diff options
| -rw-r--r-- | debian/changelog | 9 | ||||
| -rw-r--r-- | debian/control | 3 | ||||
| -rwxr-xr-x | debian/lacme.postinst | 21 | ||||
| -rwxr-xr-x | debian/lacme.postrm | 15 | ||||
| -rwxr-xr-x | debian/rules | 4 |
5 files changed, 50 insertions, 2 deletions
diff --git a/debian/changelog b/debian/changelog index 9c56889..2eeeb5c 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,5 +1,14 @@ lacme (0.7-2) UNRELEASED; urgency=medium + * The internal webserver now runs as a dedicated system user _lacme-www + (and group nogroup) instead of www-data:www-data. This is configurable + in the [webserver] section of the lacme(8) configuration file. + * The internal ACME client now runs as a dedicated system user _lacme-client + (and group nogroup) instead of nobody:nogroup. This is configurable in + the [client] section of the lacme(8) configuration file. + * The _lacme-www and _lacme-client system users are created automatically by + lacme.postinst (hence a new Depends: adduser), and deleted on purge. (So + make sure not to chown any file to these internal users.) * d/control: New lacme-accountd Suggests: openssl, gpg (for account key generation and decryption). * Add d/upstream/signing-key.asc, the OpenPGP used to signed upstream tags. diff --git a/debian/control b/debian/control index 91bdac2..07419a2 100644 --- a/debian/control +++ b/debian/control @@ -11,7 +11,8 @@ Vcs-Browser: https://salsa.debian.org/debian/lacme Package: lacme Architecture: all -Depends: libconfig-tiny-perl, +Depends: adduser, + libconfig-tiny-perl, libjson-perl, libnet-ssleay-perl, libtimedate-perl, diff --git a/debian/lacme.postinst b/debian/lacme.postinst new file mode 100755 index 0000000..536e37f --- /dev/null +++ b/debian/lacme.postinst @@ -0,0 +1,21 @@ +#!/bin/sh + +set -e + +if [ "$1" = "configure" ]; then + if ! getent passwd _lacme-www >/dev/null; then + adduser --force-badname --system \ + --home /nonexistent --no-create-home \ + --gecos "lacme www user" \ + --quiet _lacme-www || true + fi + if ! getent passwd _lacme-client >/dev/null; then + adduser --force-badname --system \ + --home /nonexistent --no-create-home \ + --gecos "lacme client user" \ + --quiet _lacme-client || true + fi +fi + +#DEBHELPER# +exit 0 diff --git a/debian/lacme.postrm b/debian/lacme.postrm new file mode 100755 index 0000000..c52a198 --- /dev/null +++ b/debian/lacme.postrm @@ -0,0 +1,15 @@ +#!/bin/sh + +set -e + +if [ "$1" = "purge" ]; then + if getent passwd _lacme-www >/dev/null; then + deluser --quiet --system _lacme-www + fi + if getent passwd _lacme-client >/dev/null; then + deluser --quiet --system _lacme-client + fi +fi + +#DEBHELPER# +exit 0 diff --git a/debian/rules b/debian/rules index cc86c79..9ba6afd 100755 --- a/debian/rules +++ b/debian/rules @@ -1,7 +1,9 @@ #!/usr/bin/make -f override_dh_auto_build: - dh_auto_build -- DESTDIR= exec_prefix=/usr datadir=/usr/share runstatedir=/run + dh_auto_build -- DESTDIR= exec_prefix=/usr datadir=/usr/share runstatedir=/run \ + lacme_www_user=_lacme-www lacme_www_group=nogroup \ + lacme_client_user=_lacme-client lacme_client_group=nogroup %: dh $@ |