The new S-S-D would not work with CRUX since for example exim uses
a PID file with root:mail and then there is a root!=mail mismatch.
The manual says
Warning: using this match option with a world-writable pidfile
or using it alone with a daemon that writes the pidfile as an
unprivileged (non-root) user will be refused with an error
(since version 1.19.3) as this is a security risk, because
either any user can write to it, or if the daemon gets
compromised, the contents of the pidfile cannot be trusted, and
then a privileged runner (such as an init script executed as
root) would end up acting on any system process. Using
/dev/null is exempt from these checks.
The actual code contradicts this as the mail group in our example
cannot write the PID file, only read it.
I thus have adjusted the code to only refuse the operation if the
group can write the file, too.
(Maybe this is even a "bug" that should be reported upstream?)
- split 'make' and 'make install' to allow parallel build
- use selective make install rule to avoid the installation
of html docs and remove them afterwards
- we use config instead of Configure because detection of
arch works just fine that way
- we must define LIBDIR to avoid installation into lib64
This uses the largely unused entries that exists for UPS integration
with sysvinit to properly shutdown the containers when SIGPWR is sent
to the container's process 1.
