openwrt-mirror/packages
1
0 Fork 0
mirror of https://github.com/openwrt/packages.git synced 2026-10-13 20:57:37 +04:00
Code Issues Packages Projects Releases Wiki Activity
Files
830fca1ed782e1860aa4e43387f5be169c0ca647
packages/utils/gpsd/Makefile
T
Michael Pfeifroth edef6a4926 gpsd: run as dedicated 'gpsd' system user 
Create a dedicated 'gpsd' system user at package-install time (via
USERID) and pin gpsd's built-in privilege-separation identity to it
via the SConstruct 'gpsd_user' option.

Background: gpsd needs to start as root to open the underlying tty /
serial device but then internally setuid()s to a configured
unprivileged identity for the rest of its lifetime -- a built-in
privilege-separation feature of the daemon.

The current package leaves 'gpsd_user' at scons' default 'nobody'.
Sharing 'nobody' across daemons is a hardening anti-pattern:
a compromise of any one 'nobody'-owned process can trivially
interfere with any other, and audit trails become ambiguous.

Group choice: gpsd_group is a device-access knob rather than an
identity knob -- once gpsd has setuid()d away from root it still
needs to open() tty / serial nodes, which OpenWrt exposes as
root:dialout mode 0660 (see procd hotplug.json and base-files
/etc/group).  What actually keeps that access working post-drop is
the setgid() target that gpsd_group selects: gpsd calls
setgroups(0, NULL) immediately before dropping privileges, so any
supplementary groups on the target user are discarded and cannot
carry the permission.

scons' gpsd_group default is not 'nobody' but 'dialout' (uucp on
Gentoo build hosts), so on OpenWrt buildbots the daemon already
lands in 'dialout' today.  Pin gpsd_group=dialout explicitly so the
resulting binary no longer depends on the builder's /etc/gentoo-release:
a Gentoo builder would otherwise bake in 'uucp', a group base-files
does not ship, and gpsd's getgrnam() fallback silently keeps root's
gid in that case.

USERID's third field ('dialout=20') still adds the gpsd user to the
dialout group in /etc/group.  This does not affect the running
daemon (setgroups() strips it) but matches Debian's gpsd packaging
and lets an operator run gpsdctl / gpsmon as 'gpsd' by hand against
device nodes.  GID 20 is the value already frozen into base-files.

Giving gpsd its own primary user:

  * confines a hypothetical gpsd RCE (there have been NMEA / UBX
    parsing bugs historically) to files owned by 'gpsd' rather than
    to the shared 'nobody' identity;
  * matches the long-standing Debian gpsd packaging convention
    (adduser --system gpsd, member of dialout);
  * is a no-op for correctly-configured installations that never
    referenced 'nobody' as an intentional identity.

No numeric UID is pinned for the primary 'gpsd' user -- dynamic
assignment via USERID is sufficient here since no cross-distro
NFS/sudoers-style muscle memory depends on a specific number.

Bump PKG_RELEASE.

