- Run as unpriviledged user sphinx

PR:		ports/108502
Submitted by:	Matthew Seaman <m.seaman@infracaninophile.co.uk> (maintainer)

4 files changed, 215 insertions, 12 deletions

diff --git a/textproc/sphinxsearch/Makefile b/textproc/sphinxsearch/Makefile
index aa94e3707097..ab04b6794466 100644
--- a/textproc/sphinxsearch/Makefile
+++ b/textproc/sphinxsearch/Makefile
@@ -5,10 +5,11 @@
 # $FreeBSD$
 #
 # Note: the Sphinx Storage Engine MySQL plugin is not supported by
-# this port at the moment.  Maybe later.
+# this port.  You need a patched version of mysql server for that.
 
 PORTNAME=	sphinxsearch
 PORTVERSION=	0.9.7.r2
+PORTREVISION=	1
 CATEGORIES=	textproc databases
 MASTER_SITES=	http://www.sphinxsearch.com/downloads/
 DISTNAME=	sphinx-${PORTVERSION:C@\.r([0-9]+)$@-rc\1@}
@@ -20,6 +21,14 @@ OPTIONS=	MYSQL            "MySQL support"                   on  \
 		PGSQL            "PostgreSQL support"              off \
 		OPTIMIZED_CFLAGS "Use compiler optimization (-O3)" off
 
+SPHINX_USR?=	_sphinx
+SPHINX_UID?=	312
+SPHINX_GRP?=	_sphinx
+SPHINX_GID?=	312
+SPHINX_DIR?=	/var/db/${PORTNAME}
+SPHINX_RUN?=	/var/run/${PORTNAME}
+SPHINX_LOG?=	/var/log/${PORTNAME}
+
 # Yes, the conflation of CPPFLAGS and CXXFLAGS is deliberate.  No,
 # don't ask.
 
@@ -28,8 +37,17 @@ CONFIGURE_TARGET=	--build=${MACHINE_ARCH}-portbld-freebsd${OSREL}
 CONFIGURE_ENV+=		CC=${CC} CPPFLAGS="${CXXFLAGS}"
 CFGFILE=	${PREFIX}/etc/sphinx.conf
 USE_RC_SUBR=	sphinxsearch.sh
-SUB_LIST+=	PORTNAME=${PORTNAME} \
-		CFGFILE=${CFGFILE}
+SUB_LIST+=	PORTNAME=${PORTNAME}     \
+		CFGFILE=${CFGFILE}       \
+		SPHINX_USR=${SPHINX_USR} \
+		SPHINX_UID=${SPHINX_UID} \
+		SPHINX_GRP=${SPHINX_GRP} \
+		SPHINX_GID=${SPHINX_GID} \
+		SPHINX_DIR=${SPHINX_DIR} \
+		SPHINX_RUN=${SPHINX_RUN} \
+		SPHINX_LOG=${SPHINX_LOG}
+SUB_FILES+=	pkg-install pkg-deinstall
+
 .if !defined(NOPORTDOCS)
 EXAMPLES=	example.sql api/sphinxapi.php api/test.php api/test2.php
 DOCS=		doc/sphinx.css doc/sphinx.html doc/sphinx.txt doc/sphinx.xml
@@ -61,13 +79,16 @@ CXXFLAGS+=		-O3 -fomit-frame-pointer
 # Fix up the sample configuration file to correspond to FreeBSD norms
 
 post-patch:
-	${REINPLACE_CMD} \
-	    -e 's!@CONFDIR@/log/searchd.pid!/var/run/searchd.pid!'    \
-	    -e 's!@CONFDIR@/log/query.log!/var/log/sphinx-query.log!' \
-	    -e 's!@CONFDIR@/log/searchd.log!/var/log/searchd.log!'    \
-	    -e 's!@CONFDIR@!/var/db/sphinxsearch!'                    \
+	@${REINPLACE_CMD} \
+	    -e "s!@CONFDIR@/log/searchd.pid!${SPHINX_RUN}/searchd.pid!"    \
+	    -e "s!@CONFDIR@/log/query.log!${SPHINX_LOG}/sphinx-query.log!" \
+	    -e "s!@CONFDIR@/log/searchd.log!${SPHINX_LOG}/searchd.log!"    \
+	    -e "s!@CONFDIR@!${SPHINX_DIR}!"                                \
 	    ${WRKSRC}/sphinx.conf.in
 
