NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

package/dhcp: add security options to DHCP server

Browse Source 
I was trying to make the ISC dhcp daemon more secure by using the
-user and -group option to let dhcp server run as non-root user.
Unfortunately these options are not available when building ISC dhcp
server with buildroot.
The reason is, that the configure script must be called with the
option --enable-paranoia to activate these options. But this option
is not set in the dhcp.mk file.

To be backward compatible I added a new option to the dhcp's Config.in
file to enable this feature when desired and parse this option in
dhcp.mk.

Signed-off-by: Andreas Ehmanns <universeiii@gmx.de>
[yann.morin.1998@free.fr: fix check-package]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
This commit is contained in:
Andreas Ehmanns 2022-04-28 09:46:41 +02:00 committed by Yann E. MORIN
parent 61bfaf0354
commit 40f7adae3c
2 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
package/dhcp/Config.in
View File

@ -25,6 +25,14 @@ config BR2_PACKAGE_DHCP_SERVER_DELAYED_ACK
help
Enable delayed ACK feature in the ISC DHCP server.
config BR2_PACKAGE_DHCP_SERVER_ENABLE_PARANOIA
bool "Enable paranoia options"
depends on BR2_PACKAGE_DHCP_SERVER
help
Add option --enable-paranoia to configure script. This
activates additional server options (-user, -group and
-chroot) to make dhcp server more secure.
config BR2_PACKAGE_DHCP_RELAY
bool "dhcp relay"
help

4
package/dhcp/dhcp.mk
View File

@ -78,6 +78,10 @@ ifeq ($(BR2_PACKAGE_DHCP_SERVER_DELAYED_ACK),y)
DHCP_CONF_OPTS += --enable-delayed-ack
endif
ifeq ($(BR2_PACKAGE_DHCP_SERVER_ENABLE_PARANOIA),y)
DHCP_CONF_OPTS += --enable-paranoia
endif
define DHCP_INSTALL_LIBS
$(MAKE) -C $(@D)/bind install-bind DESTDIR=$(TARGET_DIR)
$(MAKE) -C $(@D)/common install-exec DESTDIR=$(TARGET_DIR)