Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
| acd3c88a38 |
3
.gitignore
vendored
3
.gitignore
vendored
@ -1,2 +1 @@
|
||||
SOURCES/mod_fcgid-2.1-README.RPM
|
||||
SOURCES/mod_fcgid-2.3.9.tar.bz2
|
||||
mod_fcgid-2.3.9.tar.bz2
|
||||
|
||||
@ -1,2 +0,0 @@
|
||||
5a512f8879313c94e3ee86d664683277506d74a9 SOURCES/mod_fcgid-2.1-README.RPM
|
||||
f0b6d87dfcfe18b318905a3f91274051f3f17945 SOURCES/mod_fcgid-2.3.9.tar.bz2
|
||||
@ -1,63 +0,0 @@
|
||||
# This policy module provides support for mod_fcgid using the httpd system script domain.
|
||||
# It provides "allow" rules that will overlap to varying degrees with selinux-policy
|
||||
# packages for Fedora 5 onwards, and is a stepping stone to the merged policy included
|
||||
# as updates for selinux-policy in Fedora 8, 9, and 10.
|
||||
#
|
||||
# Rules existing in selinux-policy 2.6.4 (F7) have been stripped from this policy
|
||||
#
|
||||
# Previous versions of this policy module used a separate domain, httpd_fastcgi_script_t,
|
||||
# which is now an alias for httpd_sys_script_t.
|
||||
|
||||
policy_module(fastcgi, 0.2.6)
|
||||
|
||||
require {
|
||||
type devpts_t;
|
||||
type httpd_t;
|
||||
type httpd_log_t;
|
||||
type httpd_sys_content_t;
|
||||
type httpd_sys_content_ra_t;
|
||||
type httpd_sys_content_ro_t;
|
||||
type httpd_sys_content_rw_t;
|
||||
type httpd_sys_script_exec_t;
|
||||
type httpd_sys_script_ra_t;
|
||||
type httpd_sys_script_ro_t;
|
||||
type httpd_sys_script_rw_t;
|
||||
type httpd_sys_script_t;
|
||||
type httpd_tmp_t;
|
||||
type httpd_var_run_t;
|
||||
};
|
||||
|
||||
# Type aliases for contexts used with older policy modules
|
||||
typealias httpd_sys_content_t alias httpd_fastcgi_content_t;
|
||||
typealias httpd_sys_content_ra_t alias httpd_fastcgi_content_ra_t;
|
||||
typealias httpd_sys_content_ro_t alias httpd_fastcgi_content_ro_t;
|
||||
typealias httpd_sys_content_rw_t alias httpd_fastcgi_content_rw_t;
|
||||
typealias httpd_sys_script_exec_t alias httpd_fastcgi_script_exec_t;
|
||||
typealias httpd_sys_script_ra_t alias httpd_fastcgi_script_ra_t;
|
||||
typealias httpd_sys_script_ro_t alias httpd_fastcgi_script_ro_t;
|
||||
typealias httpd_sys_script_rw_t alias httpd_fastcgi_script_rw_t;
|
||||
typealias httpd_sys_script_t alias httpd_fastcgi_script_t;
|
||||
typealias httpd_var_run_t alias httpd_fastcgi_var_run_t;
|
||||
|
||||
# ==========================================================
|
||||
# Re-use httpd_sys_script_t for mod_fcgid apps
|
||||
# ==========================================================
|
||||
|
||||
# Allow web applications to call getpw* functions
|
||||
auth_use_nsswitch(httpd_sys_script_t)
|
||||
|
||||
# Allow httpd to create and use files and sockets for communicating with mod_fcgid
|
||||
# Rules to do this are already in selinux-policy apart from dir setattr
|
||||
setattr_dirs_pattern(httpd_t,httpd_var_run_t,httpd_var_run_t)
|
||||
|
||||
# Allow FastCGI applications to listen for FastCGI requests on their
|
||||
# sockets and respond to them
|
||||
allow httpd_sys_script_t httpd_t:unix_stream_socket { rw_stream_socket_perms };
|
||||
|
||||
# These are probably leaked file descriptors
|
||||
dontaudit httpd_t devpts_t:chr_file ioctl;
|
||||
dontaudit httpd_sys_script_t httpd_log_t:file ioctl;
|
||||
|
||||
# PHP uploads a file to /tmp and then execs programs to action them
|
||||
# Rules to do this are already in selinux-policy 2.6.4 (F7) apart from filetrans
|
||||
files_tmp_filetrans(httpd_sys_script_t,httpd_sys_script_rw_t,{ dir file lnk_file sock_file fifo_file })
|
||||
@ -1 +0,0 @@
|
||||
/var/run/mod_fcgid(/.*)? gen_context(system_u:object_r:httpd_var_run_t,s0)
