From patchwork Sun Apr 19 17:18:04 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Fitzenreiter X-Patchwork-Id: 2989 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 494xP84RqRz3xQv for ; Sun, 19 Apr 2020 17:18:20 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail02.haj.ipfire.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 494xP52jKdz1jd; Sun, 19 Apr 2020 17:18:17 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 494xP46d8Tz2yPM; Sun, 19 Apr 2020 17:18:16 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 494xP36641z2xlT for ; Sun, 19 Apr 2020 17:18:15 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (Client did not present a certificate) by mail01.ipfire.org (Postfix) with ESMTPSA id 494xP31Gqmz1jd; Sun, 19 Apr 2020 17:18:15 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1587316695; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc; bh=uMThG/WHq0Ca5M0f9E1QKxRZvvG5tsMIGgiG7UIIi/I=; b=ugQ2YmXEDt/a0F97hsIYCVloH+81XeLr52x/oL24xASp+eS/f5sMmhCcD6DB6qMRzU+g8Y LoBvTi2yx7A0OYBQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1587316695; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc; bh=uMThG/WHq0Ca5M0f9E1QKxRZvvG5tsMIGgiG7UIIi/I=; b=OFOWL3lgMaSXcbrnDZpux1KjJqvRaOM97cd18v232Hmsb9oNGuOT6h9+h8Q8dXXDbZClNj 1GqGgKYjJt6MyCUFrAuj69LtZ0J0+FcTRL2v5BoTzQFDK9VwsTHHgIV8+0lD0C7nlijnnS I+Hl17wpnRjpAsb1idVsve9VuPwQ4/YysusqkRi8kUP2EjrB5GpVc8stK6wls+LsQ3tr94 JaauPashZSsOwPH1fgPBhGjnFUNM4ViNw0S4rLlSJF2v4ax6w2c5sE78/1/PeH3Pz8upjP Gd1H/jLaVjnUvMLi8FLsOK1d8JsHRaVXkcORUcxT49SHaJJ1gooRaeH/MHLw5g== From: Arne Fitzenreiter To: development@lists.ipfire.org Subject: [PATCH] dhcpcd: create dhcpcd user and chroot folder Date: Sun, 19 Apr 2020 19:18:04 +0200 Message-Id: <20200419171804.2471-1-arne_f@ipfire.org> Authentication-Results: mail01.ipfire.org; auth=pass smtp.mailfrom=arne_f@ipfire.org X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Arne Fitzenreiter Errors-To: development-bounces@lists.ipfire.org Sender: "Development" dhcpcd 9.x adds privelege seperation by creating a chroot and running parts of the client not as root. Signed-off-by: Arne Fitzenreiter --- config/etc/group | 1 + config/etc/passwd | 1 + src/initscripts/system/mountkernfs | 5 +++++ 3 files changed, 7 insertions(+) diff --git a/config/etc/group b/config/etc/group index 4855214be..f1767b30c 100644 --- a/config/etc/group +++ b/config/etc/group @@ -20,6 +20,7 @@ dip:x:40: ftp:x:45: rsyncd:x:48: stunnel:x:51: +dhcpcd:x:52: lock:x:54: sshd:x:74: pcap:x:77: diff --git a/config/etc/passwd b/config/etc/passwd index 7893b43c9..cb0428085 100644 --- a/config/etc/passwd +++ b/config/etc/passwd @@ -7,6 +7,7 @@ ntp:x:38:38::/etc/ntp:/bin/false ftp:x:45:45:anonymous_user:/home/ftp:/bin/false rsyncd:x:48:48:rsyncd Daemon:/home/rsync:/bin/false stunnel:x:51:51:stunnel Daemon:/var/lib/stunnel:/bin/false +dhcpcd:x:52:52:dhcpcd privsep user:/run/dhcpcd/chroot:/bin/false sshd:x:74:74:sshd:/var/empty:/bin/false nobody:x:99:99:Nobody:/home/nobody:/bin/false postfix:x:100:100::/var/spool/postfix:/bin/false diff --git a/src/initscripts/system/mountkernfs b/src/initscripts/system/mountkernfs index f7be82d01..f0bfc5289 100644 --- a/src/initscripts/system/mountkernfs +++ b/src/initscripts/system/mountkernfs @@ -34,6 +34,11 @@ case "${1}" in mount -n -t tmpfs -o nosuid,nodev,mode=755,size=8M /run /run || failed=1 fi + # create folder for dhcpcd changeroot + mkdir -p /run/dhcpcd/chroot + chown dhcpcd:dhcpcd /run/dhcpcd/chroot + chmod 750 /run/dhcpcd/chroot + boot_mesg "" ${NORMAL} (exit ${failed})