Make it easier to build and install packages "unprivileged", where

the owner of all installed files is a non-root user.  This change
affects most packages that require special users or groups by making
them use the specified unprivileged user and group instead.

(1) Add two new variables PKG_GROUPS_VARS and PKG_USERS_VARS to
    unprivileged.mk.  These two variables are lists of other bmake
    variables that define package-specific users and groups.  Packages
    that have user-settable variables for users and groups, e.g. apache
    and APACHE_{USER,GROUP}, courier-mta and COURIER_{USER,GROUP},
    etc., should list these variables in PKG_USERS_VARS and PKG_GROUPS_VARS
    so that unprivileged.mk can know to set them to ${UNPRIVILEGED_USER}
    and ${UNPRIVILEGED_GROUP}.

(2) Modify packages to use PKG_GROUPS_VARS and PKG_USERS_VARS.

19 files changed, 64 insertions, 36 deletions

diff --git a/www/ap2-suphp/Makefile b/www/ap2-suphp/Makefile
index 9d82a353cee..c4ed4428237 100644
--- a/www/ap2-suphp/Makefile
+++ b/www/ap2-suphp/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.10 2007/06/30 15:05:08 joerg Exp $
+# $NetBSD: Makefile,v 1.11 2007/07/04 20:55:02 jlam Exp $
 #
 
 DISTNAME=		suphp-0.6.0
@@ -20,7 +20,8 @@ CONFIGURE_ARGS+=	--with-apache-user=${APACHE_USER:Q}
 CONFIGURE_ARGS+=	--with-logfile=${VARBASE}/httpd/suphp_log
 CONFIGURE_ARGS+=	--sysconfdir=${PKG_SYSCONFDIR:Q}
 
-BUILD_DEFS+=		APACHE_USER VARBASE
+PKG_USERS_VARS+=	APACHE_USER
+BUILD_DEFS+=		VARBASE
 
 EGDIR=			${PREFIX}/share/examples/suphp
 CONF_FILES=		${EGDIR}/suphp.conf ${PKG_SYSCONFDIR}/suphp.conf
diff --git a/www/apache/Makefile b/www/apache/Makefile
index 4c736c7c670..b2a11c48b00 100644
--- a/www/apache/Makefile
+++ b/www/apache/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.190 2007/06/28 00:38:00 lkundrak Exp $
+# $NetBSD: Makefile,v 1.191 2007/07/04 20:55:02 jlam Exp $
 #
 # This pkg does not compile in mod_ssl, only the `mod_ssl EAPI' (a set of
 # code hooks that allow mod_ssl to be compiled separately later, if desired).
@@ -58,7 +58,8 @@ USE_TOOLS+=		perl
 
 APACHE_USER?=		www
 APACHE_GROUP?=		www
-BUILD_DEFS+=		APACHE_USER APACHE_GROUP
+PKG_USERS_VARS+=	APACHE_USER
+PKG_GROUPS_VARS+=	APACHE_GROUP
 
 CONFIGURE_ARGS+=	--server-uid=${APACHE_USER:Q}
 CONFIGURE_ARGS+=	--server-gid=${APACHE_GROUP:Q}
diff --git a/www/apache2/Makefile b/www/apache2/Makefile
index 68114f91909..f7dd73c58db 100644
--- a/www/apache2/Makefile
+++ b/www/apache2/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.114 2007/06/28 01:49:04 lkundrak Exp $
+# $NetBSD: Makefile,v 1.115 2007/07/04 20:55:03 jlam Exp $
 
 .include "Makefile.common"
 
@@ -93,7 +93,8 @@ APACHE_USER?=		www
 APACHE_GROUP?=		www
 PKG_GROUPS=		${APACHE_GROUP}
 PKG_USERS=		${APACHE_USER}:${APACHE_GROUP}
-BUILD_DEFS+=		APACHE_USER APACHE_GROUP
+PKG_GROUPS_VARS+=	APACHE_GROUP
+PKG_USERS_VARS+=	APACHE_USER
 
 PKG_SYSCONFVAR=		apache
 PKG_SYSCONFSUBDIR?=	httpd
diff --git a/www/apache2/options.mk b/www/apache2/options.mk
index 67d30d215d7..072af02318b 100644
--- a/www/apache2/options.mk
+++ b/www/apache2/options.mk
@@ -1,4 +1,4 @@
-# $NetBSD: options.mk,v 1.6 2007/02/22 19:27:19 wiz Exp $
+# $NetBSD: options.mk,v 1.7 2007/07/04 20:55:03 jlam Exp $
 
