Say it with me: the pidfile and its parent directories should
only be writable by root unless you use supervise-daemon ;)
With `checkpath -o someuser:someuser $pidfile` in start_pre(), it can
cause DOS attacks because the now unprivelaged process can replace the
pidfile with some other pid number in it like pid 1 and cause the host
machine to crash when the daemon finally stops. Supervise-daemon can
supervise without the daemon creating a pidfile so don't export the
variable at all.
That assumes the scripts *are* using supervise-daemon, if
supervise-daemon fails to start (due to maybe some incorrect config
option *wink wink*) then OpenRC falls back to the older
start-stop-daemon and that *does* use the $pidfile. If thats the case
then the daemon will simply fail to start (yes I haven't tested if any
these packages work without $pidfile which they should since they are
specifying `supervisor=supervise-daemon`).
IMO failing to start is better than running in a potentially vulnerable
configuration.
Merges: https://codeberg.org/gentoo/guru/pulls/92
Part-off: https://codeberg.org/gentoo/guru/pulls/92
Signed-off-by: zyxhere💭 <zyx@envs.net>
- maestral does not work properly with dev-python/dropbox-12.2.2.
- the project is archived upstream, I'm preparing to last rite it.
- deselect failing tests.
Closes: https://bugs.gentoo.org/975481
Signed-off-by: Viorel Munteanu <ceamac@gentoo.org>
as per the coding style guide:
https://projects.gentoo.org/qa/policy-guide/ebuild-format.html#pg0101
only these changes were done:
[ -e ... ] to [[ -e ... ]]
[ -z ... ] to [[ -z ... ]]
[ -n ... ] to [[ -n ... ]]
[ ! -f ... ] to [[ ! -f ... ]]
[ -f ... ] to [[ -f ... ]]
[ -d ... ] to [[ -d ... ]]
the changes were generated using this command:
```
find -name '*.ebuild' -exec sed -i -E \
's|([^[])\[+(\s+)([^]]+)(\s+)\]+([^]]\|$)|\1\[\[\2\3\4\]\]\5|g' \
{} \+
```
this is aimed to be a series of commits meant to replace all instance of
POSIX [ ... ] to bash's [[ ... ]], to make guru up to date with the
coding style guide.
this process is divided up into a series of commits in order to make
review and testing more easy
Signed-off-by: ingenarel (NeoJesus) <ingenarel_neojesus@disroot.org>
Part-of: https://codeberg.org/gentoo/guru/pulls/6
Signed-off-by: Michał Górny <mgorny@gentoo.org>
as per the coding style guide:
https://projects.gentoo.org/qa/policy-guide/ebuild-format.html#pg0101
if it previously used [ ${PV} ... ] it uses [[ ${PV} ... ]] now
if it previously used [[ ${PV} = b ]] or [ ${PV} = b ], it uses
[[ ${PV} == b ]] now
the changes were generated using these two commands:
```
find -name '*.ebuild' -exec sed -i -E \
's|([^[])\[+(\s+)(\S*\$\S*PV\S*)(\s+)(\S+)(\s+)(\S+)(\s+)\]+([^]])|\1\[\[\2\3\4\5\6\7\8\]\]\9|g' \
{} \+
find -name '*.ebuild' -exec sed -i -E \
's|\[(\s+)(\S*\$\S*PV\S*)(\s+)==?(\s+)(\S+)(\s+)\]|\[\1\2\3==\4\5\6\]|g' \
{} \+
```
this is aimed to be a series of commits meant to replace all instance of
POSIX [ ... ] to bash's [[ ... ]], to make guru up to date with the
coding style guide
this process is divided up into a series of commits in order to make
review and testing more easy
Signed-off-by: ingenarel (NeoJesus) <ingenarel_neojesus@disroot.org>
Part-of: https://codeberg.org/gentoo/guru/pulls/6
Signed-off-by: Michał Górny <mgorny@gentoo.org>
Shimon Trolles