rpms
/
bind
7
0
Fork 1
Code Issues Pull Requests Releases Activity

- port named to use libcap library, enable threads (#433102) 

- removed some unneeded Requires
This commit is contained in:
Adam Tkac 2008-02-20 14:35:02 +00:00
parent 2eb6fc2cfe
commit aa8fd38bcf
2 changed files with 280 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

268
bind-9.5-libcap.patch Normal file
View File

@ -0,0 +1,268 @@
diff -up bind-9.5.0b2/configure.in.libcap bind-9.5.0b2/configure.in
--- bind-9.5.0b2/configure.in.libcap 2008-02-20 14:23:42.000000000 +0100
+++ bind-9.5.0b2/configure.in 2008-02-20 14:47:11.000000000 +0100
@@ -1875,7 +1875,8 @@ AC_ARG_ENABLE(linux-caps,
[ --disable-linux-caps disable linux capabilities])
case "$enable_linux_caps" in
yes|'')
- AC_CHECK_HEADERS(linux/capability.h)
+ AC_CHECK_HEADERS(sys/capability.h)
+ AC_CHECK_LIB(cap, cap_set_proc, LIBS="-lcap $LIBS")
;;
no)
;;
diff -up bind-9.5.0b2/bin/named/unix/os.c.libcap bind-9.5.0b2/bin/named/unix/os.c
--- bind-9.5.0b2/bin/named/unix/os.c.libcap 2008-02-20 14:24:31.000000000 +0100
+++ bind-9.5.0b2/bin/named/unix/os.c 2008-02-20 14:45:25.000000000 +0100
@@ -60,16 +60,16 @@ static int devnullfd = -1;
#endif
/*
- * If there's no <linux/capability.h>, we don't care about <sys/prctl.h>
+ * If there's no <sys/capability.h>, we don't care about <sys/prctl.h>
*/
-#ifndef HAVE_LINUX_CAPABILITY_H
+#ifndef HAVE_SYS_CAPABILITY_H
#undef HAVE_SYS_PRCTL_H
#endif
/*
* Linux defines:
* (T) HAVE_LINUXTHREADS
- * (C) HAVE_LINUX_CAPABILITY_H
+ * (C) HAVE_SYS_CAPABILITY_H
* (P) HAVE_SYS_PRCTL_H
* The possible cases are:
* none: setuid() normally
@@ -111,7 +111,7 @@ static struct passwd *runas_pw = NULL;
static isc_boolean_t done_setuid = ISC_FALSE;
static int dfd[2] = { -1, -1 };
-#ifdef HAVE_LINUX_CAPABILITY_H
+#ifdef HAVE_SYS_CAPABILITY_H
static isc_boolean_t non_root = ISC_FALSE;
static isc_boolean_t non_root_caps = ISC_FALSE;
@@ -125,7 +125,7 @@ static isc_boolean_t non_root_caps = ISC
#define _LINUX_FS_H
#include <sys/syscall.h> /* Required for syscall(). */
-#include <linux/capability.h> /* Required for _LINUX_CAPABILITY_VERSION. */
+#include <sys/capability.h> /* Required for _LINUX_CAPABILITY_VERSION. */
#ifdef HAVE_SYS_PRCTL_H
#include <sys/prctl.h> /* Required for prctl(). */
@@ -142,32 +142,16 @@ static isc_boolean_t non_root_caps = ISC
#endif /* HAVE_SYS_PRCTL_H */
-#ifndef SYS_capset
-#ifndef __NR_capset
-#include <asm/unistd.h> /* Slackware 4.0 needs this. */
-#endif
-#define SYS_capset __NR_capset
-#endif
-
static void
-linux_setcaps(unsigned int caps) {
- struct __user_cap_header_struct caphead;
- struct __user_cap_data_struct cap;
+linux_setcaps(cap_t caps) {
char strbuf[ISC_STRERRORSIZE];
if ((getuid() != 0 && !non_root_caps) || non_root)
return;
- memset(&caphead, 0, sizeof(caphead));
- caphead.version = _LINUX_CAPABILITY_VERSION;
- caphead.pid = 0;
- memset(&cap, 0, sizeof(cap));
- cap.effective = caps;
- cap.permitted = caps;
- cap.inheritable = 0;
- if (syscall(SYS_capset, &caphead, &cap) < 0) {
+ if (cap_set_proc(caps) < 0) {
isc__strerror(errno, strbuf, sizeof(strbuf));
- ns_main_earlyfatal("capset failed: %s:"
+ ns_main_earlyfatal("cap_set_proc failed: %s:"
" please ensure that the capset kernel"
" module is loaded. see insmod(8)",
strbuf);
@@ -176,7 +160,9 @@ linux_setcaps(unsigned int caps) {
static void
linux_initialprivs(void) {
- unsigned int caps;
+ cap_t caps;
+ cap_value_t capval;
+ char strbuf[ISC_STRERRORSIZE];
/*%
* We don't need most privileges, so we drop them right away.
@@ -184,17 +170,26 @@ linux_initialprivs(void) {
* capabilities to the minimum needed to run the server.
*/
- caps = 0;
+ if ( (caps = cap_init()) == NULL) {
+ isc__strerror(errno, strbuf, sizeof (strbuf));
+ ns_main_earlyfatal("cap_init failed: %s", strbuf);
+ }
/*
* We need to be able to bind() to privileged ports, notably port 53!
*/
- caps |= (1 << CAP_NET_BIND_SERVICE);
+
+ capval = CAP_NET_BIND_SERVICE;
+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
/*
