rpms/bind/F-9 bind-9.5-libcap.patch,1.1,1.2 bind.spec,1.256,1.257
Adam Tkac (atkac)
fedora-extras-commits at redhat.com
Mon May 5 09:42:32 UTC 2008
- Previous message (by thread): rpms/libdockapp/devel .cvsignore, 1.2, 1.3 libdockapp.spec, 1.5, 1.6 sources, 1.2, 1.3 dockapp-0.6.1-ppc64.patch, 1.1, NONE libdockapp-0.6.1-stdinc_decl.patch, 1.2, NONE
- Next message (by thread): comps/po ru.po,1.13,1.14
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
Author: atkac
Update of /cvs/pkgs/rpms/bind/F-9
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv17755
Modified Files:
bind-9.5-libcap.patch bind.spec
Log Message:
- port libcap patch to latest upstream source
bind-9.5-libcap.patch:
Index: bind-9.5-libcap.patch
===================================================================
RCS file: /cvs/pkgs/rpms/bind/F-9/bind-9.5-libcap.patch,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- bind-9.5-libcap.patch 20 Feb 2008 14:35:02 -0000 1.1
+++ bind-9.5-libcap.patch 5 May 2008 09:41:55 -0000 1.2
@@ -1,58 +1,57 @@
-diff -up bind-9.5.0b2/configure.in.libcap bind-9.5.0b2/configure.in
---- bind-9.5.0b2/configure.in.libcap 2008-02-20 14:23:42.000000000 +0100
-+++ bind-9.5.0b2/configure.in 2008-02-20 14:47:11.000000000 +0100
-@@ -1875,7 +1875,8 @@ AC_ARG_ENABLE(linux-caps,
- [ --disable-linux-caps disable linux capabilities])
- case "$enable_linux_caps" in
- yes|'')
-- AC_CHECK_HEADERS(linux/capability.h)
-+ AC_CHECK_HEADERS(sys/capability.h)
-+ AC_CHECK_LIB(cap, cap_set_proc, LIBS="-lcap $LIBS")
- ;;
- no)
- ;;
-diff -up bind-9.5.0b2/bin/named/unix/os.c.libcap bind-9.5.0b2/bin/named/unix/os.c
---- bind-9.5.0b2/bin/named/unix/os.c.libcap 2008-02-20 14:24:31.000000000 +0100
-+++ bind-9.5.0b2/bin/named/unix/os.c 2008-02-20 14:45:25.000000000 +0100
-@@ -60,16 +60,16 @@ static int devnullfd = -1;
- #endif
-
- /*
-- * If there's no <linux/capability.h>, we don't care about <sys/prctl.h>
-+ * If there's no <sys/capability.h>, we don't care about <sys/prctl.h>
- */
--#ifndef HAVE_LINUX_CAPABILITY_H
-+#ifndef HAVE_SYS_CAPABILITY_H
- #undef HAVE_SYS_PRCTL_H
- #endif
-
+diff -up bind-9.5.0b3/bin/named/unix/os.c.libcap bind-9.5.0b3/bin/named/unix/os.c
+--- bind-9.5.0b3/bin/named/unix/os.c.libcap 2008-01-30 05:55:51.000000000 +0100
++++ bind-9.5.0b3/bin/named/unix/os.c 2008-05-05 10:56:00.000000000 +0200
+@@ -69,7 +69,7 @@ static int devnullfd = -1;
/*
* Linux defines:
* (T) HAVE_LINUXTHREADS
- * (C) HAVE_LINUX_CAPABILITY_H
-+ * (C) HAVE_SYS_CAPABILITY_H
++ * (C) HAVE_SYS_CAPABILITY_H (or HAVE_LINUX_CAPABILITY_H)
* (P) HAVE_SYS_PRCTL_H
* The possible cases are:
* none: setuid() normally
-@@ -111,7 +111,7 @@ static struct passwd *runas_pw = NULL;
- static isc_boolean_t done_setuid = ISC_FALSE;
- static int dfd[2] = { -1, -1 };
-
--#ifdef HAVE_LINUX_CAPABILITY_H
-+#ifdef HAVE_SYS_CAPABILITY_H
-
+@@ -116,16 +116,9 @@ static int dfd[2] = { -1, -1 };
static isc_boolean_t non_root = ISC_FALSE;
static isc_boolean_t non_root_caps = ISC_FALSE;
-@@ -125,7 +125,7 @@ static isc_boolean_t non_root_caps = ISC
- #define _LINUX_FS_H
- #include <sys/syscall.h> /* Required for syscall(). */
+-#if defined(HAVE_CAPSET)
+-#undef _POSIX_SOURCE
+ #ifdef HAVE_SYS_CAPABILITY_H
+ #include <sys/capability.h>
+ #else
+-#include <linux/capability.h>
+-int capset(cap_user_header_t hdrp, const cap_user_data_t datap);
+-#endif
+-#include <sys/prctl.h>
+-#else
+ /*%
+ * We define _LINUX_FS_H to prevent it from being included. We don't need
+ * anything from it, and the files it includes cause warnings with 2.2
+@@ -133,9 +126,20 @@ int capset(cap_user_header_t hdrp, const
+ * and <string.h>) on 2.3 kernels.