 PKG_OPTIONS_VAR=	PKG_OPTIONS.apache
 PKG_SUPPORTED_OPTIONS=	suexec
@@ -6,7 +6,8 @@ PKG_SUPPORTED_OPTIONS=	suexec
 .include "../../mk/bsd.options.mk"
 
 .if !empty(PKG_OPTIONS:Msuexec)
-BUILD_DEFS+=		VARBASE APACHE_USER APACHE_SUEXEC_PATH
+PKG_USERS_VARS+=	APACHE_USER
+BUILD_DEFS+=		VARBASE APACHE_SUEXEC_PATH
 BUILD_DEFS+=		APACHE_SUEXEC_DOCROOT APACHE_SUEXEC_LOGFILE
 
 APACHE_SUEXEC_DOCROOT?=	${PREFIX}/share/httpd/htdocs
diff --git a/www/apache22/Makefile b/www/apache22/Makefile
index d3769554e69..c21002914fb 100644
--- a/www/apache22/Makefile
+++ b/www/apache22/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.14 2007/06/28 01:20:52 lkundrak Exp $
+# $NetBSD: Makefile,v 1.15 2007/07/04 20:55:03 jlam Exp $
 
 .include "Makefile.common"
 
@@ -105,7 +105,8 @@ APACHE_USER?=		www
 APACHE_GROUP?=		www
 PKG_GROUPS=		${APACHE_GROUP}
 PKG_USERS=		${APACHE_USER}:${APACHE_GROUP}
-BUILD_DEFS+=		APACHE_USER APACHE_GROUP
+PKG_GROUPS_VARS+=	APACHE_GROUP
+PKG_USERS_VARS+=	APACHE_USER
 
 PKG_SYSCONFVAR=		apache
 PKG_SYSCONFSUBDIR?=	httpd
diff --git a/www/apache22/options.mk b/www/apache22/options.mk
index 54bea89d5f4..57c12e5f48a 100644
--- a/www/apache22/options.mk
+++ b/www/apache22/options.mk
@@ -1,4 +1,4 @@
-# $NetBSD: options.mk,v 1.1.1.1 2006/12/08 23:31:52 xtraeme Exp $
+# $NetBSD: options.mk,v 1.2 2007/07/04 20:55:04 jlam Exp $
 
 PKG_OPTIONS_VAR=	PKG_OPTIONS.apache
 PKG_SUPPORTED_OPTIONS=	suexec
@@ -6,7 +6,8 @@ PKG_SUPPORTED_OPTIONS=	suexec
 .include "../../mk/bsd.options.mk"
 
 .if !empty(PKG_OPTIONS:Msuexec)
-BUILD_DEFS+=		VARBASE APACHE_USER APACHE_SUEXEC_PATH
+PKG_USERS_VARS+=	APACHE_USER
+BUILD_DEFS+=		VARBASE APACHE_SUEXEC_PATH
 BUILD_DEFS+=		APACHE_SUEXEC_DOCROOT APACHE_SUEXEC_LOGFILE
 
 APACHE_SUEXEC_DOCROOT?=	${PREFIX}/share/httpd/htdocs
diff --git a/www/awstats/Makefile b/www/awstats/Makefile
index 68658e66ea5..e12a3a75a92 100644
--- a/www/awstats/Makefile
+++ b/www/awstats/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.32 2007/02/20 18:29:49 minskim Exp $
+# $NetBSD: Makefile,v 1.33 2007/07/04 20:55:04 jlam Exp $
 #
 
 DISTNAME=	awstats-6.6
@@ -25,7 +25,10 @@ REPLACE_PERL+=	tools/*.pl		\
 
 APACHE_USER?=	www
 APACHE_GROUP?=	www
-BUILD_DEFS+=	APACHE_USER APACHE_GROUP VARBASE
+
+PKG_GROUPS_VARS+=	APACHE_GROUP
+PKG_USERS_VARS+=	APACHE_USER
+BUILD_DEFS+=		VARBASE
 
