- 9.5.0b3 release
- dropped patches (upstream) - bind-9.5-transfer-segv.patch - bind-9.5-mudflap.patch - bind-9.5.0-generate-xml.patch - bind-9.5-libcap.patch
This commit is contained in:
Adam Tkac
parent
95fd5e6c3e
commit
76073e2e5c
@ -1,4 +1,4 @@
|
||||
bind-9.5.0b2.tar.gz
|
||||
bind-chroot.tar.bz2
|
||||
config-3.tar.bz2
|
||||
libbind-man.tar.gz
|
||||
bind-9.5.0b3.tar.gz
|
||||
|
||||
@ -1,268 +0,0 @@
|
||||
diff -up bind-9.5.0b2/configure.in.libcap bind-9.5.0b2/configure.in
|
||||
--- bind-9.5.0b2/configure.in.libcap 2008-02-20 14:23:42.000000000 +0100
|
||||
+++ bind-9.5.0b2/configure.in 2008-02-20 14:47:11.000000000 +0100
|
||||
@@ -1875,7 +1875,8 @@ AC_ARG_ENABLE(linux-caps,
|
||||
[ --disable-linux-caps disable linux capabilities])
|
||||
case "$enable_linux_caps" in
|
||||
yes|'')
|
||||
- AC_CHECK_HEADERS(linux/capability.h)
|
||||
+ AC_CHECK_HEADERS(sys/capability.h)
|
||||
+ AC_CHECK_LIB(cap, cap_set_proc, LIBS="-lcap $LIBS")
|
||||
;;
|
||||
no)
|
||||
;;
|
||||
diff -up bind-9.5.0b2/bin/named/unix/os.c.libcap bind-9.5.0b2/bin/named/unix/os.c
|
||||
--- bind-9.5.0b2/bin/named/unix/os.c.libcap 2008-02-20 14:24:31.000000000 +0100
|
||||
+++ bind-9.5.0b2/bin/named/unix/os.c 2008-02-20 14:45:25.000000000 +0100
|
||||
@@ -60,16 +60,16 @@ static int devnullfd = -1;
|
||||
#endif
|
||||
|
||||
/*
|
||||
- * If there's no <linux/capability.h>, we don't care about <sys/prctl.h>
|
||||
+ * If there's no <sys/capability.h>, we don't care about <sys/prctl.h>
|
||||
*/
|
||||
-#ifndef HAVE_LINUX_CAPABILITY_H
|
||||
+#ifndef HAVE_SYS_CAPABILITY_H
|
||||
#undef HAVE_SYS_PRCTL_H
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Linux defines:
|
||||
* (T) HAVE_LINUXTHREADS
|
||||
- * (C) HAVE_LINUX_CAPABILITY_H
|
||||
+ * (C) HAVE_SYS_CAPABILITY_H
|
||||
* (P) HAVE_SYS_PRCTL_H
|
||||
* The possible cases are:
|
||||
* none: setuid() normally
|
||||
@@ -111,7 +111,7 @@ static struct passwd *runas_pw = NULL;
|
||||
static isc_boolean_t done_setuid = ISC_FALSE;
|
||||
static int dfd[2] = { -1, -1 };
|
||||
|
||||
-#ifdef HAVE_LINUX_CAPABILITY_H
|
||||
+#ifdef HAVE_SYS_CAPABILITY_H
|
||||
|
||||
static isc_boolean_t non_root = ISC_FALSE;
|
||||
static isc_boolean_t non_root_caps = ISC_FALSE;
|
||||
@@ -125,7 +125,7 @@ static isc_boolean_t non_root_caps = ISC
|
||||
#define _LINUX_FS_H
|
||||
|
||||
#include <sys/syscall.h> /* Required for syscall(). */
|
||||
-#include <linux/capability.h> /* Required for _LINUX_CAPABILITY_VERSION. */
|
||||
+#include <sys/capability.h> /* Required for _LINUX_CAPABILITY_VERSION. */
|
||||
|
||||
#ifdef HAVE_SYS_PRCTL_H
|
||||
#include <sys/prctl.h> /* Required for prctl(). */
|
||||
@@ -142,32 +142,16 @@ static isc_boolean_t non_root_caps = ISC
|
||||
|
||||
#endif /* HAVE_SYS_PRCTL_H */
|
||||
|
||||
-#ifndef SYS_capset
|
||||
-#ifndef __NR_capset
|
||||
-#include <asm/unistd.h> /* Slackware 4.0 needs this. */
|
||||
-#endif
|
||||
-#define SYS_capset __NR_capset
|
||||
-#endif
|
||||
-
|
||||
static void
|
||||
