mirror of https://github.com/openwrt/packages.git
nut: enable shared NSS certificate/key database for upsd and upsmon
Create a group to allow sharing directories files between upsd and upsmon, and create a shared NSS certificate/key database on postinst of nut-common (providing the database dir does not already exist). Also enables preserving the shared database across sysupgrades. Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>pull/30315/head
Daniel F. Dickinson
Alexandru Ardelean
parent
04533d5206
commit
b384d15813
|
|
@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
|
|||
|
||||
PKG_NAME:=nut
|
||||
PKG_VERSION:=2.8.5
|
||||
PKG_RELEASE:=4
|
||||
PKG_RELEASE:=5
|
||||
|
||||
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
|
||||
PKG_SOURCE_URL:=https://www.networkupstools.org/source/2.8/
|
||||
|
|
@ -98,6 +98,8 @@ define Package/nut-server/install
|
|||
$(PKG_BUILD_DIR)/libhid-ups.parsed-usermap
|
||||
$(SED) 's^### insert libhid-ups.parsed-usermap content here ###^\ncat "$(PKG_BUILD_DIR)/libhid-ups.parsed-usermap"^e' $(PKG_BUILD_DIR)/30-libhid-ups
|
||||
$(INSTALL_BIN) $(PKG_BUILD_DIR)/30-libhid-ups $(1)/etc/hotplug.d/usb/30-libhid-ups
|
||||
$(INSTALL_DIR) $(1)/etc/uci-defaults
|
||||
$(INSTALL_DATA) ./files/nut-server.default $(1)/etc/uci-defaults/90_nut-server
|
||||
endef
|
||||
|
||||
define Package/nut-common
|
||||
|
|
@ -108,7 +110,8 @@ define Package/nut-common
|
|||
+NUT_DRIVER_USB:libusb-compat \
|
||||
+NUT_DRIVER_NEON:libneon \
|
||||
+NUT_SSL:libopenssl \
|
||||
+NUT_SSL_NSS:libnss
|
||||
+NUT_SSL_NSS:libnss \
|
||||
+NUT_SSL_NSS:nss-utils
|
||||
endef
|
||||
|
||||
define Package/nut-common/description
|
||||
|
|
@ -118,6 +121,7 @@ endef
|
|||
|
||||
define Package/nut-common/conffiles
|
||||
/etc/nut/nut.conf
|
||||
/etc/nut/cert_db/
|
||||
endef
|
||||
|
||||
define Package/nut-common/install
|
||||
|
|
@ -133,12 +137,15 @@ define Package/nut-common/install
|
|||
$(if $(CONFIG_NUT_SSL_NSS),printf "%s" "nss" >$(PKG_BUILD_DIR)/ssl_backend)
|
||||
$(if $(CONFIG_NUT_SSL)$(CONFIG_NUT_SSL_NSS),,printf "%s" "none" >$(PKG_BUILD_DIR)/ssl_backend)
|
||||
$(INSTALL_DATA) $(PKG_BUILD_DIR)/ssl_backend $(1)/usr/share/nut/ssl_backend
|
||||
$(INSTALL_DIR) $(1)/etc/uci-defaults
|
||||
$(INSTALL_DATA) ./files/nut-common.default $(1)/etc/uci-defaults/89_nut-common
|
||||
endef
|
||||
|
||||
define Package/nut-server
|
||||
$(call Package/nut/Default)
|
||||
TITLE+= (server)
|
||||
DEPENDS:=nut +nut-common
|
||||
DEPENDS:=nut \
|
||||
+nut-common
|
||||
USERID:=nut=113:nut=113
|
||||
endef
|
||||
|
||||
|
|
@ -158,10 +165,17 @@ define Package/nut-server/conffiles
|
|||
/etc/nut/ups.conf
|
||||
endef
|
||||
|
||||
define Package/nut-server/postinst
|
||||
#!/bin/sh
|
||||
[ -n "$${IPKG_INSTROOT}" ] || (. /etc/uci-defaults/90_nut-server) && rm -f /etc/uci-defaults/90_nut-server
|
||||
exit 0
|
||||
endef
|
||||
|
||||
define Package/nut-upsmon
|
||||
$(call Package/nut/Default)
|
||||
TITLE+= (monitor)
|
||||
DEPENDS:=nut +nut-common
|
||||
DEPENDS:=nut \
|
||||
+nut-common
|
||||
USERID:=nutmon=114:nutmon=114
|
||||
endef
|
||||
|
||||
|
|
@ -180,6 +194,12 @@ define Package/nut-upsmon/conffiles
|
|||
