commit: f62a4daaab97707076a0bd714d6fb2b6ee25e052 Author: Amadeusz Żołnowski <aidecoe <AT> gentoo <DOT> org> AuthorDate: Sat May 27 20:31:30 2017 +0000 Commit: Amadeusz Piotr Żołnowski <aidecoe <AT> gentoo <DOT> org> CommitDate: Sat May 27 20:55:01 2017 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f62a4daa
net-im/ejabberd: Fix PAM authentication Rely on dev-erlang/epam setting SUID for epam binary instead of setting SUID for wrapper bash script which doesn't actually work. Gentoo-Bug: 612608 Package-Manager: Portage-2.3.5, Repoman-2.3.2 net-im/ejabberd/ejabberd-17.01-r1.ebuild | 302 +++++++++++++++++++++++++++++++ 1 file changed, 302 insertions(+) diff --git a/net-im/ejabberd/ejabberd-17.01-r1.ebuild b/net-im/ejabberd/ejabberd-17.01-r1.ebuild new file mode 100644 index 00000000000..6ee9e157db6 --- /dev/null +++ b/net-im/ejabberd/ejabberd-17.01-r1.ebuild @@ -0,0 +1,302 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +EAPI=6 + +SSL_CERT_MANDATORY=1 + +inherit eutils pam rebar ssl-cert systemd + +DESCRIPTION="Robust, scalable and extensible XMPP server" +HOMEPAGE="http://www.ejabberd.im/ https://github.com/processone/ejabberd/"; +SRC_URI="http://www.process-one.net/downloads/${PN}/${PV}/${P}.tgz + -> ${P}.tar.gz" + +LICENSE="GPL-2" +SLOT="0" +KEYWORDS="~amd64 ~arm ~ia64 ~ppc ~sparc ~x86" +REQUIRED_USE="mssql? ( odbc )" +# TODO: Add 'tools' flag. +IUSE="captcha debug full-xml hipe ldap mssql mysql nls odbc pam postgres redis + riak roster-gw sqlite zlib" + +RESTRICT="test" + +# TODO: Add dependencies for 'tools' flag enabled. +# TODO: tools? ( +# TODO: >=dev-erlang/meck-0.8.4 +# TODO: >=dev-erlang/moka-1.0.5b +# TODO: ) +CDEPEND=" + >=dev-erlang/cache_tab-1.0.6 + >=dev-erlang/esip-1.0.10 + >=dev-erlang/fast_tls-1.0.10 + >=dev-erlang/fast_xml-1.1.19 + >=dev-erlang/fast_yaml-1.0.8 + >=dev-erlang/jiffy-0.14.8 + >=dev-erlang/lager-3.2.1 + >=dev-erlang/luerl-0.2 + >=dev-erlang/p1_oauth2-0.6.1 + >=dev-erlang/p1_utils-1.0.6 + >=dev-erlang/stringprep-1.0.7 + >=dev-erlang/stun-1.0.9 + >=dev-erlang/xmpp-1.1.6 + >=dev-lang/erlang-17.1[hipe?,odbc?,ssl] + >=net-im/jabber-base-0.01 + ldap? ( =net-nds/openldap-2* ) + mysql? ( >=dev-erlang/p1_mysql-1.0.2 ) + nls? ( >=dev-erlang/iconv-1.0.3 ) + odbc? ( dev-db/unixODBC ) + pam? ( >=dev-erlang/epam-1.0.0-r1 + <dev-erlang/epam-1.0.1 ) + postgres? ( >=dev-erlang/p1_pgsql-1.1.2 ) + redis? ( >=dev-erlang/eredis-1.0.8 ) + riak? ( + >=dev-erlang/hamcrest-0.1.0_p20150103 + >=dev-erlang/riakc-2.4.1 + ) + sqlite? ( >=dev-erlang/sqlite3-1.1.5 ) + zlib? ( >=dev-erlang/ezlib-1.0.2 )" +DEPEND="${CDEPEND} + >=sys-apps/gawk-4.1" +RDEPEND="${CDEPEND} + captcha? ( media-gfx/imagemagick[truetype,png] )" + +DOCS=( README ) +PATCHES=( "${FILESDIR}/${P}-ejabberdctl.patch" ) + +EJABBERD_CERT="${EPREFIX}/etc/ssl/ejabberd/server.pem" +# Paths in net-im/jabber-base +JABBER_ETC="${EPREFIX}/etc/jabber" +JABBER_LOG="${EPREFIX}/var/log/jabber" +JABBER_SPOOL="${EPREFIX}/var/spool/jabber" + +# Adjust example configuration file to Gentoo. +# - Use our sample certificates. +# - Correct PAM service name. +adjust_config() { + sed -e "s|\"/path/to/ssl.pem\"|\"${EJABBERD_CERT}\"|g" \ + -e "s|\"pamservicename\"|\"xmpp\"|" \ + -i "${S}/ejabberd.yml.example" \ + || die 'failed to adjust example config' +} + +# Set paths to ejabberd lib directory consistently to point always to directory +# suffixed with version. +correct_ejabberd_paths() { + sed -e "/^EJABBERDDIR[[:space:]]*=/{s:ejabberd:${P}:}" \ + -i "${S}/Makefile.in" \ + || die 'failed to set ejabberd path in Makefile.in' + sed -e "/EJABBERD_BIN_PATH=/{s:ejabberd:${P}:}" \ + -i "${S}/ejabberdctl.template" \ + || die 'failed to set ejabberd path in ejabberdctl.template' + sed -e 's|\(captcha_cmd:[[:space:]]*"\).