shawn/op-pedal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Set pipedal_d shell to /usr/sbin/nologin

Browse Source
This commit is contained in:
Robin Davies
2024-10-12 19:22:51 -04:00
parent b05f31aa8e
commit b9c3ad2367
11 changed files with 105 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CMakeLists.txt
+2 -2
View File
@@ -1,10 +1,10 @@
cmake_minimum_required(VERSION 3.16.0)
project(pipedal
VERSION 1.3.56
VERSION 1.3.57
DESCRIPTION "PiPedal Guitar Effect Pedal For Raspberry Pi"
HOMEPAGE_URL "https://rerdavies.github.io/pipedal"
)
set (DISPLAY_VERSION "PiPedal v1.3.56-Release")
set (DISPLAY_VERSION "PiPedal v1.3.57-Experimental")
set (PACKAGE_ARCHITECTURE "arm64")
set (CMAKE_INSTALL_PREFIX "/usr/")
README.md
+2 -2
View File
@@ -6,13 +6,13 @@
<a href="https://rerdavies.github.io/pipedal/LicensePiPedal.html"><img src="https://img.shields.io/badge/MIT-MIT?label=license&color=%23808080"/></a>
<a href="https://github.com/rerdavies/pipedal/actions"><img src="https://img.shields.io/github/actions/workflow/status/rerdavies/pipedal/cmake.yml?branch=main"/></a>
Download:&nbsp;<a href='https://rerdavies.github.io/pipedal/download.html'>v1.3.56</a>
Download:&nbsp;<a href='https://rerdavies.github.io/pipedal/download.html'>v1.3.57</a>
Website:&nbsp;[https://rerdavies.github.io/pipedal](https://rerdavies.github.io/pipedal).
Documentation:&nbsp;[https://rerdavies.github.io/pipedal/Documentation.html](https://rerdavies.github.io/pipedal/Documentation.html).
&nbsp;
#### NEW version 1.3.56 Release, providing [snapshots](https://rerdavies.github.io/pipedal/Snaphots.html), and a new Performance View. See the [release notes](https://rerdavies.github.io/pipedal/ReleaseNotes) for details.
#### NEW version 1.3.57 Release, providing [snapshots](https://rerdavies.github.io/pipedal/Snaphots.html), and a new Performance View. See the [release notes](https://rerdavies.github.io/pipedal/ReleaseNotes) for details.
&nbsp;
docs/ChangingTheWebServerPort.md
+1 -1
View File
@@ -10,7 +10,7 @@ You can optionally restrict the addresses on which PiPedal will respond by provi
To configure PiPedal to only accept connections on the Wi-Fi host access point:
sudo pipedalconfig --install --port 172.23.0.2:80
sudo pipedalconfig --install --port 192.168.60.1:80
--------
[<< Command-Line Configuration of PiPedal](CommandLine.md) | [Up](Documentation.md) | [Using LV2 Audio Plugins >>](UsingLv2Plugins.md)
docs/Installing.md
+3 -3
View File
@@ -13,17 +13,17 @@ page_icon: img/Install4.jpg
Download the most recent Debian (.deb) package for your platform:
- [Raspberry Pi OS bookworm (64-bit) v1.3.56](https://github.com/rerdavies/pipedal/releases/download/)
- [Raspberry Pi OS bookworm (64-bit) v1.3.57](https://github.com/rerdavies/pipedal/releases/download/)
- [Ubuntu/Raspberry Pi OS bullseyeye (64-bit) v1.2.31](https://github.com/rerdavies/pipedal/releases/download/v1.1.31/pipedal_1.1.31_arm64.deb)
Version 1.3.56 has not yet been tested on Ubuntu or Raspberry Pi OS bullseye. On these platforms, we recommend that you use version 1.1.31.
Version 1.3.57 has not yet been tested on Ubuntu or Raspberry Pi OS bullseye. On these platforms, we recommend that you use version 1.1.31.
Install the package by running
```
sudo apt update
cd ~/Downloads
sudo apt-get install pipedal_1.3.56_arm64.deb
sudo apt-get install pipedal_1.3.57_arm64.deb
```
Adjust accordingly if you have downloaded v1.1.31.
docs/download.md
+2 -2
View File
@@ -4,7 +4,7 @@
Download the most recent Debian (.deb) package for your platform:
- <a href="https://github.com/rerdavies/pipedal/releases/download/v1.3.56/pipedal_1.3.56_arm64.deb">Raspberry Pi OS Bookworm (64-bit) v1.3.56</a>
- <a href="https://github.com/rerdavies/pipedal/releases/download/v1.3.57/pipedal_1.3.57_arm64.deb">Raspberry Pi OS Bookworm (64-bit) v1.3.57</a>
Install the package by running
@@ -12,7 +12,7 @@ Install the package by running
```
sudo apt update
cd ~/Downloads
sudo apt-get install ./pipedal_1.3.56_arm64.deb
sudo apt-get install ./pipedal_1.3.57_arm64.deb
```
Follow the instructions in [_Configuring PiPedal After Installation_](https://rerdavies.github.io/pipedal/Configuring.html) to complete the installation.
docs/index.md
+2 -2
View File
@@ -1,7 +1,7 @@
<img src="GithubBanner.png" width="100%"/>
<a href="Installing.html"><i>v1.3.56</i></a>
<a href="Installing.html"><i>v1.3.57</i></a>
&nbsp;
@@ -9,7 +9,7 @@ To download PiPedal, click [here](download.md).
