From patchwork Sun Jun 14 04:04:47 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yousong Zhou X-Patchwork-Id: 483914 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from arrakis.dune.hu (arrakis.dune.hu [78.24.191.176]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 409F8140187 for ; Sun, 14 Jun 2015 14:18:03 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b=QM5sRwgt; dkim-atps=neutral Received: from arrakis.dune.hu (localhost [127.0.0.1]) by arrakis.dune.hu (Postfix) with ESMTP id 9CAA928BBED; Sun, 14 Jun 2015 06:17:14 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on arrakis.dune.hu X-Spam-Level: X-Spam-Status: No, score=-1.5 required=5.0 tests=BAYES_00,FREEMAIL_FROM, T_DKIM_INVALID autolearn=unavailable version=3.3.2 Received: from arrakis.dune.hu (localhost [127.0.0.1]) by arrakis.dune.hu (Postfix) with ESMTP id D410E281454 for ; Sun, 14 Jun 2015 06:17:03 +0200 (CEST) X-policyd-weight: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 NOT_IN_SPAMCOP=-1.5 NOT_IN_BL_NJABL=-1.5 CL_IP_EQ_HELO_IP=-2 (check from: .gmail. - helo: .mail-pd0-f176.google. - helo-domain: .google.) FROM/MX_MATCHES_HELO(DOMAIN)=-2; rate: -8.5 Received: from mail-pd0-f176.google.com (mail-pd0-f176.google.com [209.85.192.176]) by arrakis.dune.hu (Postfix) with ESMTPS for ; Sun, 14 Jun 2015 06:17:03 +0200 (CEST) Received: by pdjm12 with SMTP id m12so48995021pdj.3 for ; Sat, 13 Jun 2015 21:17:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=JGqB3QxEE2B/py5wqww71bwBGI/nQWwTTFJYgpOW6uE=; b=QM5sRwgtWKrA1JONvxe+HtQuawEgqyvaI67AybPnaN6Y24MNOjIQts/dnbfJEZOe2j DIRqRgXJMGGHEapvGYp8f6k/laveKZbvcWId3cixNioRFdmjRUxAkVHOOC1LN38AHWND 3kI1W6XFAxyJQkgKeMUv91ex9uV33v4sH/h6l65VTgVIrAx78yh4pOLwSur1S2+y+bW4 ZDTiUOJRQgGyjN1Q87Hbxg3j7p8cwTGKArsmza5PI7W9IyYwGPklr9zRAwva4VQ+5p6E L0XFldxWB4bWCSHW6qPPbrH4AzDW4RuQne81R0/IdCmeSAO2h0slyk9JHBH0mYZpEf3j g+TA== X-Received: by 10.66.147.39 with SMTP id th7mr36656227pab.2.1434255422532; Sat, 13 Jun 2015 21:17:02 -0700 (PDT) Received: from debian.corp.sankuai.com ([103.29.140.57]) by mx.google.com with ESMTPSA id gp1sm8065797pbd.64.2015.06.13.21.17.00 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 13 Jun 2015 21:17:01 -0700 (PDT) From: Yousong Zhou To: blogic@openwrt.org Date: Sun, 14 Jun 2015 12:04:47 +0800 Message-Id: <1434254688-16153-2-git-send-email-yszhou4tech@gmail.com> X-Mailer: git-send-email 1.7.10.4 In-Reply-To: <1434254688-16153-1-git-send-email-yszhou4tech@gmail.com> References: <1434254688-16153-1-git-send-email-yszhou4tech@gmail.com> Cc: openwrt-devel@lists.openwrt.org Subject: [OpenWrt-Devel] [PATCH 2/3] openvpn: let instances drop to nobody in default config. X-BeenThere: openwrt-devel@lists.openwrt.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: OpenWrt Development List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: openwrt-devel-bounces@lists.openwrt.org Sender: "openwrt-devel" This is for security precautions. As persist_tun and persist_key are already there, this should not cause compatibility issue. Signed-off-by: Yousong Zhou --- package/network/services/openvpn/files/openvpn.config | 2 ++ 1 file changed, 2 insertions(+) diff --git a/package/network/services/openvpn/files/openvpn.config b/package/network/services/openvpn/files/openvpn.config index 5cf0ba6..3e053c3 100644 --- a/package/network/services/openvpn/files/openvpn.config +++ b/package/network/services/openvpn/files/openvpn.config @@ -253,6 +253,7 @@ config openvpn sample_server # of the privilege downgrade. option persist_key 1 option persist_tun 1 + option user nobody # Output a short status file showing # current connections, truncated @@ -337,6 +338,7 @@ config openvpn sample_client # Try to preserve some state across restarts. option persist_key 1 option persist_tun 1 + option user nobody # If you are connecting through an # HTTP proxy to reach the actual OpenVPN