meta-security/recipes-security/cynara/cynara/0005-Allow-to-tune-sockets.patch

   1 From ebde8e9fdba7bc1c8152f7e45c551030a36ece82 Mon Sep 17 00:00:00 2001
   2 From: =?UTF-8?q?Jos=C3=A9=20Bollo?= <jose.bollo@iot.bzh>
   3 Date: Thu, 25 Jan 2018 13:47:37 +0100
   4 Subject: [PATCH] Allow to tune sockets
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 Allow to change the directory of sockets
  10 through a true integration of SOCKET_DIR
  11
  12 Allow to override the socket's group of
  13  - /run/cynara/cynara-agent.socket
  14  - /run/cynara/cynara-monitor-get.socket
  15
  16 through the newly defined variable CYNARA_ADMIN_SOCKET_GROUP
  17
  18 Change-Id: I7d58854c328e948e3d6d7fa3fc00569fd08f8aef
  19 Signed-off-by: José Bollo <jose.bollo@iot.bzh>
  20
  21 ---
  22  systemd/CMakeLists.txt               | 19 +++++++++++++++----
  23  systemd/cynara-admin.socket          | 14 --------------
  24  systemd/cynara-admin.socket.in       | 14 ++++++++++++++
  25  systemd/cynara-agent.socket          | 15 ---------------
  26  systemd/cynara-agent.socket.in       | 15 +++++++++++++++
  27  systemd/cynara-monitor-get.socket    | 15 ---------------
  28  systemd/cynara-monitor-get.socket.in | 15 +++++++++++++++
  29  systemd/cynara.socket                | 14 --------------
  30  systemd/cynara.socket.in             | 14 ++++++++++++++
  31  9 files changed, 73 insertions(+), 62 deletions(-)
  32  delete mode 100644 systemd/cynara-admin.socket
  33  create mode 100644 systemd/cynara-admin.socket.in
  34  delete mode 100644 systemd/cynara-agent.socket
  35  create mode 100644 systemd/cynara-agent.socket.in
  36  delete mode 100644 systemd/cynara-monitor-get.socket
  37  create mode 100644 systemd/cynara-monitor-get.socket.in
  38  delete mode 100644 systemd/cynara.socket
  39  create mode 100644 systemd/cynara.socket.in
  40
  41 diff --git a/systemd/CMakeLists.txt b/systemd/CMakeLists.txt
  42 index 20accf0..1b75c12 100644
  43 --- a/systemd/CMakeLists.txt
  44 +++ b/systemd/CMakeLists.txt
  45 @@ -16,13 +16,24 @@
  46  # @author      Lukasz Wojciechowski <l.wojciechow@partner.samsung.com>
  47  #
  48
  49 +SET(CYNARA_ADMIN_SOCKET_GROUP
  50 +    "security_fw"
  51 +    CACHE STRING
  52 +    "Group to apply on administrative sockets")
  53 +
  54 +
  55 +CONFIGURE_FILE(cynara.socket.in             cynara.socket @ONLY)
  56 +CONFIGURE_FILE(cynara-admin.socket.in       cynara-admin.socket @ONLY)
  57 +CONFIGURE_FILE(cynara-agent.socket.in       cynara-agent.socket @ONLY)
  58 +CONFIGURE_FILE(cynara-monitor-get.socket.in cynara-monitor-get.socket @ONLY)
  59 +
  60  INSTALL(FILES
  61      ${CMAKE_SOURCE_DIR}/systemd/cynara.service
  62      ${CMAKE_SOURCE_DIR}/systemd/cynara.target
  63 -    ${CMAKE_SOURCE_DIR}/systemd/cynara.socket
  64 -    ${CMAKE_SOURCE_DIR}/systemd/cynara-admin.socket
  65 -    ${CMAKE_SOURCE_DIR}/systemd/cynara-agent.socket
  66 -    ${CMAKE_SOURCE_DIR}/systemd/cynara-monitor-get.socket
  67 +    ${CMAKE_BINARY_DIR}/systemd/cynara.socket
  68 +    ${CMAKE_BINARY_DIR}/systemd/cynara-admin.socket
  69 +    ${CMAKE_BINARY_DIR}/systemd/cynara-agent.socket
  70 +    ${CMAKE_BINARY_DIR}/systemd/cynara-monitor-get.socket
  71      DESTINATION
  72      ${SYSTEMD_UNIT_DIR}
  73  )
  74 diff --git a/systemd/cynara-admin.socket b/systemd/cynara-admin.socket
  75 deleted file mode 100644
  76 index ed38386..0000000
  77 --- a/systemd/cynara-admin.socket
  78 +++ /dev/null
  79 @@ -1,14 +0,0 @@
  80 -[Socket]
  81 -ListenStream=/run/cynara/cynara-admin.socket
  82 -SocketMode=0600
  83 -SmackLabelIPIn=@
  84 -SmackLabelIPOut=@
  85 -
  86 -Service=cynara.service
  87 -
  88 -[Unit]
  89 -Wants=cynara.target
  90 -Before=cynara.target
  91 -
  92 -[Install]
  93 -WantedBy=sockets.target
