mirror of
https://github.com/openwrt/openwrt.git
synced 2026-10-14 10:57:56 +04:00
Gary Dotzler
17a3a87f6e
Set /dev/net/tun to mode 0666, matching the TUN/TAP permissions documented by docs.kernel.org[1] and the default udev policy used by other Linux systems[2]. This avoids forcing otherwise unprivileged processes to retain elevated privileges solely to open the device node. Interface creation and attachment remain subject to the kernel's usual capability and ownership checks. [1] https://docs.kernel.org/networking/tuntap.html#configuration [2] https://github.com/systemd/systemd/blob/be1e78ec49f8c84c634d9e58dae834b27ea28436/rules.d/50-udev-default.rules.in#L111 Signed-off-by: Gary Dotzler <geldot@protonmail.com> Link: https://github.com/openwrt/openwrt/pull/25464 Signed-off-by: Nick Hainke <vincent@systemli.org>
162 lines
4.5 KiB
Makefile
162 lines
4.5 KiB
Makefile
#
|
|
# Copyright (C) 2014-2016 OpenWrt.org
|
|
#
|
|
# This is free software, licensed under the GNU General Public License v2.
|
|
# See /LICENSE for more information.
|
|
#
|
|
|
|
include $(TOPDIR)/rules.mk
|
|
|
|
PKG_NAME:=procd
|
|
PKG_RELEASE:=2
|
|
|
|
PKG_SOURCE_PROTO:=git
|
|
PKG_SOURCE_URL=$(PROJECT_GIT)/project/procd.git
|
|
PKG_MIRROR_HASH:=3aa9e70848dd7761c72ce48989965f1d1838fdd0965d971fffac120d1778833a
|
|
PKG_SOURCE_DATE:=2026-10-07
|
|
PKG_SOURCE_VERSION:=6a22d3964822f6d58fba4c4686e385ddb7e7fcb1
|
|
CMAKE_INSTALL:=1
|
|
|
|
PKG_LICENSE:=GPL-2.0
|
|
PKG_LICENSE_FILES:=
|
|
|
|
PKG_MAINTAINER:=John Crispin <john@phrozen.org>
|
|
|
|
PKG_BUILD_FLAGS:=lto
|
|
PKG_ASLR_PIE_REGULAR:=1
|
|
PKG_CONFIG_DEPENDS:= \
|
|
CONFIG_TARGET_INIT_PATH CONFIG_KERNEL_SECCOMP CONFIG_PROCD_SHOW_BOOT \
|
|
CONFIG_KERNEL_NAMESPACES CONFIG_PACKAGE_procd-ujail CONFIG_PACKAGE_procd-seccomp
|
|
|
|
include $(INCLUDE_DIR)/package.mk
|
|
include $(INCLUDE_DIR)/cmake.mk
|
|
|
|
ifeq ($(DUMP),)
|
|
STAMP_CONFIGURED:=$(strip $(STAMP_CONFIGURED))_$(shell echo $(CONFIG_TARGET_INIT_PATH) | $(MKHASH) md5)
|
|
endif
|
|
|
|
CMAKE_OPTIONS += -DEARLY_PATH="$(TARGET_INIT_PATH)"
|
|
|
|
define Package/procd/Default
|
|
SECTION:=base
|
|
CATEGORY:=Base system
|
|
DEPENDS:=+ubusd +ubus +libjson-script +ubox +libubox +libudebug \
|
|
+libubus +libblobmsg-json +libjson-c +jshn
|
|
TITLE:=OpenWrt system process manager
|
|
USERID:=:dialout=20
|
|
endef
|
|
|
|
define Package/procd
|
|
$(call Package/procd/Default)
|
|
VARIANT:=default
|
|
CONFLICTS:=procd-selinux
|
|
DEFAULT_VARIANT:=1
|
|
endef
|
|
|
|
define Package/procd-selinux
|
|
$(call Package/procd/Default)
|
|
DEPENDS += +libselinux
|
|
TITLE += with SELinux support
|
|
PROVIDES:=procd
|
|
VARIANT:=selinux
|
|
endef
|
|
|
|
define Package/procd-ujail
|
|
SECTION:=base
|
|
CATEGORY:=Base system
|
|
DEPENDS:=@KERNEL_NAMESPACES +@KERNEL_UTS_NS +@KERNEL_IPC_NS +@KERNEL_PID_NS \
|
|
+libubox +libubus +libuci +libblobmsg-json +libudebug
|
|
PKGFLAGS+=nonshared
|
|
TITLE:=OpenWrt process jail helper
|
|
endef
|
|
|
|
define Package/procd-seccomp
|
|
SECTION:=base
|
|
CATEGORY:=Base system
|
|
DEPENDS:=@USE_SECCOMP +ucode +ucode-mod-fs