\+"|\1'$(get_ejabberd_path)'/priv/bin/captcha.sh"|' \ + -i "${S}/ejabberd.yml.example" \ + || die 'failed to correct path to captcha.sh in example config' +} + +# Get epam-wrapper from 'files' directory and correct path to lib directory in +# it. epam-wrapper is placed into work directory. It is assumed no epam-wrapper +# file exists there already. +customize_epam_wrapper() { + local epam_wrapper_src="$1" + local epam_wrapper_dst="${S}/epam-wrapper" + + [[ -e ${epam_wrapper_dst} ]] && die 'epam-wrapper already exists' + sed -r -e "s@^(ERL_LIBS=).*\$@\1${EPREFIX}$(get_erl_libs)@" \ + "${epam_wrapper_src}" >"${epam_wrapper_dst}" \ + || die 'failed to install epam-wrapper' +} + +# Check if there already exists a certificate. +ejabberd_cert_exists() { + local cert + + for cert in $(gawk -- \ + 'match($0, /^[[:space:]]*certfile: "([^"]+)"/, m) {print m[1];}' \ + "${EROOT%/}${JABBER_ETC}/ejabberd.yml"); do + [[ -f ${cert} ]] && return 0 + done + + return 1 +} + +# Generate and install sample ejabberd certificate. It's installed into +# EJABBERD_CERT path. +ejabberd_cert_install() { + SSL_ORGANIZATION="${SSL_ORGANIZATION:-ejabberd XMPP Server}" + install_cert "${EJABBERD_CERT%.*}" + chown root:jabber "${EROOT%/}${EJABBERD_CERT}" || die + chmod 0440 "${EROOT%/}${EJABBERD_CERT}" || die +} + +# Get path to ejabberd lib directory. +# +# This is the path ./configure script Base for this path is path set in +# ./configure script which is /usr/lib by default. If libdir is explicitely set +# to something else than this should be adjusted here as well. +get_ejabberd_path() { + echo "/usr/$(get_libdir)/${P}" +} + +# Make ejabberd.service for systemd from upstream provided template. +make_ejabberd_service() { + sed -r \ + -e 's!@ctlscriptpath@!/usr/sbin!' \ + -e 's!(User|Group)=(.*)!\1=jabber!' \ + "${PN}.service.template" >"${PN}.service" \ + || die 'failed to make ejabberd.service' +} + +# Set paths to defined by net-im/jabber-base. +set_jabberbase_paths() { + sed -e "/^ETCDIR[[:space:]]*=/{s:@sysconfdir@/ejabberd:${JABBER_ETC}:}" \ + -e "/^LOGDIR[[:space:]]*=/{s:@localstatedir@/log/ejabberd:${JABBER_LOG}:}" \ + -e "/^SPOOLDIR[[:space:]]*=/{s:@localstatedir@/lib/ejabberd:${JABBER_SPOOL}:}" \ + -i "${S}/Makefile.in" \ + || die 'failed to set paths in Makefile.in' + sed -e "s|\(ETC_DIR=\){{sysconfdir}}.*|\1${JABBER_ETC}|" \ + -e "s|\(LOGS_DIR=\){{localstatedir}}.*|\1${JABBER_LOG}|" \ + -e "s|\(SPOOL_DIR=\){{localstatedir}}.*|\1${JABBER_SPOOL}|" \ + -i "${S}/ejabberdctl.template" \ + || die 'failed to set paths ejabberdctl.template' +} + +# Skip installing docs because it's only COPYING that's installed by Makefile. +skip_docs() { + gawk -i inplace ' +/# Documentation/, /^[[:space:]]*#?[[:space:]]*$/ { + if ($0 ~ /^[[:space:]]*#?[[:space:]]*$/) { + print $0; + } else { + next; + } +} +1 +' "${S}/Makefile.in" || die 'failed to remove docs section from Makefile.in' +} + +pkg_setup() { + if use pam; then + einfo "Adding jabber user to epam group to allow ejabberd to use PAM" \ + "authentication" + # See + # <https://docs.ejabberd.im/admin/configuration/#pam-authentication>. + # epam binary is installed by dev-erlang/epam package, therefore SUID + # is set by that package. Instead of jabber group it uses epam group, + # therefore we need to add jabber user to epam group. + usermod -a -G epam jabber || die + fi +} + +src_prepare() { + default + + rebar_remove_deps + correct_ejabberd_paths + set_jabberbase_paths + make_ejabberd_service + skip_docs + adjust_config + customize_epam_wrapper "${FILESDIR}/epam-wrapper" + + rebar_fix_include_path fast_xml + rebar_fix_include_path xmpp + + # Fix bug #591862. ERL_LIBS should point directly to ejabberd directory + # rather than its parent which is default. That way ejabberd directory + # takes precedence is module lookup. + local ejabberd_erl_libs="$(get_ejabberd_path):$(get_erl_libs)" + sed -e "s|\(ERL_LIBS=\){{libdir}}.