nut: enable shared NSS certificate/key database for upsd and upsmon

Create a group to allow sharing directories files between upsd and
upsmon, and create a shared NSS certificate/key database on postinst
of nut-common (providing the database dir does not already exist).

Also enables preserving the shared database across sysupgrades.

Signed-off-by: Daniel F. Dickinson <redacted>

diff --git a/net/nut/Makefile b/net/nut/Makefile
index d4bb8195dc969be8a43315df6d1cf35e3b73ea0a..0883ad61f6b6145182d7ff30db1707467dbcdacf 100644 (file)
--- a/net/nut/Makefile
+++ b/net/nut/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=nut
 PKG_VERSION:=2.8.5
-PKG_RELEASE:=4
+PKG_RELEASE:=5
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://www.networkupstools.org/source/2.8/
@@ -98,6 +98,8 @@ define Package/nut-server/install
                $(PKG_BUILD_DIR)/libhid-ups.parsed-usermap
        $(SED) 's^### insert libhid-ups.parsed-usermap content here ###^\ncat "$(PKG_BUILD_DIR)/libhid-ups.parsed-usermap"^e' $(PKG_BUILD_DIR)/30-libhid-ups
        $(INSTALL_BIN) $(PKG_BUILD_DIR)/30-libhid-ups $(1)/etc/hotplug.d/usb/30-libhid-ups
+       $(INSTALL_DIR) $(1)/etc/uci-defaults
+       $(INSTALL_DATA) ./files/nut-server.default $(1)/etc/uci-defaults/90_nut-server
 endef
 
 define Package/nut-common
@@ -108,7 +110,8 @@ define Package/nut-common
     +NUT_DRIVER_USB:libusb-compat \
     +NUT_DRIVER_NEON:libneon \
     +NUT_SSL:libopenssl \
-    +NUT_SSL_NSS:libnss
+    +NUT_SSL_NSS:libnss \
+    +NUT_SSL_NSS:nss-utils
 endef
 
 define Package/nut-common/description
@@ -118,6 +121,7 @@ endef
 
 define Package/nut-common/conffiles
 /etc/nut/nut.conf
+/etc/nut/cert_db/
 endef
 
 define Package/nut-common/install
@@ -133,12 +137,15 @@ define Package/nut-common/install
        $(if $(CONFIG_NUT_SSL_NSS),printf "%s" "nss" >$(PKG_BUILD_DIR)/ssl_backend)
        $(if $(CONFIG_NUT_SSL)$(CONFIG_NUT_SSL_NSS),,printf "%s" "none" >$(PKG_BUILD_DIR)/ssl_backend)
        $(INSTALL_DATA) $(PKG_BUILD_DIR)/ssl_backend $(1)/usr/share/nut/ssl_backend
+       $(INSTALL_DIR) $(1)/etc/uci-defaults
+       $(INSTALL_DATA) ./files/nut-common.default $(1)/etc/uci-defaults/89_nut-common
 endef
 
 define Package/nut-server
   $(call Package/nut/Default)
   TITLE+= (server)
-  DEPENDS:=nut +nut-common
+  DEPENDS:=nut \
+    +nut-common
   USERID:=nut=113:nut=113
 endef
 
@@ -158,10 +165,17 @@ define Package/nut-server/conffiles
 /etc/nut/ups.conf
 endef
 
+define Package/nut-server/postinst
+#!/bin/sh
+[ -n "$${IPKG_INSTROOT}" ] || (. /etc/uci-defaults/90_nut-server) && rm -f /etc/uci-defaults/90_nut-server
+exit 0
+endef
+
 define Package/nut-upsmon
   $(call Package/nut/Default)
   TITLE+= (monitor)
-  DEPENDS:=nut +nut-common
+  DEPENDS:=nut \
+    +nut-common
   USERID:=nutmon=114:nutmon=114
 endef
 
@@ -180,6 +194,12 @@ define Package/nut-upsmon/conffiles
 /etc/nut/upsmon.conf
 endef
 
+define Package/nut-upsmon/postinst
+#!/bin/sh
+[ -n "$${IPKG_INSTROOT}" ] || (. /etc/uci-defaults/90_nut-upsmon) && rm -f /etc/uci-defaults/90_nut-upsmon
+exit 0
+endef
+
 define Package/nut-upsmon/install
        $(INSTALL_DIR) $(1)/etc/nut
        $(INSTALL_DIR) $(1)/usr/sbin
@@ -194,6 +214,7 @@ define Package/nut-upsmon/install
        $(INSTALL_DIR) $(1)/etc/config
        $(INSTALL_CONF) ./files/nut_monitor $(1)/etc/config/nut_monitor
        ln -sf /var/etc/nut/upsmon.conf $(1)/etc/nut/upsmon.conf
+       $(INSTALL_DATA) ./files/nut-upsmon.default $(1)/etc/uci-defaults/90_nut-upsmon
 endef
 
