run as restricted user

inn/inn.spec

@@ -33,7 +33,7 @@ Distribution: OpenPKG [BASE]
 Group:        News
 License:      ISC
 Version:      2.4.0
-Release:      20030623
+Release:      20030624
 
 #   package options
 %option       with_fsl  yes
@@ -204,9 +204,14 @@ AutoReqProv:  no
         '%not %dir %{l_prefix}/etc/fsl' \
         '%config %{l_prefix}/etc/fsl/fsl.%{name}' \
         '%config %{l_prefix}/etc/inn/*' \
-        '%attr(4550,root,%{l_mgrp}) %{l_prefix}/bin/rnews' \
-        '%attr(4755,root,%{l_mgrp}) %{l_prefix}/libexec/inn/inndstart' \
-        '%attr(4755,root,%{l_mgrp}) %{l_prefix}/libexec/inn/startinnfeed' \
+        '%attr(4550,%{l_susr},%{l_mgrp}) %{l_prefix}/bin/rnews' \
+        '%attr(4755,%{l_susr},%{l_mgrp}) %{l_prefix}/libexec/inn/inndstart' \
+        '%attr(4755,%{l_susr},%{l_mgrp}) %{l_prefix}/libexec/inn/startinnfeed' \
+        '%attr(775,%{l_musr},%{l_rgrp}) %{l_prefix}/var/inn/db' \
+        '%attr(775,%{l_musr},%{l_rgrp}) %{l_prefix}/var/inn/log' \
+        '%attr(775,%{l_musr},%{l_rgrp}) %{l_prefix}/var/inn/run' \
+        '%attr(775,%{l_musr},%{l_rgrp}) %{l_prefix}/var/inn/spool' \
+        '%attr(775,%{l_musr},%{l_rgrp}) %{l_prefix}/var/inn/tmp' \
         '%config %{l_prefix}/var/inn/db/*'
 
 %files -f files

inn/rc.inn

@@ -6,30 +6,41 @@
 %config
     inn_enable="yes"
     inn_nntpsend_enable="no"
+    inn_log_prolog="true"
+    inn_log_epilog="true"
+    inn_log_numfiles="10"
+    inn_log_minsize="1M"
+    inn_log_complevel="9"
 
-%start -p 200 -u @l_musr@
+%start -p 200 -u @l_rusr@
     opServiceEnabled inn || exit 0
     @l_prefix@/libexec/inn/rc.news
 
-%stop -p 200 -u @l_musr@
+%stop -p 200 -u @l_rusr@
     opServiceEnabled inn || exit 0
     @l_prefix@/libexec/inn/rc.news stop
 
-%restart -u @l_musr@
+%restart -u @l_rusr@
     opServiceEnabled inn || exit 0
     @l_prefix@/libexec/inn/rc.news stop
     sleep 2
     @l_prefix@/libexec/inn/rc.news
 
-%reload -u root
+%reload -u @l_rusr@
     opServiceEnabled inn || exit 0
     @l_prefix@/bin/ctlinnd reload all rc.inn:reload
 
-%daily -u @l_musr@
+%daily -u @l_rusr@
     opServiceEnabled inn || exit 0
     @l_prefix@/libexec/inn/news.daily expireover lowmark delayrm
-
-%quarterly -u root
+    shtool rotate -f \
+        -n${inn_log_numfiles} -s${inn_log_minsize} -d \
+        -z${inn_log_complevel} -o@l_rusr@ -g@l_rgrp@ -m644 \
+        -P "${inn_log_prolog}" \
+        -E "${inn_log_epilog}" \
+        @l_prefix@/var/FOO/log/*.log
+
+%quarterly -u @l_rusr@
     opServiceEnabled inn || exit 0
     opServiceEnabled inn_nntpsend && @l_prefix@/bin/nntpsend || true