|
||||
@ -1,71 +0,0 @@
|
||||
# This policy module provides support for mod_fcgid using the httpd system script domain.
|
||||
# It provides "allow" rules that will overlap to varying degrees with selinux-policy
|
||||
# packages for Fedora 5 onwards, and is a stepping stone to the merged policy included
|
||||
# as updates for selinux-policy in Fedora 8, 9, and 10.
|
||||
#
|
||||
# Rules existing in selinux-policy 2.3.7 (FC5) have been stripped from this policy
|
||||
#
|
||||
# Previous versions of this policy module used a separate domain, httpd_fastcgi_script_t,
|
||||
# which is now an alias for httpd_sys_script_t.
|
||||
|
||||
policy_module(fastcgi, 0.1.11)
|
||||
|
||||
require {
|
||||
type devpts_t;
|
||||
type httpd_t;
|
||||
type httpd_log_t;
|
||||
type httpd_sys_content_t;
|
||||
type httpd_sys_script_exec_t;
|
||||
type httpd_sys_script_ra_t;
|
||||
type httpd_sys_script_ro_t;
|
||||
type httpd_sys_script_rw_t;
|
||||
type httpd_sys_script_t;
|
||||
type httpd_tmp_t;
|
||||
type httpd_var_run_t;
|
||||
};
|
||||
|
||||
# Type aliases for contexts used with older policy modules
|
||||
typealias httpd_sys_content_t alias httpd_fastcgi_content_t;
|
||||
typealias httpd_sys_script_exec_t alias httpd_fastcgi_script_exec_t;
|
||||
typealias httpd_sys_script_ra_t alias httpd_fastcgi_script_ra_t;
|
||||
typealias httpd_sys_script_ro_t alias httpd_fastcgi_script_ro_t;
|
||||
typealias httpd_sys_script_rw_t alias httpd_fastcgi_script_rw_t;
|
||||
typealias httpd_sys_script_t alias httpd_fastcgi_script_t;
|
||||
typealias httpd_var_run_t alias httpd_fastcgi_var_run_t;
|
||||
|
||||
# ==========================================================
|
||||
# Re-use httpd_sys_script_t for mod_fcgid apps
|
||||
# ==========================================================
|
||||
|
||||
# Allow web applications to call getpw* functions
|
||||
auth_use_nsswitch(httpd_sys_script_t)
|
||||
|
||||
# Allow httpd to create and use files and sockets for communicating with mod_fcgid
|
||||
# Rules to do this are already in selinux-policy apart from dir setattr
|
||||
allow httpd_t httpd_var_run_t:dir setattr;
|
||||
|
||||
# Allow FastCGI applications to listen for FastCGI requests on their
|
||||
# sockets and respond to them
|
||||
allow httpd_sys_script_t httpd_t:unix_stream_socket { rw_stream_socket_perms };
|
||||
|
||||
# These are probably leaked file descriptors
|
||||
dontaudit httpd_t devpts_t:chr_file ioctl;
|
||||
dontaudit httpd_sys_script_t httpd_log_t:file ioctl;
|
||||
|
||||
# Search automount filesystem to use automatically mounted filesystems
|
||||
fs_search_auto_mountpoints(httpd_sys_script_t)
|
||||
|
||||
# PHP uploads a file to /tmp and then execs programs to action them
|
||||
allow httpd_sys_script_t httpd_tmp_t:dir manage_dir_perms;
|
||||
allow httpd_sys_script_t httpd_tmp_t:file manage_file_perms;
|
||||
files_tmp_filetrans(httpd_sys_script_t,httpd_sys_script_rw_t,{ dir file lnk_file sock_file fifo_file })
|
||||
|
||||
# Support network home directories
|
||||
tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
|
||||
fs_read_nfs_files(httpd_sys_script_t)
|
||||
fs_read_nfs_symlinks(httpd_sys_script_t)
|
||||
')
|
||||
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
|
||||
fs_read_cifs_files(httpd_sys_script_t)
|
||||
fs_read_cifs_symlinks(httpd_sys_script_t)
|
||||
')
|
||||
@ -1,14 +0,0 @@
|
||||
# This is the Apache server configuration file for providing FastCGI support
|
||||
# through mod_fcgid
|
||||
#
|
||||
# Documentation is available at
|
||||
# http://httpd.apache.org/mod_fcgid/mod/mod_fcgid.html
|
||||
|
||||
LoadModule fcgid_module modules/mod_fcgid.so
|
||||
|
||||
# Use FastCGI to process .fcg .fcgi & .fpl scripts
|
||||
AddHandler fcgid-script fcg fcgi fpl
|
||||
|
||||
# Sane place to put sockets and shared memory file
|
||||
FcgidIPCDir /var/run/mod_fcgid
|
||||
FcgidProcessTableFile /var/run/mod_fcgid/fcgid_shm
|
||||
@ -1,8 +0,0 @@
|
||||
--- mod_fcgid-2.3.4/build/fixconf.sed 2009-10-07 04:16:08.000000000 +0100
|
||||
+++ mod_fcgid-2.3.4/build/fixconf.sed 2009-10-12 09:50:14.570448865 +0100
|
||||
@@ -1,4 +1,4 @@
|
||||
-#!/usr/bin/sed -f
|
||||
+#!/bin/sed -f
|
||||
#
|
||||
# Licensed to the Apache Software Foundation (ASF) under one or more
|
||||
# contributor license agreements. See the NOTICE file distributed with
|
||||
75
mod_fcgid-2.1-README.RPM
Normal file
75
mod_fcgid-2.1-README.RPM
Normal file
@ -0,0 +1,75 @@
|
||||
Using the mod_fcgid RPM Package
|
||||
===============================
|
||||
|
||||
This mod_fcgid package includes a configuration file
|
||||
/etc/httpd/conf.d/fcgid.conf that ensures that the module is loaded and
|
||||
added as the handler for .fcg, .fcgi, and .fpl applications.
