summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMichael Orlitzky <mjo@gentoo.org>2020-09-21 21:05:41 -0400
committerMichael Orlitzky <mjo@gentoo.org>2020-09-22 23:23:21 -0400
commit20979a5933eff01400776082bbcec8d693006d26 (patch)
treefb1e2975f6ac335b43f03bd2710304d4b4243974 /app-antivirus
parentdev-util/rustup: add ~arm64 keyword (diff)
downloadgentoo-20979a5933eff01400776082bbcec8d693006d26.tar.gz
gentoo-20979a5933eff01400776082bbcec8d693006d26.tar.bz2
gentoo-20979a5933eff01400776082bbcec8d693006d26.zip
app-antivirus/clamav: use tmpfiles.eclass for tmpfiles.d entries.
This avoids the systemd-specific implementation, but also hides the tmpfiles entry behind USE=systemd for security reasons (the OpenRC implementation, opentmpfiles, is insecure). The OpenRC service scripts create their own directories anyway, at the expense of a tiny bit of duplication. Closes: https://bugs.gentoo.org/740622 Package-Manager: Portage-3.0.4, Repoman-3.0.1 Signed-off-by: Michael Orlitzky <mjo@gentoo.org>
Diffstat (limited to 'app-antivirus')
-rw-r--r--app-antivirus/clamav/clamav-0.103.0.ebuild21
1 files changed, 15 insertions, 6 deletions
diff --git a/app-antivirus/clamav/clamav-0.103.0.ebuild b/app-antivirus/clamav/clamav-0.103.0.ebuild
index 16a7129ce1b4..9a1d28f89203 100644
--- a/app-antivirus/clamav/clamav-0.103.0.ebuild
+++ b/app-antivirus/clamav/clamav-0.103.0.ebuild
@@ -3,7 +3,7 @@
EAPI=7
-inherit autotools flag-o-matic systemd
+inherit autotools flag-o-matic systemd tmpfiles
DESCRIPTION="Clam Anti-Virus Scanner"
HOMEPAGE="https://www.clamav.net/"
@@ -12,7 +12,7 @@ SRC_URI="https://www.clamav.net/downloads/production/${P}.tar.gz"
LICENSE="GPL-2"
SLOT="0"
KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~sparc-solaris ~x86-solaris"
-IUSE="bzip2 doc clamonacc clamdtop clamsubmit iconv ipv6 libclamav-only libressl milter metadata-analysis-api selinux test uclibc xml"
+IUSE="bzip2 doc clamonacc clamdtop clamsubmit iconv ipv6 libclamav-only libressl milter metadata-analysis-api selinux systemd test uclibc xml"
REQUIRED_USE="libclamav-only? ( !clamonacc !clamdtop !clamsubmit !milter !metadata-analysis-api )"
@@ -118,10 +118,19 @@ src_install() {
rm -rf "${ED}"/var/lib/clamav || die
if ! use libclamav-only ; then
- systemd_dotmpfilesd "${FILESDIR}/tmpfiles.d/clamav.conf"
- systemd_newunit "${FILESDIR}/clamd_at.service" "clamd@.service"
- systemd_dounit "${FILESDIR}/clamd.service"
- systemd_dounit "${FILESDIR}/freshclamd.service"
+ if use systemd; then
+ # The tmpfiles entry is behind USE=systemd because the
+ # upstream OpenRC service files should (and do) ensure that
+ # the directories they need exist and have the correct
+ # permissions without the help of opentmpfiles. There are
+ # years-old root exploits in opentmpfiles, the design is
+ # fundamentally flawed, and the maintainer is not up to
+ # the task of fixing it.
+ dotmpfiles "${FILESDIR}/tmpfiles.d/clamav.conf"
+ systemd_newunit "${FILESDIR}/clamd_at.service" "clamd@.service"
+ systemd_dounit "${FILESDIR}/clamd.service"
+ systemd_dounit "${FILESDIR}/freshclamd.service"
+ fi
insinto /etc/logrotate.d
newins "${FILESDIR}"/clamav.logrotate clamav