diff options
| author | feld <feld@FreeBSD.org> | 2017-02-03 01:45:27 +0800 |
|---|---|---|
| committer | feld <feld@FreeBSD.org> | 2017-02-03 01:45:27 +0800 |
| commit | eda1991f05ff45ea92b4c9a5c0222c98322111b5 (patch) | |
| tree | 4fe26009dbcf37bfc7639a46ec9b511eba15ec45 /www/uwsgi | |
| parent | d0ef582caacbc1521fb2fcb95d9935b9915d8d75 (diff) | |
| download | freebsd-ports-gnome-eda1991f05ff45ea92b4c9a5c0222c98322111b5.tar.gz freebsd-ports-gnome-eda1991f05ff45ea92b4c9a5c0222c98322111b5.tar.zst freebsd-ports-gnome-eda1991f05ff45ea92b4c9a5c0222c98322111b5.zip | |
www/uwsgi: Further rc script security improvements
This update introduces a dedicated user for uwsgi and introduces the
uwsgi_socket_owner setting which by default is set to www:www. The
previous change to socket mode of 600 has been modified to 660 as well.
This change further increases security while restoring compatibility.
MFH: 2017Q1
Differential Revision: https://reviews.freebsd.org/D9398
Diffstat (limited to 'www/uwsgi')
| -rw-r--r-- | www/uwsgi/Makefile | 5 | ||||
| -rw-r--r-- | www/uwsgi/files/uwsgi.in | 18 |
2 files changed, 15 insertions, 8 deletions
diff --git a/www/uwsgi/Makefile b/www/uwsgi/Makefile index 7866b9596256..376cd5e32dfa 100644 --- a/www/uwsgi/Makefile +++ b/www/uwsgi/Makefile @@ -3,7 +3,7 @@ PORTNAME= uwsgi PORTVERSION= 2.0.14 -PORTREVISION= 1 +PORTREVISION= 2 CATEGORIES= www python MASTER_SITES= http://projects.unbit.it/downloads/ @@ -17,6 +17,9 @@ USES= python ssl USE_PYTHON= distutils USE_RC_SUBR= uwsgi +USERS= uwsgi +GROUPS= uwsgi + OPTIONS_DEFINE= DEBUG JSON PCRE XML DEBUG_VARS= PYDISTUTILS_BUILDARGS+=--debug diff --git a/www/uwsgi/files/uwsgi.in b/www/uwsgi/files/uwsgi.in index 33ac1ac87d91..33db07b815c0 100644 --- a/www/uwsgi/files/uwsgi.in +++ b/www/uwsgi/files/uwsgi.in @@ -14,14 +14,16 @@ # Default is /tmp/uwsgi.sock. # uwsgi_socket_mode (int): Set the mode of the socket. # Default is 600. +# uwsgi_socket_owner (str): Set the owner of the socket. +# Default is www:www. # uwsgi_logfile (path): Set the path to the uwsgi log file # Default is /var/log/uwsgi.log. # uwsgi_pidfile (path): Set the path to the uwsgi pid file # Default is /var/run/uwsgi.pid. # uwsgi_uid (int): Set the UID of the process to run with -# Default is 80. +# Default is 165 (uwsgi). # uwsgi_gid (int): Set the GID of the process to run with -# Default is 80. +# Default is 165 (uwsgi). # uwsgi_flags (str): Set the uwsgi command line arguments # Default is "-M -L". # uwsgi_procname (str): Define to "uWSGI" if you start uwsgi with @@ -47,11 +49,12 @@ command=%%PREFIX%%/bin/uwsgi : ${uwsgi_enable="NO"} : ${uwsgi_profiles=""} : ${uwsgi_socket="/tmp/${name}.sock"} -: ${uwsgi_socket_mode="600"} +: ${uwsgi_socket_mode="660"} +: ${uwsgi_socket_owner="www:www"} : ${uwsgi_logfile="/var/log/${name}.log"} : ${uwsgi_pidfile="/var/run/${name}.pid"} -: ${uwsgi_uid="80"} -: ${uwsgi_gid="80"} +: ${uwsgi_uid="165"} +: ${uwsgi_gid="165"} : ${uwsgi_flags="-M -L"} : ${uwsgi_procname="${command}"} @@ -75,7 +78,8 @@ if [ -n "${uwsgi_profiles}" ]; then exit 1 fi eval uwsgi_socket=\${uwsgi_${profile}_socket:-"/tmp/${name}-${profile}.sock"} - eval uwsgi_socket_mode=\${uwsgi_${profile}_socket_mode:-"600"} + eval uwsgi_socket_mode=\${uwsgi_${profile}_socket_mode:-"660"} + eval uwsgi_socket_owner=\${uwsgi_${profile}_socket_owner:-"www:www"} eval uwsgi_logfile=\${uwsgi_${profile}_logfile:-"/var/log/${name}-${profile}.log"} eval uwsgi_pidfile=\${uwsgi_${profile}_pidfile:-"/var/run/${name}-${profile}.pid"} eval uwsgi_uid=\${uwsgi_${profile}_uid:-"${uwsgi_uid}"} @@ -92,7 +96,7 @@ if [ -n "${uwsgi_profiles}" ]; then fi command=%%PREFIX%%/bin/uwsgi -command_args="--pidfile ${uwsgi_pidfile} -s ${uwsgi_socket} --chmod-socket=${uwsgi_socket_mode} -d ${uwsgi_logfile} --uid ${uwsgi_uid} --gid ${uwsgi_gid}" +command_args="--pidfile ${uwsgi_pidfile} -s ${uwsgi_socket} --chmod-socket=${uwsgi_socket_mode} --chown-socket=${uwsgi_socket_owner} -d ${uwsgi_logfile} --uid ${uwsgi_uid} --gid ${uwsgi_gid}" pidfile=${uwsgi_pidfile} stop_postcmd=stop_postcmd reload_precmd=reload_precmd |