 # OWN_DIRS=		${VARBASE}/awstats
 OWN_DIRS_PERMS+=	${VARBASE}/awstats ${APACHE_USER} ${APACHE_GROUP} 0700
diff --git a/www/drupal/Makefile b/www/drupal/Makefile
index 6bf268ab524..159ed9430a7 100644
--- a/www/drupal/Makefile
+++ b/www/drupal/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.21 2007/04/09 19:30:48 adrianp Exp $
+# $NetBSD: Makefile,v 1.22 2007/07/04 20:55:04 jlam Exp $
 
 DISTNAME=	drupal-5.1
 CATEGORIES=	www
@@ -14,7 +14,9 @@ DEPENDS+=	${PHP_PKG_PREFIX}-gd>=4.3.3:../../graphics/php-gd
 NO_BUILD=	YES
 DRUPAL=		${PREFIX}/share/drupal
 PAX_DIRS=	includes misc modules scripts themes
-BUILD_DEFS+=	APACHE_USER APACHE_GROUP
+
+PKG_GROUPS_VARS+=	APACHE_GROUP
+PKG_USERS_VARS+=	APACHE_USER
 
 OWN_DIRS+=		${DRUPAL}/sites/default
 OWN_DIRS_PERMS+=	${DRUPAL}/files ${APACHE_USER} ${APACHE_GROUP} 0750
diff --git a/www/geeklog/Makefile b/www/geeklog/Makefile
index 63b43f72926..b64ceabaa50 100644
--- a/www/geeklog/Makefile
+++ b/www/geeklog/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.15 2007/05/20 15:56:44 taca Exp $
+# $NetBSD: Makefile,v 1.16 2007/07/04 20:55:04 jlam Exp $
 #
 
 DISTNAME=	geeklog-${VER}
@@ -16,7 +16,8 @@ DEPENDS+=	${PHP_PKG_PREFIX}-mysql>=4.3.0:../../databases/php-mysql
 VER=		1.4.1
 NO_BUILD=	YES
 
-BUILD_DEFS+=	APACHE_GROUP GEEKLOG_SITEBASE
+PKG_GROUPS_VARS+=	APACHE_GROUP
+BUILD_DEFS+=		GEEKLOG_SITEBASE
 
 GEEKLOG_SYS=		emailgeeklogstories language plugins readme sql system
 GEEKLOG_TMPL_SUB=	backend images/articles images/library \
diff --git a/www/horde/Makefile b/www/horde/Makefile
index 4445fd5311b..bf5d1ce0128 100644
--- a/www/horde/Makefile
+++ b/www/horde/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.49 2007/03/18 12:24:13 adrianp Exp $
+# $NetBSD: Makefile,v 1.50 2007/07/04 20:55:04 jlam Exp $
 
 DISTNAME=	horde-3.1.4
 CATEGORIES=	www
@@ -35,7 +35,7 @@ EGDIR=		${PREFIX}/share/examples/horde
 HORDEDIR=	${PREFIX}/share/horde
 PAXDIRS=	js lib locale po scripts services templates themes util admin
 SENDMAIL?=	/usr/sbin/sendmail
-BUILD_DEFS+=	APACHE_USER
+PKG_USERS_VARS+=APACHE_USER
 
 PKG_SYSCONFSUBDIR?=	httpd
 MESSAGE_SUBST+=		HORDEDIR=${HORDEDIR:Q}
diff --git a/www/iasp/Makefile b/www/iasp/Makefile
index bb8badf9c28..765b22a587b 100644
--- a/www/iasp/Makefile
+++ b/www/iasp/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.14 2006/02/22 20:37:45 wiz Exp $
+# $NetBSD: Makefile,v 1.15 2007/07/04 20:55:05 jlam Exp $
 
 .include "../../www/iasp/Makefile.common"
 
@@ -19,13 +19,15 @@ PLIST_SUBST+=	IASP=${IASP_DESTDIR:S/^${PREFIX}\///:Q}
 
 IASP_USER?=	${APACHE_USER}
 IASP_GROUP?=	${APACHE_GROUP}
-BUILD_DEFS+=	IASP_USER IASP_GROUP
 FILES_SUBST+=	IASP_USER=${IASP_USER:Q}
 FILES_SUBST+=	IASP_GROUP=${IASP_GROUP:Q}
 
