From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <gentoo-commits+bounces-1208746-garchives=archives.gentoo.org@lists.gentoo.org>
Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by finch.gentoo.org (Postfix) with ESMTPS id 5FA9C138359
for <garchives@archives.gentoo.org>; Wed, 23 Sep 2020 03:34:58 +0000 (UTC)
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
by pigeon.gentoo.org (Postfix) with SMTP id D0725E0849;
Wed, 23 Sep 2020 03:34:50 +0000 (UTC)
Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183])
(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
(No client certificate requested)
by pigeon.gentoo.org (Postfix) with ESMTPS id 80C9BE0849
for <gentoo-commits@lists.gentoo.org>; Wed, 23 Sep 2020 03:34:50 +0000 (UTC)
Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84])
(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
(No client certificate requested)
by smtp.gentoo.org (Postfix) with ESMTPS id BEB1333BDE6
for <gentoo-commits@lists.gentoo.org>; Wed, 23 Sep 2020 03:34:48 +0000 (UTC)
Received: from localhost.localdomain (localhost [IPv6:::1])
by oystercatcher.gentoo.org (Postfix) with ESMTP id 49D10353
for <gentoo-commits@lists.gentoo.org>; Wed, 23 Sep 2020 03:34:47 +0000 (UTC)
From: "Michael Orlitzky" <mjo@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Content-Transfer-Encoding: 8bit
Content-type: text/plain; charset=UTF-8
Reply-To: gentoo-dev@lists.gentoo.org, "Michael Orlitzky" <mjo@gentoo.org>
Message-ID: <1600831401.20979a5933eff01400776082bbcec8d693006d26.mjo@gentoo>
Subject: [gentoo-commits] repo/gentoo:master commit in: app-antivirus/clamav/
X-VCS-Repository: repo/gentoo
X-VCS-Files: app-antivirus/clamav/clamav-0.103.0.ebuild
X-VCS-Directories: app-antivirus/clamav/
X-VCS-Committer: mjo
X-VCS-Committer-Name: Michael Orlitzky
X-VCS-Revision: 20979a5933eff01400776082bbcec8d693006d26
X-VCS-Branch: master
Date: Wed, 23 Sep 2020 03:34:47 +0000 (UTC)
Precedence: bulk
List-Post: <mailto:gentoo-commits@lists.gentoo.org>
List-Help: <mailto:gentoo-commits+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-commits+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-commits+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-commits.gentoo.org>
X-BeenThere: gentoo-commits@lists.gentoo.org
X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply
X-Archives-Salt: 31380904-38f2-4b67-add7-821f233e5c3e
X-Archives-Hash: 9f27bc437644e38a92131ca2c54ce53b
commit: 20979a5933eff01400776082bbcec8d693006d26
Author: Michael Orlitzky <mjo <AT> gentoo <DOT> org>
AuthorDate: Tue Sep 22 01:05:41 2020 +0000
Commit: Michael Orlitzky <mjo <AT> gentoo <DOT> org>
CommitDate: Wed Sep 23 03:23:21 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=20979a59
app-antivirus/clamav: use tmpfiles.eclass for tmpfiles.d entries.
This avoids the systemd-specific implementation, but also hides the
tmpfiles entry behind USE=systemd for security reasons (the OpenRC
implementation, opentmpfiles, is insecure). The OpenRC service scripts
create their own directories anyway, at the expense of a tiny bit of
duplication.
Closes: https://bugs.gentoo.org/740622
Package-Manager: Portage-3.0.4, Repoman-3.0.1
Signed-off-by: Michael Orlitzky <mjo <AT> gentoo.org>
app-antivirus/clamav/clamav-0.103.0.ebuild | 21 +++++++++++++++------
1 file changed, 15 insertions(+), 6 deletions(-)
diff --git a/app-antivirus/clamav/clamav-0.103.0.ebuild b/app-antivirus/clamav/clamav-0.103.0.ebuild
index 16a7129ce1b..9a1d28f8920 100644
--- a/app-antivirus/clamav/clamav-0.103.0.ebuild
+++ b/app-antivirus/clamav/clamav-0.103.0.ebuild
@@ -3,7 +3,7 @@
EAPI=7
-inherit autotools flag-o-matic systemd
+inherit autotools flag-o-matic systemd tmpfiles
DESCRIPTION="Clam Anti-Virus Scanner"
HOMEPAGE="https://www.clamav.net/"
@@ -12,7 +12,7 @@ SRC_URI="https://www.clamav.net/downloads/production/${P}.tar.gz"
LICENSE="GPL-2"
SLOT="0"
KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~sparc-solaris ~x86-solaris"
-IUSE="bzip2 doc clamonacc clamdtop clamsubmit iconv ipv6 libclamav-only libressl milter metadata-analysis-api selinux test uclibc xml"
+IUSE="bzip2 doc clamonacc clamdtop clamsubmit iconv ipv6 libclamav-only libressl milter metadata-analysis-api selinux systemd test uclibc xml"
REQUIRED_USE="libclamav-only? ( !clamonacc !clamdtop !clamsubmit !milter !metadata-analysis-api )"
@@ -118,10 +118,19 @@ src_install() {
rm -rf "${ED}"/var/lib/clamav || die
if ! use libclamav-only ; then
- systemd_dotmpfilesd "${FILESDIR}/tmpfiles.d/clamav.conf"
- systemd_newunit "${FILESDIR}/clamd_at.service" "clamd@.service"
- systemd_dounit "${FILESDIR}/clamd.service"
- systemd_dounit "${FILESDIR}/freshclamd.service"
+ if use systemd; then
+ # The tmpfiles entry is behind USE=systemd because the
+ # upstream OpenRC service files should (and do) ensure that
+ # the directories they need exist and have the correct
+ # permissions without the help of opentmpfiles. There are
+ # years-old root exploits in opentmpfiles, the design is
+ # fundamentally flawed, and the maintainer is not up to
+ # the task of fixing it.
+ dotmpfiles "${FILESDIR}/tmpfiles.d/clamav.conf"
+ systemd_newunit "${FILESDIR}/clamd_at.service" "clamd@.service"
+ systemd_dounit "${FILESDIR}/clamd.service"
+ systemd_dounit "${FILESDIR}/freshclamd.service"
+ fi
insinto /etc/logrotate.d
newins "${FILESDIR}"/clamav.logrotate clamav