File default-paths.patch of Package gotosocial

Overview Repositories Revisions Requests Users Attributes Meta

File default-paths.patch of Package gotosocial (Revision 3506f83a5e2375796551fb4f4e6bb1aa)

Currently displaying revision 3506f83a5e2375796551fb4f4e6bb1aa , Show latest

From 930d0c5f45732989b531b3c9fdcb943fb14c6ed0 Mon Sep 17 00:00:00 2001
From: tux93 <tux93@opensuse.org>
Date: Fri, 26 Jan 2024 14:51:58 +0100
Subject: [PATCH] Modify default paths to match packaging, extend AppArmor
 profile

---
 example/apparmor/gotosocial | 42 ++++++++++++++++---------------------
 example/config.yaml         |  8 +++----
 example/gotosocial.service  |  5 +++--
 3 files changed, 25 insertions(+), 30 deletions(-)

diff --git a/example/apparmor/gotosocial b/example/apparmor/gotosocial
index 40686194..789b179c 100644
--- a/example/apparmor/gotosocial
+++ b/example/apparmor/gotosocial
@@ -1,40 +1,34 @@
 #include <tunables/global>
 
 profile gotosocial flags=(attach_disconnected, mediate_deleted) {
-  #include <abstractions/base>
-  #include <abstractions/nameservice>
+  include <abstractions/base>
+  include <abstractions/dbus-session-strict>
+  include <abstractions/gio-open>
+  include <abstractions/nameservice>
+  include <abstractions/user-tmp>
 
-  /gotosocial/gotosocial mrix,
-  /usr/bin/gotosocial mrix,
-  /usr/local/bin/gotosocial mrix,
-
-  owner /gotosocial/{,**} r,
-  owner /gotosocial/db/* wk,
-  owner /gotosocial/storage/** wk,
+  /usr/sbin/gotosocial mrix,
 
   # Allow GoToSocial to write logs
   #
   # NOTE: you only need to allow write permissions to /var/log/syslog if you've
-  # enabled logging to syslog. Otherwise, you can comment out that line.
-  /var/log/gotosocial/* w,
-  owner /var/log/syslog w,
+  # enabled logging to syslog.
+  # owner /var/log/syslog w,
 
-  # These directories are not currently used by any of the recommended
-  # GoToSocial installation methods, but they may be used in the future and/or
-  # for custom installations.
   owner /etc/gotosocial/{,**} r,
-  owner /usr/lib/gotosocial/{,**} r,
   owner /usr/share/gotosocial/{,**} r,
-  owner /usr/local/etc/gotosocial/{,**} r,
-  owner /usr/local/lib/gotosocial/{,**} r,
-  owner /usr/local/share/gotosocial/{,**} r,
-  owner /var/lib/gotosocial/{,**} r,
-  owner /opt/gotosocial/{,**} r,
-  owner /run/gotosocial/{,**} r,
+  owner /var/lib/gotosocial/{,**} rwk,
 
+  /etc/mime.types r,
+  /etc/services r,
   /proc/sys/net/core/somaxconn r,
+  /sys/fs/cgroup/system.slice/gotosocial.service/cgroup.controllers r,
+  /sys/fs/cgroup/system.slice/gotosocial.service/pids.current r,
+  /sys/fs/cgroup/system.slice/gotosocial.service/pids.max r,
   /sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,
-  owner @{PROC}/@{pid}/cpuset r,
+  owner /proc/*/cgroup r,
+  owner /proc/*/cpuset r,
+  owner /proc/*/mountinfo r,
 
   # TCP / UDP network access
   network inet stream,
@@ -42,9 +36,9 @@ profile gotosocial flags=(attach_disconnected, mediate_deleted) {
   network inet dgram,
   network inet6 dgram,
 
-  # Allow GoToSocial to send signals to/receive signals from worker processes
   # Allow GoToSocial to receive signals from unconfined processes
   signal (receive) peer=unconfined,
+  # Allow GoToSocial to send signals to/receive signals from worker processes
   signal (send,receive) peer=gotosocial,
 }
 
diff --git a/example/config.yaml b/example/config.yaml
index bbdd8adb..a46ac2a0 100644
--- a/example/config.yaml
+++ b/example/config.yaml
@@ -266,12 +266,12 @@ cache:
 # String. Directory from which gotosocial will attempt to load html templates (.tmpl files).
 # Examples: ["/some/absolute/path/", "./relative/path/", "../../some/weird/path/"]
 # Default: "./web/template/"
-web-template-base-dir: "./web/template/"
+web-template-base-dir: "/usr/share/gotosocial/web/template/"
 
 # String. Directory from which gotosocial will attempt to serve static web assets (images, scripts).
 # Examples: ["/some/absolute/path/", "./relative/path/", "../../some/weird/path/"]
 # Default: "./web/assets/"
-web-asset-base-dir: "./web/assets/"
+web-asset-base-dir: "/usr/share/gotosocial/web/assets/"
 
 ###########################
 ##### INSTANCE CONFIG #####
@@ -497,7 +497,7 @@ storage-backend: "local"
 # Only required when running with the local storage backend.
 # Examples: ["/home/gotosocial/storage", "/opt/gotosocial/datastorage"]
 # Default: "/gotosocial/storage"
-storage-local-base-path: "/gotosocial/storage"
+storage-local-base-path: "/var/lib/gotosocial/storage"
 
 # String. API endpoint of the S3 compatible service.
 # Only required when running with the s3 storage backend.
@@ -609,7 +609,7 @@ letsencrypt-port: 80
 # In any case, make sure GoToSocial has permissions to write to / read from this directory.
 # Examples: ["/home/gotosocial/storage/certs", "/acmecerts"]
 # Default: "/gotosocial/storage/certs"
-letsencrypt-cert-dir: "/gotosocial/storage/certs"
+letsencrypt-cert-dir: "/var/lib/gotosocial/storage/certs"
 
 # String. Email address to use when registering LetsEncrypt certs.
 # Most likely, this will be the email address of the instance administrator.
diff --git a/example/gotosocial.service b/example/gotosocial.service
index 37a66c66..606ff8ee 100644
--- a/example/gotosocial.service
+++ b/example/gotosocial.service
@@ -12,10 +12,11 @@ Group=gotosocial
 
 Type=exec
 Restart=on-failure
+AppArmorProfile=gotosocial
 
 # change if your path to the GoToSocial binary is different
-ExecStart=/gotosocial/gotosocial --config-path config.yaml server start
-WorkingDirectory=/gotosocial
+ExecStart=/usr/sbin/gotosocial --config-path /etc/gotosocial/config.yaml server start
+WorkingDirectory=/var/lib/gotosocial
 
 # Sandboxing options to harden security
 # Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
-- 
2.43.0

Places

File default-paths.patch of Package gotosocial (Revision 3506f83a5e2375796551fb4f4e6bb1aa)

Places