aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMark Johnston <markj@FreeBSD.org>2024-05-14 14:43:03 +0000
committerMark Johnston <markj@FreeBSD.org>2024-05-14 15:27:26 +0000
commit52fe0689eac79f0287cd884f526d33d44237869a (patch)
tree90574524338467cd3c61cb84c65f8e3ca1f44882
parent9ba210177e0372d011e5f01be55559aed0eb9785 (diff)
downloadports-52fe0689eac79f0287cd884f526d33d44237869a.tar.gz
ports-52fe0689eac79f0287cd884f526d33d44237869a.zip
net-mgmt/net-snmp: Avoid changing to the snmpd user for now
Switching the user might break existing configurations, for reasons that are not fully clear yet. Avoid surprises by letting users opt-in to that change, for now. Also provide an rc.conf variable to make it easy to configure snmpd to drop privileges if they so choose. Reported by: dvl Approved by: zi Sponsored by: Klara, Inc. Sponsored by: Stormshield Differential Revision: https://reviews.freebsd.org/D45199
-rw-r--r--net-mgmt/net-snmp/Makefile2
-rw-r--r--net-mgmt/net-snmp/files/snmpd.in13
2 files changed, 13 insertions, 2 deletions
diff --git a/net-mgmt/net-snmp/Makefile b/net-mgmt/net-snmp/Makefile
index 5fca4ba36051..01534364feb8 100644
--- a/net-mgmt/net-snmp/Makefile
+++ b/net-mgmt/net-snmp/Makefile
@@ -1,7 +1,7 @@
PORTNAME= snmp
PORTVERSION= 5.9.4
PORTEPOCH= 1
-PORTREVISION= 1
+PORTREVISION= 2
CATEGORIES= net-mgmt
MASTER_SITES= SF/net-${PORTNAME}/net-${PORTNAME}/${PORTVERSION} \
ZI
diff --git a/net-mgmt/net-snmp/files/snmpd.in b/net-mgmt/net-snmp/files/snmpd.in
index 7f140200aa45..7f75cacad813 100644
--- a/net-mgmt/net-snmp/files/snmpd.in
+++ b/net-mgmt/net-snmp/files/snmpd.in
@@ -8,6 +8,12 @@
# snmpd_enable="YES"
# snmpd_flags="<set as needed>"
# snmpd_conffile="<set as needed>"
+#
+# Add the following line to make snmpd drop privileges after initialization.
+# This might invalidate existing SNMPv3 users.
+#
+# snmpd_sugid="YES"
+#
. /etc/rc.subr
@@ -18,6 +24,7 @@ load_rc_config snmpd
snmpd_enable=${snmpd_enable:-"NO"}
snmpd_flush_cache=${snmpd_flush_cache-"NO"}
+snmpd_sugid=${snmpd_sugid:-"NO"}
pidfile=${snmpd_pidfile:-"/var/run/net_snmpd.pid"}
@@ -57,7 +64,11 @@ net_snmpd_precmd () {
if [ -n "${snmpd_conffile_set}" ]; then
rc_flags="-c ${snmpd_conffile_set#,} ${rc_flags}"
fi
- rc_flags="-u snmpd -g snmpd -p ${pidfile} ${rc_flags}"
+ if checkyesno snmpd_sugid; then
+ rc_flags="-u snmpd -g snmpd ${rc_flags}"
+ fi
+
+ rc_flags="-p ${pidfile} ${rc_flags}"
}
run_rc_command "$1"