Merge pull request #23 from fraenki/haproxy_chroot

net/haproxy: chroot fixes

net/haproxy/src/etc/inc/plugins.inc.d/haproxy.inc

@@ -37,7 +37,7 @@ function haproxy_syslog()
     $syslogconf = array();
 
     $syslogconf['haproxy'] = array(
-        'local' => '/var/run/haproxy/var/run/log',
+        'local' => '/var/haproxy/var/run/log',
         'facility' => array('haproxy'),
         'remote' => 'relayd',
     );

net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml

@@ -24,12 +24,6 @@
                 <help><![CDATA[Enable or disable HAProxy running as root.<br/><div class="text-info"><b>NOTE:</b> Enabling root could be a security issue but it's required by some feature.</div>]]></help>
                 <advanced>true</advanced>
             </field>
-            <field>
-                <id>haproxy.general.tuning.chroot</id>
-                <label>Secure mode (chroot)</label>
-                <type>checkbox</type>
-                <help><![CDATA[Enable or disable HAProxy's chroot feature.]]></help>
-            </field>
             <field>
                 <id>haproxy.general.tuning.nbproc</id>
                 <label>HAProxy processes</label>

net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml

@@ -14,10 +14,6 @@
                     <default>0</default>
                     <Required>Y</Required>
                 </root>
-                <chroot type="BooleanField">
-                    <default>1</default>
-                    <Required>Y</Required>
-                </chroot>
                 <maxConnections type="IntegerField">
                     <MinimumValue>1</MinimumValue>
                     <MaximumValue>500000</MaximumValue>

net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/setup.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 
-HAPROXY_DIRS="/var/run/haproxy /var/etc/haproxy/ssl /var/etc/haproxy/lua /var/etc/haproxy/errorfiles"
+HAPROXY_DIRS="/var/haproxy/var/run /var/etc/haproxy/ssl /var/etc/haproxy/lua /var/etc/haproxy/errorfiles"
 
 for directory in ${HAPROXY_DIRS}; do
     mkdir -p ${directory}
@@ -9,7 +9,7 @@ for directory in ${HAPROXY_DIRS}; do
 done
 
 # chroot dir must not be writable
-chmod 550 /var/run/haproxy
+find /var/haproxy -type d -exec chmod 550 {} \;
 
 # export required data to filesystem
 /usr/local/opnsense/scripts/OPNsense/HAProxy/exportCerts.php > /dev/null 2>&1

net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf

@@ -446,9 +446,7 @@ global
     uid                         80
 {% endif %}
     gid                         80
-{% if OPNsense.HAProxy.general.tuning.chroot == "1" %}
-    chroot                      /var/run/haproxy
-{% endif %}
+    chroot                      /var/haproxy
     daemon
     stats                       socket /var/run/haproxy.socket level admin
     nbproc                      {{OPNsense.HAProxy.general.tuning.nbproc}}