|
|
TITLE:=OpenWrt process seccomp helper + trace2seccomp
|
|
endef
|
|
|
|
define Package/uxc
|
|
SECTION:=base
|
|
CATEGORY:=Base system
|
|
DEPENDS:=+procd-ujail +libubus +libubox +libblobmsg-json +blockd +odhcpd +ucode +ucode-mod-fs +ucode-mod-ubus +ucode-mod-uci +ucode-mod-uloop +PACKAGE_uxc:rpcd
|
|
TITLE:=OpenWrt container management
|
|
MAINTAINER:=Daniel Golle <daniel@makrotopia.org>
|
|
endef
|
|
|
|
define Package/procd/config
|
|
menu "Configuration"
|
|
depends on PACKAGE_procd || PACKAGE_procd-selinux
|
|
|
|
config PROCD_SHOW_BOOT
|
|
bool
|
|
default n
|
|
prompt "Print the shutdown to the console as well as logging it to syslog"
|
|
|
|
endmenu
|
|
endef
|
|
|
|
ifeq ($(BUILD_VARIANT),selinux)
|
|
CMAKE_OPTIONS += -DSELINUX=1
|
|
endif
|
|
|
|
ifeq ($(CONFIG_PROCD_SHOW_BOOT),y)
|
|
CMAKE_OPTIONS += -DSHOW_BOOT_ON_CONSOLE=1
|
|
endif
|
|
|
|
ifdef CONFIG_PACKAGE_procd-ujail
|
|
CMAKE_OPTIONS += -DJAIL_SUPPORT=1
|
|
endif
|
|
|
|
SECCOMP=$(if $(CONFIG_PACKAGE_procd-seccomp),1,0)
|
|
CMAKE_OPTIONS += -DSECCOMP_SUPPORT=$(SECCOMP) -DUTRACE_SUPPORT=$(SECCOMP)
|
|
|
|
define Package/procd/install
|
|
$(INSTALL_DIR) $(1)/sbin $(1)/etc $(1)/etc/hotplug.json.d \
|
|
$(1)/etc/hotplug-preinit.json.d $(1)/lib/functions
|
|
|
|
$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/{init,procd,askfirst,udevtrigger,upgraded} $(1)/sbin/
|
|
$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/libsetlbf.so $(1)/lib
|
|
$(INSTALL_BIN) ./files/reload_config $(1)/sbin/
|
|
$(INSTALL_CONF) ./files/hotplug*.json $(1)/etc/
|
|
$(INSTALL_DATA) ./files/procd.sh $(1)/lib/functions/
|
|
$(INSTALL_BIN) ./files/service $(1)/sbin/service
|
|
endef
|
|
|
|
Package/procd-selinux/install = $(Package/procd/install)
|
|
|
|
define Package/procd-ujail/install
|
|
$(INSTALL_DIR) $(1)/sbin
|
|
$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/ujail $(1)/sbin/
|
|
endef
|
|
|
|
define Package/procd-seccomp/install
|
|
$(INSTALL_DIR) $(1)/sbin
|
|
$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/trace2seccomp $(1)/sbin/
|
|
$(LN) trace2seccomp $(1)/sbin/utrace
|
|
$(LN) trace2seccomp $(1)/sbin/seccomp-trace
|
|
endef
|
|
|
|
define Package/uxc/conffiles
|
|
/etc/uxc
|
|
endef
|
|
|
|
define Package/uxc/install
|
|
$(INSTALL_DIR) $(1)/sbin $(1)/usr/share/uxc
|
|
$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/uxc $(1)/sbin/
|
|
$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/uxc-net $(1)/sbin/
|
|
$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/uxc-stack $(1)/sbin/
|
|
$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/share/uxc/uxc-stack.uc $(1)/usr/share/uxc/
|
|
$(INSTALL_DIR) $(1)/etc/init.d
|
|
$(INSTALL_BIN) ./files/uxc.init $(1)/etc/init.d/uxc
|
|
$(INSTALL_DIR) $(1)/lib/functions
|
|
$(INSTALL_DATA) ./files/uxc.sh $(1)/lib/functions/
|
|
endef
|
|
|
|
$(eval $(call BuildPackage,procd))
|
|
$(eval $(call BuildPackage,procd-selinux))
|
|
$(eval $(call BuildPackage,procd-ujail))
|
|
$(eval $(call BuildPackage,procd-seccomp))
|
|
$(eval $(call BuildPackage,uxc))
|