New upstream bugfix release
Drop libcap-ng-0.8.3-apply-disable.patch since things should be fixed
This commit is contained in:
Steve Grubb
parent
fed9b23c8d
commit
4b5f25c926
@ -1,71 +0,0 @@
|
||||
diff -urp libcap-ng-0.8.3.orig/src/cap-ng.c libcap-ng-0.8.3/src/cap-ng.c
|
||||
--- libcap-ng-0.8.3.orig/src/cap-ng.c 2021-09-28 12:14:41.000000000 -0400
|
||||
+++ libcap-ng-0.8.3/src/cap-ng.c 2021-09-28 12:23:23.551725018 -0400
|
||||
@@ -767,6 +767,41 @@ int capng_updatev(capng_act_t action, ca
|
||||
return rc;
|
||||
}
|
||||
|
||||
+#include <sys/param.h>
|
||||
+static char *get_exename(char *exename, int size)
|
||||
+{
|
||||
+ char tmp[PATH_MAX+1];
|
||||
+ int res;
|
||||
+
|
||||
+ /* get the name of the current executable */
|
||||
+ if ((res = readlink("/proc/self/exe", tmp, PATH_MAX)) < 0)
|
||||
+ strcpy(exename, "\"?\"");
|
||||
+ else {
|
||||
+ tmp[res] = '\0';
|
||||
+ snprintf(exename, size, "\"%s\"", tmp);
|
||||
+ }
|
||||
+ return exename;
|
||||
+}
|
||||
+
|
||||
+#include <syslog.h>
|
||||
+static void log_problem(unsigned int msg)
|
||||
+{
|
||||
+ static const char *text[3] = {
|
||||
+ "dropping bounding set",
|
||||
+ "getting new bounding set",
|
||||
+ "dropping bounding set due to not having CAP_SETPCAP"
|
||||
+ };
|
||||
+ static int warned[3] = {0, 0, 0};
|
||||
+ unsigned idx = msg - 2;
|
||||
+ char exe[2048];
|
||||
+ if (warned[idx] == 0) {
|
||||
+ // Only warn once
|
||||
+ syslog(LOG_ERR, "libcap-ng used by %s failed %s in capng_apply",
|
||||
+ get_exename(exe, 2047), text[idx]);
|
||||
+ warned[idx] = 1;
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
int capng_apply(capng_select_t set)
|
||||
{
|
||||
int rc = 0;
|
||||
@@ -788,19 +823,22 @@ if (HAVE_PR_CAPBSET_DROP) {
|
||||
if (capng_have_capability(CAPNG_BOUNDING_SET,
|
||||
i) == 0) {
|
||||
if (prctl(PR_CAPBSET_DROP, i, 0, 0, 0) <0) {
|
||||
- rc = -2;
|
||||
+// rc = -2;
|
||||
+ log_problem(2);
|
||||
goto try_caps;
|
||||
}
|
||||
}
|
||||
}
|
||||
m.state = CAPNG_APPLIED;
|
||||
if (get_bounding_set() < 0) {
|
||||
- rc = -3;
|
||||
+// rc = -3;
|
||||
+ log_problem(3);
|
||||
goto try_caps;
|
||||
}
|
||||
} else {
|
||||
memcpy(&m, &state, sizeof(m)); /* restore state */
|
||||
- rc = -4;
|
||||
+// rc = -4;
|
||||
+ log_problem(4);
|
||||
goto try_caps;
|
||||
}
|
||||
}
|
||||
@ -1,50 +0,0 @@
|
||||
diff -urp libcap-ng-0.8.3.orig/src/cap-ng.h libcap-ng-0.8.3/src/cap-ng.h
|
||||
--- libcap-ng-0.8.3.orig/src/cap-ng.h 2022-03-29 16:21:43.000000000 -0400
|
||||
+++ libcap-ng-0.8.3/src/cap-ng.h 2023-09-04 11:35:55.683458005 -0400
|
||||
@@ -27,11 +27,18 @@
|
||||
#include <linux/capability.h>
|
||||
#include <unistd.h>
|
||||
|
||||
+// The next 2 macros originate in sys/cdefs.h
|
||||
+// gcc-analyzer notation
|
||||
#ifndef __attr_dealloc
|
||||
# define __attr_dealloc(dealloc, argno)
|
||||
# define __attr_dealloc_free
|
||||
#endif
|
||||
|
||||
+// Warn unused result
|
||||
+#ifndef __wur
|
||||
+# define __wur
|
||||
+#endif
|
||||
+
