mirror of
https://github.com/macports/macports-ports.git
synced 2026-07-12 18:20:25 -07:00
Nicholas HurleyandRenee Otten
2d11556daf
By default (and securely), vidoas explicitly sets the PATH to only include the bare minimum standard bin directories (under /, /usr, and /usr/local). However, since macports installs in /opt/local, when vidoas gets to the stage of validating the new configuration (using `doas -C`), it fails because doas is not on the PATH. This adds a patch to update the PATH in vidoas so it can succeed when installed via macports.
84 lines
3.6 KiB
Tcl
84 lines
3.6 KiB
Tcl
# -*- coding: utf-8; mode: tcl; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- vim:fenc=utf-8:ft=tcl:et:sw=4:ts=4:sts=4
|
|
|
|
PortSystem 1.0
|
|
PortGroup codeberg 1.0
|
|
PortGroup makefile 1.0
|
|
|
|
codeberg.setup thejessesmith doas 6.3p13
|
|
revision 2
|
|
checksums rmd160 7584ac777c09e07bbeb153f28be1f750963713a8 \
|
|
sha256 2cca9003856e92ec0a50b3e559b7f3132bf8293dc8302613933f8ed06c8c7fc5 \
|
|
size 34883
|
|
|
|
categories sysutils
|
|
maintainers {ryandesign @ryandesign} openmaintainer
|
|
license BSD
|
|
|
|
description a utility that lets a user run a command as another user
|
|
|
|
long_description ${name} allows a user to run a command as though they \
|
|
were another user. Typically doas is used to allow \
|
|
non-privileged users to run commands as though they were \
|
|
the root user. ${name} offers two benefits over sudo: its \
|
|
configuration file has a simple syntax and it is smaller, \
|
|
requiring less effort to audit the code. This makes it \
|
|
harder for both admins and coders to make mistakes that \
|
|
potentially open security holes in the system.
|
|
|
|
depends_build port:bison
|
|
|
|
build.env "OPT=${configure.optflags}"
|
|
|
|
patchfiles vidoas-fix-path.diff
|
|
|
|
post-patch {
|
|
reinplace "s|@PREFIX@|${prefix}|" ${worksrcpath}/vidoas
|
|
}
|
|
|
|
post-destroot {
|
|
xinstall -m 0644 ${worksrcpath}/doas.conf.sample ${destroot}${prefix}/etc
|
|
set docdir ${prefix}/share/doc/${subport}
|
|
xinstall -d ${destroot}${docdir}
|
|
xinstall -W ${worksrcpath} -m 0644 \
|
|
LICENSE \
|
|
README.md \
|
|
${destroot}${docdir}
|
|
# The following can be removed after MacPorts 2.12.2 has been
|
|
# available for a while. See https://trac.macports.org/ticket/73516
|
|
if {[vercmp [macports_version] < "2.12.2"] && [getuid] == 0} {
|
|
set macports_uid [name_to_uid $macportsuser]
|
|
set macports_gid [uname_to_gid $macportsuser]
|
|
fs-traverse -depth fullpath [list $destroot] {
|
|
file lstat $fullpath statinfo
|
|
# Ensure installed files are not owned by the unprivileged account
|
|
if {$statinfo(uid) == $macports_uid || $statinfo(gid) == $macports_gid} {
|
|
if {$statinfo(uid) == $macports_uid} {
|
|
ui_debug "Changing owner to ${install.user} for $fullpath"
|
|
set new_owner ${install.user}
|
|
} else {
|
|
# only group needs to be changed
|
|
set new_owner [name_to_uid $statinfo(uid)]
|
|
}
|
|
if {$statinfo(gid) == $macports_gid} {
|
|
ui_debug "Changing group to ${install.group} for $fullpath"
|
|
set new_group ${install.group}
|
|
} else {
|
|
# only owner needs to be changed
|
|
set new_group [name_to_gid $statinfo(gid)]
|
|
}
|
|
# Changing owner may also change permissions, so we restore
|
|
# them afterwards. 'file attributes' doesn't work on links
|
|
# (it operates on the link target instead) but links should
|
|
# not have setuid/setgid bits set anyway.
|
|
if {$statinfo(type) ne "link"} {
|
|
set saved_perms [file attributes $fullpath -permissions]
|
|
}
|
|
lchown $fullpath $new_owner $new_group
|
|
if {$statinfo(type) ne "link"} {
|
|
file attributes $fullpath -permissions $saved_perms
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|