mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
Johnathan CorganandGitHub
fe205e74de
Replace the resolvectl-only fips-dns.service with a detection script that configures whichever DNS resolver is available: 1. systemd dns-delegate (systemd >= 258, declarative drop-in) 2. systemd-resolved via resolvectl (most systemd distros) 3. dnsmasq (standalone) 4. NetworkManager with dnsmasq plugin 5. Warning with manual instructions if none found Service reloads are non-fatal — config is written and the backend is recorded even if the reload fails, preventing state file cleanup issues under set -e. Teardown reads the recorded backend from /run/fips/dns-backend and reverses the configuration, or cleans up all possible backends if the state file is missing. Includes a Docker-based test harness (testing/dns-resolver/test.sh) covering all five backends across Debian 12, Debian 13, Fedora, and bare systems. Fixes #52.
31 lines
707 B
Bash
Executable File
31 lines
707 B
Bash
Executable File
#!/bin/sh
|
|
# FIPS post-removal script for Debian/Ubuntu
|
|
set -e
|
|
|
|
case "$1" in
|
|
purge)
|
|
# Remove configuration and identity keys
|
|
rm -rf /etc/fips/
|
|
|
|
# Remove tmpfiles.d entry
|
|
rm -f /usr/lib/tmpfiles.d/fips.conf
|
|
|
|
# Remove runtime directory
|
|
rm -rf /run/fips/
|
|
|
|
# Remove DNS config files that fips-dns-setup may have created
|
|
rm -f /etc/systemd/dns-delegate/fips.dns-delegate
|
|
rm -f /etc/dnsmasq.d/fips.conf
|
|
rm -f /etc/NetworkManager/dnsmasq.d/fips.conf
|
|
|
|
# Remove fips system group
|
|
if getent group fips >/dev/null 2>&1; then
|
|
groupdel fips 2>/dev/null || true
|
|
fi
|
|
;;
|
|
esac
|
|
|
|
#DEBHELPER#
|
|
|
|
exit 0
|