mirror of
https://github.com/gentoo-mirror/guru.git
synced 2026-10-12 17:51:11 -04:00
zyxhere💭
3ed37b3ed5
Say it with me: the pidfile and its parent directories should only be writable by root unless you use supervise-daemon ;) With `checkpath -o someuser:someuser $pidfile` in start_pre(), it can cause DOS attacks because the now unprivelaged process can replace the pidfile with some other pid number in it like pid 1 and cause the host machine to crash when the daemon finally stops. Supervise-daemon can supervise without the daemon creating a pidfile so don't export the variable at all. That assumes the scripts *are* using supervise-daemon, if supervise-daemon fails to start (due to maybe some incorrect config option *wink wink*) then OpenRC falls back to the older start-stop-daemon and that *does* use the $pidfile. If thats the case then the daemon will simply fail to start (yes I haven't tested if any these packages work without $pidfile which they should since they are specifying `supervisor=supervise-daemon`). IMO failing to start is better than running in a potentially vulnerable configuration. Merges: https://codeberg.org/gentoo/guru/pulls/92 Part-off: https://codeberg.org/gentoo/guru/pulls/92 Signed-off-by: zyxhere💭 <zyx@envs.net>
98 lines
2.8 KiB
Bash
98 lines
2.8 KiB
Bash
# Copyright 2024-2026 Gentoo Authors
|
|
# Distributed under the terms of the GNU General Public License v2
|
|
|
|
EAPI=8
|
|
|
|
inherit go-module systemd toolchain-funcs
|
|
|
|
EGO_SUM=(
|
|
"github.com/hashicorp/go-syslog v1.0.0"
|
|
"github.com/hashicorp/go-syslog v1.0.0/go.mod"
|
|
"github.com/jedisct1/dlog v0.0.0-20210101122416-354ffe815216"
|
|
"github.com/jedisct1/dlog v0.0.0-20210101122416-354ffe815216/go.mod"
|
|
"github.com/kardianos/service v1.2.0"
|
|
"github.com/kardianos/service v1.2.0/go.mod"
|
|
"github.com/pborman/getopt/v2 v2.1.0"
|
|
"github.com/pborman/getopt/v2 v2.1.0/go.mod"
|
|
"github.com/vishvananda/netlink v1.1.0"
|
|
"github.com/vishvananda/netlink v1.1.0/go.mod"
|
|
"github.com/vishvananda/netlink v1.2.1-beta.2.0.20240713210050-d13535d71ed3"
|
|
"github.com/vishvananda/netlink v1.2.1-beta.2.0.20240713210050-d13535d71ed3/go.mod"
|
|
"github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df"
|
|
"github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod"
|
|
"github.com/vishvananda/netns v0.0.4"
|
|
"github.com/vishvananda/netns v0.0.4/go.mod"
|
|
"golang.org/x/net v0.23.0"
|
|
"golang.org/x/net v0.23.0/go.mod"
|
|
"golang.org/x/sys v0.0.0-20190606203320-7fc4e5ec1444/go.mod"
|
|
"golang.org/x/sys v0.0.0-20201015000850-e3ed0017c211/go.mod"
|
|
"golang.org/x/sys v0.0.0-20201231184435-2d18734c6014/go.mod"
|
|
"golang.org/x/sys v0.2.0/go.mod"
|
|
"golang.org/x/sys v0.10.0/go.mod"
|
|
"golang.org/x/sys v0.18.0"
|
|
"golang.org/x/sys v0.18.0/go.mod"
|
|
"golang.org/x/sys v0.22.0"
|
|
"golang.org/x/sys v0.22.0/go.mod"
|
|
)
|
|
|
|
go-module_set_globals
|
|
|
|
DESCRIPTION="A tool for redirecting a given program's TCP traffic to SOCKS5 or HTTP proxy"
|
|
HOMEPAGE="https://github.com/hmgle/graftcp"
|
|
SRC_URI="https://github.com/hmgle/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz
|
|
${EGO_SUM_SRC_URI}"
|
|
|
|
SLOT="0"
|
|
LICENSE="GPL-3+"
|
|
# Go dependency licenses
|
|
LICENSE+=" Apache-2.0 BSD BSD-2 MIT ZLIB"
|
|
KEYWORDS="~amd64 ~arm ~arm64 ~x86"
|
|
|
|
RDEPEND="acct-user/graftcp"
|
|
BDEPEND=">=dev-lang/go-1.21"
|
|
|
|
PATCHES=(
|
|
"${FILESDIR}/0002-build-no-longer-strip-symbols.patch"
|
|
"${FILESDIR}/0005-let-graftcp-respect-LDFLAGS.patch"
|
|
)
|
|
|
|
DOCS=(
|
|
README{,.zh-CN}.md
|
|
example-{black,white}list-ip.txt
|
|
example-graftcp.conf
|
|
local/example-graftcp-local.conf
|
|
)
|
|
|
|
# Written in golang
|
|
QA_FLAGS_IGNORED="
|
|
usr/bin/graftcp-local
|
|
usr/bin/mgraftcp
|
|
"
|
|
|
|
src_compile() {
|
|
local mymakeargs=(
|
|
VERSION="v${PV}"
|
|
CC="$(tc-getCC)"
|
|
AR="$(tc-getAR)"
|
|
CFLAGS="${CFLAGS} -DNDEBUG"
|
|
)
|
|
emake "${mymakeargs[@]}"
|
|
}
|
|
|
|
src_install() {
|
|
local mymakeargs=(
|
|
DESTDIR="${D}"
|
|
PREFIX="${EPREFIX}/usr"
|
|
SYSTEMD_UNIT_DIR="$(systemd_get_systemunitdir)"
|
|
)
|
|
emake -j1 "${mymakeargs[@]}" install install_systemd
|
|
|
|
fowners -R root:graftcp /etc/graftcp-local
|
|
fperms 0640 /etc/graftcp-local/graftcp-local.conf
|
|
|
|
newinitd "${FILESDIR}"/graftcp-local.initd-r1 graftcp-local
|
|
newconfd "${FILESDIR}"/graftcp-local.confd graftcp-local
|
|
|
|
einstalldocs
|
|
}
|