- move SELinux context logging to mod_systemd from httpd binary
This commit is contained in:
parent
b0e7cd798e
commit
8c54e332bb
@ -14,9 +14,9 @@ Subject: [PATCH] Check and use gettid() directly with glibc 2.30+.
|
|||||||
|
|
||||||
diff --git a/configure.in b/configure.in
|
diff --git a/configure.in b/configure.in
|
||||||
index 423d58d4b9a..60cbf7b7f81 100644
|
index 423d58d4b9a..60cbf7b7f81 100644
|
||||||
--- httpd-2.4.43/configure.in.gettid
|
--- httpd-2.4.54/configure.in.gettid
|
||||||
+++ httpd-2.4.43/configure.in
|
+++ httpd-2.4.54/configure.in
|
||||||
@@ -478,7 +500,8 @@
|
@@ -502,22 +502,26 @@
|
||||||
timegm \
|
timegm \
|
||||||
getpgid \
|
getpgid \
|
||||||
fopen64 \
|
fopen64 \
|
||||||
@ -26,9 +26,7 @@ index 423d58d4b9a..60cbf7b7f81 100644
|
|||||||
)
|
)
|
||||||
|
|
||||||
dnl confirm that a void pointer is large enough to store a long integer
|
dnl confirm that a void pointer is large enough to store a long integer
|
||||||
@@ -489,16 +512,19 @@
|
APACHE_CHECK_VOID_PTR_LEN
|
||||||
APR_ADDTO(HTTPD_LIBS, [-lselinux])
|
|
||||||
])
|
|
||||||
|
|
||||||
-AC_CACHE_CHECK([for gettid()], ac_cv_gettid,
|
-AC_CACHE_CHECK([for gettid()], ac_cv_gettid,
|
||||||
+if test $ac_cv_func_gettid = no; then
|
+if test $ac_cv_func_gettid = no; then
|
||||||
@ -50,8 +48,8 @@ index 423d58d4b9a..60cbf7b7f81 100644
|
|||||||
fi
|
fi
|
||||||
|
|
||||||
dnl ## Check for the tm_gmtoff field in struct tm to get the timezone diffs
|
dnl ## Check for the tm_gmtoff field in struct tm to get the timezone diffs
|
||||||
--- httpd-2.4.43/server/log.c.gettid
|
--- httpd-2.4.54/server/log.c.gettid
|
||||||
+++ httpd-2.4.43/server/log.c
|
+++ httpd-2.4.54/server/log.c
|
||||||
@@ -55,7 +55,7 @@
|
@@ -55,7 +55,7 @@
|
||||||
#include "ap_mpm.h"
|
#include "ap_mpm.h"
|
||||||
#include "ap_listen.h"
|
#include "ap_listen.h"
|
||||||
@ -61,7 +59,7 @@ index 423d58d4b9a..60cbf7b7f81 100644
|
|||||||
#include <sys/syscall.h>
|
#include <sys/syscall.h>
|
||||||
#include <sys/types.h>
|
#include <sys/types.h>
|
||||||
#endif
|
#endif
|
||||||
@@ -625,14 +625,18 @@
|
@@ -627,14 +627,18 @@
|
||||||
#if APR_HAS_THREADS
|
#if APR_HAS_THREADS
|
||||||
int result;
|
int result;
|
||||||
#endif
|
#endif
|
||||||
@ -82,7 +80,7 @@ index 423d58d4b9a..60cbf7b7f81 100644
|
|||||||
#if APR_HAS_THREADS
|
#if APR_HAS_THREADS
|
||||||
if (ap_mpm_query(AP_MPMQ_IS_THREADED, &result) == APR_SUCCESS
|
if (ap_mpm_query(AP_MPMQ_IS_THREADED, &result) == APR_SUCCESS
|
||||||
&& result != AP_MPMQ_NOT_SUPPORTED)
|
&& result != AP_MPMQ_NOT_SUPPORTED)
|
||||||
@@ -966,7 +970,7 @@
|
@@ -968,7 +972,7 @@
|
||||||
#if APR_HAS_THREADS
|
#if APR_HAS_THREADS
|
||||||
field_start = len;
|
field_start = len;
|
||||||
len += cpystrn(buf + len, ":tid ", buflen - len);
|
len += cpystrn(buf + len, ":tid ", buflen - len);
|
@ -1,24 +1,22 @@
|
|||||||
diff --git a/configure.in b/configure.in
|
diff --git a/configure.in b/configure.in
|
||||||
index 74015ca..8c0ee10 100644
|
index 74015ca..8c0ee10 100644
|
||||||
--- a/configure.in
|
--- httpd-2.4.54/modules/arch/unix/config5.m4.selinux
|
||||||
+++ b/configure.in
|
+++ httpd-2.4.54/modules/arch/unix/config5.m4
|
||||||
@@ -508,6 +508,11 @@ getloadavg
|
@@ -23,6 +23,11 @@
|
||||||
dnl confirm that a void pointer is large enough to store a long integer
|
AC_MSG_WARN([Your system does not support systemd.])