 PKG_USERS=	${IASP_USER}:${IASP_GROUP}
 PKG_GROUPS=	${IASP_GROUP}
 
+PKG_GROUPS_VARS+=	IASP_GROUP
+PKG_USERS_VARS+=	IASP_USER
+
 WRKSRC=		${WRKDIR}/${IASP_DIR}
 REQD_DIRS=	${IASP_DESTDIR}
 OWN_DIRS_PERMS=	${IASP_DESTDIR}/logs ${IASP_USER} ${IASP_GROUP} 0750
diff --git a/www/privoxy/Makefile b/www/privoxy/Makefile
index cdd260e41ee..c4a47622040 100644
--- a/www/privoxy/Makefile
+++ b/www/privoxy/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.30 2006/11/24 18:26:06 drochner Exp $
+# $NetBSD: Makefile,v 1.31 2007/07/04 20:55:05 jlam Exp $
 #
 
 DISTNAME=	${PKGNAME_NOREV}-stable-src
@@ -14,7 +14,8 @@ COMMENT=	Web proxy with advanced filtering capabilities
 
 PRIVOXY_USER?=		privoxy
 PRIVOXY_GROUP?=		privoxy
-BUILD_DEFS+=		PRIVOXY_USER PRIVOXY_GROUP
+PKG_GROUPS_VARS+=	PRIVOXY_GROUP
+PKG_USERS_VARS+=	PRIVOXY_USER
 
 PKG_SYSCONFSUBDIR?=	privoxy
 
diff --git a/www/screws/Makefile b/www/screws/Makefile
index 1a8d8ac141c..d34946976a2 100644
--- a/www/screws/Makefile
+++ b/www/screws/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.18 2007/07/02 09:44:39 joerg Exp $
+# $NetBSD: Makefile,v 1.19 2007/07/04 20:55:05 jlam Exp $
 #
 
 DISTNAME=	screws-0.56
@@ -12,7 +12,8 @@ COMMENT=	SCRipt Enhanced Web Server
 
 USE_TOOLS+=	perl:run
 
-BUILD_DEFS+=	SCREWS_USER SCREWS_GROUP
+PKG_GROUPS_VARS+=	SCREWS_GROUP
+PKG_USERS_VARS+=	SCREWS_USER
 
 PKG_USERS=	${SCREWS_USER}:${SCREWS_GROUP}
 PKG_GROUPS=	${SCREWS_GROUP}
diff --git a/www/squid/Makefile b/www/squid/Makefile
index e124a63fea3..3d6e4134ca9 100644
--- a/www/squid/Makefile
+++ b/www/squid/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.192 2007/05/13 16:45:44 taca Exp $
+# $NetBSD: Makefile,v 1.193 2007/07/04 20:55:05 jlam Exp $
 
 DISTNAME=	squid-2.6.STABLE13
 PKGNAME=	${DISTNAME:S/STABLE//}
@@ -30,6 +30,9 @@ MAKE_ENV+=	PKG_PREFIX=${PREFIX:Q} VARBASE=${VARBASE:Q}
 PLIST_SRC=	${WRKDIR}/PLIST
 RCD_SCRIPTS=	squid
 
+PKG_GROUPS_VARS+=	SQUID_GROUP
+PKG_USERS_VARS+=	SQUID_USER
+
 PKG_GROUPS=	${SQUID_GROUP}
 PKG_USERS=	${SQUID_USER}:${SQUID_GROUP}
 
@@ -52,7 +55,7 @@ PKG_SYSCONFSUBDIR?=	squid
 
 SQUID_USER?=	squid
 SQUID_GROUP?=	squid
-BUILD_DEFS+=	SQUID_USER SQUID_GROUP VARBASE
+BUILD_DEFS+=	VARBASE
 
 CONFIGURE_ARGS+=	--enable-auth=basic,digest,ntlm \
 			--enable-cachemgr-hostname=localhost \
diff --git a/www/squirm/Makefile b/www/squirm/Makefile
index e30968342f3..e5a6aee3b74 100644
--- a/www/squirm/Makefile
+++ b/www/squirm/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.1.1.1 2006/10/02 17:12:19 rillig Exp $
+# $NetBSD: Makefile,v 1.2 2007/07/04 20:55:06 jlam Exp $
 #
 
 DISTNAME=		squirm-1.0betaB
@@ -20,7 +20,9 @@ SQUID_USER?=		squid
 SQUID_GROUP?=		squid
 PKG_USERS+=		${SQUID_USER}:${SQUID_GROUP}
 PKG_GROUPS+=		${SQUID_GROUP}
-BUILD_DEFS+=		SQUID_USER SQUID_GROUP VARBASE
+PKG_USERS_VARS+=	SQUID_USER
+PKG_GROUPS_VARS+=	SQUID_GROUP
+BUILD_DEFS+=		VARBASE
 
