mail-filter/opendkim: new revision with a dedicated "opendkim" user.

Prior to this revision, the OpenDKIM daemon would run as the "milter"
user, which is a username shared by a few other related packages.
However, that user has the ability to read your private DKIM signing
keys, and no other services should have access to those. Thus, sharing
the user account creates a security risk. In the new revision, a
dedicated "opendkim" user is created for the OpenDKIM daemon. The
configuration, OpenRC service script, and systemd service files have
all been updated with the new user name.

In addition, the permissions on /var/lib/opendkim have been tightened
so members of the "opendkim" group can only read it by default. The
daemon does not need to modify your keys, in particular, and should
not be able to. One downside to this is that the "Statistics"
configuration directive that was enabled by default with USE=berkdb
will no longer work out-of-the-box. It will still work, but the
administrator will need to grant write access to the file that he
designates for the statistics data. But since it won't work without
some extra fiddling, it has been removed from the configuration file
that we install.

An ewarn notifies users who are upgrading of the account name change.

Closes: https://bugs.gentoo.org/629888
Signed-off-by: Michael Orlitzky <mjo@gentoo.org>
Package-Manager: Portage-2.3.62, Repoman-2.3.11

2 files changed, 70 insertions, 0 deletions

diff --git a/mail-filter/opendkim/files/opendkim-r2.service b/mail-filter/opendkim/files/opendkim-r2.service
new file mode 100644
index 000000000000..006ff822d7f9
--- /dev/null
+++ b/mail-filter/opendkim/files/opendkim-r2.service
@@ -0,0 +1,15 @@
+[Unit]
+Description=DomainKeys Identified Mail (DKIM) Milter
+Documentation=man:opendkim(8) man:opendkim.conf(5) man:opendkim-genkey(8) man:opendkim-genzone(8) man:opendkim-testadsp(8) man:opendkim-testkey http://www.opendkim.org/docs.html
+After=network.target nss-lookup.target syslog.target
+
+[Service]
+ExecStart=/usr/sbin/opendkim -f -x /etc/opendkim/opendkim.conf
+ExecReload=/bin/kill -USR1 $MAINPID
+RuntimeDirectory=opendkim
+RuntimeDirectoryMode=0750
+User=opendkim
+Group=opendkim
+
+[Install]
+WantedBy=multi-user.target
diff --git a/mail-filter/opendkim/files/opendkim.init.r4 b/mail-filter/opendkim/files/opendkim.init.r4
new file mode 100644
index 000000000000..8c349b85dd31
--- /dev/null
+++ b/mail-filter/opendkim/files/opendkim.init.r4
@@ -0,0 +1,55 @@
+#!/sbin/openrc-run
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+CONFFILE=/etc/opendkim/${SVCNAME}.conf
+
+depend() {
+	use dns logger net
+	before mta
+}
+
+check_cfg() {
+
+	PIDFILE=$(sed -ne 's/^[[:space:]]*PidFile[[:space:]]\+//p' "${CONFFILE}")
+	local PIDDIR="${PIDFILE%/*}"
+	if [ ! -d  "${PIDDIR}" ] ; then
+		checkpath -q -d -o opendkim:opendkim -m 0755 "${PIDDIR}" || return 1
+	fi
+	if [ ! -f "${CONFFILE}" ] ; then
+		eerror "Configuration file ${CONFFILE} is missing"
+		return 1
+	fi
+	if [ -z "${PIDFILE}" ] ; then
+		eerror "Configuration file needs PidFile setting - recommend adding 'PidFile /var/run/opendkim/${SVCNAME}.pid' to ${CONFFILE}"
+		return 1
+	fi
+
+	if egrep -q '^[[:space:]]*Background[[:space:]]+no' "${CONFFILE}" ; then
+		eerror "${SVCNAME} service cannot run with Background key set to yes!"
+		return 1
+	fi
+}
+
+start() {
+	check_cfg || return 1
+	
+	# Remove stalled Unix socket if no other process is using it
+	local UNIX_SOCKET=$(sed -ne 's/^[[:space:]]*Socket[[:space:]]\+\(unix\|local\)://p' "${CONFFILE}")
+
+	if [ -S "${UNIX_SOCKET}" ] && ! fuser -s "${UNIX_SOCKET}"; then
+		rm "${UNIX_SOCKET}"
+	fi
+
+	ebegin "Starting OpenDKIM"
+	start-stop-daemon --start --pidfile "${PIDFILE}" \
+		--exec /usr/sbin/opendkim -- -x "${CONFFILE}"
+	eend $?
+}
+
+stop() {
+	check_cfg || return 1
+	ebegin "Stopping OpenDKIM"
+	start-stop-daemon --stop --pidfile "${PIDFILE}"
+	eend $?
+}