/etc/nut/upsmon.conf
|
||||
endef
|
||||
|
||||
define Package/nut-upsmon/postinst
|
||||
#!/bin/sh
|
||||
[ -n "$${IPKG_INSTROOT}" ] || (. /etc/uci-defaults/90_nut-upsmon) && rm -f /etc/uci-defaults/90_nut-upsmon
|
||||
exit 0
|
||||
endef
|
||||
|
||||
define Package/nut-upsmon/install
|
||||
$(INSTALL_DIR) $(1)/etc/nut
|
||||
$(INSTALL_DIR) $(1)/usr/sbin
|
||||
|
|
@ -194,6 +214,7 @@ define Package/nut-upsmon/install
|
|||
$(INSTALL_DIR) $(1)/etc/config
|
||||
$(INSTALL_CONF) ./files/nut_monitor $(1)/etc/config/nut_monitor
|
||||
ln -sf /var/etc/nut/upsmon.conf $(1)/etc/nut/upsmon.conf
|
||||
$(INSTALL_DATA) ./files/nut-upsmon.default $(1)/etc/uci-defaults/90_nut-upsmon
|
||||
endef
|
||||
|
||||
define Package/nut-upsmon/conffiles
|
||||
|
|
|
|||
|
|
@ -0,0 +1,67 @@
|
|||
#!/bin/sh
|
||||
# In recent (relevant) versions of shellcheck busybox is a valid shell type
|
||||
# shellcheck shell=busybox
|
||||
|
||||
# uci-defaults script to setup nut-common package
|
||||
# * create (if not present) shared group for directories shared with nut-upsmon
|
||||
# * install/create NSS certificate/key database
|
||||
|
||||
# IPKG_INSTROOT is intentionally only set when building an image and
|
||||
# is intentionally empty on a live OpenWrt device
|
||||
|
||||
# Shellcheck source paths intentionally point to the location of files of
|
||||
# the scripts in the development environment (where shellcheck is used), not
|
||||
# on the live OpenWrt device.
|
||||
|
||||
# This script lives in nut-common package, which is independent of the
|
||||
# nut-upsmon package in which nut-upsmon.default lives
|
||||
|
||||
# The separate packages limit the opportunities for code-sharing across the
|
||||
# scripts.
|
||||
|
||||
# Only run this uci-defaults script on a live OpenWrt device
|
||||
[ -z "${IPKG_INSTROOT}" ] || exit 0
|
||||
|
||||
# shellcheck source=net/nut/files/functions.sh.functions
|
||||
. /lib/functions.sh || {
|
||||
# As the uci-defaults environment in which this runs does not have logging
|
||||
# available, nor is stderr captured or displayed on the console, these messages
|
||||
# exist only to assist when debugging manual runs of the script.
|
||||
printf "'%s': '%s'" "nut-common.default" "FATAL: Unable to source 'functions.sh'" || true
|
||||
exit 1
|
||||
}
|
||||
|
||||
if ! group_exists "nutgrp"; then
|
||||
group_add_next "nutgrp"
|
||||
fi
|
||||
|
||||
if [ -n "$(command -v certutil)" ]; then
|
||||
if [ ! -d /etc/nut/cert_db ]; then
|
||||
old_umask="$(umask)"
|
||||
umask 027
|
||||
{
|
||||
mkdir -p /etc/nut/cert_db
|
||||
chgrp nutgrp /etc/nut/cert_db
|
||||
} || {
|
||||
printf "'%s': '%s'" "nut-common.default" "FATAL: Unable to create '/etc/nut/cert_db' with the needed group and permissions" || true
|
||||
umask "$old_umask"
|
||||
exit 1
|
||||
}
|
||||
umask "$old_umask"
|
||||
|
||||
# We only create the database if the directory did not exist before running this script, as we
|
||||
# do not wish to overwrite an existing database
|
||||
certutil -N -d /etc/nut/cert_db --empty-password || {
|
||||
printf "'%s': '%s'" "nut-common.default" "FATAL: Unable to create empty certificate database"
|
||||
umask "$old_umask"