-linux_setcaps(unsigned int caps) {
|
||||
- struct __user_cap_header_struct caphead;
|
||||
- struct __user_cap_data_struct cap;
|
||||
+linux_setcaps(cap_t caps) {
|
||||
char strbuf[ISC_STRERRORSIZE];
|
||||
|
||||
if ((getuid() != 0 && !non_root_caps) || non_root)
|
||||
return;
|
||||
|
||||
- memset(&caphead, 0, sizeof(caphead));
|
||||
- caphead.version = _LINUX_CAPABILITY_VERSION;
|
||||
- caphead.pid = 0;
|
||||
- memset(&cap, 0, sizeof(cap));
|
||||
- cap.effective = caps;
|
||||
- cap.permitted = caps;
|
||||
- cap.inheritable = 0;
|
||||
- if (syscall(SYS_capset, &caphead, &cap) < 0) {
|
||||
+ if (cap_set_proc(caps) < 0) {
|
||||
isc__strerror(errno, strbuf, sizeof(strbuf));
|
||||
- ns_main_earlyfatal("capset failed: %s:"
|
||||
+ ns_main_earlyfatal("cap_set_proc failed: %s:"
|
||||
" please ensure that the capset kernel"
|
||||
" module is loaded. see insmod(8)",
|
||||
strbuf);
|
||||
@@ -176,7 +160,9 @@ linux_setcaps(unsigned int caps) {
|
||||
|
||||
static void
|
||||
linux_initialprivs(void) {
|
||||
- unsigned int caps;
|
||||
+ cap_t caps;
|
||||
+ cap_value_t capval;
|
||||
+ char strbuf[ISC_STRERRORSIZE];
|
||||
|
||||
/*%
|
||||
* We don't need most privileges, so we drop them right away.
|
||||
@@ -184,17 +170,26 @@ linux_initialprivs(void) {
|
||||
* capabilities to the minimum needed to run the server.
|
||||
*/
|
||||
|
||||
- caps = 0;
|
||||
+ if ( (caps = cap_init()) == NULL) {
|
||||
+ isc__strerror(errno, strbuf, sizeof (strbuf));
|
||||
+ ns_main_earlyfatal("cap_init failed: %s", strbuf);
|
||||
+ }
|
||||
|
||||
/*
|
||||
* We need to be able to bind() to privileged ports, notably port 53!
|
||||
*/
|
||||
- caps |= (1 << CAP_NET_BIND_SERVICE);
|
||||
+
|
||||
+ capval = CAP_NET_BIND_SERVICE;
|
||||
+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
|
||||
+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
|
||||
|
||||
/*
|
||||
* We need chroot() initially too.
|
||||
*/
|
||||
- caps |= (1 << CAP_SYS_CHROOT);
|
||||
+
|
||||
+ capval = CAP_SYS_CHROOT;
|
||||
+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
|
||||
+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
|
||||
|
||||
#if defined(HAVE_SYS_PRCTL_H) || !defined(HAVE_LINUXTHREADS)
|
||||
/*
|
||||
@@ -203,19 +198,25 @@ linux_initialprivs(void) {
|
||||
* tried) or we're not using threads. If either of these is
|
||||
* true, we want the setuid capability.
|
||||
*/
|
||||
- caps |= (1 << CAP_SETUID);
|
||||
+ capval = CAP_SETUID;
|
||||
+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
|
||||
+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Since we call initgroups, we need this.
|
||||
*/
|
||||
- caps |= (1 << CAP_SETGID);
|
||||
+ capval = CAP_SETGID;
|
||||
+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
|
||||
+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
|
||||
|
||||
/*
|
||||
* Without this, we run into problems reading a configuration file
|
||||
* owned by a non-root user and non-world-readable on startup.
