- Disable user switching again, as the configure script tries to read the uid at build time.

- Disable Android plugin again, seems to want to run on Android user pace.

4 files changed, 12 insertions, 10 deletions

diff --git a/debian/changelog b/debian/changelog
index d4876a4a3..2084a9556 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,9 +1,11 @@
 strongswan (4.4.0-1) unstable; urgency=low
 
   * New upstream release, now with a high-availability plugin.
-  * Enable building of android, ha, dhcp, and farp plugins.
-  * Enable capability dropping (now depends on libcap) and switching
-    user to new system user strongswan (with nogroup) after startup.
+  * Enable building of ha, dhcp, and farp plugins.
+  * Enable capability dropping (now depends on libcap). Switching
+    user to new system user strongswan (with nogroup) after startup
+    is still disabled until this can be integrated with build-time
+    determination of uid.
   * Enable PF_KEY and KLIPS kernel interfaces as an alternative to
     the standard NETKEY interface. This should allow interoperability
     with the KLIPS kernel module built by openswan modules source
diff --git a/debian/rules b/debian/rules
index 781ae389e..0ed3462fe 100755
--- a/debian/rules
+++ b/debian/rules
@@ -12,7 +12,6 @@ export DEB_BUILD_HARDENING=1
 
 CONFIGUREARGS := --prefix=/usr --sysconfdir=/etc --localstatedir=/var \
 		--libexecdir=/usr/lib \
-		--with-user=strongswan --with-group=nogroup \
 		--with-capabilities=libcap \
 		--enable-kernel-pfkey --enable-kernel-klips \
 		--enable-ldap --enable-curl \
@@ -24,8 +23,8 @@ CONFIGUREARGS := --prefix=/usr --sysconfdir=/etc --localstatedir=/var \
 		--enable-eap-radius --enable-eap-identity --enable-eap-md5 \
 		--enable-eap-gtc --enable-eap-aka --enable-eap-mschapv2 \
 		--enable-sql --enable-integrity-test \
-		--enable-nm --enable-android \
-		--enable-ha --enable-dhcp --enable-farp
+		--enable-nm --enable-ha --enable-dhcp --enable-farp
+	#	--with-user=strongswan --with-group=nogroup \
 	# Could enable --enable-nat-transport, but this is actually insecure,
 	# so don't!
 	# And for --enable-eap-sim we would need the library, which we don't
diff --git a/debian/strongswan-starter.postinst b/debian/strongswan-starter.postinst
index 52e895a88..32bf86ffc 100644
--- a/debian/strongswan-starter.postinst
+++ b/debian/strongswan-starter.postinst
@@ -292,7 +292,8 @@ EOF
         #fi
 
 	# create user for strongswan to change its uid into
-	setup_strongswan_user
+        # disabled until this can be kept in sync with build-time uid
+	#setup_strongswan_user
 
 	if [ -z "$2" ]; then
 	    # no old configured version - start strongswan now
diff --git a/debian/strongswan-starter.postrm b/debian/strongswan-starter.postrm
index 6e4a581ff..455687a3c 100644
--- a/debian/strongswan-starter.postrm
+++ b/debian/strongswan-starter.postrm
@@ -32,9 +32,9 @@ esac
 
 if [ "$1" = "purge" ] ; then
         update-rc.d ipsec remove >/dev/null
-        if which deluser >/dev/null 2>&1; then
-        	deluser --quiet strongswan > /dev/null || true
-        fi
+        #if which deluser >/dev/null 2>&1; then
+        #	deluser --quiet strongswan > /dev/null || true
+        #fi
 
         rm -rf /etc/ipsec.d/
         rm -rf /var/run/pluto/