Server bug fix: Include CAP_SETGID so it does not run as root
* debian/mandos.postinst (configure): If old version was 1.7.4-1 or 1.7.4-1~bpo8+1, fix situation where clients.pickle file is owned by root. * mandos (main): Print debug info about setuid() and setgid() * mandos.service ([Service]/CapabilityBoundingSet): Add "CAP_KILL CAP_SETGID"; the latter is needed for setgid() to be allowed.
if ! dpkg-statoverride --list "/var/lib/mandos" >/dev/null \
54
2>&1; then
55
chown _mandos:_mandos /var/lib/mandos
56
chmod u=rwx,go= /var/lib/mandos
57
fi
58
59
if dpkg --compare-versions "$2" eq "1.8.0-1" \
60
|| dpkg --compare-versions "$2" eq "1.8.0-1~bpo9+1"; then
61
if grep --quiet --regexp='^[[:space:]]*key_id[[:space:]]*=[[:space:]]*[Ee]3[Bb]0[Cc]44298[Ff][Cc]1[Cc]149[Aa][Ff][Bb][Ff]4[Cc]8996[Ff][Bb]92427[Aa][Ee]41[Ee]4649[Bb]934[Cc][Aa]495991[Bb]7852[Bb]855[[:space:]]*$' /etc/mandos/clients.conf; then