- move SELinux context logging to mod_systemd from httpd binary

This commit is contained in:
Joe Orton 2022-06-17 12:21:04 +01:00
parent b0e7cd798e
commit 8c54e332bb
3 changed files with 71 additions and 62 deletions

View File

@ -14,9 +14,9 @@ Subject: [PATCH] Check and use gettid() directly with glibc 2.30+.
diff --git a/configure.in b/configure.in diff --git a/configure.in b/configure.in
index 423d58d4b9a..60cbf7b7f81 100644 index 423d58d4b9a..60cbf7b7f81 100644
--- httpd-2.4.43/configure.in.gettid --- httpd-2.4.54/configure.in.gettid
+++ httpd-2.4.43/configure.in +++ httpd-2.4.54/configure.in
@@ -478,7 +500,8 @@ @@ -502,22 +502,26 @@
timegm \ timegm \
getpgid \ getpgid \
fopen64 \ fopen64 \
@ -26,9 +26,7 @@ index 423d58d4b9a..60cbf7b7f81 100644
) )
dnl confirm that a void pointer is large enough to store a long integer dnl confirm that a void pointer is large enough to store a long integer
@@ -489,16 +512,19 @@ APACHE_CHECK_VOID_PTR_LEN
APR_ADDTO(HTTPD_LIBS, [-lselinux])
])
-AC_CACHE_CHECK([for gettid()], ac_cv_gettid, -AC_CACHE_CHECK([for gettid()], ac_cv_gettid,
+if test $ac_cv_func_gettid = no; then +if test $ac_cv_func_gettid = no; then
@ -50,8 +48,8 @@ index 423d58d4b9a..60cbf7b7f81 100644
fi fi
dnl ## Check for the tm_gmtoff field in struct tm to get the timezone diffs dnl ## Check for the tm_gmtoff field in struct tm to get the timezone diffs
--- httpd-2.4.43/server/log.c.gettid --- httpd-2.4.54/server/log.c.gettid
+++ httpd-2.4.43/server/log.c +++ httpd-2.4.54/server/log.c
@@ -55,7 +55,7 @@ @@ -55,7 +55,7 @@
#include "ap_mpm.h" #include "ap_mpm.h"
#include "ap_listen.h" #include "ap_listen.h"
@ -61,7 +59,7 @@ index 423d58d4b9a..60cbf7b7f81 100644
#include <sys/syscall.h> #include <sys/syscall.h>
#include <sys/types.h> #include <sys/types.h>
#endif #endif
@@ -625,14 +625,18 @@ @@ -627,14 +627,18 @@
#if APR_HAS_THREADS #if APR_HAS_THREADS
int result; int result;
#endif #endif
@ -82,7 +80,7 @@ index 423d58d4b9a..60cbf7b7f81 100644
#if APR_HAS_THREADS #if APR_HAS_THREADS
if (ap_mpm_query(AP_MPMQ_IS_THREADED, &result) == APR_SUCCESS if (ap_mpm_query(AP_MPMQ_IS_THREADED, &result) == APR_SUCCESS
&& result != AP_MPMQ_NOT_SUPPORTED) && result != AP_MPMQ_NOT_SUPPORTED)
@@ -966,7 +970,7 @@ @@ -968,7 +972,7 @@
#if APR_HAS_THREADS #if APR_HAS_THREADS
field_start = len; field_start = len;
len += cpystrn(buf + len, ":tid ", buflen - len); len += cpystrn(buf + len, ":tid ", buflen - len);

View File

@ -1,24 +1,22 @@
diff --git a/configure.in b/configure.in diff --git a/configure.in b/configure.in
index 74015ca..8c0ee10 100644 index 74015ca..8c0ee10 100644
--- a/configure.in --- httpd-2.4.54/modules/arch/unix/config5.m4.selinux
+++ b/configure.in +++ httpd-2.4.54/modules/arch/unix/config5.m4
@@ -508,6 +508,11 @@ getloadavg @@ -23,6 +23,11 @@
dnl confirm that a void pointer is large enough to store a long integer AC_MSG_WARN([Your system does not support systemd.])
APACHE_CHECK_VOID_PTR_LEN enable_systemd="no"
else
+AC_CHECK_LIB(selinux, is_selinux_enabled, [ + AC_CHECK_LIB(selinux, is_selinux_enabled, [
+ AC_DEFINE(HAVE_SELINUX, 1, [Defined if SELinux is supported]) + AC_DEFINE(HAVE_SELINUX, 1, [Defined if SELinux is supported])
+ APR_ADDTO(HTTPD_LIBS, [-lselinux]) + APR_ADDTO(MOD_SYSTEMD_LDADD, [-lselinux])
+]) + ])
+ +
AC_CACHE_CHECK([for gettid()], ac_cv_gettid, APR_ADDTO(MOD_SYSTEMD_LDADD, [$SYSTEMD_LIBS])
[AC_TRY_RUN(#define _GNU_SOURCE fi
#include <unistd.h> ])
diff --git a/server/core.c b/server/core.c --- httpd-2.4.54/modules/arch/unix/mod_systemd.c.selinux
index a6fa2fb..cf4cba4 100644 +++ httpd-2.4.54/modules/arch/unix/mod_systemd.c
--- a/server/core.c @@ -35,6 +35,10 @@
+++ b/server/core.c
@@ -65,6 +65,10 @@
#include <unistd.h> #include <unistd.h>
#endif #endif
@ -26,35 +24,38 @@ index a6fa2fb..cf4cba4 100644
+#include <selinux/selinux.h> +#include <selinux/selinux.h>
+#endif +#endif
+ +
/* LimitRequestBody handling */ APR_DECLARE_OPTIONAL_FN(int,
#define AP_LIMIT_REQ_BODY_UNSET ((apr_off_t) -1) ap_find_systemd_socket, (process_rec *, apr_port_t));
#define AP_DEFAULT_LIMIT_REQ_BODY ((apr_off_t) 1<<30) /* 1GB */
@@ -5150,6 +5154,28 @@ static int core_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *pte @@ -70,6 +74,20 @@
return apr_psprintf(p, "%s port %u", addr, sa->port);
} }
#endif
+#ifdef HAVE_SELINUX +#ifdef HAVE_SELINUX
+ { +static void log_selinux_context(void)
+ static int already_warned = 0; +{
+ int is_enabled = is_selinux_enabled() > 0; + char *con;
+
+ if (is_enabled && !already_warned) {
+ security_context_t con;
+
+ if (getcon(&con) == 0) {
+ +
+ if (is_selinux_enabled() && getcon(&con) == 0) {
+ ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL, + ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL,
+ "SELinux policy enabled; " + "SELinux policy enabled; "
+ "httpd running as context %s", con); + "httpd running as context %s", con);
+
+ already_warned = 1;
+
+ freecon(con); + freecon(con);
+ } + }
+ } +}
+ }
+#endif +#endif
+ +
/* Report the service is ready in post_config, which could be during
* startup or after a reload. The server could still hit a fatal
* startup error after this point during ap_run_mpm(), so this is
@@ -87,6 +105,10 @@
if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
return OK; return OK;
}
+#ifdef HAVE_SELINUX
+ log_selinux_context();
+#endif
+
for (lr = ap_listeners; lr; lr = lr->next) {
char *s = dump_listener(lr, ptemp);

