git: 52fe0689eac7 - main - net-mgmt/net-snmp: Avoid changing to the snmpd user for now

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/ports/commit/?id=52fe0689eac79f0287cd884f526d33d44237869a

commit 52fe0689eac79f0287cd884f526d33d44237869a
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2024-05-14 14:43:03 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2024-05-14 15:27:26 +0000

    net-mgmt/net-snmp: Avoid changing to the snmpd user for now
    
    Switching the user might break existing configurations, for reasons that
    are not fully clear yet.  Avoid surprises by letting users opt-in to
    that change, for now.
    
    Also provide an rc.conf variable to make it easy to configure snmpd to
    drop privileges if they so choose.
    
    Reported by:    dvl
    Approved by:    zi
    Sponsored by:   Klara, Inc.
    Sponsored by:   Stormshield
    Differential Revision:  https://reviews.freebsd.org/D45199
---
 net-mgmt/net-snmp/Makefile       |  2 +-
 net-mgmt/net-snmp/files/snmpd.in | 13 ++++++++++++-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/net-mgmt/net-snmp/Makefile b/net-mgmt/net-snmp/Makefile
index 5fca4ba36051..01534364feb8 100644
--- a/net-mgmt/net-snmp/Makefile
+++ b/net-mgmt/net-snmp/Makefile
@@ -1,7 +1,7 @@
 PORTNAME=	snmp
 PORTVERSION=	5.9.4
 PORTEPOCH=	1
-PORTREVISION=	1
+PORTREVISION=	2
 CATEGORIES=	net-mgmt
 MASTER_SITES=	SF/net-${PORTNAME}/net-${PORTNAME}/${PORTVERSION} \
 		ZI
diff --git a/net-mgmt/net-snmp/files/snmpd.in b/net-mgmt/net-snmp/files/snmpd.in
index 7f140200aa45..7f75cacad813 100644
--- a/net-mgmt/net-snmp/files/snmpd.in
+++ b/net-mgmt/net-snmp/files/snmpd.in
@@ -8,6 +8,12 @@
 # snmpd_enable="YES"
 # snmpd_flags="<set as needed>"
 # snmpd_conffile="<set as needed>"
+#
+# Add the following line to make snmpd drop privileges after initialization.
+# This might invalidate existing SNMPv3 users.
+#
+# snmpd_sugid="YES"
+#
 
 . /etc/rc.subr
 
@@ -18,6 +24,7 @@ load_rc_config snmpd
 
 snmpd_enable=${snmpd_enable:-"NO"}
 snmpd_flush_cache=${snmpd_flush_cache-"NO"}
+snmpd_sugid=${snmpd_sugid:-"NO"}
 
 pidfile=${snmpd_pidfile:-"/var/run/net_snmpd.pid"}
 
@@ -57,7 +64,11 @@ net_snmpd_precmd () {
 	if [ -n "${snmpd_conffile_set}" ]; then
 		rc_flags="-c ${snmpd_conffile_set#,} ${rc_flags}"
 	fi
-	rc_flags="-u snmpd -g snmpd -p ${pidfile} ${rc_flags}"
+	if checkyesno snmpd_sugid; then
+		rc_flags="-u snmpd -g snmpd ${rc_flags}"
+	fi
+
+	rc_flags="-p ${pidfile} ${rc_flags}"
 }
 
 run_rc_command "$1"