+pre-install:
+	@${SETENV} ${SCRIPTS_ENV} ${SH} ${PKGINSTALL} ${PKGNAME} PRE-INSTALL
+
 do-install: install-bin install-docs install-examples
 
 install-bin:
@@ -92,7 +113,10 @@ install-examples:
 .endfor
 .endif
 
-post-install:
+post-install: post-install-cfg
+	@${SETENV} ${SCRIPTS_ENV} ${SH} ${PKGINSTALL} ${PKGNAME} POST-INSTALL
+
+post-install-cfg:
 	@if [ ! -f ${CFGFILE} ]; then \
 	  ${CP} -p ${CFGFILE}.sample ${CFGFILE} ; \
 	fi
diff --git a/textproc/sphinxsearch/files/pkg-deinstall.in b/textproc/sphinxsearch/files/pkg-deinstall.in
new file mode 100644
index 000000000000..85b63ccf82cf
--- /dev/null
+++ b/textproc/sphinxsearch/files/pkg-deinstall.in
@@ -0,0 +1,32 @@
+#!/bin/sh
+#
+# $FreeBSD$
+#
+
+sphinx_usr=%%SPHINX_USR%%
+sphinx_grp=%%SPHINX_GRP%%
+sphinx_dir=%%SPHINX_DIR%%
+sphinx_name=%%PORTNAME%%
+
+case $2 in
+    POST-DEINSTALL)
+
+    cat <<EOMSG
+
+The $sphinx_name port has been deleted.  If you are not
+upgrading and don't intend to use $sphinx_name any more
+then you may wish to delete the $sphinx_usr account,
+and the $sphinx_grp group together with the working
+directory $sphinx_dir; which can be done with the
+following commands:
+
+    # pw userdel -n $sphinx_usr
+    # rm -rf $sphinx_dir
+EOMSG
+    echo
+    ;;
+esac
+
+#
+# That's All Folks!
+#
diff --git a/textproc/sphinxsearch/files/pkg-install.in b/textproc/sphinxsearch/files/pkg-install.in
new file mode 100644
index 000000000000..37e03b835600
--- /dev/null
+++ b/textproc/sphinxsearch/files/pkg-install.in
@@ -0,0 +1,123 @@
+#!/bin/sh
+#
+# $FreeBSD$
+#
+
+PATH=/usr/sbin:/usr/bin:/bin ; export PATH
+
+sphinx_dir=%%SPHINX_DIR%%
+sphinx_usr=%%SPHINX_USR%%
+sphinx_uid=%%SPHINX_UID%%
+sphinx_grp=%%SPHINX_GRP%%
+sphinx_gid=%%SPHINX_GID%%
+sphinx_run=%%SPHINX_RUN%%
+sphinx_log=%%SPHINX_LOG%%
+sphinx_name=%%PORTNAME%%
+
+sphinx_gcos="Sphinxsearch Owner"
+sphinx_home=/nonexistent
+sphinx_shell=/sbin/nologin
+
+create_group() {
+    local user uid group gid gcos home shell
+
+    user=$1
+    uid=$2
+    group=$3
+    gid=$4
+    gcos=$5
+    home=$6
+    shell=$7
+
+    if pw groupadd -n $group -g $gid ; then
+	echo "===> Group $group created"
+    else
+	cat <<-EOERRORMSG
+	*** Failed to create the $group group.
+
+	Please add the $user user and $group group
+	manually with the commands:
+
+	    pw groupadd -n $group -g $gid
+	    pw useradd -n $user -u $uid -g $group -c "$gcos" \\
+	        -d $home -s $shell -h -
+
+	and retry installing this package.
+	EOERRORMSG
+	exit 1
+    fi
+}
+
+
+create_user() {
+    local user uid group gid gcos home shell
+
+    user=$1
+    uid=$2
+    group=$3
+    gid=$4
+    gcos=$5
+    home=$6
+    shell=$7
+
+    if pw useradd -n $user -u $uid -g $group -c "$gcos" -d $home \
+	-s $shell -h - ; then
+	echo "===> Created $user user"
+    else
+	cat <<-EOERRORMSG
+	*** Failed to create the $user user.
+
+	Please add the $user user manually with the command:
+
+	    pw useradd -n $user -u $uid -g $group -c "$gcos" \\
+		        -d $home -s $shell -h -
+
+	and retry installing this package.
+	EOERRORMSG
+	exit 1
+    fi
+}
+
+
+case $2 in
+    PRE-INSTALL)
+
+        # Create the sphinx user and group if they do not already exist
+
+        if pw user show -n $sphinx_usr >/dev/null 2>&1 ; then
+	    echo "===> Using pre-existing user $sphinx_usr"
+	else
+	    if ! pw group show -n $sphinx_grp >/dev/null 2>&1 ; then
+		create_group $sphinx_usr $sphinx_uid $sphinx_grp $sphinx_gid \
+		    "$sphinx_gcos" $sphinx_home $sphinx_shell
+	    fi
+	    create_user $sphinx_usr $sphinx_uid $sphinx_grp $sphinx_gid \
+		"$sphinx_gcos" $sphinx_home $sphinx_shell
+	fi
+	;;
+    POST-INSTALL)
+
+    	# Create and set ownership of the Sphinx working directory
+        if [ -d $sphinx_dir ]; then
+	    echo "==> Using pre-existing directory $sphinx_dir"
+	else
+	    echo "==> Creating the Sphinx working directory: $sphinx_dir"
+	    mkdir -m 755 $sphinx_dir || exit 1
+	fi
+
+    	# Create and set ownership of the Sphinx data directory
+        if [ -d $sphinx_dir/data ]; then
+	    echo "==> Using pre-existing directory $sphinx_dir/data"
+	else
+	    echo "==> Creating the Sphinx data directory: $sphinx_dir/data"
+	    mkdir -m 755 $sphinx_dir/data || exit 1
+	fi
+
+        echo "===> Adjusting file ownership in $sphinx_dir"
+        chown -R $sphinx_usr:$sphinx_grp $sphinx_dir || exit 1
+	;;
+esac
+
+#
+# That's All Folks!
+#
diff --git a/textproc/sphinxsearch/files/sphinxsearch.sh.in b/textproc/sphinxsearch/files/sphinxsearch.sh.in
index fd93cc6b661d..83c2ff67b760 100644
--- a/textproc/sphinxsearch/files/sphinxsearch.sh.in
+++ b/textproc/sphinxsearch/files/sphinxsearch.sh.in
@@ -15,11 +15,16 @@
 #
 # %%PORTNAME%%_conffile="%%CFGFILE%%"
 #                          -- path to config file
-# %%PORTNAME%%_pidfile="/var/run/searchd.pid"
+# %%PORTNAME%%_pidfile="%%SPHINX_RUN%%/searchd.pid"
 #                          -- location of pidfile: must match setting
 #                             in ${%%PORTNAME%%_conffile}
+# %%PORTNAME%%_user="%%SPHINX_USR%%"
+#                          -- user to run searchd as
+# %%PORTNAME%%_group="%%SPHINX_GRP%%"
+#                          -- group to run searchd as
+# %%PORTNAME%%_logdir="%%SPHINX_LOG%%"
+#                          -- directory searchd writes logs to
 #
-
 . /etc/rc.subr
 