*|\1${ejabberd_erl_libs}|" \ + -i "${S}/ejabberdctl.template" \ + || die 'failed to set ERL_LIBS in ejabberdctl.template' +} + +src_configure() { + econf \ + --docdir="${EPREFIX}/usr/share/doc/${PF}/html" \ + --enable-user=jabber \ + $(use_enable debug) \ + $(use_enable full-xml) \ + $(use_enable hipe) \ + $(use_enable mssql) \ + $(use_enable mysql) \ + $(use_enable nls iconv) \ + $(use_enable odbc) \ + $(use_enable pam) \ + $(use_enable postgres pgsql) \ + $(use_enable redis) \ + $(use_enable riak) \ + $(use_enable roster-gw roster-gateway-workaround) \ + $(use_enable sqlite) \ + $(use_enable zlib) +} + +src_compile() { + emake REBAR='rebar -v' src +} + +src_install() { + default + + if use pam; then + local epam_path="$(get_ejabberd_path)/priv/bin/epam" + + pamd_mimic_system xmpp auth account || die "cannot create pam.d file" + into "$(get_ejabberd_path)/priv" + newbin epam-wrapper epam + fi + + newconfd "${FILESDIR}/${PN}.confd" "${PN}" + newinitd "${FILESDIR}/${PN}.initd" "${PN}" + systemd_dounit "${PN}.service" + systemd_dotmpfilesd "${FILESDIR}/${PN}.tmpfiles.conf" + + insinto /etc/logrotate.d + newins "${FILESDIR}/${PN}.logrotate" "${PN}" +} + +pkg_postinst() { + if [[ ! ${REPLACING_VERSIONS} ]]; then + echo + elog "For configuration instructions, please see" + elog " http://www.process-one.net/en/ejabberd/docs/"; + echo + if [[ " ${REPLACING_VERSIONS} " =~ \ 2\. ]]; then + ewarn "If you have used pubsub in ejabberd-2.* you may encounter issues after" + ewarn "migration to ${PV}. pubsub data may not be migrated automatically and" + ewarn "you may need to run migration script manually, see:" + ewarn + ewarn " https://github.com/processone/ejabberd/issues/479#issuecomment-124497456"; + ewarn + ewarn "In case you don't care about all stored moods, activities, geoinfo and you" + ewarn "know you don't store in pubsub anything important, you can just remove" + ewarn "pubsub tables:" + ewarn + ewarn " rm ${EROOT%/}${JABBER_SPOOL}/pubsub_*" + ewarn + ewarn "See also: https://bugs.gentoo.org/show_bug.cgi?id=588244"; + echo + fi + elif [[ -f ${EROOT}etc/jabber/ejabberd.cfg ]]; then + elog "Ejabberd now defaults to using a YAML format for its config file." + elog "The old ejabberd.cfg file can be converted using the following instructions:" + echo + elog "1. Make sure all processes related to the previous version of ejabberd aren't" + elog " running. Usually this just means the ejabberd and epmd daemons and possibly" + elog " the pam-related process (epam) if pam support is enabled." + elog "2. Run \`ejabberdctl start\` with sufficient permissions. Note that this can" + elog " fail to start ejabberd properly for various reasons. Check ejabberd's main" + elog " log file at /var/log/jabber/ejabberd.log to confirm it started successfully." + elog "3. Run" + elog " \`ejabberdctl convert_to_yaml /etc/jabber/ejabberd.cfg /etc/jabber/ejabberd.yml.new\`" + elog " with sufficient permissions, edit and rename /etc/jabber/ejabberd.yml.new to" + elog " /etc/jabber/ejabberd.yml, and finally restart ejabberd with the new config" + elog " file." + echo + fi + + if ! ejabberd_cert_exists; then + ejabberd_cert_install + fi +}
