mirror of
https://github.com/openwrt/packages.git
synced 2026-06-01 15:32:05 +08:00
John Audia
7301104e68
Rsyncd only needs a subset of all capabilities so create
a dedicated user with these capabilities. This is better from both a
security and an isolation perspective than running as root.
Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc
Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 2a7364534e)
22 lines
475 B
Bash
22 lines
475 B
Bash
#!/bin/sh /etc/rc.common
|
|
# Copyright (C) 2011-2014 OpenWrt.org
|
|
|
|
START=90
|
|
STOP=10
|
|
|
|
USE_PROCD=1
|
|
PROG=/usr/bin/rsync
|
|
|
|
start_service() {
|
|
procd_open_instance
|
|
procd_set_param command "$PROG" --daemon --no-detach
|
|
[ -x /sbin/ujail -a -e /etc/capabilities/rsyncd.json ] && {
|
|
procd_add_jail rsyncd
|
|
procd_set_param capabilities /etc/capabilities/rsyncd.json
|
|
procd_set_param user rsyncd
|
|
procd_set_param group rsyncd
|
|
procd_set_param no_new_privs 1
|
|
}
|
|
procd_close_instance
|
|
}
|