+ */
+ #define _LINUX_FS_H
+-
+-#include <sys/syscall.h> /* Required for syscall(). */
-#include <linux/capability.h> /* Required for _LINUX_CAPABILITY_VERSION. */
-+#include <sys/capability.h> /* Required for _LINUX_CAPABILITY_VERSION. */
++#include <linux/capability.h>
++#ifdef HAVE_CAPSET
++int capset(cap_user_header_t hdrp, const cap_user_data_t datap);
++#else
++/* We don't have libcap or capset, let's use syscall*/
++#include <syscall.h>
++#ifndef SYS_capset
++#ifndef __NR_capset
++#include <asm/unistd.h> /* Slackware 4.0 needs this. */
++#endif /* __NR_capset */
++#define SYS_capset __NR_capset
++#endif /* SYS_capset */
++#endif /* HAVE_CAPSET */
++#endif /* HAVE_SYS_CAPABILITY_H */
#ifdef HAVE_SYS_PRCTL_H
#include <sys/prctl.h> /* Required for prctl(). */
-@@ -142,32 +142,16 @@ static isc_boolean_t non_root_caps = ISC
+@@ -152,23 +156,28 @@ int capset(cap_user_header_t hdrp, const
#endif /* HAVE_SYS_PRCTL_H */
@@ -62,110 +61,154 @@
-#endif
-#define SYS_capset __NR_capset
-#endif
--
+-#endif
++#ifdef HAVE_LIBCAP
++#define SETCAPS_FUNC "cap_set_proc "
++#else
++typedef unsigned int cap_t;
++#ifdef HAVE_CAPSET
++#define SETCAPS_FUNC "capset "
++#else
++#define SETCAPS_FUNC "syscall(capset) "
++#endif /* HAVE_CAPSET */
++#endif /* HAVE_LIBCAP */
+
static void
-linux_setcaps(unsigned int caps) {
-- struct __user_cap_header_struct caphead;
-- struct __user_cap_data_struct cap;
+linux_setcaps(cap_t caps) {
++#ifndef HAVE_LIBCAP
+ struct __user_cap_header_struct caphead;
+ struct __user_cap_data_struct cap;
++#endif
char strbuf[ISC_STRERRORSIZE];
if ((getuid() != 0 && !non_root_caps) || non_root)
return;
-
-- memset(&caphead, 0, sizeof(caphead));
-- caphead.version = _LINUX_CAPABILITY_VERSION;
-- caphead.pid = 0;
-- memset(&cap, 0, sizeof(cap));
-- cap.effective = caps;
-- cap.permitted = caps;
-- cap.inheritable = 0;
-- if (syscall(SYS_capset, &caphead, &cap) < 0) {
+-
++#ifndef HAVE_LIBCAP
+ memset(&caphead, 0, sizeof(caphead));
+ caphead.version = _LINUX_CAPABILITY_VERSION;
+ caphead.pid = 0;
+@@ -176,46 +185,76 @@ linux_setcaps(unsigned int caps) {
+ cap.effective = caps;
+ cap.permitted = caps;
+ cap.inheritable = 0;
+-#ifdef HAVE_CAPSET
++#endif
++#ifdef HAVE_LIBCAP
+ if (cap_set_proc(caps) < 0) {
- isc__strerror(errno, strbuf, sizeof(strbuf));
++#elif defined(HAVE_CAPSET)
+ if (capset(&caphead, &cap) < 0 ) {
+- isc__strerror(errno, strbuf, sizeof(strbuf));
- ns_main_earlyfatal("capset failed: %s:"
-+ ns_main_earlyfatal("cap_set_proc failed: %s:"
+- " please ensure that the capset kernel"
+- " module is loaded. see insmod(8)",
+- strbuf);
+- }
+ #else
+ if (syscall(SYS_capset, &caphead, &cap) < 0) {
++#endif
+ isc__strerror(errno, strbuf, sizeof(strbuf));
