Projetos/rpi-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

package/strongswan: allow non-root user/group to own IKE charon daemon

Browse Source 
Strongswan allows[1] to run the IKE charon daemon as non-root (defaults
to running as root) user/group, so let's allow that.

[1] https://docs.strongswan.org/docs/latest/install/reducedPrivileges.html#_running_strongswan_as_non_root
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit is contained in:
Quentin Schulz
2025-06-26 13:20:19 +02:00
committed by Julien Olivain
parent e7ca2197c4
commit 1d3ec1fc7f
2 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
package/strongswan/Config.in
View File

@@ -204,6 +204,11 @@ config BR2_PACKAGE_STRONGSWAN_SQL
config BR2_PACKAGE_STRONGSWAN_BYPASS_LAN
bool "Enable BYPASS-LAN plugin"
config BR2_PACKAGE_STRONGSWAN_NONROOT
bool "Run as non-root"
help
This allows running the IKE charon daemon as the non-root
user/group charon/charon.
endif
config BR2_PACKAGE_STRONGSWAN_PKI

10
package/strongswan/strongswan.mk
View File

@@ -66,6 +66,16 @@ ifeq ($(BR2_PACKAGE_STRONGSWAN_DROP_CAPS),y)
STRONGSWAN_CONF_OPTS += --with-capabilities=libcap
endif
ifeq ($(BR2_PACKAGE_STRONGSWAN_NONROOT),y)
STRONGSWAN_CONF_OPTS += \
--with-user=charon \
--with-group=charon
define STRONGSWAN_USERS
charon -1 charon -1 * - - -
endef
endif
ifeq ($(BR2_TOOLCHAIN_HAS_LIBATOMIC),y)
STRONGSWAN_CONF_ENV += LIBS='-latomic'
endif