OpenPKG Specs: tun/tun.spec@0ba300bdf30a (annotated)

tun/tun.spec@0ba300bdf30a (annotated)

tun/tun.spec

Mon, 20 Apr 2009 19:22:00 +0200

author: Michael Schloh von Bennewitz <michael@schloh.com>
date: Mon, 20 Apr 2009 19:22:00 +0200
changeset 178: 0ba300bdf30a
parent 75: b3a835aa617c
child 387: 33ae2d61c751
permissions: -rw-r--r--

Change unfortunate but partly useful overreaching security tradeoff.
The principle of allocating each running process an individual system
user and group can have security benefits, however maintining a plethora
of users, groups, processes, file modes, file permissions, and even
nonportable file ACLs on a host serving from a hundred processes has
some security disadvantages. This tradeoff is even worse for systems
like OpenPKG which benefit from administration transparency through the
use of minimal system intrusion and only three usage privilege levels.

 ##
 ##  tun.spec -- OpenPKG RPM Specification
 ##  Copyright (c) 2009 Michael Schloh von Bennewitz <michael@schloh.com>
 ##
 ##  Permission to use, copy, modify, and distribute this software for
 ##  any purpose with or without fee is hereby granted, provided that
 ##  the above copyright notice and this permission notice appear in all
 ##  copies.
 ##
 ##  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
 ##  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
 ##  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 ##  IN NO EVENT SHALL THE AUTHORS AND COPYRIGHT HOLDERS AND THEIR
 ##  CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 ##  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 ##  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
 ##  USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
 ##  ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 ##  OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
 ##  OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 ##  SUCH DAMAGE.
 ##
 # MSvB Fixme: Device driver could possibly be stripped
 #    %{l_shtool} install -c -m -s 755 \
 #        tun $RPM_BUILD_ROOT%{l_prefix}/lib/tun
 #   package information
 Name:         tun
 Summary:      Universal TUN/TAP Device Driver
 URL:          http://vtun.sourceforge.net/tun/
 Vendor:       Maxim Krasnyansky
 Packager:     Michael Schloh von Bennewitz
 Distribution: Michael Schloh von Bennewitz
 Class:        EVAL
 Group:        Driver
 License:      GPL
 Version:      1.1
 Release:      20090106
 #   list of sources
 Source0:      http://vtun.sourceforge.net/tun/tun-%{version}.tar.gz
 Patch0:       tun.patch
 #   build information
 Prefix:       %{l_prefix}
 BuildRoot:    %{l_buildroot}
 BuildPreReq:  OpenPKG, openpkg >= 20050726, make
 PreReq:       OpenPKG, openpkg >= 20050726
 AutoReq:      no
 AutoReqProv:  no
 %description
     Tun provides packet reception and transmission for user space
     programs. It can be viewed as a simple Point-to-Point device, which
     instead of receiving packets from a physical media, receives them
     from user space program and instead of sending packets via physical
     media writes them to the user space program.
 %track
     prog tun = {
         version   = %{version}
         url       = http://vtun.sourceforge.net/tun/
         regex     = tun-(__VER__)\.tar\.gz
     }
 %prep
     %setup -q -n tun-%{version}
     %patch -p0
 %build
     CC="%{l_cc}" \
     CFLAGS="%{l_cflags -O}" \
     ./configure \
         --prefix=%{l_prefix}
     locplat=`grep 'OS_DIR *=' Makefile | sed -e 's;OS_DIR[^=][^=]*= *\([^ ][^ ]*\);\1;'`
     ( cd $locplat
       %{l_make} %{l_mflags -O}
     ) || exit $?
 %install
     rm -rf $RPM_BUILD_ROOT
     %{l_shtool} mkdir -f -p -m 755 \
         $RPM_BUILD_ROOT%{l_prefix}/lib/tun
     locplat=`grep 'OS_DIR *=' Makefile | sed -e 's;OS_DIR[^=][^=]*= *\([^ ][^ ]*\);\1;'`
     ( cd $locplat
       %{l_shtool} install -c -m 644 \
           tun tun.conf if_tun.h $RPM_BUILD_ROOT%{l_prefix}/lib/tun
     ) || exit $?
     %{l_rpmtool} files -v -ofiles -r$RPM_BUILD_ROOT %{l_files_std}
 %files -f files
 %clean
     rm -rf $RPM_BUILD_ROOT
 %post
     if [ $1 -eq 1 -o $1 -eq 2 ]; then
         #   announce special nature of this package
         ( echo "Attention: The special nature of the package contents require privileged"
           echo "interation, and must be carefully copied and nonportably installed to"
           echo "system areas outside of the OpenPKG instance."
           echo ""
           echo "This package therefore does not conform to basic OpenPKG principles, and"
           echo "should be removed immediately after its short term utility is exhausted."
           echo ""
           echo "To complete the installation on a SVR4 style operating system:"
           echo ""
           echo "  $ su -"
           echo "  # find %{l_prefix}/lib/tun/ -print"
           echo "  # shtool install -c -m 755 -o root -g sys tun /usr/kernel/drv/"
           echo "  # shtool install -c -m 644 -o root -g sys tun.conf /usr/kernel/drv/"
           echo "  # shtool install -c -m 644 -o root -g bin if_tun.h /usr/include/net/"
           echo "  # /usr/sbin/rem_drv tun"
           echo "  # /usr/sbin/add_drv tun"
         ) | %{l_rpmtool} msg -b -t notice
     fi
     exit 0
 %postun
     [ $1 -eq 0 ] || exit 0
     #   announce special nature of this package on uninstall
     ( echo "Attention: The special nature of the package contents require privileged"
       echo "interation, and must be carefully deleted and nonportably uninstalled"
       echo "from system areas outside of the OpenPKG instance."
       echo ""
       echo "  $ su -"
       echo "  # ls -ld /usr/kernel/drv/*tun* /usr/include/net/*tun*"
       echo "  # /usr/sbin/rem_drv tun"
       echo "  # ls -ld /usr/kernel/drv/*tun*"
       echo "  # ls -ld /usr/include/net/*tun*"
       echo "  # rm -f /usr/kernel/drv/tun"
       echo "  # rm -f /usr/kernel/drv/tun.conf"
       echo "  # rm -f /usr/include/net/if_tun.h"
     ) | %{l_rpmtool} msg -b -t notice
     exit 0

OpenPKG Specs / annotate

tun/tun.spec@0ba300bdf30a (annotated)

tun/tun.spec