diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2024-05-14 14:43:03 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2024-05-14 15:27:26 +0000 |
| commit | 52fe0689eac79f0287cd884f526d33d44237869a (patch) | |
| tree | 90574524338467cd3c61cb84c65f8e3ca1f44882 /net-mgmt | |
| parent | 9ba210177e0372d011e5f01be55559aed0eb9785 (diff) | |
| download | ports-52fe0689eac79f0287cd884f526d33d44237869a.tar.gz ports-52fe0689eac79f0287cd884f526d33d44237869a.zip | |
net-mgmt/net-snmp: Avoid changing to the snmpd user for now
Switching the user might break existing configurations, for reasons that
are not fully clear yet. Avoid surprises by letting users opt-in to
that change, for now.
Also provide an rc.conf variable to make it easy to configure snmpd to
drop privileges if they so choose.
Reported by: dvl
Approved by: zi
Sponsored by: Klara, Inc.
Sponsored by: Stormshield
Differential Revision: https://reviews.freebsd.org/D45199
Diffstat (limited to 'net-mgmt')
| -rw-r--r-- | net-mgmt/net-snmp/Makefile | 2 | ||||
| -rw-r--r-- | net-mgmt/net-snmp/files/snmpd.in | 13 |
2 files changed, 13 insertions, 2 deletions
diff --git a/net-mgmt/net-snmp/Makefile b/net-mgmt/net-snmp/Makefile index 5fca4ba36051..01534364feb8 100644 --- a/net-mgmt/net-snmp/Makefile +++ b/net-mgmt/net-snmp/Makefile @@ -1,7 +1,7 @@ PORTNAME= snmp PORTVERSION= 5.9.4 PORTEPOCH= 1 -PORTREVISION= 1 +PORTREVISION= 2 CATEGORIES= net-mgmt MASTER_SITES= SF/net-${PORTNAME}/net-${PORTNAME}/${PORTVERSION} \ ZI diff --git a/net-mgmt/net-snmp/files/snmpd.in b/net-mgmt/net-snmp/files/snmpd.in index 7f140200aa45..7f75cacad813 100644 --- a/net-mgmt/net-snmp/files/snmpd.in +++ b/net-mgmt/net-snmp/files/snmpd.in @@ -8,6 +8,12 @@ # snmpd_enable="YES" # snmpd_flags="<set as needed>" # snmpd_conffile="<set as needed>" +# +# Add the following line to make snmpd drop privileges after initialization. +# This might invalidate existing SNMPv3 users. +# +# snmpd_sugid="YES" +# . /etc/rc.subr @@ -18,6 +24,7 @@ load_rc_config snmpd snmpd_enable=${snmpd_enable:-"NO"} snmpd_flush_cache=${snmpd_flush_cache-"NO"} +snmpd_sugid=${snmpd_sugid:-"NO"} pidfile=${snmpd_pidfile:-"/var/run/net_snmpd.pid"} @@ -57,7 +64,11 @@ net_snmpd_precmd () { if [ -n "${snmpd_conffile_set}" ]; then rc_flags="-c ${snmpd_conffile_set#,} ${rc_flags}" fi - rc_flags="-u snmpd -g snmpd -p ${pidfile} ${rc_flags}" + if checkyesno snmpd_sugid; then + rc_flags="-u snmpd -g snmpd ${rc_flags}" + fi + + rc_flags="-p ${pidfile} ${rc_flags}" } run_rc_command "$1" |