|
||||
|
||||
Example: setting up moin with mod_fcgid
|
||||
=======================================
|
||||
|
||||
Setting up moin with mod_fcgid is very similar to setting it up as a regular
|
||||
CGI application.
|
||||
|
||||
* Create a directory for your wiki instance:
|
||||
|
||||
DESTDIR=/var/www/mywiki
|
||||
mkdir -p $DESTDIR/cgi-bin
|
||||
|
||||
* Copy in the wiki template data and the application itself:
|
||||
|
||||
cp -a /usr/share/moin/{data,underlay} $DESTDIR
|
||||
cp -a /usr/share/moin/server/moin.fcg $DESTDIR/cgi-bin
|
||||
cp -a /usr/share/moin/config/wikiconfig.py $DESTDIR/cgi-bin
|
||||
|
||||
* Fix the directory ownership
|
||||
|
||||
chown -R apache:apache $DESTDIR/{data,underlay}
|
||||
|
||||
* Edit $DESTDIR/cgi-bin/wikiconfig.py to suit your needs
|
||||
|
||||
* Create a httpd configuration file for the wiki, e.g.
|
||||
/etc/httpd/conf.d/mywiki.conf
|
||||
|
||||
# Wiki application data common to all wiki instances
|
||||
Alias /moin_static185 "/usr/share/moin/htdocs/"
|
||||
<Directory "/usr/share/moin/htdocs/">
|
||||
Options Indexes FollowSymLinks
|
||||
AllowOverride None
|
||||
Order allow,deny
|
||||
Allow from all
|
||||
<IfModule mod_expires.c>
|
||||
ExpiresActive On
|
||||
ExpiresDefault "access plus 1 year"
|
||||
</IfModule>
|
||||
</Directory>
|
||||
|
||||
# Wiki instance with mod_fcgid
|
||||
<IfModule mod_fcgid.c>
|
||||
ScriptAlias /mywiki "/var/www/mywiki/cgi-bin/moin.fcg"
|
||||
<Directory "/var/www/mywiki/cgi-bin/">
|
||||
Options Indexes FollowSymLinks ExecCGI
|
||||
AllowOverride None
|
||||
Order allow,deny
|
||||
Allow from all
|
||||
</Directory>
|
||||
</IfModule>
|
||||
|
||||
* Restart the web server to load the new configuration:
|
||||
|
||||
service httpd restart
|
||||
|
||||
That should do it!
|
||||
|
||||
Ruby on Rails with mod_fcgid
|
||||
============================
|
||||
|
||||
One of the differences between mod_fastcgi and mod_fcgid is that the former
|
||||
sets the SCRIPT_NAME environment variable whilst the latter does not, and it's
|
||||
reported (http://bugzilla.redhat.com/476658) that Ruby on Rails expects this
|
||||
environment variable to be present. A workaround for this is to add:
|
||||
|
||||
ActionController::AbstractRequest.relative_url_root = ""
|
||||
|
||||
to the Rails::Initializer.run segment of config/environment.rb
|
||||
|
||||
@ -1,47 +1,29 @@
|
||||
Using mod_fcgid with SELinux in Fedora Core 5 / RHEL 5 onwards
|
||||
==============================================================
|
||||
|
||||
Versions of this package built for Fedora Core 5, 6, or 7 include an SELinux
|
||||
policy module to support FastCGI applications. Later Fedora releases and Red
|
||||
Hat Enterprise Linux 5.3 onwards include the policy in the main selinux-policy
|
||||
package and do not require the separate module.
|
||||
|
||||
The module source (fastcgi.{fc,te}) is included for reference as documentation
|
||||
in the package.
|
||||
|
||||
The module uses the same set of SELinux types for FastCGI applications as for
|
||||
regular CGI scripts (or "system scripts" as they are known in SELinux), as
|
||||
described in "man httpd_selinux".
|
||||
|
||||
* httpd_sys_content_t
|
||||
- Set files with httpd_sys_content_t for content that is available
|
||||
- Set files with httpd_sys_content_t for content that is available to read
|
||||
from all FastCGI scripts and the daemon.
|
||||
|
||||
* httpd_sys_rw_content_t
|
||||
- Set files with httpd_sys_rw_content_t if you want httpd_sys_script_exec_t
|
||||
scripts to read/write the data, and disallow other processes from access.