|
||||||
APACHE_CHECK_VOID_PTR_LEN
|
enable_systemd="no"
|
||||||
|
else
|
||||||
+AC_CHECK_LIB(selinux, is_selinux_enabled, [
|
+ AC_CHECK_LIB(selinux, is_selinux_enabled, [
|
||||||
+ AC_DEFINE(HAVE_SELINUX, 1, [Defined if SELinux is supported])
|
+ AC_DEFINE(HAVE_SELINUX, 1, [Defined if SELinux is supported])
|
||||||
+ APR_ADDTO(HTTPD_LIBS, [-lselinux])
|
+ APR_ADDTO(MOD_SYSTEMD_LDADD, [-lselinux])
|
||||||
+])
|
+ ])
|
||||||
+
|
+
|
||||||
AC_CACHE_CHECK([for gettid()], ac_cv_gettid,
|
APR_ADDTO(MOD_SYSTEMD_LDADD, [$SYSTEMD_LIBS])
|
||||||
[AC_TRY_RUN(#define _GNU_SOURCE
|
fi
|
||||||
#include <unistd.h>
|
])
|
||||||
diff --git a/server/core.c b/server/core.c
|
--- httpd-2.4.54/modules/arch/unix/mod_systemd.c.selinux
|
||||||
index a6fa2fb..cf4cba4 100644
|
+++ httpd-2.4.54/modules/arch/unix/mod_systemd.c
|
||||||
--- a/server/core.c
|
@@ -35,6 +35,10 @@
|
||||||
+++ b/server/core.c
|
|
||||||
@@ -65,6 +65,10 @@
|
|
||||||
#include <unistd.h>
|
#include <unistd.h>
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
@ -26,35 +24,38 @@ index a6fa2fb..cf4cba4 100644
|
|||||||
+#include <selinux/selinux.h>
|
+#include <selinux/selinux.h>
|
||||||
+#endif
|
+#endif
|
||||||
+
|
+
|
||||||
/* LimitRequestBody handling */
|
APR_DECLARE_OPTIONAL_FN(int,
|
||||||
#define AP_LIMIT_REQ_BODY_UNSET ((apr_off_t) -1)
|
ap_find_systemd_socket, (process_rec *, apr_port_t));
|
||||||
#define AP_DEFAULT_LIMIT_REQ_BODY ((apr_off_t) 1<<30) /* 1GB */
|
|
||||||
@@ -5150,6 +5154,28 @@ static int core_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *pte
|
@@ -70,6 +74,20 @@
|
||||||
|
return apr_psprintf(p, "%s port %u", addr, sa->port);
|
||||||
}
|
}
|
||||||
#endif
|
|
||||||
|
|
||||||
+#ifdef HAVE_SELINUX
|
+#ifdef HAVE_SELINUX
|
||||||
+ {
|
+static void log_selinux_context(void)
|
||||||
+ static int already_warned = 0;
|
+{
|
||||||
+ int is_enabled = is_selinux_enabled() > 0;
|
+ char *con;
|
||||||
+
|
|
||||||
+ if (is_enabled && !already_warned) {
|
|
||||||
+ security_context_t con;
|
|
||||||
+
|
|
||||||
+ if (getcon(&con) == 0) {
|
|
||||||
+
|
+
|
||||||
|
+ if (is_selinux_enabled() && getcon(&con) == 0) {
|
||||||
+ ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL,
|
+ ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL,
|
||||||
+ "SELinux policy enabled; "
|
+ "SELinux policy enabled; "
|
||||||
+ "httpd running as context %s", con);
|
+ "httpd running as context %s", con);
|
||||||
+
|
|
||||||
+ already_warned = 1;
|
|
||||||
+
|
|
||||||
+ freecon(con);
|
+ freecon(con);
|
||||||
+ }
|
+ }
|
||||||
+ }
|
+}
|
||||||
+ }
|
|
||||||
+#endif
|
+#endif
|
||||||
+
|
+
|
||||||
|
/* Report the service is ready in post_config, which could be during
|
||||||
|
* startup or after a reload. The server could still hit a fatal
|
||||||
|
* startup error after this point during ap_run_mpm(), so this is
|
||||||
|
@@ -87,6 +105,10 @@
|
||||||
|
if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
|
||||||
return OK;
|
return OK;
|
||||||
}
|
|
||||||
|
+#ifdef HAVE_SELINUX
|
||||||
|
+ log_selinux_context();
|
||||||
|
+#endif
|
||||||
|
+
|
||||||
|
for (lr = ap_listeners; lr; lr = lr->next) {
|
||||||
|
char *s = dump_listener(lr, ptemp);
|
||||||
|
|
||||||
|
18
httpd.spec
18
httpd.spec
@ -24,7 +24,7 @@
|
|||||||
Summary: Apache HTTP Server
|
Summary: Apache HTTP Server
|
||||||
Name: httpd
|
Name: httpd
|
||||||
Version: 2.4.54
|
Version: 2.4.54
|
||||||
Release: 8%{?dist}
|
Release: 9%{?dist}
|
||||||
URL: https://httpd.apache.org/
|
URL: https://httpd.apache.org/
