debian: Run the server as `tripe' rather than `root'.

We have the fancy privilege separation machinery now, so we might as
well actually use it.  This involves (a) slightly hacking the
/etc/default/tripe file to set the user and group, and (b) actually
creating the necessary user and group accounts in the postinst script.

diff --git a/debian/control b/debian/control
index b451153..fe30c90 100644 (file)
--- a/debian/control
+++ b/debian/control
@@ -9,7 +9,7 @@ Standards-Version: 3.1.1
 
 Package: tripe
 Architecture: any
-Depends: ${shlibs:Depends}, makedev (>= 2.3.1-63)
+Depends: ${shlibs:Depends}, makedev (>= 2.3.1-63), adduser
 Recommends: catacomb-bin
 Suggests: pkstream
 Description: Trivial IP Encryption: a simple virtual private network

diff --git a/debian/rules b/debian/rules
index 0a422e8..7cc8074 100755 (executable)
--- a/debian/rules
+++ b/debian/rules
@@ -38,7 +38,8 @@ binary-install/python-tripe::
 
 install/tripe::
        cp $(DEB_BUILDDIR)/init/tripe-init debian/tripe.init
-       cp $(DEB_SRCDIR)/init/tripe.conf debian/tripe.default
+       sed 's/^#\(user\|group\)/\1/' \
+               $(DEB_SRCDIR)/init/tripe.conf >debian/tripe.default
 
 cleanbuilddir::
        rm -f debian/tripe.init debian/tripe.default

diff --git a/debian/tripe.postinst b/debian/tripe.postinst
index 468f196..2994690 100644 (file)
--- a/debian/tripe.postinst
+++ b/debian/tripe.postinst
@@ -2,8 +2,24 @@
 
 set -e
 
-if [ ! -c /dev/.devfsd ] && [ ! -c /dev/net/tun ]; then
+## Make sure that /dev/net/tun exists.  Don't do anything special if devfs or
+## udev is running.
+if [ ! -c /dev/.devfsd ] &&
+   [ ! -d /dev/.udev ] &&
+   [ ! -c /dev/net/tun ]
+then
+  echo "/dev/net/tun not present: invoking MAKEDEV to create it."
   (cd /dev && /sbin/MAKEDEV tun)
 fi
 
+## Make sure that the `tripe' user and group exist.
+getent group tripe >/dev/null ||
+       addgroup --system tripe
+getent passwd tripe >/dev/null || \
+       adduser --system \
+               --ingroup tripe \
+               --home /etc/tripe \
+               --gecos "TrIPE server" \
+               tripe
+
 #DEBHELPER#