+- ns_main_earlyfatal("syscall(capset) failed: %s:"
++ ns_main_earlyfatal(SETCAPS_FUNC "failed: %s:"
" please ensure that the capset kernel"
" module is loaded. see insmod(8)",
strbuf);
-@@ -176,7 +160,9 @@ linux_setcaps(unsigned int caps) {
+ }
+-#endif
+ }
++#ifdef HAVE_LIBCAP
++#define SET_CAP(flag) \
++ do { \
++ capval = (flag); \
++ err = cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); \
++ if (err == -1) { \
++ isc__strerror(errno, strbuf, sizeof(strbuf)); \
++ ns_main_earlyfatal("cap_set_proc failed: %s", strbuf); \
++ } \
++ \
++ err = cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); \
++ if (err == -1) { \
++ isc__strerror(errno, strbuf, sizeof(strbuf)); \
++ ns_main_earlyfatal("cap_set_proc failed: %s", strbuf); \
++ } \
++ } while (0)
++#define INIT_CAP \
++ do { \
++ caps = cap_init(); \
++ if (caps == NULL) { \
++ isc__strerror(errno, strbuf, sizeof(strbuf)); \
++ ns_main_earlyfatal("cap_init failed: %s", strbuf); \
++ } \
++ } while (0)
++#else
++#define SET_CAP(flag) { caps |= (1 << (flag)); }
++#define INIT_CAP { caps = 0; }
++#endif /* HAVE_LIBCAP */
++
static void
linux_initialprivs(void) {
- unsigned int caps;
+ cap_t caps;
++#ifdef HAVE_LIBCAP
+ cap_value_t capval;
+ char strbuf[ISC_STRERRORSIZE];
++ int err;
++#endif
/*%
* We don't need most privileges, so we drop them right away.
-@@ -184,17 +170,26 @@ linux_initialprivs(void) {
+ * Later on linux_minprivs() will be called, which will drop our
* capabilities to the minimum needed to run the server.
*/
-
+-
- caps = 0;
-+ if ( (caps = cap_init()) == NULL) {
-+ isc__strerror(errno, strbuf, sizeof (strbuf));
-+ ns_main_earlyfatal("cap_init failed: %s", strbuf);
-+ }
++ INIT_CAP;
/*
* We need to be able to bind() to privileged ports, notably port 53!
*/
- caps |= (1 << CAP_NET_BIND_SERVICE);
-+
-+ capval = CAP_NET_BIND_SERVICE;
-+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
-+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
++ SET_CAP(CAP_NET_BIND_SERVICE);
/*
* We need chroot() initially too.
*/
- caps |= (1 << CAP_SYS_CHROOT);
-+
-+ capval = CAP_SYS_CHROOT;
-+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
-+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
++ SET_CAP(CAP_SYS_CHROOT);
#if defined(HAVE_SYS_PRCTL_H) || !defined(HAVE_LINUXTHREADS)
/*
-@@ -203,19 +198,25 @@ linux_initialprivs(void) {
+@@ -224,19 +263,19 @@ linux_initialprivs(void) {
* tried) or we're not using threads. If either of these is
* true, we want the setuid capability.
*/
- caps |= (1 << CAP_SETUID);
-+ capval = CAP_SETUID;
-+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
-+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
++ SET_CAP(CAP_SETUID);
#endif
/*
* Since we call initgroups, we need this.