|
||||
|
||||
* httpd_sys_script_exec_t
|
||||
- Set FastCGI scripts with httpd_sys_script_exec_t to allow them to run
|
||||
with access to all system script types.
|
||||
|
||||
* httpd_sys_script_ro_t
|
||||
- Set files with httpd_sys_script_ro_t if you want httpd_sys_script_exec_t
|
||||
scripts to read but not write the data, and disallow other processes from
|
||||
access.
|
||||
|
||||
* httpd_sys_script_rw_t
|
||||
- Set files with httpd_sys_script_rw_t if you want httpd_sys_script_exec_t
|
||||
scripts to read/write the data, and disallow other processes from access.
|
||||
|
||||
* httpd_sys_script_ra_t
|
||||
- Set files with httpd_sys_script_ra_t if you want httpd_sys_script_exec_t
|
||||
scripts to read/append to the file, and disallow other processes from
|
||||
access.
|
||||
|
||||
So for the moin wiki layout described in README.RPM of the main mod_fcgid
|
||||
package, the contexts would be set as follows:
|
||||
|
||||
cd /var/www/mywiki
|
||||
chcon -t httpd_sys_content_t .
|
||||
chcon -R -t httpd_sys_script_exec_t cgi-bin
|
||||
chcon -R -t httpd_sys_script_rw_t data underlay
|
||||
chcon -R -t httpd_sys_rw_content_t data underlay
|
||||
|
||||
It is necessary to turn on the httpd_enable_cgi boolean to run either regular
|
||||
or FastCGI scripts:
|
||||
@ -59,5 +41,5 @@ chances that any vulnerability in any of your web applications could be
|
||||
exploited by a spammer.
|
||||
|
||||
If you have any questions or issues regarding FastCGI and SELinux, please don't
|
||||
hesitate to bring them up on fedora-selinux-list.
|
||||
hesitate to bring them up on Fedora's selinux-list.
|
||||
|
||||
40
mod_fcgid-2.3.9-r1919454.patch
Normal file
40
mod_fcgid-2.3.9-r1919454.patch
Normal file
@ -0,0 +1,40 @@
|
||||
# ./pullrev.sh 1919454
|
||||
http://svn.apache.org/viewvc?view=revision&revision=1919454
|
||||
|
||||
https://issues.redhat.com/browse/RHEL-50029
|
||||
|
||||
only in patch2:
|
||||
--- mod_fcgid-2.3.9/modules/fcgid/fcgid_proctbl_unix.c
|
||||
+++ mod_fcgid-2.3.9/modules/fcgid/fcgid_proctbl_unix.c
|
||||
@@ -136,18 +136,23 @@
|
||||
fcgid_server_conf *sconf = ap_get_module_config(main_server->module_config,
|
||||
&fcgid_module);
|
||||
|
||||
- /* Remove share memory first */
|
||||
+ /* Use anonymous SHM segment by default, fall back to name-based. */
|
||||
+ if ((rv = apr_shm_create(&g_sharemem, shmem_size, NULL,
|
||||
+ main_server->process->pconf)) != APR_SUCCESS) {
|
||||
+ /* Remove any existing segment first, ignore errors. */
|
||||
apr_shm_remove(sconf->shmname_path, main_server->process->pconf);
|
||||
|
||||
- /* Create share memory */
|
||||
- if ((rv = apr_shm_create(&g_sharemem, shmem_size, sconf->shmname_path,
|
||||
- main_server->process->pconf)) != APR_SUCCESS)
|
||||
- {
|
||||
+ rv = apr_shm_create(&g_sharemem, shmem_size, sconf->shmname_path,
|
||||
+ main_server->process->pconf);
|
||||
+ if (rv) {
|
||||
ap_log_error(APLOG_MARK, APLOG_EMERG, rv, main_server,
|
||||
- "mod_fcgid: Can't create shared memory for size %" APR_SIZE_T_FMT " bytes",
|
||||
- shmem_size);
|
||||
- exit(1);
|
||||
+ "mod_fcgid: Can't create shared memory either "
|
||||
+ "anonymous or at %s, for size %" APR_SIZE_T_FMT " bytes",
|
||||
+ sconf->shmname_path, shmem_size);
|
||||
+ return rv;
|
||||
}
|
||||
+ }
|
||||
+
|
||||
_global_memory = apr_shm_baseaddr_get(g_sharemem);
|
||||
|
||||
/* Create global mutex */
|
||||
@ -1,82 +1,35 @@
|
||||
# Fedora 5, 6, and 7 versions includes SELinux policy module package
|
||||
# Fedora 8 and 9 versions include policy in errata selinux-policy releases
|
||||
# Fedora 10 onwards include policy in standard selinux-policy releases
|
||||
# RHEL 5.5 onwards include policy in standard selinux-policy releases
|
||||
%if 0%{?fedora} < 5 || 0%{?fedora} > 7 || 0%{?rhel}
|
||||
%global selinux_module 0
|
||||
%global selinux_types %{nil}
