On 2013-08-28 Wed 11:56 AM |, Stuart Henderson wrote: > > "make plist" and tweak the results as needed like other ports do. > a port shouldn't be touching files in the ports tree itself during > build, and in this case it won't even work (you keep appending to > the file each time it's run). >
The pre-install macro deletes PLIST*, so it works very well. > > From a quick look at the script (I'm only using spamd as a classic > tarpit on a low priority MX rather than anything else so I'm not > interesting in using it myself..) there are various uses of > fixed/predictable names for tempfiles in shared directories, > which is unsafe. It's a well known problem so there's plenty of > advice e.g. > > https://www.securecoding.cert.org/confluence/display/seccode/FIO43-C.+Do+not+create+temporary+files+in+shared+directories > > (note, predictable names includes using $$, use mktemp with a decent > number of X's, say 10+, instead) > It's part of the deliberate design concept to use predictable names as the tool caches blacklists. If during the next run there are temporary networking errors, the currently running instance can reuse previously cached data. This is also essential to rsync large blacklists, as wiping out cached files defeats the purpose of the protocol. As the blacklists are (mostly) publicly available, I thought /var/tmp was sufficient. As per the README, the cache is settable, and there are 2 examples (for local distribution amongst a cluster of mail servers, via [s]ftp, scp, whatever);- /var/spool/ftp/pub/OpenBSD/spamd-cache/ /var/spool/ftp/pub/spamd/ The locks also need to have predictable names as each time spamd-setup is run by cron, it exec's a new instance for each blacklist. There is no persistent process to use any IPC. After reading the CERT URL, I realise an attacker might be able to alter the blacklists.... OK. I could default to using /var/[spool/]${DISTNAME} for everything, and also check for stale files internally, rather than rely on daily(8). Quick question;- should tools log in /var/log, or their own sub dir (e.g. apache, squid)? I chose to append failed $(mktemp) logs to /var/tmp/${DISTNAME}.log as any transient networking errors are inconsequential after a couple of days, by which time daily(8) will have deleted the log. A newsyslog(8) entry seemed OTT for a seldom used log. > ... retrieved=$(print ${url} | sed 's/[`??!"$%^&*()+=:;@~#\|?/<>,]/_/g') > > Keep known-good characters, rather than try and strip out bad > characters. A hash of the URL might be more appropriate. > OK. I done it that way to make the cache human readable for any manual administration: $ ls /var/tmp/spamd-setup-downloader psbl-mirror.surriel.com__psbl_psbl.txt rsync-mirrors.uceprotect.net__RBLDNSD-ALL_dnsbl-1.uceprotect.net www.bsdly.net__peter_bsdly.net.traplist www.bsdly.net__peter_bsdly.net.traplist~ www.openbsd.org_spamd_nixspam www.openbsd.org_spamd_nixspam.gz www.openbsd.org_spamd_nixspam.gz~ www.openbsd.org_spamd_traplist www.openbsd.org_spamd_traplist.gz www.openbsd.org_spamd_traplist.gz~ Right then, several alterations to implement.... Thanks for the help, -- Craig Skinner | http://twitter.com/Craig_Skinner | http://linkd.in/yGqkv7
