rpms/dhcp/devel dhcp-4.1.0p1-capability.patch, NONE, 1.1 dhcp.spec, 1.269, 1.270
David Cantrell
dcantrel at fedoraproject.org
Wed Aug 19 01:14:35 UTC 2009
Author: dcantrel
Update of /cvs/pkgs/rpms/dhcp/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv10728
Modified Files:
dhcp.spec
Added Files:
dhcp-4.1.0p1-capability.patch
Log Message:
* Tue Aug 18 2009 David Cantrell <dcantrell at redhat.com> - 12:4.1.0p1-5
- Drop unnecessary capabilities in dhclient (#517649)
dhcp-4.1.0p1-capability.patch:
client/Makefile.am | 2 +-
client/dhclient.c | 12 ++++++++++++
configure.ac | 3 +++
3 files changed, 16 insertions(+), 1 deletion(-)
--- NEW FILE dhcp-4.1.0p1-capability.patch ---
diff -urp dhcp-4.1.0p1.orig/client/dhclient.c dhcp-4.1.0p1/client/dhclient.c
--- dhcp-4.1.0p1.orig/client/dhclient.c 2009-08-15 11:44:33.000000000 -0400
+++ dhcp-4.1.0p1/client/dhclient.c 2009-08-15 12:32:52.000000000 -0400
@@ -37,6 +37,9 @@
#include <sys/time.h>
#include <sys/wait.h>
#include <limits.h>
+#ifdef HAVE_LIBCAP_NG
+#include <cap-ng.h>
+#endif
/*
* Defined in stdio.h when _GNU_SOURCE is set, but we don't want to define
@@ -422,6 +425,15 @@ main(int argc, char **argv) {
path_dhclient_script = s;
}
+#ifdef HAVE_LIBCAP_NG
+ /* Drop capabilities */
+ capng_clear(CAPNG_SELECT_BOTH);
+ capng_updatev(CAPNG_ADD,
+ CAPNG_EFFECTIVE|CAPNG_PERMITTED|CAPNG_BOUNDING_SET,
+ CAP_NET_ADMIN, CAP_NET_RAW, CAP_NET_BIND_SERVICE, -1);
+ capng_apply(CAPNG_SELECT_BOTH);
+#endif
+
/* Set up the initial dhcp option universe. */
initialize_common_option_spaces();
diff -urp dhcp-4.1.0p1.orig/client/Makefile.am dhcp-4.1.0p1/client/Makefile.am
--- dhcp-4.1.0p1.orig/client/Makefile.am 2009-08-15 11:44:33.000000000 -0400
+++ dhcp-4.1.0p1/client/Makefile.am 2009-08-15 12:32:34.000000000 -0400
@@ -5,7 +5,7 @@ dhclient_SOURCES = clparse.c dhclient.c
scripts/netbsd scripts/nextstep scripts/openbsd \
scripts/solaris scripts/openwrt
dhclient_LDADD = ../common/libdhcp.a ../minires/libres.a \
- ../omapip/libomapi.a ../dst/libdst.a
+ ../omapip/libomapi.a ../dst/libdst.a $(CAPNG_LDADD)
man_MANS = dhclient.8 dhclient-script.8 dhclient.conf.5 dhclient.leases.5
EXTRA_DIST = $(man_MANS)
diff -urp dhcp-4.1.0p1.orig/configure.ac dhcp-4.1.0p1/configure.ac
--- dhcp-4.1.0p1.orig/configure.ac 2009-08-15 11:44:33.000000000 -0400
+++ dhcp-4.1.0p1/configure.ac 2009-08-15 12:32:34.000000000 -0400
@@ -388,6 +388,9 @@ AC_TRY_LINK(
# Look for optional headers.
AC_CHECK_HEADERS(sys/socket.h net/if_dl.h net/if6.h regex.h)
+# look for capabilities library
+LIBCAP_NG_PATH
+
# find an MD5 library
AC_SEARCH_LIBS(MD5_Init, [crypto])
AC_SEARCH_LIBS(MD5Init, [crypto])
Index: dhcp.spec
===================================================================
RCS file: /cvs/pkgs/rpms/dhcp/devel/dhcp.spec,v
retrieving revision 1.269
retrieving revision 1.270
diff -u -p -r1.269 -r1.270
--- dhcp.spec 15 Aug 2009 01:10:42 -0000 1.269
+++ dhcp.spec 19 Aug 2009 01:14:35 -0000 1.270
@@ -13,7 +13,7 @@
Summary: Dynamic host configuration protocol software
Name: dhcp
Version: %{basever}p1
-Release: 4%{?dist}
+Release: 5%{?dist}
# NEVER CHANGE THE EPOCH on this package. The previous maintainer (prior to
# dcantrell maintaining the package) made incorrect use of the epoch and
# that's why it is at 12 now. It should have never been used, but it was.
@@ -54,6 +54,7 @@ Patch19: %{name}-4.1.0-IFNAMSIZ.patch
Patch20: %{name}-4.1.0-add_timeout_when_NULL.patch
Patch21: %{name}-4.1.0-64_bit_lease_parse.patch
Patch22: %{name}-4.1.0-CVE-2009-1892.patch
+Patch23: %{name}-4.1.0p1-capability.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
BuildRequires: autoconf
@@ -212,6 +213,9 @@ libdhcpctl and libomapi static libraries
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1892
%patch22 -p1
+# Drop unnecessary capabilities in dhclient (#517649)
+%patch23 -p1
+
# Copy in documentation and example scripts for LDAP patch to dhcpd
%{__install} -p -m 0755 ldap-for-dhcp-%{ldappatchver}/dhcpd-conf-to-ldap contrib/
@@ -471,6 +475,9 @@ fi
%attr(0644,root,root) %{_mandir}/man3/omapi.3.gz
%changelog
+* Tue Aug 18 2009 David Cantrell <dcantrell at redhat.com> - 12:4.1.0p1-5
+- Drop unnecessary capabilities in dhclient (#517649)
+
* Fri Aug 14 2009 David Cantrell <dcantrell at redhat.com> - 12:4.1.0p1-4
- Upgrade to latest ldap-for-dhcp patch which makes sure that only
dhcpd links with OpenLDAP (#517474)
More information about the fedora-extras-commits
mailing list