|
||||
%global selinux_variants %{nil}
|
||||
%global selinux_buildreqs %{nil}
|
||||
%else
|
||||
%global selinux_module 1
|
||||
%global selinux_types %(awk '/^#[[:space:]]*SELINUXTYPE=/,/^[^#]/ { if ($3 == "-") printf "%s ", $2 }' /etc/selinux/config 2>/dev/null)
|
||||
%global selinux_variants %([ -z "%{selinux_types}" ] && echo mls strict targeted || echo %{selinux_types})
|
||||
%global selinux_buildreqs checkpolicy, selinux-policy-devel, hardlink
|
||||
%endif
|
||||
|
||||
# apxs script location
|
||||
%{!?_httpd_apxs: %global _httpd_apxs %{_sbindir}/apxs}
|
||||
|
||||
# Module Magic Number
|
||||
%{!?_httpd_mmn: %global _httpd_mmn %(cat %{_includedir}/httpd/.mmn 2>/dev/null || echo 0-0)}
|
||||
|
||||
# Configuration directory
|
||||
%{!?_httpd_confdir: %global _httpd_confdir %{_sysconfdir}/httpd/conf.d}
|
||||
|
||||
# For httpd ≥ 2.4 we have a different filesystem layout
|
||||
%if 0%{?fedora} > 17 || 0%{?rhel} > 6
|
||||
%global httpd24 1
|
||||
%global rundir /run
|
||||
%else
|
||||
%global httpd24 0
|
||||
%global rundir %{_localstatedir}/run
|
||||
%endif
|
||||
|
||||
Name: mod_fcgid
|
||||
Version: 2.3.9
|
||||
Release: 17%{?dist}
|
||||
Release: 35%{?dist}
|
||||
Summary: FastCGI interface module for Apache 2
|
||||
Group: System Environment/Daemons
|
||||
License: ASL 2.0
|
||||
License: Apache-2.0
|
||||
URL: http://httpd.apache.org/mod_fcgid/
|
||||
Source0: http://www.apache.org/dist/httpd/mod_fcgid/mod_fcgid-%{version}.tar.bz2
|
||||
Source1: fcgid.conf
|
||||
Source2: mod_fcgid-2.1-README.RPM
|
||||
Source3: mod_fcgid-2.1-README.SELinux
|
||||
Source4: mod_fcgid-tmpfs.conf
|
||||
Source5: fcgid24.conf
|
||||
Source10: fastcgi.te
|
||||
Source11: fastcgi-2.5.te
|
||||
Source12: fastcgi.fc
|
||||
Patch0: mod_fcgid-2.3.4-fixconf-shellbang.patch
|
||||
Patch1: mod_fcgid-2.3.9-r1847623.patch
|
||||
Patch2: mod_fcgid-2.3.9-r1848298.patch
|
||||
Patch3: mod_fcgid-2.3.9-r1847624.patch
|
||||
Patch0: mod_fcgid-2.3.9-r1847623.patch
|
||||
Patch1: mod_fcgid-2.3.9-1024-env-vars.patch
|
||||
Patch2: mod_fcgid-2.3.9-r1847624.patch
|
||||
Patch3: mod_fcgid-2.3.9-r1848298.patch
|
||||
Patch4: mod_fcgid-2.3.9-r1848311.patch
|
||||
Patch5: mod_fcgid-2.3.9-1024-env-vars.patch
|
||||
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(id -nu)
|
||||
BuildRequires: httpd-devel >= 2.0, pkgconfig
|
||||
Patch5: mod_fcgid-2.3.9-r1919454.patch
|
||||
BuildRequires: coreutils
|
||||
BuildRequires: gcc
|
||||
BuildRequires: httpd-devel >= 2.4
|
||||
BuildRequires: make
|
||||
BuildRequires: pkgconfig
|
||||
BuildRequires: sed
|
||||
# systemd-rpm-macros needed for definition of %%{_tmpfilesdir}
|
||||
%if (0%{?fedora} && 0%{?fedora} <= 30)
|
||||
BuildRequires: systemd
|
||||
%else
|
||||
BuildRequires: systemd-rpm-macros
|
||||
%endif
|
||||
Requires: httpd-mmn = %{_httpd_mmn}
|
||||
# systemd-units needed for ownership of /usr/lib/tmpfiles.d directory
|
||||
%if 0%{?fedora} > 14 || 0%{?rhel} > 6
|
||||
Requires: systemd-units
|
||||
%endif
|
||||
# Make sure that selinux-policy is sufficiently up-to-date if it's installed
|
||||
# FastCGI policy properly incorporated into EL 5.5
|
||||
%if "%{?rhel}" == "5"
|
||||
Conflicts: selinux-policy < 2.4.6-279.el5
|
||||
# No provide here because selinux-policy >= 2.4.6-279.el5 does the providing
|
||||
Obsoletes: mod_fcgid-selinux <= %{version}-%{release}
|
||||
%endif
|
||||
%if "%{?fedora}" == "8"
|
||||
Conflicts: selinux-policy < 3.0.8-123.fc8
|
||||
%endif
|
||||
%if "%{?fedora}" == "9"
|
||||
Conflicts: selinux-policy < 3.3.1-107.fc9
|
||||
%endif
|
||||
%if "%{?fedora}" == "10"
|
||||
Conflicts: selinux-policy < 3.5.13-8.fc10
|
||||
%endif
|
||||
# systemd needed for ownership of %%{_tmpfilesdir}
|
||||
Requires: systemd
|
||||
|
||||
%description
|
||||
mod_fcgid is a binary-compatible alternative to the Apache module mod_fastcgi.
