mirror of
https://github.com/openwrt/packages.git
synced 2025-12-10 12:41:22 +00:00
2a7364534e
Rsyncd only needs a subset of all capabilities so create a dedicated user with these capabilities. This is better from both a security and an isolation perspective than running as root. Build system: x86/64 Build-tested: x86/64-glibc Run-tested: x86/64-glibc Signed-off-by: John Audia <therealgraysky@proton.me>
22 lines
475 B
Bash
22 lines
475 B
Bash
#!/bin/sh /etc/rc.common
|
|
# Copyright (C) 2011-2014 OpenWrt.org
|
|
|
|
START=90
|
|
STOP=10
|
|
|
|
USE_PROCD=1
|
|
PROG=/usr/bin/rsync
|
|
|
|
start_service() {
|
|
procd_open_instance
|
|
procd_set_param command "$PROG" --daemon --no-detach
|
|
[ -x /sbin/ujail -a -e /etc/capabilities/rsyncd.json ] && {
|
|
procd_add_jail rsyncd
|
|
procd_set_param capabilities /etc/capabilities/rsyncd.json
|
|
procd_set_param user rsyncd
|
|
procd_set_param group rsyncd
|
|
procd_set_param no_new_privs 1
|
|
}
|
|
procd_close_instance
|
|
}
|