|
||||||
Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
|
Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
|
||||||
Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
|
Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
|
||||||
@ -86,7 +86,7 @@ Patch22: httpd-2.4.43-mod_systemd.patch
|
|||||||
Patch23: httpd-2.4.53-export.patch
|
Patch23: httpd-2.4.53-export.patch
|
||||||
Patch24: httpd-2.4.43-corelimit.patch
|
Patch24: httpd-2.4.43-corelimit.patch
|
||||||
Patch25: httpd-2.4.54-selinux.patch
|
Patch25: httpd-2.4.54-selinux.patch
|
||||||
Patch26: httpd-2.4.43-gettid.patch
|
Patch26: httpd-2.4.54-gettid.patch
|
||||||
Patch27: httpd-2.4.54-icons.patch
|
Patch27: httpd-2.4.54-icons.patch
|
||||||
Patch30: httpd-2.4.43-cachehardmax.patch
|
Patch30: httpd-2.4.43-cachehardmax.patch
|
||||||
Patch34: httpd-2.4.43-socket-activation.patch
|
Patch34: httpd-2.4.43-socket-activation.patch
|
||||||
@ -150,7 +150,7 @@ The httpd-core package contains essential httpd binaries.
|
|||||||
%package devel
|
%package devel
|
||||||
Summary: Development interfaces for the Apache HTTP Server
|
Summary: Development interfaces for the Apache HTTP Server
|
||||||
Requires: apr-devel, apr-util-devel, pkgconfig, libtool
|
Requires: apr-devel, apr-util-devel, pkgconfig, libtool
|
||||||
Requires: httpd-core = %{version}-%{release}
|
Requires: httpd-core = 0:%{version}-%{release}
|
||||||
|
|
||||||
%description devel
|
%description devel
|
||||||
The httpd-devel package contains the APXS binary and other files
|
The httpd-devel package contains the APXS binary and other files
|
||||||
@ -254,7 +254,6 @@ written in the Lua programming language.
|
|||||||
%patch22 -p1 -b .mod_systemd
|
%patch22 -p1 -b .mod_systemd
|
||||||
%patch23 -p1 -b .export
|
%patch23 -p1 -b .export
|
||||||
%patch24 -p1 -b .corelimit
|
%patch24 -p1 -b .corelimit
|
||||||
%patch25 -p1 -b .selinux
|
|
||||||
%patch26 -p1 -b .gettid
|
%patch26 -p1 -b .gettid
|
||||||
%patch27 -p1 -b .icons
|
%patch27 -p1 -b .icons
|
||||||
%patch30 -p1 -b .cachehardmax
|
%patch30 -p1 -b .cachehardmax
|
||||||
@ -266,6 +265,7 @@ written in the Lua programming language.
|
|||||||
%patch42 -p1 -b .r1828172+
|
%patch42 -p1 -b .r1828172+
|
||||||
%patch45 -p1 -b .logjournal
|
%patch45 -p1 -b .logjournal
|
||||||
%patch46 -p1 -b .separatesystemd
|
%patch46 -p1 -b .separatesystemd
|
||||||
|
%patch25 -p1 -b .selinux
|
||||||
|
|
||||||
%patch60 -p1 -b .enable-sslv3
|
%patch60 -p1 -b .enable-sslv3
|
||||||
%patch61 -p1 -b .r1878890
|
%patch61 -p1 -b .r1878890
|
||||||
@ -384,6 +384,13 @@ export LYNX_PATH=/usr/bin/links
|
|||||||
--disable-http2 \
|
--disable-http2 \
|
||||||
--disable-md \
|
--disable-md \
|
||||||
$*
|
$*
|
||||||
|
|
||||||
|
if grep -q ac_cv_have_threadsafe_pollset=no config.log; then
|
||||||
|
cat config.log
|
||||||
|
: Failed to find thread-safe APR.
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
%make_build
|
%make_build
|
||||||
|
|
||||||
%install
|
%install
|
||||||
@ -840,6 +847,9 @@ exit $rv
|
|||||||
%{_rpmconfigdir}/macros.d/macros.httpd
|
%{_rpmconfigdir}/macros.d/macros.httpd
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Mon Dec 19 2022 Joe Orton <jorton@redhat.com> - 2.4.54-9
|
||||||
|
- move SELinux context logging to mod_systemd
|
||||||
|
|
||||||
* Mon Dec 19 2022 Joe Orton <jorton@redhat.com> - 2.4.54-8
|
* Mon Dec 19 2022 Joe Orton <jorton@redhat.com> - 2.4.54-8
|
||||||
- define _httpd_statedir macro
|
- define _httpd_statedir macro
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user