|
||||
@ -84,179 +37,138 @@ mod_fcgid has a new process management strategy, which concentrates on reducing
|
||||
the number of fastcgi servers, and kicking out corrupt fastcgi servers as soon
|
||||
as possible.
|
||||
|
||||
%if %{selinux_module}
|
||||
%package selinux
|
||||
Summary: SELinux policy module supporting FastCGI applications with mod_fcgid
|
||||
Group: System Environment/Base
|
||||
BuildRequires: %{selinux_buildreqs}
|
||||
# selinux-policy is required for directory ownership of %%{_datadir}/selinux/*
|
||||
#
|
||||
# version requirement is a hack to avoid problems mixing new modules with older policy,
|
||||
# e.g. http://www.redhat.com/archives/fedora-selinux-list/2006-May/msg00102.html
|
||||
# _selinux_policy_version introduced in F-20 (#999584), but can be emulated by
|
||||
# pulling the policy version number from the policyhelp file on older distributions
|
||||
%{!?_selinux_policy_version: %global _selinux_policy_version %(sed -e 's,.*selinux-policy-\\([^/]*\\)/.*,\\1,' /usr/share/selinux/devel/policyhelp 2>/dev/null || echo 0.0.0)}
|
||||
%global selinux_policynum %(echo %{_selinux_policy_version} | awk -F. '{ printf "%d%02d%02d", $1, $2, $3 }')
|
||||
Requires: selinux-policy >= %{_selinux_policy_version}
|
||||
Requires: %{name} = %{version}-%{release}
|
||||
Requires(post): /usr/sbin/semodule, /sbin/restorecon
|
||||
Requires(postun): /usr/sbin/semodule, /sbin/restorecon
|
||||
|
||||
%description selinux
|
||||
SELinux policy module supporting FastCGI applications with mod_fcgid.
|
||||
%endif
|
||||
|
||||
%prep
|
||||
%setup -q
|
||||
cp -p %{SOURCE1} fcgid.conf
|
||||
%autosetup -p1 -S gendiff
|
||||
|
||||
cp -p %{SOURCE2} README.RPM
|
||||
cp -p %{SOURCE3} README.SELinux
|
||||
cp -p %{SOURCE5} fcgid24.conf
|
||||
%if 0%{?selinux_policynum} < 20501
|
||||
cp -p %{SOURCE10} fastcgi.te
|
||||
%else
|
||||
cp -p %{SOURCE11} fastcgi.te
|
||||
%endif
|
||||
cp -p %{SOURCE12} fastcgi.fc
|
||||
|
||||
# Fix shellbang in fixconf script for our location of sed
|
||||
%if 0%{?fedora} < 24 && 0%{?rhel} < 8
|
||||
%if (0%{?rhel} && 0%{?rhel} <= 7) || (0%{?fedora} && 0%{?fedora} <= 23)
|
||||
%patch0 -p1
|
||||
%endif
|
||||
%patch1 -p1 -b .r1847623
|
||||
%patch2 -p1 -b .r1848298
|
||||
%patch3 -p1 -b .r1847624
|
||||
%patch4 -p1 -b .r1848311
|
||||
%patch5 -p1 -b .1024_env_vars
|
||||
|
||||
%build
|
||||
APXS=%{_httpd_apxs} ./configure.apxs
|
||||
make
|
||||
%if %{selinux_module}
|
||||
for selinuxvariant in %{selinux_variants}
|
||||
do
|
||||
make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile
|
||||
mv fastcgi.pp fastcgi.pp.${selinuxvariant}
|
||||
make NAME=${selinuxvariant} -f /usr/share/selinux/devel/Makefile clean
|
||||
done
|
||||
%endif
|
||||
|
||||
%install
|
||||
rm -rf %{buildroot}
|
||||
make DESTDIR=%{buildroot} MKINSTALLDIRS="mkdir -p" install
|
||||
%if %{httpd24}
|
||||
%make_install MKINSTALLDIRS="mkdir -p"
|
||||
mkdir -p %{buildroot}{%{_httpd_confdir},%{_httpd_modconfdir}}
|
||||
echo "LoadModule fcgid_module modules/mod_fcgid.so" > %{buildroot}%{_httpd_modconfdir}/10-fcgid.conf
|
||||
install -D -m 644 fcgid24.conf %{buildroot}%{_httpd_confdir}/fcgid.conf
|
||||
%else
|
||||
install -D -m 644 fcgid.conf %{buildroot}%{_httpd_confdir}/fcgid.conf
|
||||
%endif
|
||||
install -d -m 755 %{buildroot}%{rundir}/mod_fcgid
|
||||
install -d -m 755 %{buildroot}/run/mod_fcgid
|
||||
|
||||
# Include the manual as %%doc, don't need it elsewhere
|
||||
%if %{httpd24}
|
||||
rm -rf %{buildroot}%{_httpd_contentdir}/manual
|
||||
%else
|
||||
rm -rf %{buildroot}%{_var}/www/manual
|
||||
%endif
|
||||
|
||||
# Make sure %%{rundir}/mod_fcgid exists at boot time for systems
|
||||
# with %%{rundir} on tmpfs (#656625)
|
||||
%if 0%{?fedora} > 14 || 0%{?rhel} > 6
|
||||
install -d -m 755 %{buildroot}%{_prefix}/lib/tmpfiles.d
|
||||