To view PiPedal documentation, click [here](Documentation.md).
#### NEW version 1.3.56 Release. See the [release notes](https://rerdavies.github.io/pipedal/ReleaseNotes) for details.
#### NEW version 1.3.57 Release. See the [release notes](https://rerdavies.github.io/pipedal/ReleaseNotes) for details.
&nbsp;
react/src/AppThemed.tsx
+1 -1
View File
@@ -103,7 +103,7 @@ const appStyles = (theme: Theme) => createStyles({
bottom: "0px",
opacity: 0.8,
background:
isDarkMode() ? "#222" : "#DDD",
isDarkMode() ? "#222" : "#EEE",
},
loadingContent: {
display: "block",
src/CMakeLists.txt
+17 -6
View File
@@ -5,6 +5,10 @@ set (CMAKE_INSTALL_PREFIX "/usr/")
set (USE_PCH 1)
set (ENABLE_BACKTRACE 1)
set (USE_SANITIZE true)
set(CXX_STANDARD 20)
include(FindPkgConfig)
@@ -96,9 +100,6 @@ endif()
set(CMAKE_CXX_STANDARD 20)
set(CMAKE_CXX_STANDARD_REQUIRED True)
set (USE_SANITIZE true)
if (!ENABLE_VST3)
set (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Werror -Wno-psabi -DARCHITECTURE=${CPACK_SYSTEM_NAME}")
else()
@@ -119,10 +120,17 @@ if (CMAKE_BUILD_TYPE MATCHES Debug)
endif()
elseif(CMAKE_BUILD_TYPE MATCHES RelWithDebInfo)
message(STATUS "RelWithgDebInfo build")
#set (CMAKE_CXX_FLAGS ${CMAKE_CXX_FLAGS} "" )
set (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -DNDEBUG" )
else()
message(STATUS "Release build")
#set (CMAKE_CXX_FLAGS ${CMAKE_CXX_FLAGS} "" )
set (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -DNDEBUG" )
endif()
if (ENABLE_BACKTRACE)
set (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -rdynamic")
if (${DEBIAN_ARCHITECTURE} MATCHES arm64)
set (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -funwind-tables")
endif()
endif()
@@ -292,6 +300,9 @@ add_executable(pipedald
)
target_include_directories(pipedald PRIVATE ${PIPEDAL_INCLUDES})
target_compile_definitions(pipedald PRIVATE "ENABLE_BACKTRACE=${ENABLE_BACKTRACE}")
target_link_libraries(pipedald PRIVATE PiPedalCommon
${PIPEDAL_LIBS}
@@ -627,7 +638,7 @@ add_executable(pipedalconfig
)
target_link_libraries(pipedalconfig PRIVATE PiPedalCommon pthread atomic uuid stdc++fs
target_link_libraries(pipedalconfig PRIVATE PiPedalCommon pthread atomic uuid stdc++fs
)
add_executable(pipedal_latency_test
src/ConfigMain.cpp
+35 -2
View File
@@ -44,6 +44,9 @@
#include <grp.h>
#include "ofstream_synced.hpp"
#include <pwd.h>
#include <unistd.h>
#define P2PD_DISABLED
#if JACK_HOST
@@ -88,6 +91,29 @@ namespace fs = std::filesystem;
#define REMOVE_OLD_SERVICE 0 // Grandfathering: whether to remove the old shutdown service (now pipedaladmind)
#define OLD_SHUTDOWN_SERVICE "pipedalshutdownd"
void changeUserShell(const char* username, const char* newShell) {
struct passwd* pw;
struct passwd p;
char buf[1024];
pw = getpwnam(username);
if (pw == nullptr) {
throw std::runtime_error("User not found");
}
if (strcmp(pw->pw_shell,newShell) == 0) {
return;
}
std::string args = SS("/usr/sbin/usermod -s " << newShell << " " << username);
if (silentSysExec(args.c_str()) != EXIT_SUCCESS)
{
cout << "Failed to set shell for " << username << endl;
}
}
fs::path GetServiceFileName(const std::string &serviceName)
{
return fs::path(SERVICE_PATH) / (serviceName + ".service");
@@ -926,7 +952,7 @@ void Install(const fs::path &programPrefix, const std::string endpointAddress)
try
{
// apply policy changes we dropped into the polkit configuration files (allows pipedal_d to use NetworkManager dbus apis).
