- add user and socket support

Changed files:
    p0f.init -> 1.13
    p0f.sysconfig -> 1.4

diff --git a/p0f.init b/p0f.init
index 2b74e6c2e670454ecb6a34463c5efad4da766841..2c51c577779cc8e2a713c440136c163faa8ae23f 100644 (file)
--- a/p0f.init
+++ b/p0f.init
@@ -43,8 +43,17 @@ case "$1" in
                                RULE="$P0F_RULE"
                        fi
                fi
+               OPTIONS=""
                if [ -n "$P0F_INTERFACE" ]; then
-                       OPTIONS="-i $P0F_INTERFACE"
+                       OPTIONS="$OPTIONS -i $P0F_INTERFACE"
+               fi
+               if [ -n "$P0F_SOCKET" ]; then
+                       # read the manual first and then ask why the umask
+                       umask 007
+                       OPTIONS="$OPTIONS -Q $P0F_SOCKET"
+               fi
+               if [ -n "$P0F_USER" ]; then
+                       OPTIONS="$OPTIONS -u $P0F_USER"
                fi
                if [ $P0F_UNKNOWN_SIGNATURES = "yes" ]; then
                        OPTIONS="$OPTIONS -U"
@@ -59,6 +68,10 @@ case "$1" in
                /usr/sbin/p0f "$RULE" $OPTIONS $P0F_OPTIONS -d -o /var/log/p0f 2>/dev/null
                RETVAL=$?
                if [ $RETVAL -eq 0 ]; then
+                       # this is secure, as socket is always created with current umask and root
+                       if [ "$P0F_USER" ] && [ "$P0F_SOCKET" ]; then
+                               chown ${P0F_USER}: $P0F_SOCKET
+                       fi
                        touch /var/lock/subsys/p0f
                        ok;
                else

diff --git a/p0f.sysconfig b/p0f.sysconfig
index 698faebf27f5c2b9027b46881b093a891f3ce62a..86fdfde3e2a79a61d5a8360a75b330cf660138a7 100644 (file)
--- a/p0f.sysconfig
+++ b/p0f.sysconfig
@@ -15,5 +15,13 @@ P0F_KNOWN_SIGNATURES="no"
 # set to "yes" add timestamps
 P0F_TIMESTAMPS="no"
 
+# listen on a specified local stream socket. This is a method of integrating
+# p0f with active services (web server or web scripts, etc).
+P0F_SOCKET="/var/run/p0f.sock"
+
+# chroot to this user's home directory after reading configuration data and
+# binding to sockets, then to switch to his UID, GID and supplementary groups.
+P0F_USER="p0f"
+
 # add other options
 P0F_OPTIONS=""