* We need chroot() initially too.
*/
- caps |= (1 << CAP_SYS_CHROOT);
+
+ capval = CAP_SYS_CHROOT;
+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
#if defined(HAVE_SYS_PRCTL_H) || !defined(HAVE_LINUXTHREADS)
/*
@@ -203,19 +198,25 @@ linux_initialprivs(void) {
* tried) or we're not using threads. If either of these is
* true, we want the setuid capability.
*/
- caps |= (1 << CAP_SETUID);
+ capval = CAP_SETUID;
+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
#endif
/*
* Since we call initgroups, we need this.
*/
- caps |= (1 << CAP_SETGID);
+ capval = CAP_SETGID;
+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
/*
* Without this, we run into problems reading a configuration file
* owned by a non-root user and non-world-readable on startup.
*/
- caps |= (1 << CAP_DAC_READ_SEARCH);
+ capval = CAP_DAC_READ_SEARCH;
+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
/*
* XXX We might want to add CAP_SYS_RESOURCE, though it's not
@@ -224,14 +225,18 @@ linux_initialprivs(void) {
* of files, the stack size, data size, and core dump size to
* support named.conf options, this is now being added to test.
*/
- caps |= (1 << CAP_SYS_RESOURCE);
+ capval = CAP_SYS_RESOURCE;
+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
linux_setcaps(caps);
}
static void
linux_minprivs(void) {
- unsigned int caps;
+ cap_t caps;
+ cap_value_t capval;
+ char strbuf[ISC_STRERRORSIZE];
/*%
* Drop all privileges except the ability to bind() to privileged
@@ -241,8 +246,14 @@ linux_minprivs(void) {
* chroot() could be used to escape from the chrooted area.
*/
- caps = 0;
- caps |= (1 << CAP_NET_BIND_SERVICE);
+ if ( (caps = cap_init()) == NULL) {
+ isc__strerror(errno, strbuf, sizeof (strbuf));
+ ns_main_earlyfatal("cap_init failed: %s", strbuf);
+ }
+
+ capval = CAP_NET_BIND_SERVICE;
+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
/*
* XXX We might want to add CAP_SYS_RESOURCE, though it's not
@@ -251,7 +262,9 @@ linux_minprivs(void) {
* of files, the stack size, data size, and core dump size to
* support named.conf options, this is now being added to test.
*/
- caps |= (1 << CAP_SYS_RESOURCE);
+ capval = CAP_SYS_RESOURCE;
+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
linux_setcaps(caps);
}
@@ -278,7 +291,7 @@ linux_keepcaps(void) {
}
#endif
-#endif /* HAVE_LINUX_CAPABILITY_H */
+#endif /* HAVE_SYS_CAPABILITY_H */
static void
@@ -295,7 +308,7 @@ setup_syslog(const char *progname) {
void
ns_os_init(const char *progname) {
setup_syslog(progname);
-#ifdef HAVE_LINUX_CAPABILITY_H
+#ifdef HAVE_SYS_CAPABILITY_H
linux_initialprivs();
#endif
#ifdef HAVE_LINUXTHREADS
@@ -474,7 +487,7 @@ ns_os_changeuser(void) {
done_setuid = ISC_TRUE;
#ifdef HAVE_LINUXTHREADS
-#ifdef HAVE_LINUX_CAPABILITY_H
+#ifdef HAVE_SYS_CAPABILITY_H
if (!non_root_caps)
ns_main_earlyfatal("-u with Linux threads not supported: "
"requires kernel support for "
@@ -507,7 +520,7 @@ ns_os_changeuser(void) {
strbuf);
}
#endif
-#if defined(HAVE_LINUX_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
+#if defined(HAVE_SYS_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
linux_minprivs();
#endif
}
@@ -522,7 +535,7 @@ ns_os_minprivs(void) {
ns_os_changeuser(); /* Call setuid() before threads are started */
#endif
-#if defined(HAVE_LINUX_CAPABILITY_H) && defined(HAVE_LINUXTHREADS)
+#if defined(HAVE_SYS_CAPABILITY_H) && defined(HAVE_LINUXTHREADS)
linux_minprivs();
#endif
}
diff -up bind-9.5.0b2/config.h.in.libcap bind-9.5.0b2/config.h.in
--- bind-9.5.0b2/config.h.in.libcap 2008-02-20 14:23:57.000000000 +0100
+++ bind-9.5.0b2/config.h.in 2008-02-20 14:24:17.000000000 +0100
@@ -196,8 +196,8 @@ int sigwait(const unsigned int *set, int
/* Define if libxml2 was found */
#undef HAVE_LIBXML2
-/* Define to 1 if you have the <linux/capability.h> header file. */
-#undef HAVE_LINUX_CAPABILITY_H
+/* Define to 1 if you have the <sys/capability.h> header file. */
+#undef HAVE_SYS_CAPABILITY_H
/* Define to 1 if you have the <locale.h> header file. */
#undef HAVE_LOCALE_H