install -p -m 644 %{SOURCE4} %{buildroot}%{_prefix}/lib/tmpfiles.d/mod_fcgid.conf
|
||||
%endif
|
||||
|
||||
# Install SELinux policy modules
|
||||
%if %{selinux_module}
|
||||
for selinuxvariant in %{selinux_variants}
|
||||
do
|
||||
install -d %{buildroot}%{_datadir}/selinux/${selinuxvariant}
|
||||
install -p -m 644 fastcgi.pp.${selinuxvariant} \
|
||||
%{buildroot}%{_datadir}/selinux/${selinuxvariant}/fastcgi.pp
|
||||
done
|
||||
# Hardlink identical policy module packages together
|
||||
hardlink -cv %{buildroot}%{_datadir}/selinux
|
||||
%endif
|
||||
|
||||
%clean
|
||||
rm -rf %{buildroot}
|
||||
|
||||
%if %{selinux_module}
|
||||
%post selinux
|
||||
# Install SELinux policy modules
|
||||
for selinuxvariant in %{selinux_variants}
|
||||
do
|
||||
/usr/sbin/semodule -s ${selinuxvariant} -i \
|
||||
%{_datadir}/selinux/${selinuxvariant}/fastcgi.pp &> /dev/null || :
|
||||
done
|
||||
# Fix up non-standard directory context from earlier packages
|
||||
/sbin/restorecon -R %{rundir}/mod_fcgid || :
|
||||
|
||||
%postun selinux
|
||||
# Clean up after package removal
|
||||
if [ $1 -eq 0 ]; then
|
||||
# Remove SELinux policy modules
|
||||
for selinuxvariant in %{selinux_variants}; do
|
||||
/usr/sbin/semodule -s ${selinuxvariant} -r fastcgi &> /dev/null || :
|
||||
done
|
||||
# Clean up any remaining file contexts (shouldn't be any really)
|
||||
[ -d %{rundir}/mod_fcgid ] && \
|
||||
/sbin/restorecon -R %{rundir}/mod_fcgid &> /dev/null || :
|
||||
fi
|
||||
exit 0
|
||||
%endif
|
||||
# Make sure /run/mod_fcgid exists at boot time (#656625)
|
||||
install -d -m 755 %{buildroot}%{_tmpfilesdir}
|
||||
install -p -m 644 %{SOURCE4} %{buildroot}%{_tmpfilesdir}/mod_fcgid.conf
|
||||
|
||||
%files
|
||||
%if 0%{?_licensedir:1}
|
||||
%license LICENSE-FCGID
|
||||
%else
|
||||
%doc LICENSE-FCGID
|
||||
%endif
|
||||
%doc README.RPM README.SELinux
|
||||
# mod_fcgid.html.en is explicitly encoded as ISO-8859-1
|
||||
%doc CHANGES-FCGID NOTICE-FCGID README-FCGID STATUS-FCGID
|
||||
%doc docs/manual/mod/mod_fcgid.html.en modules/fcgid/ChangeLog
|
||||
%doc build/fixconf.sed
|
||||
%{_libdir}/httpd/modules/mod_fcgid.so
|
||||
%if %{httpd24}
|
||||
%config(noreplace) %{_httpd_modconfdir}/10-fcgid.conf
|
||||
%endif
|
||||
%config(noreplace) %{_httpd_confdir}/fcgid.conf
|
||||
%if 0%{?fedora} > 14 || 0%{?rhel} > 6
|
||||
%{_prefix}/lib/tmpfiles.d/mod_fcgid.conf
|
||||
%endif
|
||||
%dir %attr(0775,root,apache) %{rundir}/mod_fcgid/
|
||||
|
||||
%if %{selinux_module}
|
||||
%files selinux
|
||||
%doc fastcgi.fc fastcgi.te README.SELinux
|
||||
%{_datadir}/selinux/*/fastcgi.pp
|
||||
%endif
|
||||
%{_tmpfilesdir}/mod_fcgid.conf
|
||||
%dir %attr(0775,root,apache) /run/mod_fcgid/
|
||||
|
||||
%changelog
|
||||
* Mon Dec 07 2020 Lubos Uhliarik <luhliari@redhat.com> - 2.3.9-17
|
||||
- Resolves: #1876525 - mod_fcgid does not pass more than 64 variables to an FCGI
|
||||
server process environment
|
||||
* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 2.3.9-35
|
||||
- Bump release for October 2024 mass rebuild:
|
||||
Resolves: RHEL-64018
|
||||
|
||||
* Thu Dec 13 2018 Joe Orton <jorton@redhat.com> - 2.3.9-16
|
||||
- restrict symbol exports in mod_fcgid.so (#1655035)
|
||||
* Mon Jul 22 2024 Joe Orton <jorton@redhat.com> - 2.3.9-34
|
||||
- sync from c9s
|
||||
- switch to using anonymous shm by default
|
||||
Resolves: RHEL-50029
|
||||
|
||||
* Mon Dec 10 2018 Joe Orton <jorton@redhat.com> - 2.3.9-15
|
||||
- fix memory consumption for large request bodies (#1654200)
|
||||
* Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 2.3.9-33
|
||||
- Bump release for June 2024 mass rebuild
|
||||
|
||||
* Fri Dec 7 2018 Joe Orton <jorton@redhat.com> - 2.3.9-14
|
||||
- fix handling of chunked request bodies (#1656851)
|
||||
* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.9-32