|
||||
*/
|
||||
- caps |= (1 << CAP_DAC_READ_SEARCH);
|
||||
+ capval = CAP_DAC_READ_SEARCH;
|
||||
+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
|
||||
+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
|
||||
|
||||
/*
|
||||
* XXX We might want to add CAP_SYS_RESOURCE, though it's not
|
||||
@@ -224,14 +225,18 @@ linux_initialprivs(void) {
|
||||
* of files, the stack size, data size, and core dump size to
|
||||
* support named.conf options, this is now being added to test.
|
||||
*/
|
||||
- caps |= (1 << CAP_SYS_RESOURCE);
|
||||
+ capval = CAP_SYS_RESOURCE;
|
||||
+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
|
||||
+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
|
||||
|
||||
linux_setcaps(caps);
|
||||
}
|
||||
|
||||
static void
|
||||
linux_minprivs(void) {
|
||||
- unsigned int caps;
|
||||
+ cap_t caps;
|
||||
+ cap_value_t capval;
|
||||
+ char strbuf[ISC_STRERRORSIZE];
|
||||
|
||||
/*%
|
||||
* Drop all privileges except the ability to bind() to privileged
|
||||
@@ -241,8 +246,14 @@ linux_minprivs(void) {
|
||||
* chroot() could be used to escape from the chrooted area.
|
||||
*/
|
||||
|
||||
- caps = 0;
|
||||
- caps |= (1 << CAP_NET_BIND_SERVICE);
|
||||
+ if ( (caps = cap_init()) == NULL) {
|
||||
+ isc__strerror(errno, strbuf, sizeof (strbuf));
|
||||
+ ns_main_earlyfatal("cap_init failed: %s", strbuf);
|
||||
+ }
|
||||
+
|
||||
+ capval = CAP_NET_BIND_SERVICE;
|
||||
+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
|
||||
+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
|
||||
|
||||
/*
|
||||
* XXX We might want to add CAP_SYS_RESOURCE, though it's not
|
||||
@@ -251,7 +262,9 @@ linux_minprivs(void) {
|
||||
* of files, the stack size, data size, and core dump size to
|
||||
* support named.conf options, this is now being added to test.
|
||||
*/
|
||||
- caps |= (1 << CAP_SYS_RESOURCE);
|
||||
+ capval = CAP_SYS_RESOURCE;
|
||||
+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
|
||||
+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
|
||||
|
||||
linux_setcaps(caps);
|
||||
}
|
||||
@@ -278,7 +291,7 @@ linux_keepcaps(void) {
|
||||
}
|
||||
#endif
|
||||
|
||||
-#endif /* HAVE_LINUX_CAPABILITY_H */
|
||||
+#endif /* HAVE_SYS_CAPABILITY_H */
|
||||
|
||||
|
||||
static void
|
||||
@@ -295,7 +308,7 @@ setup_syslog(const char *progname) {
|
||||
void
|
||||
ns_os_init(const char *progname) {
|
||||
setup_syslog(progname);
|
||||
-#ifdef HAVE_LINUX_CAPABILITY_H
|
||||
+#ifdef HAVE_SYS_CAPABILITY_H
|
||||
linux_initialprivs();
|
||||
#endif
|
||||
#ifdef HAVE_LINUXTHREADS
|
||||
@@ -474,7 +487,7 @@ ns_os_changeuser(void) {
|
||||
done_setuid = ISC_TRUE;
|
||||
|
||||
#ifdef HAVE_LINUXTHREADS
|
||||
-#ifdef HAVE_LINUX_CAPABILITY_H
|
||||
+#ifdef HAVE_SYS_CAPABILITY_H
|
||||
if (!non_root_caps)
|
