 ${i} done - if [ ! -d /var/log/pdagent ]; then - install -d -o ${pdagentd_user} /var/log/pdagent - fi - if [ ! -d /var/run/pdagent ]; then - install -d -o ${pdagentd_user} /var/run/pdagent - fi + chown -R ${pdagentd_user}:${pdagentd_group} /var/db/pdagent + + install -d -o ${pdagentd_user} /var/log/pdagent + install -d -o ${pdagentd_user} /var/run/pdagent } run_rc_command "$1" Copied: branches/2018Q2/net-mgmt/py-pdagent/pkg-message (from r466569, head/net-mgmt/py-pdagent/pkg-message) ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ branches/2018Q2/net-mgmt/py-pdagent/pkg-message Wed Apr 11 13:01:27 2018 (r467046, copy of r466569, head/net-mgmt/py-pdagent/pkg-message) @@ -0,0 +1,6 @@ +!!! NOTICE !!! + +You must add the required users and service accounts to the pdagent +group to permit write access to /var/db/pdagent. + +!!! NOTICE !!!