mirror of
https://github.com/gentoo-mirror/guru.git
synced 2026-10-12 17:51:11 -04:00
zyxhere💭
3ed37b3ed5
Say it with me: the pidfile and its parent directories should only be writable by root unless you use supervise-daemon ;) With `checkpath -o someuser:someuser $pidfile` in start_pre(), it can cause DOS attacks because the now unprivelaged process can replace the pidfile with some other pid number in it like pid 1 and cause the host machine to crash when the daemon finally stops. Supervise-daemon can supervise without the daemon creating a pidfile so don't export the variable at all. That assumes the scripts *are* using supervise-daemon, if supervise-daemon fails to start (due to maybe some incorrect config option *wink wink*) then OpenRC falls back to the older start-stop-daemon and that *does* use the $pidfile. If thats the case then the daemon will simply fail to start (yes I haven't tested if any these packages work without $pidfile which they should since they are specifying `supervisor=supervise-daemon`). IMO failing to start is better than running in a potentially vulnerable configuration. Merges: https://codeberg.org/gentoo/guru/pulls/92 Part-off: https://codeberg.org/gentoo/guru/pulls/92 Signed-off-by: zyxhere💭 <zyx@envs.net>
32 lines
890 B
Plaintext
32 lines
890 B
Plaintext
#!/sbin/openrc-run
|
|
# shellcheck shell=sh
|
|
#
|
|
# Copyright 2024-2026 Gentoo Authors
|
|
# Distributed under the terms of the GNU General Public License v2
|
|
|
|
: "${BYEDPI_USER:=byedpi}"
|
|
: "${BYEDPI_GROUP:=nobody}"
|
|
|
|
: "${BYEDPI_BIND_IP:=0.0.0.0}"
|
|
: "${BYEDPI_BIND_PORT:=1080}"
|
|
: "${BYEDPI_OPTS:=--split 1 --disorder 3+s --mod-http=h,d --auto=torst --tlsrec 1+s}"
|
|
|
|
description="Bypass DPI SOCKS proxy"
|
|
supervisor="supervise-daemon"
|
|
command="/usr/bin/ciadpi"
|
|
pidfile="/run/byedpi/${RC_SVCNAME}.pid"
|
|
command_user="${BYEDPI_USER}:${BYEDPI_GROUP}"
|
|
command_args="--ip ${BYEDPI_BIND_IP} --port ${BYEDPI_BIND_PORT} ${BYEDPI_OPTS}"
|
|
command_args_background="--daemon --pidfile ${pidfile}"
|
|
output_logger="logger -p daemon.info -t byedpi --"
|
|
error_logger="logger -p daemon.err -t byedpi --"
|
|
|
|
depend() {
|
|
need net
|
|
use firewall logger
|
|
}
|
|
|
|
start_pre() {
|
|
checkpath -q -do "${BYEDPI_USER}":root /run/"${RC_SVCNAME}"
|
|
}
|