Signed-off-by: Michael Pfeifroth <micpf@westermo.com>
2026-08-07 13:47:42 +03:00

180 lines
4.8 KiB
Makefile
Raw Blame History

#
# Copyright (C) 2006-2015 OpenWrt.org
#
# This is free software, licensed under the GNU General Public License v2.
# See /LICENSE for more information.
#
include $(TOPDIR)/rules.mk
PKG_NAME:=gpsd
PKG_VERSION:=3.26.1
PKG_RELEASE:=3
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
PKG_SOURCE_URL:=@SAVANNAH/$(PKG_NAME)
PKG_HASH:=45c0d4779324bd59a47cfcb7ac57180d2dbdf418603d398a079392dabf1f740c
PKG_MAINTAINER:=Pushpal Sidhu <psidhu.devel@gmail.com>
PKG_LICENSE:=BSD-3-Clause
PKG_LICENSE_FILES:=COPYING
PKG_CPE_ID:=cpe:/a:gpsd_project:gpsd
PKG_BUILD_DEPENDS:=scons/host
include $(INCLUDE_DIR)/package.mk
include ../../devel/scons/scons.mk
define Package/gpsd/Default
DEPENDS+= +libusb-1.0
URL:=https://gpsd.gitlab.io/gpsd/
endef
define Package/gpsd/Default/description
gpsd is a userland daemon acting as a translator between GPS and AIS receivers
and their clients. gpsd listens on port 2947 for clients requesting
position/time/velocity information. The receivers are expected to generate
position information in a well-known format -- as NMEA-0183 sentences, SiRF
binary, Rockwell binary, Garmin binary format, or other vendor binary
protocols. gpsd takes this information from the GPS and translates it into
something uniform and easier to understand for clients.
endef
define Package/gpsd
$(call Package/gpsd/Default)
SECTION:=utils
CATEGORY:=Utilities
TITLE:=An interface daemon for GPS receivers
USERID:=gpsd:gpsd:dialout=20
DEPENDS+= +gpsd-utils
endef
define Package/gpsd/conffiles
/etc/config/gpsd
endef
define Package/gpsd/description
$(call Package/gpsd/Default/description)
This package contains the GPS daemon.
endef
define Package/gpsd-clients
$(call Package/gpsd/Default)
SECTION:=utils
CATEGORY:=Utilities
DEPENDS+= +libncurses
TITLE:=GPS tools and clients
endef
define Package/gpsd-clients/description
$(call Package/gpsd/Default/description)
This package contains auxiliary tools and example clients for monitoring and
testing the GPS daemon.
endef
define Package/gpsd-utils
$(call Package/gpsd/Default)
SECTION:=utils
CATEGORY:=Utilities
TITLE:=GPS daemon utils
endef
define Package/gpsd-utils/description
$(call Package/gpsd/Default/description)
This package contains utilities for interacting with GPS daemon.
endef
define Package/libgps
$(call Package/gpsd/Default)
SECTION:=libs
CATEGORY:=Libraries
TITLE:=C service library for communicating with the GPS daemon
ABI_VERSION:=31
endef
define Package/libgps/description
$(call Package/gpsd/Default/description)
This package contains the libgps library.
endef
SCONS_VARS += \
CFLAGS="$(TARGET_CFLAGS) $(EXTRA_CFLAGS) -L$(STAGING_DIR)/usr/lib" \
LINKFLAGS="$(TARGET_LDFLAGS)"
SCONS_OPTIONS += \
gpsd_user=gpsd \
gpsd_group=dialout \
target_platform=linux \
dbus_export=no \
tsip=no \
fv18=no \
tripmate=no \
earthmate=no \
itrax=no \
navcom=no \
ubx=no \
evermore=no \
ntrip=no \
libgpsmm=no \
libQgpsmm=no \
bluez=no \
nostrip=yes \
python=no \
implicit_link=no \
chrpath=no \
manbuild=no \
sysroot="$(TOOLCHAIN_ROOT_DIR)" \
target="$(TARGET_CROSS:-=)"
define Build/InstallDev
$(INSTALL_DIR) $(1)/usr/include
$(CP) $(PKG_INSTALL_DIR)/usr/include/gps.h $(1)/usr/include/
$(INSTALL_DIR) $(1)/usr/lib
$(CP) $(PKG_INSTALL_DIR)/usr/lib/libgps*.so* $(1)/usr/lib/
$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libgps.pc $(1)/usr/lib/pkgconfig
$(SED) 's,/usr/include,$$$${prefix}/include,g' $(1)/usr/lib/pkgconfig/libgps.pc
$(SED) 's,/usr/lib,$$$${exec_prefix}/lib,g' $(1)/usr/lib/pkgconfig/libgps.pc
endef
define Package/gpsd/install
$(INSTALL_DIR) $(1)/etc/config
$(INSTALL_CONF) ./files/gpsd.config $(1)/etc/config/gpsd
$(INSTALL_DIR) $(1)/etc/init.d
$(INSTALL_BIN) ./files/gpsd.init $(1)/etc/init.d/gpsd
$(INSTALL_DIR) $(1)/usr/sbin
$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/gpsd $(1)/usr/sbin/
$(INSTALL_BIN) ./files/usr/sbin/gpsd-wrapper $(1)/usr/sbin/
$(INSTALL_DIR) $(1)/etc/gpsd
$(INSTALL_BIN) ./files/etc/gpsd/device-hook $(1)/etc/gpsd/
$(INSTALL_DIR) $(1)/etc/uci-defaults
$(INSTALL_DATA) ./files/etc/uci-defaults/* $(1)/etc/uci-defaults/
endef
define Package/gpsd-clients/install
$(INSTALL_DIR) $(1)/usr/bin
$(INSTALL_BIN) \
$(PKG_INSTALL_DIR)/usr/bin/cgps \
$(PKG_INSTALL_DIR)/usr/bin/gps{ctl,decode,mon,pipe} \
$(PKG_INSTALL_DIR)/usr/bin/gpxlogger \
$(PKG_INSTALL_DIR)/usr/bin/lcdgps \
$(1)/usr/bin/
endef
define Package/gpsd-utils/install
$(INSTALL_DIR) $(1)/usr/sbin
$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/gpsdctl $(1)/usr/sbin/
endef
define Package/libgps/install
$(INSTALL_DIR) $(1)/usr/lib
$(CP) $(PKG_INSTALL_DIR)/usr/lib/libgps.so.$(ABI_VERSION)* $(1)/usr/lib/
endef
$(eval $(call BuildPackage,gpsd))
$(eval $(call BuildPackage,gpsd-clients))
$(eval $(call BuildPackage,gpsd-utils))
$(eval $(call BuildPackage,libgps))
Reference in new issue View Git Blame Copy Permalink