| Summary: | net-misc/networkmanager-openvpn-0.9.8.4 - add support to drop root privileges and chroot | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | Matthias Maier <tamiko> |
| Component: | Current packages | Assignee: | Steev Klimaszewski (RETIRED) <steev> |
| Status: | RESOLVED UPSTREAM | ||
| Severity: | normal | CC: | gnome, nikoli |
| Priority: | Normal | Keywords: | PATCH |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| See Also: | https://bugzilla.gnome.org/show_bug.cgi?id=555518 | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
| Attachments: | Patch against sources to add --user ... --group ... --chroot ... to the command line | ||
Created attachment 378862 [details, diff]
Patch against sources to add --user ... --group ... --chroot ... to the command line
Please submit this patch upstream to https://bugzilla.gnome.org/show_bug.cgi?id=555518 |
openvpn has a facility to drop root privileges and chroot to an empty directory after completed initialization. This is done be specifying "--user [...] --group [...] --chroot [...]" on the command line. However, the networkmanager plugin does not do this and always runs openvpn with full root privileges - while other networkmanager plugins drop root privileges (e.g. networkmanager-openconnect). Please find attached a small patch (more a proof of concept) against the networkmanager-openvpn that adds above command line to the invocation of openvpn. This should probably go along with a enewgroup nm-openvpn enewuser nm-openvpn -1 -1 -1 nm-openvpn + create chroot directory (e.g. /var/lib/openvpn/chroot) in the appropriate ebuild phases. Reproducible: Always