 PKG_SYSCONFSUBDIR=	squirm
 EGDIR=			${PREFIX}/share/examples/squirm
diff --git a/www/tinyproxy/Makefile b/www/tinyproxy/Makefile
index 6bcb371f292..12c3e2919cf 100644
--- a/www/tinyproxy/Makefile
+++ b/www/tinyproxy/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.22 2006/09/19 08:31:18 rillig Exp $
+# $NetBSD: Makefile,v 1.23 2007/07/04 20:55:06 jlam Exp $
 #
 
 DISTNAME=	tinyproxy-1.6.2
@@ -17,12 +17,14 @@ PKG_SYSCONFSUBDIR=	tinyproxy
 
 .include "../../mk/bsd.prefs.mk"
 
-BUILD_DEFS+=		TINYPROXY_USER TINYPROXY_GROUP VARBASE
+BUILD_DEFS+=		VARBASE
 
 TINYPROXY_USER?=	tinyproxy
 TINYPROXY_GROUP?=	tinyproxy
 PKG_GROUPS=		${TINYPROXY_GROUP}
 PKG_USERS=		${TINYPROXY_USER}:${TINYPROXY_GROUP}
+PKG_GROUPS_VARS+=	TINYPROXY_GROUP
+PKG_USERS_VARS+=	TINYPROXY_USER
 FILES_SUBST+=		TINYPROXY_USER=${TINYPROXY_USER:Q}
 FILES_SUBST+=		TINYPROXY_GROUP=${TINYPROXY_GROUP:Q}
 
diff --git a/www/zope29/Makefile b/www/zope29/Makefile
index cd7e2ecb439..c91fc9b2b65 100644
--- a/www/zope29/Makefile
+++ b/www/zope29/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.11 2007/04/01 15:29:45 taca Exp $
+# $NetBSD: Makefile,v 1.12 2007/07/04 20:55:06 jlam Exp $
 # FreeBSD Id: ports/www/zope29/Makefile,v 1.86 2006/08/03 15:53:04 garga Exp
 
 DISTNAME=	Zope-${VER}-final
@@ -35,6 +35,8 @@ SZOPEBASEDIR?=		${WEBBASEDIR}/Zope29
 
 # Do not change anything below this line.
 
+PKG_USERS_VARS+=	ZOPE_USER
+
 .if defined(INSTANCENAME)
 ZOPEINSTANCENAME=	${INSTANCENAME}
 .endif
diff --git a/www/zope3/Makefile b/www/zope3/Makefile
index eec1d0bed7f..c0839202209 100644
--- a/www/zope3/Makefile
+++ b/www/zope3/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.15 2007/02/28 15:49:55 wiz Exp $
+# $NetBSD: Makefile,v 1.16 2007/07/04 20:55:06 jlam Exp $
 #
 
 DISTNAME=		Zope-3.3.1
@@ -25,7 +25,7 @@ CONFIGURE_ARGS+=	--with-python ${PYTHONBIN} \
 EXTRACT_USING=		gtar
 .endif
 
-BUILD_DEFS+=		VARBASE ZOPE3_GROUP ZOPE3_USER
+BUILD_DEFS+=		VARBASE
 BUILD_TARGET=		build
 
 RCD_SCRIPTS=		zope3 zss3
diff --git a/www/zope3/Makefile.common b/www/zope3/Makefile.common
index fa3258bbaa5..e338feadabe 100644
--- a/www/zope3/Makefile.common
+++ b/www/zope3/Makefile.common
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile.common,v 1.2 2006/05/06 22:38:27 wiz Exp $
+# $NetBSD: Makefile.common,v 1.3 2007/07/04 20:55:07 jlam Exp $
 #
 
 PYTHON_VERSIONS_ACCEPTED=	24
@@ -9,4 +9,7 @@ ZOPE3_DOCDIR=		${PREFIX}/share/doc/zope3
 ZOPE3_GROUP?=		zope3
 ZOPE3_USER?=		zope3
 
+PKG_GROUPS_VARS+=	ZOPE3_GROUP
+PKG_USERS_VARS+=	ZOPE3_USER
+
 .include "../../lang/python/application.mk"