 name=%%PORTNAME%%
@@ -27,12 +32,31 @@ rcvar=`set_rcvar`
 
 %%PORTNAME%%_enable=${%%PORTNAME%%_enable-"NO"}
 %%PORTNAME%%_conffile=${%%PORTNAME%%_conffile-"%%CFGFILE%%"}
-%%PORTNAME%%_pidfile=${%%PORTNAME%%_pidfile-"/var/run/searchd.pid"}
+%%PORTNAME%%_pidfile=${%%PORTNAME%%_pidfile-"%%SPHINX_RUN%%/searchd.pid"}
+%%PORTNAME%%_user=${%%PORTNAME%%_user-"%%SPHINX_USR%%"}
+%%PORTNAME%%_group=${%%PORTNAME%%_group-"%%SPHINX_GRP%%"}
+%%PORTNAME%%_logdir=${%%PORTNAME%%_logdir-"%%SPHINX_LOG%%"}
+
+start_precmd="create_dirs"
 
 command=%%PREFIX%%/sbin/searchd
 pidfile=${%%PORTNAME%%_pidfile}
 required_files=${%%PORTNAME%%_conffile}
 %%PORTNAME%%_flags="--config ${%%PORTNAME%%_conffile}"
 
+create_dirs ()
+{
+    piddir=$(dirname ${%%PORTNAME%%_pidfile})
+    if [ ! -d ${piddir} ]; then
+	mkdir -m 755 -p ${piddir}
+	chown -R ${%%PORTNAME%%_user}:${%%PORTNAME%%_group} ${piddir}
+    fi
+    if [ ! -d ${%%PORTNAME%%_logdir} ]; then
+	mkdir -m 755 -p ${%%PORTNAME%%_logdir}
+	chown -R ${%%PORTNAME%%_user}:${%%PORTNAME%%_group} \
+	    ${%%PORTNAME%%_logdir}
+    fi
+}
+
 load_rc_config ${name}
 run_rc_command "$1"