silentSysExec(SYSTEMCTL_BIN " restart polkit");
silentSysExec(SYSTEMCTL_BIN " restart polkit.service");
DeployVarConfig();
@@ -994,7 +1020,7 @@ void Install(const fs::path &programPrefix, const std::string endpointAddress)
if (!userExists(SERVICE_ACCOUNT_NAME))
{
if (sysExec(USERADD_BIN " " SERVICE_ACCOUNT_NAME " -g " SERVICE_GROUP_NAME " -m --home /var/pipedal/home -N -r") != EXIT_SUCCESS)
if (sysExec(USERADD_BIN " " SERVICE_ACCOUNT_NAME " -g " SERVICE_GROUP_NAME " -s /usr/sbin/nologin -m --home /var/pipedal/home -N -r") != EXIT_SUCCESS)
{
// throw std::runtime_error("Failed to create service account.");
}
@@ -1007,6 +1033,13 @@ void Install(const fs::path &programPrefix, const std::string endpointAddress)
// add to netdev group
sysExec(USERMOD_BIN " -a -G " NETDEV_GROUP_NAME " " SERVICE_ACCOUNT_NAME);
try {
changeUserShell(SERVICE_ACCOUNT_NAME, "/usr/sbin/nologon");
} catch (const std::exception&e)
{
cout << "Error: Can't set user shell for pipedal_d. " << e.what() << std::endl;
}
// create and configure /var directory.
fs::path varDirectory("/var/pipedal");
src/SetWifiConfig.cpp
+10 -10
View File
@@ -544,9 +544,9 @@ p2p configuration:
dnsmaqsq.d/30-pipedal-p2p.conf:
interface=p2p-wlan0-0
dhcp-range=p2p-wlan0,173.24.0.3,172.23.0.127,1h
dhcp-range=p2p-wlan0,173.24.0.3,192.168.60.127,1h
domain=local
address=/pipedal.local/172.23.0.2
address=/pipedal.local/192.168.60.2
except-interface=eth0
except-interface=wlan0
@@ -556,8 +556,8 @@ except-interface=lo
dhcpcd.conf:
======
interface p2p-wlan0-0
static ip_address=172.24.0.1/16
domain_name_servers=172.24.0.1
static ip_address=192.168.60.1/16
domain_name_servers=192.168.60.1
Watch resolv.conf to make sure we don't lose DNS servers.
************************************************************************************/
@@ -672,8 +672,8 @@ static void ConfigDhcpcdForP2p()
// dhcpcd.conf:
// ======
// interface p2p-wlan0-0
// static ip_address=172.24.0.1/24
// domain_name_server=172.24.0.1
// static ip_address=192.168.60.1/24
// domain_name_server=192.168.60.1
int line = dhcpcd.GetLineThatStartsWith("hostname");
std::string hostNameLine;
@@ -691,8 +691,8 @@ static void ConfigDhcpcdForP2p()
{
line = dhcpcd.GetLineCount();
// interface p2p-wlan0-0
// static ip_address=172.24.0.1/16 (trying int on .1.)
// domain_name_server=172.24.0.1
// static ip_address=192.168.60.1/16 (trying int on .1.)
// domain_name_server=192.168.60.1
dhcpcd.InsertLine(line++, "interface p2p-wlan0-0");
dhcpcd.InsertLine(line++, " static ip_address=" P2P_INTERFACE_ADDR);
@@ -705,8 +705,8 @@ static void ConfigDhcpcdForP2p()
line = dhcpcd.GetLineCount();
}
// interface p2p-wlan0-0
// static ip_address=172.24.0.1/16 (trying int on .1.)
// domain_name_server=172.24.0.1
// static ip_address=192.168.60.1/16 (trying int on .1.)
// domain_name_server=192.168.60.1
dhcpcd.InsertLine(line++, SS("allowinterfaces p2p-" << GetWifiConfigWlanAddress() << "-*").c_str());
dhcpcd.InsertLine(line++, "static ip_address=" P2P_INTERFACE_ADDR);
src/main.cpp
+30 -2
View File
@@ -27,7 +27,7 @@
#include "ServiceConfiguration.hpp"
#include "AvahiService.hpp"
#include "WebServerConfig.hpp"
#include <execinfo.h>
#include "PiPedalSocket.hpp"
#include "PluginHost.hpp"
#include <boost/system/error_code.hpp>
@@ -87,11 +87,39 @@ static void AsanCheck()
exit(EXIT_FAILURE);
}
#if ENABLE_BACKTRACE
void segvHandler(int sig) {
void *array[10];
// Get void*'s for all entries on the stack
size_t size;
size = backtrace(array, 10);
// Print out all the frames to stderr
const char *message = "Error: SEGV signal received.\n";
write(STDERR_FILENO,message,strlen(message));
backtrace_symbols_fd(array+2, size-2, STDERR_FILENO);
_exit(EXIT_FAILURE);
}
static void EnableBacktrace()
{
signal(SIGSEGV, segvHandler);
}
#endif
int main(int argc, char *argv[])
{
#ifndef WIN32
umask(002); // newly created files in /var/pipedal get 775-ish permissions, which improves debugging/live-service interaction.
umask(002); // newly created files in /var/pipedal get 7cd75-ish permissions, which improves debugging/live-service interaction.
#endif
#if ENABLE_BACKTRACE
EnableBacktrace();
#endif
// Check command line arguments.