chmod/own recursor.conf for the systemd case

diff --git a/builder-support/debian/recursor/debian-buster/pdns-recursor.postinst b/builder-support/debian/recursor/debian-buster/pdns-recursor.postinst
index 1c32de2854bba1bfbc3e1e3cbafa1647e8cf83d5..c4a755daadc28eb56ed6e31e51fe5b252bab74bd 100644 (file)
--- a/builder-support/debian/recursor/debian-buster/pdns-recursor.postinst
+++ b/builder-support/debian/recursor/debian-buster/pdns-recursor.postinst
@@ -5,6 +5,11 @@ case "$1" in
   configure)
     addgroup --system pdns
     adduser --system --home /var/spool/powerdns --shell /bin/false --ingroup pdns --disabled-password --disabled-login --gecos "PowerDNS" pdns
+    if [ "`stat -c '%U:%G' /etc/powerdns/recursor.conf`" = "root:root" ]; then
+      chown root:pdns /etc/powerdns/recursor.conf
+      # Make sure that pdns can read it; the default used to be 0600
+      chmod g+r /etc/powerdns/recursor.conf
+    fi
   ;;
 
   *)

diff --git a/builder-support/debian/recursor/debian-buster/rules b/builder-support/debian/recursor/debian-buster/rules
index c8a82683b90b903c786a6225a0869db2c69fbce7..e91959c3d5f7d3881f426200fa4dda82bf75a299 100755 (executable)
--- a/builder-support/debian/recursor/debian-buster/rules
+++ b/builder-support/debian/recursor/debian-buster/rules
@@ -57,3 +57,8 @@ override_dh_installinit:
 
 override_dh_gencontrol:
        dh_gencontrol -- $(SUBSTVARS)
+
+override_dh_fixperms:
+       dh_fixperms
+        # these files often contain passwords. 640 as it is chowned to root:pdns
+       chmod 0640 debian/pdns-server/etc/powerdns/recursor.conf

diff --git a/builder-support/debian/recursor/debian-jessie/pdns-recursor.postinst b/builder-support/debian/recursor/debian-jessie/pdns-recursor.postinst
index 1c32de2854bba1bfbc3e1e3cbafa1647e8cf83d5..c4a755daadc28eb56ed6e31e51fe5b252bab74bd 100644 (file)
--- a/builder-support/debian/recursor/debian-jessie/pdns-recursor.postinst
+++ b/builder-support/debian/recursor/debian-jessie/pdns-recursor.postinst
@@ -5,6 +5,11 @@ case "$1" in
   configure)
     addgroup --system pdns
     adduser --system --home /var/spool/powerdns --shell /bin/false --ingroup pdns --disabled-password --disabled-login --gecos "PowerDNS" pdns
+    if [ "`stat -c '%U:%G' /etc/powerdns/recursor.conf`" = "root:root" ]; then
+      chown root:pdns /etc/powerdns/recursor.conf
+      # Make sure that pdns can read it; the default used to be 0600
+      chmod g+r /etc/powerdns/recursor.conf
+    fi
   ;;
 
   *)

diff --git a/builder-support/debian/recursor/debian-jessie/rules b/builder-support/debian/recursor/debian-jessie/rules
index 20d715d51a20fa043a677bbcf119772d0424c74a..a70e92acb64927cf5e4c00021c54d3c27ffaa23b 100755 (executable)
--- a/builder-support/debian/recursor/debian-jessie/rules
+++ b/builder-support/debian/recursor/debian-jessie/rules
@@ -57,3 +57,8 @@ override_dh_installinit:
 
 override_dh_gencontrol:
        dh_gencontrol -- $(SUBSTVARS)
+
+override_dh_fixperms:
+       dh_fixperms
+        # these files often contain passwords. 640 as it is chowned to root:pdns
+       chmod 0640 debian/pdns-server/etc/powerdns/recursor.conf

diff --git a/builder-support/debian/recursor/debian-stretch/pdns-recursor.postinst b/builder-support/debian/recursor/debian-stretch/pdns-recursor.postinst
index 1c32de2854bba1bfbc3e1e3cbafa1647e8cf83d5..c4a755daadc28eb56ed6e31e51fe5b252bab74bd 100644 (file)
--- a/builder-support/debian/recursor/debian-stretch/pdns-recursor.postinst
+++ b/builder-support/debian/recursor/debian-stretch/pdns-recursor.postinst
@@ -5,6 +5,11 @@ case "$1" in
   configure)
     addgroup --system pdns
     adduser --system --home /var/spool/powerdns --shell /bin/false --ingroup pdns --disabled-password --disabled-login --gecos "PowerDNS" pdns
+    if [ "`stat -c '%U:%G' /etc/powerdns/recursor.conf`" = "root:root" ]; then
+      chown root:pdns /etc/powerdns/recursor.conf
+      # Make sure that pdns can read it; the default used to be 0600
+      chmod g+r /etc/powerdns/recursor.conf
+    fi
   ;;
 
   *)

diff --git a/builder-support/debian/recursor/debian-stretch/rules b/builder-support/debian/recursor/debian-stretch/rules
index c8a82683b90b903c786a6225a0869db2c69fbce7..e91959c3d5f7d3881f426200fa4dda82bf75a299 100755 (executable)
--- a/builder-support/debian/recursor/debian-stretch/rules
+++ b/builder-support/debian/recursor/debian-stretch/rules
@@ -57,3 +57,8 @@ override_dh_installinit:
 
 override_dh_gencontrol:
        dh_gencontrol -- $(SUBSTVARS)
+
+override_dh_fixperms:
+       dh_fixperms
+        # these files often contain passwords. 640 as it is chowned to root:pdns
+       chmod 0640 debian/pdns-server/etc/powerdns/recursor.conf