use systemd to setcap

4 files changed, 18 insertions, 4 deletions

diff --git a/.SRCINFO b/.SRCINFO
index 68dcbf632998..540a2958b6b6 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,7 +1,7 @@
 pkgbase = caddy
 	pkgdesc = A configurable, general-purpose HTTP/2 web server for any platform
 	pkgver = 0.9.3
-	pkgrel = 5
+	pkgrel = 6
 	url = https://caddyserver.com
 	install = caddy.install
 	arch = i686
diff --git a/PKGBUILD b/PKGBUILD
index 4c6b6c1d5715..bb114b477e47 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -1,6 +1,6 @@
 pkgname=caddy
 pkgver=0.9.3
-pkgrel=5
+pkgrel=6
 pkgdesc='A configurable, general-purpose HTTP/2 web server for any platform'
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')
 url='https://caddyserver.com'
@@ -15,6 +15,7 @@ md5sums=('SKIP')
 
 prepare() {
     cd $srcdir
+    patch -Np1 < ../setcap.patch
     export GOPATH="$srcdir/build"
     rm -rf "$GOPATH/src/$gopkgname"
     mkdir -p "$GOPATH/src/$gopkgname"
diff --git a/caddy.install b/caddy.install
index d56cbe21244a..94fd46d64239 100644
--- a/caddy.install
+++ b/caddy.install
@@ -1,6 +1,4 @@
 post_install() {
-    setcap 'cap_net_bind_service=+ep' /usr/local/bin/caddy
-
     getent passwd www-data || useradd --system -s /usr/bin/nologin -d / -U www-data
 
     mkdir -p /etc/ssl/caddy
diff --git a/setcap.patch b/setcap.patch
new file mode 100644
index 000000000000..5f8f30e097d1
--- /dev/null
+++ b/setcap.patch
@@ -0,0 +1,15 @@
+--- a/caddy/dist/init/linux-systemd/caddy.service	2016-12-04 13:29:37.126666666 +0000
++++ b/caddy/dist/init/linux-systemd/caddy.service	2016-12-04 13:30:25.119999999 +0000
+@@ -38,9 +38,9 @@
+ ; The following additional security directives only work with systemd v229 or later.
+ ; They further retrict privileges that can be gained by caddy. Uncomment if you like.
+ ; Note that you may have to add capabilities required by any plugins in use.
+-;CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+-;AmbientCapabilities=CAP_NET_BIND_SERVICE
+-;NoNewPrivileges=true
++CapabilityBoundingSet=CAP_NET_BIND_SERVICE
++AmbientCapabilities=CAP_NET_BIND_SERVICE
++NoNewPrivileges=true
+
+ [Install]
+ WantedBy=multi-user.target