mirror of
https://github.com/jmcorgan/fips.git
synced 2026-08-06 14:44:37 +00:00
Johnathan Corgan
b33d6531ce
The fips-dns.service unit had three issues: 1. Wants=systemd-resolved.service caused systemd to start systemd-resolved on systems that weren't using it, breaking existing DNS by rewriting /etc/resolv.conf to the stub resolver at 127.0.0.53. 2. The ExecStart busy-wait loop for fips0 had no timeout, hanging forever if fips.service failed to create the TUN device. 3. Installers unconditionally enabled fips-dns.service regardless of whether systemd-resolved was present. Fix by replacing Wants= with ConditionPathExists=/run/systemd/resolve (skips cleanly if resolved isn't running), adding Requires=fips.service (won't start without the daemon), bounding the fips0 wait loop to 30 seconds, and making the installers conditional on systemd-resolved being active.
39 lines
1.2 KiB
Bash
Executable File
39 lines
1.2 KiB
Bash
Executable File
#!/bin/sh
|
|
# FIPS post-install script for Debian/Ubuntu
|
|
set -e
|
|
|
|
case "$1" in
|
|
configure)
|
|
# Create fips system group for control socket access
|
|
if ! getent group fips >/dev/null 2>&1; then
|
|
groupadd --system fips
|
|
fi
|
|
|
|
# Ensure runtime directory exists with correct ownership
|
|
if [ -d /run/systemd/system ]; then
|
|
systemd-tmpfiles --create /usr/lib/tmpfiles.d/fips.conf 2>/dev/null || true
|
|
fi
|
|
|
|
# Reload systemd and enable services
|
|
if [ -d /run/systemd/system ]; then
|
|
systemctl daemon-reload
|
|
systemctl enable fips.service 2>/dev/null || true
|
|
if systemctl is-active --quiet systemd-resolved.service 2>/dev/null; then
|
|
systemctl enable fips-dns.service 2>/dev/null || true
|
|
fi
|
|
|
|
# On upgrade, restart services that were running before
|
|
if [ -n "$2" ]; then
|
|
systemctl start fips.service 2>/dev/null || true
|
|
if systemctl is-enabled --quiet fips-dns.service 2>/dev/null; then
|
|
systemctl start fips-dns.service 2>/dev/null || true
|
|
fi
|
|
fi
|
|
fi
|
|
;;
|
|
esac
|
|
|
|
#DEBHELPER#
|
|
|
|
exit 0
|