Run in separated user & add completions

4 files changed, 24 insertions, 7 deletions

diff --git a/.gitignore b/.gitignore
index c55eb26e2d69..b19a717f519e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,4 +2,5 @@
 !.SRCINFO
 !.gitignore
 !PKGBUILD
+!mosdns-sysusers.conf
 !mosdns.service
diff --git a/PKGBUILD b/PKGBUILD
index ad948b27bf2f..db650c1f790e 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Henry-ZHR <henry-zhr@qq.com>
 pkgname=mosdns
 pkgver=4.5.3
-pkgrel=1
+pkgrel=2
 pkgdesc="A DNS forwarder"
 arch=('x86_64')
 url="https://github.com/IrineSistiana/mosdns"
@@ -9,13 +9,17 @@ license=('GPL3')
 depends=('glibc')
 makedepends=('git' 'go')
 optdepends=('v2ray-domain-list-community: geosite.dat'
-            'v2ray-geoip: geoip.dat')
+            'v2ray-geoip: geoip.dat'
+            'bash-completion: bash completions'
+            'zsh-completions: zsh completitons')
 backup=('etc/mosdns/config.yaml')
 _tag=760a660192fdf996463b024d1d0e19bd66b6ed31 # git rev-parse "v${pkgver}"
 source=("${pkgname}::git+${url}.git#tag=${_tag}"
+        "mosdns-sysusers.conf"
         "mosdns.service")
 sha512sums=('SKIP'
-            'c4defddfc87754b8dd105df080374ec32785c435b5a60fa60608e5e0b57eddd4aa6c5581daceba6dff6d84b8e0f4914db0ea09f0150aecee17e216379f7fcb62')
+            '6388385b26b0a37d519482537c976c559ff050c8cf0135be0a7bfc75538bd0c13e0e6487b165e7e06b7b3f0e9ecb802eaf105e62a315c77eed2e3161f690d184'
+            'f54f076eb392aa7b9dc9b50018fca63668eefa4f15a7373d44a1a237158e621248e96c9ac72405660c9a1c5de684604514e809b2b12bae6b201bacbe7fc2b560')
 
 prepare() {
   mkdir -p "${pkgname}/build"
@@ -23,18 +27,25 @@ prepare() {
 
 build() {
   cd "${pkgname}/build"
-  export CGO_CPPFLAGS="${CPPFLAGS}"
   export CGO_CFLAGS="${CFLAGS}"
+  export CGO_CPPFLAGS="${CPPFLAGS}"
   export CGO_CXXFLAGS="${CXXFLAGS}"
   export CGO_LDFLAGS="${LDFLAGS}"
-  go run ../ config gen config.yaml
   go build -buildmode=pie -trimpath -ldflags="-linkmode external -s -w -X main.version=$(git describe --tags --long --always)" -mod=readonly -modcacherw -o mosdns ../
+  go run ../ config gen config.yaml
+  go run ../ completion bash >bash-completion
+  go run ../ completion zsh >zsh-completion
 }
 
 package() {
   cd "${srcdir}/${pkgname}"
   install -Dm755 "build/mosdns" "${pkgdir}/usr/bin/mosdns"
   install -Dm644 "build/config.yaml" "${pkgdir}/etc/mosdns/config.yaml"
+  install -Dm644 "build/bash-completion" "${pkgdir}/usr/share/bash-completion/completions/mosdns"
+  install -Dm644 "build/zsh-completion" "${pkgdir}/usr/share/zsh/site-functions/_mosdns"
   install -Dm644 "LICENSE" "${pkgdir}/usr/share/licenses/mosdns/LICENSE"
-  install -Dm644 "${srcdir}/mosdns.service" "${pkgdir}/usr/lib/systemd/system/mosdns.service"
+
+  cd "${srcdir}"
+  install -Dm644 "mosdns-sysusers.conf" "${pkgdir}/usr/lib/sysusers.d/mosdns.conf"
+  install -Dm644 "mosdns.service" "${pkgdir}/usr/lib/systemd/system/mosdns.service"
 }
diff --git a/mosdns-sysusers.conf b/mosdns-sysusers.conf
new file mode 100644
index 000000000000..1945e42c3be5
--- /dev/null
+++ b/mosdns-sysusers.conf
@@ -0,0 +1 @@
+u mosdns - "mosdns daemon" /
\ No newline at end of file
diff --git a/mosdns.service b/mosdns.service
index dad2983c2e95..692937706d99 100644
--- a/mosdns.service
+++ b/mosdns.service
@@ -5,7 +5,11 @@ After=network.target
 [Service]
 Type=exec
 ExecStart=/usr/bin/mosdns start -c /etc/mosdns/config.yaml -d /etc/mosdns
-Restart=on-failure
+Restart=on-abnormal
+User=mosdns
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
+NoNewPrivileges=true
 
 [Install]
 WantedBy=multi-user.target