24
bind.spec
View File

@ -19,7 +19,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
Name: bind
License: ISC
Version: 9.5.0
Release: 27.%{RELEASEVER}%{?dist}
Release: 28.%{RELEASEVER}%{?dist}
Epoch: 32
Url: http://www.isc.org/products/BIND/
Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@ -61,6 +61,7 @@ Patch72: bind-9.5-dlz-64bit.patch
Patch87: bind-9.5-parallel-build.patch
Patch88: bind-9.5-transfer-segv.patch
Patch89: bind-9.5-mudflap.patch
Patch90: bind-9.5-libcap.patch
# SDB patches
Patch11: bind-9.3.2b2-sdbsrc.patch
@ -83,13 +84,15 @@ Patch83: bind-9.5-libidn2.patch
Patch85: bind-9.5-libidn3.patch
#
Requires: bind-libs = %{epoch}:%{version}-%{release}, glibc >= 2.2, mktemp
Requires: mktemp
Requires(post): grep, chkconfig >= 1.3.26
Requires(pre): shadow-utils
Requires(preun):chkconfig >= 1.3.26
Obsoletes: bind-config, caching-nameserver
Provides: bind-config, caching-nameserver
BuildRequires: gcc, glibc-devel >= 2.2.5-26, glibc-kernheaders >= 2.4-7.10, openssl-devel, libtool, autoconf, pkgconfig
BuildRequires: gcc, glibc-devel >= 2.2.5-26, glibc-kernheaders >= 2.4-7.10
BuildRequires: openssl-devel, libtool, autoconf, pkgconfig, libcap-devel
BuildRequires: libidn-devel
%if %{SDB}
BuildRequires: openldap-devel, postgresql-devel, sqlite-devel, mysql-devel, unixODBC-devel
%endif
@ -101,13 +104,10 @@ BuildRequires: net-tools, perl
%endif
%if %{GSSTSIG}
BuildRequires: krb5-devel
Requires: krb5-libs
%endif
%if %{DEBUG}
BuildRequires: libmudflap-devel
%endif
BuildRequires: libidn-devel
Requires: libidn
%description
BIND (Berkeley Internet Name Domain) is an implementation of the DNS
@ -120,7 +120,6 @@ tools for verifying that the DNS server is operating properly.
%package sdb
Summary: BIND server with database backends and DLZ suppport
Group: System Environment/Daemons
Requires: bind = %{epoch}:%{version}-%{release}
%description sdb
BIND (Berkeley Internet Name Domain) is an implementation of the DNS
@ -145,7 +144,6 @@ Contains libraries used by both the bind server package as well as the utils pac
%package utils
Summary: Utilities for querying DNS name servers
Group: Applications/System
Requires: bind-libs = %{epoch}:%{version}-%{release}
%description utils
Bind-utils contains a collection of utilities for querying DNS (Domain
@ -161,7 +159,6 @@ servers.
%package devel
Summary: Header files and libraries needed for BIND DNS development
Group: Development/Libraries
Requires: bind-libs = %{epoch}:%{version}-%{release}
Obsoletes: bind-libbind-devel
%description devel
@ -173,7 +170,6 @@ required for development with ISC BIND 9 and BIND 8
Summary: A chroot runtime environment for the ISC BIND DNS server, named(8)
Group: System Environment/Daemons
Prefix: %{chroot_prefix}
Requires: bind = %{epoch}:%{version}-%{release}
Requires(post): grep
Requires(preun): grep
@ -192,6 +188,7 @@ Based on the code from Jan "Yenya" Kasprzak <kas@fi.muni.cz>
%patch10 -p1 -b .PIE
%patch69 -p1 -b .generate-xml
%patch16 -p1 -b .redhat_doc
%patch90 -p1 -b .libcap
%if %{SDB}
mkdir bin/named-sdb
cp -r bin/named/* bin/named-sdb
@ -278,11 +275,10 @@ fi
%configure \
--with-libtool \
--localstatedir=/var \
--disable-threads \
--enable-threads \
--enable-ipv6 \
--with-pic \
--disable-openssl-version-check \
--disable-linux-caps \
%if %{LIBBIND}
--enable-libbind \
%endif
@ -659,6 +655,10 @@ rm -rf ${RPM_BUILD_ROOT}
%{_sbindir}/bind-chroot-admin
%changelog
* Wed Feb 20 2008 Adam Tkac <atkac redhat com> 32:9.5.0-28.b2
- port named to use libcap library, enable threads (#433102)
- removed some unneeded Requires
* Tue Feb 19 2008 Adam Tkac <atkac redhat com> 32:9.5.0-27.b2
- removed conditional build with libefence (use -fmudflapth instead)
- fixed building of DLZ stuff (#432497)