Hardened sysklogd.

diff --git a/config/etc/group b/config/etc/group
index dcb6217a73cfdadd86e987e95c8f80541efbde35..82c3d44e7bc00fdb694259066dcaefbfc46c7cd6 100644 (file)
--- a/config/etc/group
+++ b/config/etc/group
@@ -14,6 +14,8 @@ video:x:12:
 utmp:x:13:
 usb:x:14:
 cdrom:x:15:
+syslogd:x:16:
+klogd:x:17:
 messagebus:x:18:
 haldaemon:x:19:
 fcron:x:22:
@@ -30,8 +32,6 @@ snort:x:101:
 logwatch:x:102:
 dnsmasq:x:103:
 cron:x:104:
-syslogd:x:105:
-klogd:x:106:
 postfix:x:107:
 postdrop:x:108:
 clamav:x:109:

diff --git a/config/etc/passwd b/config/etc/passwd
index 8892766e4a5a9fddbc681e3085a497559487fd41..7dbe2fb17d85ddbb52483d24d9318e5ce44687a8 100644 (file)
--- a/config/etc/passwd
+++ b/config/etc/passwd
@@ -2,6 +2,8 @@ root:x:0:0:root:/root:/bin/bash
 bin:x:1:1:bin:/bin:/bin/false
 daemon:x:2:2:daemon:/sbin:/bin/false
 mail:x:8:12:mail:/var/spool/mail:/bin/false
+syslogd:x:16:16:System Log Daemon:/var/lib/syslogd:/sbin/nologin
+klogd:x:17:17:Kernel Log Daemon:/var/lib/klogd:/sbin/nologin
 messagebus:x:18:18:D-BUS Message Daemon User:/dev/null:/bin/false
 haldaemon:x:19:19:HAL Daemon User:/dev/null:/bin/false
 fcron:x:22:22:Fcron User:/dev/null:/bin/false
@@ -18,8 +20,6 @@ snort:x:101:101:ftp:/var/log/snort:/bin/false
 logwatch:x:102:102::/var/log/logwatch:/bin/false
 dnsmasq:x:103:103::/:/bin/false
 cron:x:104:104::/:/bin/false
-syslogd:x:105:105:/var/empty:/bin/false
-klogd:x:106:106:/var/empty:/bin/false
 clamav:x:109:109:Clam AntiVirus:/home/clamav:/bin/false
 amavis:x:110:110:Amavisd-new user:/var/amavis:
 cyrus:x:111:12:Cyrus user:/usr/cyrus:

diff --git a/lfs/sysklogd b/lfs/sysklogd
index 9142508c57d9c98c578ff2684771b43e0175b57b..ee4dcab07364bbc3449f78ac6cdb79c553b28746 100644 (file)
--- a/lfs/sysklogd
+++ b/lfs/sysklogd
@@ -37,7 +37,8 @@ TARGET     = $(DIR_INFO)/$(STAGE_ORDER)_$(STAGE)/$(THISAPP)
 # Top-level Rules
 ###############################################################################
 
-objects = $(DL_FILE)
+objects = $(DL_FILE) $(THISAPP)-disable__syslog_chk-1.patch \
+       $(THISAPP)-priv_sep-1.patch
 
 install : $(TARGET)
 
@@ -53,10 +54,17 @@ $(objects) :
 $(TARGET) : 
        @$(PREBUILD)
        @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
+
+       cd $(DIR_APP) && patch -Np1 -i $(DIR_PATCHES)/$(THISAPP)-disable__syslog_chk-1.patch
+       cd $(DIR_APP) && patch -Np1 -i $(DIR_PATCHES)/$(THISAPP)-priv_sep-1.patch
+
+       install -d -m0000 /var/lib/syslogd
+       install -d -m0000 /var/lib/klogd
+
+       cd $(DIR_APP) && sed 's/644/600/' -i.orig syslogd.c
+
        cd $(DIR_APP) && make $(PARALLELISMFLAGS)
        cd $(DIR_APP) && make install
-       touch /var/log/{dhcpcd.log,messages,ovpnserver.log}
-       chmod 664 /var/log/{dhcpcd.log,messages,ovpnserver.log}
-       chown 0:105 /var/log/{dhcpcd.log,messages,ovpnserver.log}
+
        @rm -rf $(DIR_APP)
        @$(POSTBUILD)