||||
ns_main_earlyfatal("-u with Linux threads not supported: "
|
||||
"requires kernel support for "
|
||||
@@ -507,7 +520,7 @@ ns_os_changeuser(void) {
|
||||
strbuf);
|
||||
}
|
||||
#endif
|
||||
-#if defined(HAVE_LINUX_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
|
||||
+#if defined(HAVE_SYS_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
|
||||
linux_minprivs();
|
||||
#endif
|
||||
}
|
||||
@@ -522,7 +535,7 @@ ns_os_minprivs(void) {
|
||||
ns_os_changeuser(); /* Call setuid() before threads are started */
|
||||
#endif
|
||||
|
||||
-#if defined(HAVE_LINUX_CAPABILITY_H) && defined(HAVE_LINUXTHREADS)
|
||||
+#if defined(HAVE_SYS_CAPABILITY_H) && defined(HAVE_LINUXTHREADS)
|
||||
linux_minprivs();
|
||||
#endif
|
||||
}
|
||||
diff -up bind-9.5.0b2/config.h.in.libcap bind-9.5.0b2/config.h.in
|
||||
--- bind-9.5.0b2/config.h.in.libcap 2008-02-20 14:23:57.000000000 +0100
|
||||
+++ bind-9.5.0b2/config.h.in 2008-02-20 14:24:17.000000000 +0100
|
||||
@@ -196,8 +196,8 @@ int sigwait(const unsigned int *set, int
|
||||
/* Define if libxml2 was found */
|
||||
#undef HAVE_LIBXML2
|
||||
|
||||
-/* Define to 1 if you have the <linux/capability.h> header file. */
|
||||
-#undef HAVE_LINUX_CAPABILITY_H
|
||||
+/* Define to 1 if you have the <sys/capability.h> header file. */
|
||||
+#undef HAVE_SYS_CAPABILITY_H
|
||||
|
||||
/* Define to 1 if you have the <locale.h> header file. */
|
||||
#undef HAVE_LOCALE_H
|
||||
@ -1,16 +0,0 @@
|
||||
Index: make/rules.in
|
||||
===================================================================
|
||||
RCS file: /proj/cvs/prod/bind9/make/rules.in,v
|
||||
retrieving revision 1.62
|
||||
diff -u -r1.62 rules.in
|
||||
--- make/rules.in 18 Jun 2007 23:47:57 -0000 1.62
|
||||
+++ make/rules.in 18 Feb 2008 14:46:16 -0000
|
||||
@@ -104,7 +104,7 @@
|
||||
BUILD_CC = @BUILD_CC@
|
||||
BUILD_CFLAGS = @BUILD_CFLAGS@
|
||||
BUILD_CPPFLAGS = @BUILD_CPPFLAGS@
|
||||
-BUILD_LDFAGS = @BUILD_LDFAGS@
|
||||
+BUILD_LDFLAGS = @BUILD_LDFLAGS@
|
||||
BUILD_LIBS = @BUILD_LIBS@
|
||||
|
||||
.SUFFIXES:
|
||||
@ -1,13 +0,0 @@
|
||||
diff -up bind-9.5.0b1/lib/dns/rbtdb.c.segv bind-9.5.0b1/lib/dns/rbtdb.c
|
||||
--- bind-9.5.0b1/lib/dns/rbtdb.c.segv 2008-02-11 14:52:12.000000000 +0100
|
||||
+++ bind-9.5.0b1/lib/dns/rbtdb.c 2008-02-11 14:55:58.000000000 +0100
|
||||
@@ -1633,7 +1633,8 @@ decrement_reference(dns_rbtdb_t *rbtdb,
|
||||
"decrement_reference: "
|
||||
"dns_rbt_deletenode: %s",
|
||||
isc_result_totext(result));
|
||||
- } else if (dns_rbtnode_refcurrent(node) == 0) {
|
||||
+ } else if (rbtdb->deadnodes != NULL &&
|
||||
+ dns_rbtnode_refcurrent(node) == 0) {
|
||||
INSIST(!ISC_LINK_LINKED(node, deadlink));
|
||||
ISC_LIST_APPEND(rbtdb->deadnodes[bucket], node, deadlink);
|
||||
}
|
||||
@ -1,11 +0,0 @@
|
||||
