dnsmasq: run as dedicated UID/GID

[openwrt/staging/stintel.git] / package / network / services / dnsmasq / files / dnsmasq.init

diff --git a/package/network/services/dnsmasq/files/dnsmasq.init b/package/network/services/dnsmasq/files/dnsmasq.init
index 504c4acf4c975848f57e1ed10935f7ffdfc46fc5..7f90b8fa3e2744d9cb685671b67057e221006ff0 100644 (file)
--- a/package/network/services/dnsmasq/files/dnsmasq.init
+++ b/package/network/services/dnsmasq/files/dnsmasq.init
@@ -218,8 +218,16 @@ dnsmasq() {
        mkdir -p /tmp/hosts /tmp/dnsmasq.d
        xappend "--addn-hosts=/tmp/hosts"
        xappend "--conf-dir=/tmp/dnsmasq.d"
+       xappend "--user=dnsmasq"
+       xappend "--group=dnsmasq"
 
        echo >> $CONFIGFILE
+
+       config_get_bool enable_tftp "$cfg" enable_tftp 0
+       [ "$enable_tftp" -gt 0 ] && {
+               config_get tftp_root "$cfg" tftp_root
+               append EXTRA_MOUNT $tftp_root
+       }
 }
 
 dhcp_subscrid_add() {
@@ -310,6 +318,9 @@ dhcp_host_add() {
        config_get networkid "$cfg" networkid
        [ -n "$networkid" ] && dhcp_option_add "$cfg" "$networkid" "$force"
 
+       config_get_bool enable "$cfg" enable 1
+       [ "$enable" = "0" ] && return 0
+
        config_get name "$cfg" name
        config_get ip "$cfg" ip
        [ -n "$ip" -o -n "$name" ] || return 0
@@ -336,7 +347,9 @@ dhcp_host_add() {
        config_get_bool broadcast "$cfg" broadcast 0
        [ "$broadcast" = "0" ] && broadcast=
 
-       xappend "--dhcp-host=$macs${networkid:+,net:$networkid}${broadcast:+,set:needs-broadcast}${tag:+,set:$tag}${ip:+,$ip}${name:+,$name}"
+       config_get leasetime "$cfg" leasetime
+
+       xappend "--dhcp-host=$macs${networkid:+,net:$networkid}${broadcast:+,set:needs-broadcast}${tag:+,set:$tag}${ip:+,$ip}${name:+,$name}${leasetime:+,$leasetime}"
 }
 
 dhcp_tag_add() {
@@ -540,6 +553,24 @@ dhcp_hostrecord_add() {
        xappend "--host-record=$record"
 }
 
+dhcp_relay_add() {
+       local cfg="$1"
+       local local_addr server_addr interface
+
+       config_get local_addr "$cfg" local_addr
+       [ -n "$local_addr" ] || return 0
+
+       config_get server_addr "$cfg" server_addr
+       [ -n "$server_addr" ] || return 0
+
+       config_get interface "$cfg" interface
+       if [ -z "$interface" ]; then
+               xappend "--dhcp-relay=$local_addr,$server_addr"
+       else
+               xappend "--dhcp-relay=$local_addr,$server_addr,$interface"
+       fi
+}
+
 service_triggers()
 {
        procd_add_reload_trigger "dhcp"
@@ -555,17 +586,6 @@ start_service() {
 
        config_load dhcp
 
-       procd_open_instance
-       procd_set_param command $PROG -C $CONFIGFILE -k -x /var/run/dnsmasq/dnsmasq.pid
-       procd_set_param file $CONFIGFILE
-       procd_set_param respawn
-
-       procd_add_jail dnsmasq ubus log
-       procd_add_jail_mount $CONFIGFILE $TRUSTANCHORSFILE $HOSTFILE /etc/passwd /etc/group /etc/TZ /dev/null /dev/urandom /etc/dnsmasq.conf /tmp/dnsmasq.d /tmp/resolv.conf.auto /etc/hosts /etc/ethers
-       procd_add_jail_mount_rw /var/run/dnsmasq/ /tmp/dhcp.leases $TIMESTAMPFILE
-       
-       procd_close_instance
-
        # before we can call xappend
        mkdir -p /var/run/dnsmasq/
        mkdir -p $(dirname $CONFIGFILE)
@@ -574,7 +594,7 @@ start_service() {
 
        if [ ! -f "$TIMESTAMPFILE" ]; then
                touch "$TIMESTAMPFILE"
-               chown nobody.nogroup "$TIMESTAMPFILE"
+               chown dnsmasq.dnsmasq "$TIMESTAMPFILE"
        fi
 
        echo "# auto-generated config file from /etc/config/dhcp" > $CONFIGFILE
@@ -599,6 +619,7 @@ start_service() {
        config_foreach dhcp_subscrid_add subscrid
        config_foreach dhcp_domain_add domain
        config_foreach dhcp_hostrecord_add hostrecord
+       config_foreach dhcp_relay_add relay
 
        # add own hostname
        [ $ADD_LOCAL_HOSTNAME -eq 1 ] && {
@@ -643,6 +664,17 @@ start_service() {
        for DNS_SERVER in $DNS_SERVERS ; do
                echo "nameserver $DNS_SERVER" >> /tmp/resolv.conf
        done
+
+       procd_open_instance
+       procd_set_param command $PROG -C $CONFIGFILE -k -x /var/run/dnsmasq/dnsmasq.pid
+       procd_set_param file $CONFIGFILE
+       procd_set_param respawn
+
+       procd_add_jail dnsmasq ubus log
+       procd_add_jail_mount $CONFIGFILE $TRUSTANCHORSFILE $HOSTFILE /etc/passwd /etc/group /etc/TZ /dev/null /dev/urandom /etc/dnsmasq.conf /tmp/dnsmasq.d /tmp/resolv.conf.auto /etc/hosts /etc/ethers $EXTRA_MOUNT
+       procd_add_jail_mount_rw /var/run/dnsmasq/ /tmp/dhcp.leases $TIMESTAMPFILE
+
+       procd_close_instance
 }
 
 reload_service() {