View File

@ -24,7 +24,7 @@
Summary: Apache HTTP Server Summary: Apache HTTP Server
Name: httpd Name: httpd
Version: 2.4.54 Version: 2.4.54
Release: 8%{?dist} Release: 9%{?dist}
URL: https://httpd.apache.org/ URL: https://httpd.apache.org/
Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@ -86,7 +86,7 @@ Patch22: httpd-2.4.43-mod_systemd.patch
Patch23: httpd-2.4.53-export.patch Patch23: httpd-2.4.53-export.patch
Patch24: httpd-2.4.43-corelimit.patch Patch24: httpd-2.4.43-corelimit.patch
Patch25: httpd-2.4.54-selinux.patch Patch25: httpd-2.4.54-selinux.patch
Patch26: httpd-2.4.43-gettid.patch Patch26: httpd-2.4.54-gettid.patch
Patch27: httpd-2.4.54-icons.patch Patch27: httpd-2.4.54-icons.patch
Patch30: httpd-2.4.43-cachehardmax.patch Patch30: httpd-2.4.43-cachehardmax.patch
Patch34: httpd-2.4.43-socket-activation.patch Patch34: httpd-2.4.43-socket-activation.patch
@ -150,7 +150,7 @@ The httpd-core package contains essential httpd binaries.
%package devel %package devel
Summary: Development interfaces for the Apache HTTP Server Summary: Development interfaces for the Apache HTTP Server
Requires: apr-devel, apr-util-devel, pkgconfig, libtool Requires: apr-devel, apr-util-devel, pkgconfig, libtool
Requires: httpd-core = %{version}-%{release} Requires: httpd-core = 0:%{version}-%{release}
%description devel %description devel
The httpd-devel package contains the APXS binary and other files The httpd-devel package contains the APXS binary and other files
@ -254,7 +254,6 @@ written in the Lua programming language.
%patch22 -p1 -b .mod_systemd %patch22 -p1 -b .mod_systemd
%patch23 -p1 -b .export %patch23 -p1 -b .export
%patch24 -p1 -b .corelimit %patch24 -p1 -b .corelimit
%patch25 -p1 -b .selinux
%patch26 -p1 -b .gettid %patch26 -p1 -b .gettid
%patch27 -p1 -b .icons %patch27 -p1 -b .icons
%patch30 -p1 -b .cachehardmax %patch30 -p1 -b .cachehardmax
@ -266,6 +265,7 @@ written in the Lua programming language.
%patch42 -p1 -b .r1828172+ %patch42 -p1 -b .r1828172+
%patch45 -p1 -b .logjournal %patch45 -p1 -b .logjournal
%patch46 -p1 -b .separatesystemd %patch46 -p1 -b .separatesystemd
%patch25 -p1 -b .selinux
%patch60 -p1 -b .enable-sslv3 %patch60 -p1 -b .enable-sslv3
%patch61 -p1 -b .r1878890 %patch61 -p1 -b .r1878890
@ -384,6 +384,13 @@ export LYNX_PATH=/usr/bin/links
--disable-http2 \ --disable-http2 \
--disable-md \ --disable-md \
$* $*
if grep -q ac_cv_have_threadsafe_pollset=no config.log; then
cat config.log
: Failed to find thread-safe APR.
exit 1
fi
%make_build %make_build
%install %install
@ -840,6 +847,9 @@ exit $rv
%{_rpmconfigdir}/macros.d/macros.httpd %{_rpmconfigdir}/macros.d/macros.httpd
%changelog %changelog
* Mon Dec 19 2022 Joe Orton <jorton@redhat.com> - 2.4.54-9
- move SELinux context logging to mod_systemd
* Mon Dec 19 2022 Joe Orton <jorton@redhat.com> - 2.4.54-8 * Mon Dec 19 2022 Joe Orton <jorton@redhat.com> - 2.4.54-8
- define _httpd_statedir macro - define _httpd_statedir macro