blob: bed75c6b98c50c5beee2be2d433ce3d6149f05dd (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
|
#!/bin/mkpkg
# description: User space IEEE 802.1X/WPA supplicant
# url: https://hostap.epitest.fi/wpa_supplicant/
name=wpa_supplicant
version=2.12
release=2
depends=(libressl libnl libcap2)
groups=(wpa_supplicant:user:wpa_supplicant:/var/lib/wpa_supplicant:750:905:905)
services=(wpa_supplicant)
permissions=(
/sbin/wpa_supplicant:root:wpa_supplicant:750
/sbin/wpa_cli:root:wpa_supplicant:750
/etc/wpa_supplicant.conf:root:wpa_supplicant:640
)
source=(https://w1.fi/releases/$name-$version.tar.gz)
patch() {
cd $name-$version
# Fix LibreSSL compatibility - add const to callback signature
sed -i 's/SSL_CIPHER \*\*cipher/const SSL_CIPHER **cipher/' \
src/crypto/tls_openssl.c
# Make client sockets group-writable after bind() so the
# unprivileged daemon can sendto() replies. fchmod() before
# bind() has no effect on musl, so we chmod() the path after.
# Combined with client sockets in /run/wpa_supplicant/ (setgid),
# the socket inherits group wpa_supplicant and becomes writable
# by the daemon.
sed -i '/ctrl->dest.sun_family = AF_UNIX;/i\\tchmod(ctrl->local.sun_path, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);' \
src/common/wpa_ctrl.c
}
sha256sums=(
"08e23937e16d0155e55cab2b51f51fbe10d80a1aa91c4e15442645059b737ef6"
)
build() {
cd $name-$version/$name
cp defconfig .config
# Enable libnl3
sed -i 's/^#CONFIG_LIBNL32=y/CONFIG_LIBNL32=y/' .config
# Disable dbus
sed -i 's/^CONFIG_CTRL_IFACE_DBUS_NEW=y/#CONFIG_CTRL_IFACE_DBUS_NEW=y/' .config
sed -i 's/^CONFIG_CTRL_IFACE_DBUS_INTRO=y/#CONFIG_CTRL_IFACE_DBUS_INTRO=y/' .config
# Disable MACsec (not needed, avoids link issues)
sed -i 's/^CONFIG_DRIVER_MACSEC_LINUX=y/#CONFIG_DRIVER_MACSEC_LINUX=y/' .config
# Add libnl3 include path
echo "CFLAGS += -I/include/libnl3" >> .config
# Internal line editing for wpa_cli: history, tab completion
sed -i 's/^#CONFIG_WPA_CLI_EDIT=y/CONFIG_WPA_CLI_EDIT=y/' .config
# Both dir defines must point to /run/wpa_supplicant:
# CLIENT_DIR: where wpa_cli creates its own client socket
# DIR: where wpa_cli scans for the server socket (default: /var/run/wpa_supplicant)
echo 'CFLAGS += -DCONFIG_CTRL_IFACE_CLIENT_DIR=\"/run/wpa_supplicant\"' >> .config
echo 'CFLAGS += -DCONFIG_CTRL_IFACE_DIR=\"/run/wpa_supplicant\"' >> .config
make BINDIR=/sbin LIBDIR=/lib
make DESTDIR=$PKG BINDIR=/sbin LIBDIR=/lib install
# Man pages
install -d $PKG/usr/share/man/man8
install -m 644 doc/docbook/*.8 $PKG/usr/share/man/man8/
# Default config
install -d $PKG/etc
printf '%s\n' \
'ctrl_interface=DIR=/run/wpa_supplicant GROUP=wpa_supplicant' \
'p2p_disabled=1' \
> $PKG/etc/wpa_supplicant.conf
# Remove man pages for binaries not included
rm -f $PKG/usr/share/man/man8/eapol_test.8
rm -f $PKG/usr/share/man/man8/wpa_gui.8
}
post_build() {
# runit service with capsh privilege separation
# Sequence: --keep=1 preserves caps across setuid,
# --user drops to unprivileged, --inh + --addamb
# raise ambient caps for the exec'd process.
# -O overrides ctrl_interface so wpa_supplicant uses
# the pre-created directory without attempting chown/chmod.
# IFACE must be exported so the capsh subshell can see it.
install -d $PKG/etc/sv/wpa_supplicant/log
printf '%s\n' \
'#!/bin/sh' \
'exec 2>&1' \
'install -d -m 2770 -o root -g wpa_supplicant /run/wpa_supplicant' \
'# find first wireless interface' \
'for dev in /sys/class/net/*/wireless; do' \
' [ -e "$dev" ] || continue' \
' IFACE=${dev%%/wireless}' \
' IFACE=${IFACE##*/}' \
' break' \
'done' \
'[ -z "$IFACE" ] && exit 1' \
'export IFACE' \
'exec capsh --keep=1 --user=wpa_supplicant \' \
' --inh=cap_net_admin,cap_net_raw \' \
' --addamb=cap_net_admin \' \
' --addamb=cap_net_raw \' \
' -- -c "exec /sbin/wpa_supplicant -i \$IFACE -c /etc/wpa_supplicant.conf -O /run/wpa_supplicant"' \
> $PKG/etc/sv/wpa_supplicant/run
printf '%s\n' \
'#!/bin/sh' \
'rm -rf /run/wpa_supplicant' \
> $PKG/etc/sv/wpa_supplicant/finish
printf '%s\n' \
'#!/bin/sh' \
'mkdir -p /var/log/wpa_supplicant' \
'exec svlogd -tt /var/log/wpa_supplicant' \
> $PKG/etc/sv/wpa_supplicant/log/run
chmod 755 $PKG/etc/sv/wpa_supplicant/run
chmod 755 $PKG/etc/sv/wpa_supplicant/finish
chmod 755 $PKG/etc/sv/wpa_supplicant/log/run
}
signify() {
untrusted comment: public key
RWTZ9IduCSQ/mL8337TEUinPwT92xFEUpD92hkS7IxcOnzTt9QdpohT3
}
# vim: filetype=sh
|