|
||||
exit 1
|
||||
}
|
||||
chgrp nutgrp /etc/nut/cert_db/*
|
||||
# certutil does not honour umask so we must set permissions with chmod
|
||||
chmod 0640 /etc/nut/cert_db/*
|
||||
else
|
||||
# If /etc/nut/cert_db already exists, we assume it is a pre-existing install
|
||||
# and do not override potential system administrator initiated changes.
|
||||
:
|
||||
fi
|
||||
fi
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
#!/bin/sh
|
||||
# In recent (relevant) versions of shellcheck busybox is a valid shell type
|
||||
# shellcheck shell=busybox
|
||||
|
||||
# uci-defaults script to setup nut-server package
|
||||
# * create (if not present) shared group for directories shared with nut-upsmon
|
||||
# * install/create NSS certificate/key database
|
||||
|
||||
# IPKG_INSTROOT is intentionally only set when building an image and
|
||||
# is intentionally empty on a live OpenWrt device
|
||||
|
||||
# Shellcheck source paths intentionally point to the location of files of
|
||||
# the scripts in the development environment (where shellcheck is used), not
|
||||
# on the live OpenWrt device.
|
||||
|
||||
# This script lives in nut-server package, which is independent of the
|
||||
# nut-upsmon package in which nut-upsmon.default lives
|
||||
|
||||
# The separate packages limit the opportunities for code-sharing across the
|
||||
# scripts.
|
||||
|
||||
# Only run this uci-defaults script on a live OpenWrt device
|
||||
[ -z "${IPKG_INSTROOT}" ] || exit 0
|
||||
|
||||
# shellcheck source=net/nut/files/functions.sh.functions
|
||||
. /lib/functions.sh || {
|
||||
# As the uci-defaults environment in which this runs does not have logging
|
||||
# available, nor is stderr captured or displayed on the console, these messages
|
||||
# exist only to assist when debugging manual runs of the script.
|
||||
printf "'%s': '%s'" "nut-server.default" "FATAL: Unable to source 'functions.sh'" || true
|
||||
exit 1
|
||||
}
|
||||
|
||||
if ! group_exists "nutgrp"; then
|
||||
group_add_next "nutgrp"
|
||||
fi
|
||||
|
||||
group_add_user "nutgrp" "nut"
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
#!/bin/sh
|
||||
# In recent (relevant) versions of shellcheck busybox is a valid shell type
|
||||
# shellcheck shell=busybox
|
||||
|
||||
# uci-defaults script to setup nut-upsmon package
|
||||
# * create (if not present) shared group for directories shared with nut-server
|
||||
# * install/create NSS certificate/key database
|
||||
|
||||
# IPKG_INSTROOT is intentionally only set when building an image and
|
||||
# is intentionally empty on a live OpenWrt device
|
||||
|
||||
# Shellcheck source paths intentionally point to the location of files of
|
||||
# the scripts in the development environment (where shellcheck is used), not
|
||||
# on the live OpenWrt device.
|
||||
|
||||
# This script lives in nut-upsmon package, which is independent of the
|
||||
# nut-server package in which nut-server.default lives
|
||||
|
||||
# The separate packages limit the opportunities for code-sharing across the
|
||||
# scripts.
|
||||
|
||||
# Only run this uci-defaults script on a live OpenWrt device
|
||||
[ -z "${IPKG_INSTROOT}" ] || exit 0
|
||||
|
||||
# shellcheck source=net/nut/files/functions.sh.functions
|
||||
. /lib/functions.sh || {
|
||||
# As the uci-defaults environment in which this runs does not have logging
|
||||
# available, nor is stderr captured or displayed on the console, these messages
|
||||
# exist only to assist when debugging manual runs of the script.
|
||||
printf "'%s': '%s'" "nut-upsmon.default" "FATAL: Unable to source 'functions.sh'" || true
|
||||
exit 1
|
||||
}
|
||||
|
||||
if ! group_exists "nutgrp"; then
|
||||
group_add_next "nutgrp"
|
||||
fi
|
||||
|
||||
group_add_user "nutgrp" "nutmon"
|
||||
Loading…
Reference in New Issue