--- bind-9.5.0a5/bin/named/Makefile.in.xml 2007-06-19 11:49:35.000000000 +0200
|
||||
+++ bind-9.5.0a5/bin/named/Makefile.in 2007-06-19 11:49:48.000000000 +0200
|
||||
@@ -154,7 +154,7 @@ bind9.xsl.h: bind9.xsl convertxsl.pl
|
||||
${PERL} ${srcdir}/convertxsl.pl < ${srcdir}/bind9.xsl > bind9.xsl.h
|
||||
|
||||
depend: bind9.xsl.h
|
||||
-server.@O@: bind9.xsl.h
|
||||
+server.o: bind9.xsl.h
|
||||
|
||||
installdirs:
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
|
||||
20
bind.spec
20
bind.spec
@ -2,7 +2,7 @@
|
||||
# Red Hat BIND package .spec file
|
||||
#
|
||||
|
||||
%define RELEASEVER b2
|
||||
%define RELEASEVER b3
|
||||
|
||||
%{?!SDB: %define SDB 1}
|
||||
%{?!LIBBIND: %define LIBBIND 1}
|
||||
@ -18,7 +18,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
|
||||
Name: bind
|
||||
License: ISC
|
||||
Version: 9.5.0
|
||||
Release: 29.3.%{RELEASEVER}%{dist}
|
||||
Release: 30.%{RELEASEVER}%{dist}
|
||||
Epoch: 32
|
||||
Url: http://www.isc.org/products/BIND/
|
||||
Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
|
||||
@ -54,13 +54,9 @@ Patch10: bind-9.5-PIE.patch
|
||||
Patch13: bind-9.3.1rc1-fix_libbind_includedir.patch
|
||||
Patch16: bind-9.3.2-redhat_doc.patch
|
||||
Patch63: bind-9.4.0-dnssec-directory.patch
|
||||
Patch69: bind-9.5.0-generate-xml.patch
|
||||
Patch71: bind-9.5-overflow.patch
|
||||
Patch72: bind-9.5-dlz-64bit.patch
|
||||
Patch87: bind-9.5-parallel-build.patch
|
||||
Patch88: bind-9.5-transfer-segv.patch
|
||||
Patch89: bind-9.5-mudflap.patch
|
||||
Patch90: bind-9.5-libcap.patch
|
||||
|
||||
# SDB patches
|
||||
Patch11: bind-9.3.2b2-sdbsrc.patch
|
||||
@ -181,9 +177,7 @@ Based on the code from Jan "Yenya" Kasprzak <kas@fi.muni.cz>
|
||||
%patch1 -p1 -b .key
|
||||
%patch5 -p1 -b .nonexec
|
||||
%patch10 -p1 -b .PIE
|
||||
%patch69 -p1 -b .generate-xml
|
||||
%patch16 -p1 -b .redhat_doc
|
||||
%patch90 -p1 -b .libcap
|
||||
%if %{SDB}
|
||||
mkdir bin/named-sdb
|
||||
cp -r bin/named/* bin/named-sdb
|
||||
@ -240,8 +234,6 @@ cp -fp contrib/dbus/{dbus_mgr.h,dbus_service.h} bin/named/include/named
|
||||
%patch83 -p1 -b .libidn2
|
||||
%patch85 -p1 -b .libidn3
|
||||
%patch87 -p1 -b .parallel
|
||||
%patch88 -p1 -b .transfer-segv
|
||||
%patch89 -p0 -b .mudflap
|
||||
:;
|
||||
|
||||
|
||||
@ -647,6 +639,14 @@ rm -rf ${RPM_BUILD_ROOT}
|
||||
%{_sbindir}/bind-chroot-admin
|
||||
|
||||
%changelog
|
||||
* Mon Apr 21 2008 Adam Tkac <atkac redhat com> 32:9.5.0-30.b3
|
||||
- 9.5.0b3 release
|
||||
- dropped patches (upstream)
|
||||
- bind-9.5-transfer-segv.patch
|
||||
- bind-9.5-mudflap.patch
|
||||
- bind-9.5.0-generate-xml.patch
|
||||
- bind-9.5-libcap.patch
|
||||
|
||||
* Wed Apr 02 2008 Adam Tkac <atkac redhat com> 32:9.5.0-29.3.b2
|
||||
- fixed named.conf.sample file (#437569)
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user