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
|
||||
|
||||
* Fri Nov 30 2018 Joe Orton <jorton@redhat.com> - 2.3.9-13
|
||||
- increase maximum FcgidInitialEnv to 256 chars (#1651310)
|
||||
* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.9-31
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
|
||||
|
||||
* Thu May 03 2018 Luboš Uhliarik <luhliari@redhat.com> - 2.3.9-12
|
||||
- Related: #1564219 - SELinux prevents httpd from starting when mod_fcgid
|
||||
is installed
|
||||
* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.9-30
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
|
||||
|
||||
* Tue Apr 24 2018 Luboš Uhliarik <luhliari@redhat.com> - 2.3.9-11
|
||||
* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.9-29
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
|
||||
|
||||
* Wed Aug 24 2022 Paul Howarth <paul@city-fan.org> - 2.3.9-28
|
||||
- BR: systemd-rpm-macros for definition of %%{_tmpfilesdir}
|
||||
|
||||
* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.9-27
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
|
||||
|
||||
* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.9-26
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
|
||||
|
||||
* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.9-25
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
|
||||
|
||||
* Wed Jan 27 2021 Paul Howarth <paul@city-fan.org> - 2.3.9-24
|
||||
- Drop EL-6 support
|
||||
- Use %%license unconditionally
|
||||
- _httpd_* macros always available
|
||||
- Run directory is always /run on tmpfs
|
||||
- Assume httpd ≥ 2.4 filesystem layout
|
||||
- systemd-units always provided by systemd
|
||||
|
||||
* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.9-23
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
|
||||
|
||||
* Thu Aug 27 2020 Joe Orton <jorton@redhat.com> - 2.3.9-22
|
||||
- merge fixes from RHEL (r1848298, etc)
|
||||
|
||||
* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.9-21
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
|
||||
|
||||
* Mon Jul 13 2020 Tom Stellard <tstellar@redhat.com> - 2.3.9-20
|
||||
- Use make macros
|
||||
- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
|
||||
|
||||
* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.9-19
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
|
||||
|
||||
* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.9-18
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
|
||||
|
||||
* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.9-17
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
|
||||
|
||||
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.9-16
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
|
||||
|
||||
* Thu May 3 2018 Paul Howarth <paul@city-fan.org> - 2.3.9-15
|
||||
- Correct mode of %%{rundir}/mod_fcgid in %%{_tmpfilesdir}/mod_fcgid.conf
|
||||
|
||||
* Wed May 02 2018 Luboš Uhliarik <luhliari@redhat.com> - 2.3.9-14
|
||||
- Resolves: #1564219 - SELinux prevents httpd from starting when mod_fcgid
|
||||
is installed
|
||||
is installed (also #1574390)
|
||||
|
||||
* Tue Feb 20 2018 Paul Howarth <paul@city-fan.org> - 2.3.9-13
|
||||
- BR: gcc
|
||||
|
||||
* Thu Feb 08 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.9-12
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
|
||||
|
||||
* Fri Jan 26 2018 Paul Howarth <paul@city-fan.org> - 2.3.9-11
|
||||
- Drop SELinux policy module: all supported targets have it in base policy now
|
||||
- Update README.SELinux to current types and ship it
|
||||
- Use forward-looking conditionals
|
||||
- One build requirement per line
|
||||
- Drop legacy Group: tag
|
||||
|
||||
* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.9-10
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
|
||||
Loading…
Reference in New Issue
Block a user