 define Package/nut-upsmon/conffiles

diff --git a/net/nut/files/nut-common.default b/net/nut/files/nut-common.default
new file mode 100644 (file)
index 0000000..efb6c65
--- /dev/null
+++ b/net/nut/files/nut-common.default
@@ -0,0 +1,67 @@
+#!/bin/sh
+# In recent (relevant) versions of shellcheck busybox is a valid shell type
+# shellcheck shell=busybox
+
+# uci-defaults script to setup nut-common package
+#  * create (if not present) shared group for directories shared with nut-upsmon
+#  * install/create NSS certificate/key database
+
+# IPKG_INSTROOT is intentionally only set when building an image and
+# is intentionally empty on a live OpenWrt device
+
+# Shellcheck source paths intentionally point to the location of files of
+# the scripts in the development environment (where shellcheck is used), not
+# on the live OpenWrt device.
+
+# This script lives in nut-common package, which is independent of the
+# nut-upsmon package in which nut-upsmon.default lives
+
+# The separate packages limit the opportunities for code-sharing across the
+# scripts.
+
+# Only run this uci-defaults script on a live OpenWrt device
+[ -z "${IPKG_INSTROOT}" ] || exit 0
+
+# shellcheck source=net/nut/files/functions.sh.functions
+. /lib/functions.sh || {
+       # As the uci-defaults environment in which this runs does not have logging
+       # available, nor is stderr captured or displayed on the console, these messages
+       # exist only to assist when debugging manual runs of the script.
+       printf "'%s': '%s'" "nut-common.default" "FATAL: Unable to source 'functions.sh'" || true
+       exit 1
+}
+
+if ! group_exists "nutgrp"; then
+       group_add_next "nutgrp"
+fi
+
+if [ -n "$(command -v certutil)" ]; then
+       if [ ! -d /etc/nut/cert_db ]; then
+               old_umask="$(umask)"
+               umask 027
+               {
+                       mkdir -p /etc/nut/cert_db
+                       chgrp nutgrp /etc/nut/cert_db
+               } || {
+                       printf "'%s': '%s'" "nut-common.default" "FATAL: Unable to create '/etc/nut/cert_db' with the needed group and permissions" || true
+                       umask "$old_umask"
+                       exit 1
+               }
+               umask "$old_umask"
+
+               # We only create the database if the directory did not exist before running this script, as we
+               # do not wish to overwrite an existing database
+               certutil -N -d /etc/nut/cert_db --empty-password || {
+                       printf "'%s': '%s'" "nut-common.default" "FATAL: Unable to create empty certificate database"
+                       umask "$old_umask"
+                       exit 1
+               }
+               chgrp nutgrp /etc/nut/cert_db/*
+               # certutil does not honour umask so we must set permissions with chmod
+               chmod 0640 /etc/nut/cert_db/*
+       else
+               # If /etc/nut/cert_db already exists, we assume it is a pre-existing install
+               # and do not override potential system administrator initiated changes.
+               :
+       fi
+fi

diff --git a/net/nut/files/nut-server.default b/net/nut/files/nut-server.default
new file mode 100644 (file)
index 0000000..8d6be2f
--- /dev/null
+++ b/net/nut/files/nut-server.default
@@ -0,0 +1,38 @@
+#!/bin/sh
+# In recent (relevant) versions of shellcheck busybox is a valid shell type
+# shellcheck shell=busybox
+
+# uci-defaults script to setup nut-server package
+#  * create (if not present) shared group for directories shared with nut-upsmon
+#  * install/create NSS certificate/key database
+
+# IPKG_INSTROOT is intentionally only set when building an image and
+# is intentionally empty on a live OpenWrt device
+
+# Shellcheck source paths intentionally point to the location of files of
+# the scripts in the development environment (where shellcheck is used), not
+# on the live OpenWrt device.
+
+# This script lives in nut-server package, which is independent of the
+# nut-upsmon package in which nut-upsmon.default lives
+
+# The separate packages limit the opportunities for code-sharing across the
+# scripts.
+
+# Only run this uci-defaults script on a live OpenWrt device
+[ -z "${IPKG_INSTROOT}" ] || exit 0
+
+# shellcheck source=net/nut/files/functions.sh.functions
+. /lib/functions.sh || {
+       # As the uci-defaults environment in which this runs does not have logging
+       # available, nor is stderr captured or displayed on the console, these messages
+       # exist only to assist when debugging manual runs of the script.
+       printf "'%s': '%s'" "nut-server.default" "FATAL: Unable to source 'functions.sh'" || true
+       exit 1
+}
+
+if ! group_exists "nutgrp"; then
+       group_add_next "nutgrp"
+fi
+
+group_add_user "nutgrp" "nut"

diff --git a/net/nut/files/nut-upsmon.default b/net/nut/files/nut-upsmon.default
new file mode 100644 (file)
index 0000000..3eda299
--- /dev/null
+++ b/net/nut/files/nut-upsmon.default
@@ -0,0 +1,38 @@
+#!/bin/sh
+# In recent (relevant) versions of shellcheck busybox is a valid shell type
+# shellcheck shell=busybox
+
+# uci-defaults script to setup nut-upsmon package
+#  * create (if not present) shared group for directories shared with nut-server
+#  * install/create NSS certificate/key database
+
+# IPKG_INSTROOT is intentionally only set when building an image and
+# is intentionally empty on a live OpenWrt device
+
+# Shellcheck source paths intentionally point to the location of files of
+# the scripts in the development environment (where shellcheck is used), not
+# on the live OpenWrt device.
+
+# This script lives in nut-upsmon package, which is independent of the
+# nut-server package in which nut-server.default lives
+
+# The separate packages limit the opportunities for code-sharing across the
+# scripts.
+
+# Only run this uci-defaults script on a live OpenWrt device
+[ -z "${IPKG_INSTROOT}" ] || exit 0
+
+# shellcheck source=net/nut/files/functions.sh.functions
+. /lib/functions.sh || {
+       # As the uci-defaults environment in which this runs does not have logging
+       # available, nor is stderr captured or displayed on the console, these messages
+       # exist only to assist when debugging manual runs of the script.
+       printf "'%s': '%s'" "nut-upsmon.default" "FATAL: Unable to source 'functions.sh'" || true
+       exit 1
+}
+
+if ! group_exists "nutgrp"; then
+       group_add_next "nutgrp"
+fi
+
+group_add_user "nutgrp" "nutmon"