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
@@ -57,21 +64,21 @@ typedef enum { CAPNG_NO_FLAG=0, CAPNG_D
|
||||
void capng_clear(capng_select_t set);
|
||||
void capng_fill(capng_select_t set);
|
||||
void capng_setpid(int pid);
|
||||
-int capng_get_caps_process(void);
|
||||
+int capng_get_caps_process(void) __wur;
|
||||
int capng_update(capng_act_t action, capng_type_t type,unsigned int capability);
|
||||
int capng_updatev(capng_act_t action, capng_type_t type,
|
||||
unsigned int capability, ...);
|
||||
|
||||
// These functions apply the capabilities previously setup to a process
|
||||
-int capng_apply(capng_select_t set);
|
||||
-int capng_lock(void);
|
||||
-int capng_change_id(int uid, int gid, capng_flags_t flag);
|
||||
+int capng_apply(capng_select_t set) __wur;
|
||||
+int capng_lock(void) __wur;
|
||||
+int capng_change_id(int uid, int gid, capng_flags_t flag) __wur;
|
||||
|
||||
// These functions are used for file based capabilities
|
||||
int capng_get_rootid(void);
|
||||
int capng_set_rootid(int rootid);
|
||||
-int capng_get_caps_fd(int fd);
|
||||
-int capng_apply_caps_fd(int fd);
|
||||
+int capng_get_caps_fd(int fd) __wur;
|
||||
+int capng_apply_caps_fd(int fd) __wur;
|
||||
|
||||
// These functions check capability bits
|
||||
capng_results_t capng_have_capabilities(capng_select_t set);
|
||||
@ -1,13 +1,10 @@
|
||||
Summary: Alternate posix capabilities library
|
||||
Name: libcap-ng
|
||||
Version: 0.8.3
|
||||
Release: 8%{?dist}
|
||||
Version: 0.8.4
|
||||
Release: 1%{?dist}
|
||||
License: LGPL-2.0-or-later
|
||||
URL: https://people.redhat.com/sgrubb/libcap-ng/
|
||||
Source0: https://people.redhat.com/sgrubb/libcap-ng/%{name}-%{version}.tar.gz
|
||||
# This patch can be removed when 1899540 is resolved
|
||||
Patch1: libcap-ng-0.8.3-apply-disable.patch
|
||||
Patch2: libcap-ng-0.8.3-wur.patch
|
||||
BuildRequires: gcc
|
||||
BuildRequires: make
|
||||
BuildRequires: kernel-headers >= 2.6.11
|
||||
@ -50,8 +47,6 @@ lets you set the file system based capabilities.
|
||||
|
||||
%prep
|
||||
%setup -q
|
||||
%patch 1 -p1
|
||||
%patch 2 -p1
|
||||
|
||||
%build
|
||||
%configure --libdir=%{_libdir} --with-python=no --with-python3
|
||||
@ -97,11 +92,15 @@ make check
|
||||
%attr(0644,root,root) %{_mandir}/man8/*
|
||||
|
||||
%changelog
|
||||
* Wed Dec 20 2023 Steve Grubb <sgrubb@redhat.com> 0.8.4-1
|
||||
- New upstream bugfix release
|
||||
- Drop libcap-ng-0.8.3-apply-disable.patch since things should be fixed
|
||||
|
||||
* Mon Sep 04 2023 Steve Grubb <sgrubb@redhat.com> 0.8.3-8
|
||||
- Add function annotations to warn on unused results
|
||||
- SPDX Migration
|
||||
|
||||
* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 0.8.3-7
|
||||
* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> 0.8.3-7
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
|
||||
|
||||
* Tue Jun 13 2023 Python Maint <python-maint@redhat.com> - 0.8.3-6
|
||||
|
||||
Loading…
Reference in New Issue
Block a user