aboutsummaryrefslogtreecommitdiffstats
path: root/debian
diff options
context:
space:
mode:
authorGuilhem Moulin <guilhem@debian.org>2021-02-15 00:32:29 +0100
committerGuilhem Moulin <guilhem@debian.org>2021-02-22 03:31:12 +0100
commita321c90db4a6d323f1a9bc06c4d861cee8868664 (patch)
tree7804d619f5198b4387fb64b78f1742035d80fd78 /debian
parentf08eeeed6abaea2d6dbe8fd801eb0acd187e23d0 (diff)
Use dedicated system users for internal components.
* The internal webserver now runs as a dedicated system user _lacme-www (and group nogroup) instead of www-data:www-data. This is configurable in the [webserver] section of the lacme(8) configuration file. * The internal ACME client now runs as a dedicated system user _lacme-client (and group nogroup) instead of nobody:nogroup. This is configurable in the [client] section of the lacme(8) configuration file. * The _lacme-www and _lacme-client system users are created automatically by lacme.postinst (hence a new Depends: adduser), and deleted on purge. (So make sure not to chown any file to these internal users.)
Diffstat (limited to 'debian')
-rw-r--r--debian/changelog9
-rw-r--r--debian/control3
-rwxr-xr-xdebian/lacme.postinst21
-rwxr-xr-xdebian/lacme.postrm15
-rwxr-xr-xdebian/rules4
5 files changed, 50 insertions, 2 deletions
diff --git a/debian/changelog b/debian/changelog
index 9c56889..2eeeb5c 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,5 +1,14 @@
lacme (0.7-2) UNRELEASED; urgency=medium
+ * The internal webserver now runs as a dedicated system user _lacme-www
+ (and group nogroup) instead of www-data:www-data. This is configurable
+ in the [webserver] section of the lacme(8) configuration file.
+ * The internal ACME client now runs as a dedicated system user _lacme-client
+ (and group nogroup) instead of nobody:nogroup. This is configurable in
+ the [client] section of the lacme(8) configuration file.
+ * The _lacme-www and _lacme-client system users are created automatically by
+ lacme.postinst (hence a new Depends: adduser), and deleted on purge. (So
+ make sure not to chown any file to these internal users.)
* d/control: New lacme-accountd Suggests: openssl, gpg (for account key
generation and decryption).
* Add d/upstream/signing-key.asc, the OpenPGP used to signed upstream tags.
diff --git a/debian/control b/debian/control
index 91bdac2..07419a2 100644
--- a/debian/control
+++ b/debian/control
@@ -11,7 +11,8 @@ Vcs-Browser: https://salsa.debian.org/debian/lacme
Package: lacme
Architecture: all
-Depends: libconfig-tiny-perl,
+Depends: adduser,
+ libconfig-tiny-perl,
libjson-perl,
libnet-ssleay-perl,
libtimedate-perl,
diff --git a/debian/lacme.postinst b/debian/lacme.postinst
new file mode 100755
index 0000000..536e37f
--- /dev/null
+++ b/debian/lacme.postinst
@@ -0,0 +1,21 @@
+#!/bin/sh
+
+set -e
+
+if [ "$1" = "configure" ]; then
+ if ! getent passwd _lacme-www >/dev/null; then
+ adduser --force-badname --system \
+ --home /nonexistent --no-create-home \
+ --gecos "lacme www user" \
+ --quiet _lacme-www || true
+ fi
+ if ! getent passwd _lacme-client >/dev/null; then
+ adduser --force-badname --system \
+ --home /nonexistent --no-create-home \
+ --gecos "lacme client user" \
+ --quiet _lacme-client || true
+ fi
+fi
+
+#DEBHELPER#
+exit 0
diff --git a/debian/lacme.postrm b/debian/lacme.postrm
new file mode 100755
index 0000000..c52a198
--- /dev/null
+++ b/debian/lacme.postrm
@@ -0,0 +1,15 @@
+#!/bin/sh
+
+set -e
+
+if [ "$1" = "purge" ]; then
+ if getent passwd _lacme-www >/dev/null; then
+ deluser --quiet --system _lacme-www
+ fi
+ if getent passwd _lacme-client >/dev/null; then
+ deluser --quiet --system _lacme-client
+ fi
+fi
+
+#DEBHELPER#
+exit 0
diff --git a/debian/rules b/debian/rules
index cc86c79..9ba6afd 100755
--- a/debian/rules
+++ b/debian/rules
@@ -1,7 +1,9 @@
#!/usr/bin/make -f
override_dh_auto_build:
- dh_auto_build -- DESTDIR= exec_prefix=/usr datadir=/usr/share runstatedir=/run
+ dh_auto_build -- DESTDIR= exec_prefix=/usr datadir=/usr/share runstatedir=/run \
+ lacme_www_user=_lacme-www lacme_www_group=nogroup \
+ lacme_client_user=_lacme-client lacme_client_group=nogroup
%:
dh $@