mirror of
https://github.com/openwrt/packages.git
synced 2025-12-10 12:41:22 +00:00
2dcc84370c
Create kea state directories with mode 0750 per restrictions added in 2.6.3 Refresh patches Fixes the following CVEs: * CVE-2025-32803: Change the umask to no group write and no other access at the entry of Kea server/agent binaries * CVE-2025-32801: kea-dhcp4, kea-dhcp6, kea-dhcp-ddns, and kea-ctrl-agent will now only load hook libraries from the default installation directory Full upstream changelogs are available at: https://downloads.isc.org/isc/kea/2.6.1/Kea-2.6.1-ReleaseNotes.txt https://downloads.isc.org/isc/kea/2.6.2/Kea-2.6.2-ReleaseNotes.txt https://downloads.isc.org/isc/kea/2.6.3/Kea-2.6.3-ReleaseNotes.txt https://downloads.isc.org/isc/kea/2.6.4/Kea-2.6.4-ReleaseNotes.txt Signed-off-by: Noah Meyerhans <frodo@morgul.net>
45 lines
840 B
Bash
Executable File
45 lines
840 B
Bash
Executable File
#!/bin/sh /etc/rc.common
|
|
|
|
USE_PROCD=1
|
|
START=25
|
|
STOP=85
|
|
|
|
BIN_PATH="/usr/sbin"
|
|
CONF_PATH="/etc/kea"
|
|
|
|
start_service() {
|
|
mkdir -p /var/run/kea /var/lib/kea
|
|
chmod 0750 /var/run/kea /var/lib/kea
|
|
|
|
config_load "kea"
|
|
config_foreach start_kea "service"
|
|
}
|
|
|
|
start_kea() {
|
|
local cfg="$1"
|
|
|
|
config_get_bool disabled "$cfg" disabled 0
|
|
[ "$disabled" = "0" ] || return
|
|
|
|
config_get name "$cfg" name "$cfg"
|
|
|
|
case "$name" in
|
|
ctrl_agent|dhcp4|dhcp6|dhcp_ddns)
|
|
name="${name/_/-}"
|
|
cmd="${BIN_PATH}/kea-${name}"
|
|
cnf="${CONF_PATH}/kea-${name}.conf"
|
|
;;
|
|
*)
|
|
return 0
|
|
esac
|
|
|
|
procd_open_instance "$name"
|
|
procd_set_param command "$cmd" -c "$cnf"
|
|
procd_set_param env KEA_LOCKFILE_DIR=/tmp
|
|
procd_append_param env KEA_PIDFILE_DIR=/tmp
|
|
procd_set_param file "$cnf"
|
|
procd_set_param stderr 1
|
|
procd_set_param stdout 1
|
|
procd_close_instance
|
|
}
|