*/
- caps |= (1 << CAP_SETGID);
-+ capval = CAP_SETGID;
-+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
-+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
++ SET_CAP(CAP_SETGID);
/*
* Without this, we run into problems reading a configuration file
* owned by a non-root user and non-world-readable on startup.
*/
- caps |= (1 << CAP_DAC_READ_SEARCH);
-+ capval = CAP_DAC_READ_SEARCH;
-+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
-+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
++ SET_CAP(CAP_DAC_READ_SEARCH);
/*
* XXX We might want to add CAP_SYS_RESOURCE, though it's not
-@@ -224,14 +225,18 @@ linux_initialprivs(void) {
+@@ -245,15 +284,21 @@ linux_initialprivs(void) {
* of files, the stack size, data size, and core dump size to
* support named.conf options, this is now being added to test.
*/
- caps |= (1 << CAP_SYS_RESOURCE);
-+ capval = CAP_SYS_RESOURCE;
-+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
-+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
++ SET_CAP(CAP_SYS_RESOURCE);
linux_setcaps(caps);
}
@@ -174,95 +217,43 @@
linux_minprivs(void) {
- unsigned int caps;
+ cap_t caps;
++#ifdef HAVE_LIBCAP
+ cap_value_t capval;
+ char strbuf[ISC_STRERRORSIZE];
++ int err;
++#endif
++ INIT_CAP;
/*%
* Drop all privileges except the ability to bind() to privileged
-@@ -241,8 +246,14 @@ linux_minprivs(void) {
+ * ports.
+@@ -262,8 +307,7 @@ linux_minprivs(void) {
* chroot() could be used to escape from the chrooted area.
*/
- caps = 0;
- caps |= (1 << CAP_NET_BIND_SERVICE);
-+ if ( (caps = cap_init()) == NULL) {
-+ isc__strerror(errno, strbuf, sizeof (strbuf));
-+ ns_main_earlyfatal("cap_init failed: %s", strbuf);
-+ }
-+
-+ capval = CAP_NET_BIND_SERVICE;
-+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
-+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
++ SET_CAP(CAP_NET_BIND_SERVICE);
/*
* XXX We might want to add CAP_SYS_RESOURCE, though it's not
-@@ -251,7 +262,9 @@ linux_minprivs(void) {
+@@ -272,7 +316,7 @@ linux_minprivs(void) {
* of files, the stack size, data size, and core dump size to
* support named.conf options, this is now being added to test.
*/
- caps |= (1 << CAP_SYS_RESOURCE);
-+ capval = CAP_SYS_RESOURCE;
-+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
-+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
++ SET_CAP(CAP_SYS_RESOURCE);
linux_setcaps(caps);
}
-@@ -278,7 +291,7 @@ linux_keepcaps(void) {
- }
- #endif
-
--#endif /* HAVE_LINUX_CAPABILITY_H */
-+#endif /* HAVE_SYS_CAPABILITY_H */
-
-
- static void
-@@ -295,7 +308,7 @@ setup_syslog(const char *progname) {
- void
- ns_os_init(const char *progname) {
- setup_syslog(progname);
--#ifdef HAVE_LINUX_CAPABILITY_H
-+#ifdef HAVE_SYS_CAPABILITY_H
- linux_initialprivs();
- #endif
- #ifdef HAVE_LINUXTHREADS
-@@ -474,7 +487,7 @@ ns_os_changeuser(void) {
- done_setuid = ISC_TRUE;
-
- #ifdef HAVE_LINUXTHREADS
--#ifdef HAVE_LINUX_CAPABILITY_H
-+#ifdef HAVE_SYS_CAPABILITY_H
- if (!non_root_caps)
- ns_main_earlyfatal("-u with Linux threads not supported: "
- "requires kernel support for "
-@@ -507,7 +520,7 @@ ns_os_changeuser(void) {
- strbuf);
- }
- #endif
