43 lines
1.7 KiB
Python
43 lines
1.7 KiB
Python
#!/usr/bin/env python3
|
|
"""Normalize the packaged RustProxy systemd unit for Linux DEB/RPM."""
|
|
|
|
from pathlib import Path
|
|
import re
|
|
import sys
|
|
path = Path(sys.argv[1])
|
|
name = sys.argv[2]
|
|
text = path.read_text()
|
|
if not re.search(r'^\[Service\][ \t]*$', text, re.M):
|
|
raise SystemExit('unit has no [Service] section')
|
|
# This normalization also covers older/source-provided debian/*.service units:
|
|
# ProtectHome=true masks /home completely, so neither chgrp nor setfacl can
|
|
# make web roots/certificate files there readable. Keep the directories
|
|
# read-only, in addition to the existing strict filesystem sandbox.
|
|
if re.search(r'^[ \t]*ProtectHome[ \t]*=', text, re.M):
|
|
text = re.sub(r'^[ \t]*ProtectHome[ \t]*=.*$', 'ProtectHome=read-only',
|
|
text, flags=re.M)
|
|
else:
|
|
text = re.sub(r'^(\[Service\][ \t]*\n)',
|
|
lambda m: m.group(1) + 'ProtectHome=read-only\n',
|
|
text, count=1, flags=re.M)
|
|
if not re.search(r'^ExecReload=', text, re.M):
|
|
if not re.search(r'^ExecStart=', text, re.M):
|
|
raise SystemExit('unit has no ExecStart; cannot attach reload')
|
|
text = re.sub(
|
|
r'^(ExecStart=[^\n]*\n)',
|
|
lambda m: m.group(1) +
|
|
f'ExecReload=/usr/bin/{name} --data-dir /var/lib/rustproxy --admin-listen 127.0.0.1:9090 reload\n',
|
|
text,
|
|
count=1,
|
|
flags=re.M,
|
|
)
|
|
if re.search(r'^ProtectSystem=strict\s*$', text, re.M) and not re.search(
|
|
r'^ReadWritePaths=.*(?:^|[ \t])-?/etc/rustproxy(?:[ \t]|$)', text, re.M
|
|
):
|
|
text = re.sub(
|
|
r'^(ProtectSystem=strict\s*\n)',
|
|
lambda m: m.group(1) + 'ReadWritePaths=-/etc/rustproxy\n',
|
|
text, count=1, flags=re.M,
|
|
)
|
|
path.write_text(text)
|