  94 diff --git a/systemd/cynara-admin.socket.in b/systemd/cynara-admin.socket.in
  95 new file mode 100644
  96 index 0000000..2364c3e
  97 --- /dev/null
  98 +++ b/systemd/cynara-admin.socket.in
  99 @@ -0,0 +1,14 @@
 100 +[Socket]
 101 +ListenStream=@SOCKET_DIR@/cynara-admin.socket
 102 +SocketMode=0600
 103 +SmackLabelIPIn=@
 104 +SmackLabelIPOut=@
 105 +
 106 +Service=cynara.service
 107 +
 108 +[Unit]
 109 +Wants=cynara.target
 110 +Before=cynara.target
 111 +
 112 +[Install]
 113 +WantedBy=sockets.target
 114 diff --git a/systemd/cynara-agent.socket b/systemd/cynara-agent.socket
 115 deleted file mode 100644
 116 index 5a677e0..0000000
 117 --- a/systemd/cynara-agent.socket
 118 +++ /dev/null
 119 @@ -1,15 +0,0 @@
 120 -[Socket]
 121 -ListenStream=/run/cynara/cynara-agent.socket
 122 -SocketGroup=security_fw
 123 -SocketMode=0060
 124 -SmackLabelIPIn=*
 125 -SmackLabelIPOut=@
 126 -
 127 -Service=cynara.service
 128 -
 129 -[Unit]
 130 -Wants=cynara.target
 131 -Before=cynara.target
 132 -
 133 -[Install]
 134 -WantedBy=sockets.target
 135 diff --git a/systemd/cynara-agent.socket.in b/systemd/cynara-agent.socket.in
 136 new file mode 100644
 137 index 0000000..4f86c9d
 138 --- /dev/null
 139 +++ b/systemd/cynara-agent.socket.in
 140 @@ -0,0 +1,15 @@
 141 +[Socket]
 142 +ListenStream=@SOCKET_DIR@/cynara-agent.socket
 143 +SocketGroup=@CYNARA_ADMIN_SOCKET_GROUP@
 144 +SocketMode=0060
 145 +SmackLabelIPIn=*
 146 +SmackLabelIPOut=@
 147 +
 148 +Service=cynara.service
 149 +
 150 +[Unit]
 151 +Wants=cynara.target
 152 +Before=cynara.target
 153 +
 154 +[Install]
 155 +WantedBy=sockets.target
 156 diff --git a/systemd/cynara-monitor-get.socket b/systemd/cynara-monitor-get.socket
 157 deleted file mode 100644
 158 index a50feeb..0000000
 159 --- a/systemd/cynara-monitor-get.socket
 160 +++ /dev/null
 161 @@ -1,15 +0,0 @@
 162 -[Socket]
 163 -ListenStream=/run/cynara/cynara-monitor-get.socket
 164 -SocketGroup=security_fw
 165 -SocketMode=0060
 166 -SmackLabelIPIn=@
 167 -SmackLabelIPOut=@
 168 -
 169 -Service=cynara.service
 170 -
 171 -[Unit]
 172 -Wants=cynara.target
 173 -Before=cynara.target
 174 -
 175 -[Install]
 176 -WantedBy=sockets.target
 177 diff --git a/systemd/cynara-monitor-get.socket.in b/systemd/cynara-monitor-get.socket.in
 178 new file mode 100644
 179 index 0000000..b88dbf7
 180 --- /dev/null
 181 +++ b/systemd/cynara-monitor-get.socket.in
 182 @@ -0,0 +1,15 @@
 183 +[Socket]
 184 +ListenStream=@SOCKET_DIR@/cynara-monitor-get.socket
 185 +SocketGroup=@CYNARA_ADMIN_SOCKET_GROUP@
 186 +SocketMode=0060
 187 +SmackLabelIPIn=@
 188 +SmackLabelIPOut=@
 189 +
 190 +Service=cynara.service
 191 +
 192 +[Unit]
 193 +Wants=cynara.target
 194 +Before=cynara.target
 195 +
 196 +[Install]
 197 +WantedBy=sockets.target
 198 diff --git a/systemd/cynara.socket b/systemd/cynara.socket
 199 deleted file mode 100644
 200 index fad2745..0000000
 201 --- a/systemd/cynara.socket
 202 +++ /dev/null
 203 @@ -1,14 +0,0 @@
 204 -[Socket]
 205 -ListenStream=/run/cynara/cynara.socket
 206 -SocketMode=0666
 207 -SmackLabelIPIn=*
 208 -SmackLabelIPOut=@
 209 -
 210 -Service=cynara.service
 211 -
 212 -[Unit]
 213 -Wants=cynara.target
 214 -Before=cynara.target
 215 -
 216 -[Install]
 217 -WantedBy=sockets.target
 218 diff --git a/systemd/cynara.socket.in b/systemd/cynara.socket.in
 219 new file mode 100644
 220 index 0000000..ba76549
 221 --- /dev/null
 222 +++ b/systemd/cynara.socket.in
 223 @@ -0,0 +1,14 @@
 224 +[Socket]
 225 +ListenStream=@SOCKET_DIR@/cynara.socket
 226 +SocketMode=0666
 227 +SmackLabelIPIn=*
 228 +SmackLabelIPOut=@
 229 +
 230 +Service=cynara.service
 231 +
 232 +[Unit]
 233 +Wants=cynara.target
 234 +Before=cynara.target
 235 +
 236 +[Install]
 237 +WantedBy=sockets.target