--#if defined(HAVE_LINUX_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
-+#if defined(HAVE_SYS_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
- linux_minprivs();
- #endif
- }
-@@ -522,7 +535,7 @@ ns_os_minprivs(void) {
- ns_os_changeuser(); /* Call setuid() before threads are started */
- #endif
-
--#if defined(HAVE_LINUX_CAPABILITY_H) && defined(HAVE_LINUXTHREADS)
-+#if defined(HAVE_SYS_CAPABILITY_H) && defined(HAVE_LINUXTHREADS)
- linux_minprivs();
- #endif
- }
-diff -up bind-9.5.0b2/config.h.in.libcap bind-9.5.0b2/config.h.in
---- bind-9.5.0b2/config.h.in.libcap 2008-02-20 14:23:57.000000000 +0100
-+++ bind-9.5.0b2/config.h.in 2008-02-20 14:24:17.000000000 +0100
-@@ -196,8 +196,8 @@ int sigwait(const unsigned int *set, int
- /* Define if libxml2 was found */
- #undef HAVE_LIBXML2
-
--/* Define to 1 if you have the <linux/capability.h> header file. */
--#undef HAVE_LINUX_CAPABILITY_H
-+/* Define to 1 if you have the <sys/capability.h> header file. */
-+#undef HAVE_SYS_CAPABILITY_H
-
- /* Define to 1 if you have the <locale.h> header file. */
- #undef HAVE_LOCALE_H
+diff -up bind-9.5.0b3/configure.in.libcap bind-9.5.0b3/configure.in
+--- bind-9.5.0b3/configure.in.libcap 2008-01-30 05:55:51.000000000 +0100
++++ bind-9.5.0b3/configure.in 2008-05-05 10:53:11.000000000 +0200
+@@ -1876,6 +1876,7 @@ AC_ARG_ENABLE(linux-caps,
+ case "$enable_linux_caps" in
+ yes|'')
+ AC_CHECK_HEADERS(linux/capability.h sys/capability.h)
++ AC_CHECK_LIB(cap, cap_set_proc)
+ AC_CHECK_FUNCS(capset)
+ ;;
+ no)
Index: bind.spec
===================================================================
RCS file: /cvs/pkgs/rpms/bind/F-9/bind.spec,v
retrieving revision 1.256
retrieving revision 1.257
diff -u -r1.256 -r1.257
--- bind.spec 30 Apr 2008 09:49:23 -0000 1.256
+++ bind.spec 5 May 2008 09:41:55 -0000 1.257
@@ -18,7 +18,7 @@
Name: bind
License: ISC
Version: 9.5.0
-Release: 29.3.%{RELEASEVER}%{dist}
+Release: 30.%{RELEASEVER}%{?dist}
Epoch: 32
Url: http://www.isc.org/products/BIND/
Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -244,7 +244,7 @@
export CPPFLAGS="$CPPFLAGS -D_GNU_SOURCE"
export STD_CDEFINES="$CPPFLAGS"
-libtoolize -c -f; aclocal --force; autoconf -f
+libtoolize -c -f; aclocal --force; autoheader -f; autoconf -f
%if %{WITH_DBUS}
%ifarch s390x x86_64 ppc64
@@ -641,12 +641,13 @@
%{_sbindir}/bind-chroot-admin
%changelog
-* Wed Apr 30 2008 Adam Tkac <atkac redhat com> 32:9.5.0-30.b3
+* Mon May 05 2008 Adam Tkac <atkac redhat com> 32:9.5.0-30.b3
- 9.5.0b3 release
- dropped patches (upstream)
- bind-9.5.0-generate-xml.patch
- bind-9.5-transfer-segv.patch
- bind-9.5-mudflap.patch
+- updated bind-9.5-libcap.patch
* Wed Apr 02 2008 Adam Tkac <atkac redhat com> 32:9.5.0-29.3.b2
- fixed named.conf.sample file (#437569)
- Previous message (by thread): rpms/libdockapp/devel .cvsignore, 1.2, 1.3 libdockapp.spec, 1.5, 1.6 sources, 1.2, 1.3 dockapp-0.6.1-ppc64.patch, 1.1, NONE libdockapp-0.6.1-stdinc_decl.patch, 1.2, NONE
- Next message (by thread): comps/po ru.po,1.13,1.14
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
More information about the fedora-extras-commits
mailing list