rpms/mod_security
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Resolves: RHEL-172046 - add mod_security

Browse Source
This commit is contained in:
Luboš Uhliarik 2026-07-22 15:01:47 +02:00
parent 86a1573edf
commit e03cd8aaa5
16 changed files with 567 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.fmf/version Normal file
View File

@ -0,0 +1 @@
1

1
.gitignore vendored Normal file
View File

@ -0,0 +1 @@
/modsecurity-v2.9.14.tar.gz

5
10-mod_security.conf Normal file
View File

@ -0,0 +1,5 @@
LoadModule security2_module modules/mod_security2.so
<IfModule !mod_unique_id.c>
LoadModule unique_id_module modules/mod_unique_id.so
</IfModule>

3
README.md
View File

@ -1,3 +0,0 @@
# Package Not Available
This package is not available on CentOS Stream 10.
It may be available on another branch.

1
dead.package
View File

@ -1 +0,0 @@
mod_security package is retired on branch c10s for CS-2551

6
gating.yaml Normal file
View File

@ -0,0 +1,6 @@
--- !Policy
product_versions:
- rhel-*
decision_context: osci_compose_gate
rules:
- !PassingTestCaseRule {test_case_name: osci.brew-build./plans/appstream.functional}

83
mod_security-2.9.3-remote-rules-timeout.patch Normal file
View File

@ -0,0 +1,83 @@
diff --git a/apache2/apache2_config.c b/apache2/apache2_config.c
index ca21893..26870a2 100644
--- a/apache2/apache2_config.c
+++ b/apache2/apache2_config.c
@@ -2690,6 +2690,22 @@ static const char *cmd_remote_rules(cmd_parms *cmd, void *_dcfg, const char *p1,
return NULL;
}
+static const char *cmd_remote_timeout(cmd_parms *cmd, void *_dcfg, const char *p1)
+{
+ directory_config *dcfg = (directory_config *)_dcfg;
+ long int timeout;
+
+ if (dcfg == NULL) return NULL;
+
+ timeout = strtol(p1, NULL, 10);
+ if ((timeout == LONG_MAX)||(timeout == LONG_MIN)||(timeout < 0)) {
+ return apr_psprintf(cmd->pool, "ModSecurity: Invalid value for SecRemoteTimeout: %s", p1);
+ }
+
+ remote_rules_timeout = timeout;
+
+ return NULL;
+}
static const char *cmd_status_engine(cmd_parms *cmd, void *_dcfg, const char *p1)
{
@@ -4215,6 +4231,14 @@ const command_rec module_directives[] = {
"Abort or Warn"
),
+ AP_INIT_TAKE1 (
+ "SecRemoteTimeout",
+ cmd_remote_timeout,
+ NULL,
+ CMD_SCOPE_ANY,
+ "timeout in seconds"
+ ),
+
AP_INIT_TAKE1 (
"SecXmlExternalEntity",
diff --git a/apache2/mod_security2.c b/apache2/mod_security2.c
index 1850191..1df6f0b 100644
--- a/apache2/mod_security2.c
+++ b/apache2/mod_security2.c
@@ -77,6 +77,8 @@ msc_remote_rules_server DSOLOCAL *remote_rules_server = NULL;
#endif
int DSOLOCAL remote_rules_fail_action = REMOTE_RULES_ABORT_ON_FAIL;
char DSOLOCAL *remote_rules_fail_message = NULL;
+unsigned long int DSOLOCAL remote_rules_timeout = NOT_SET;
+
int DSOLOCAL status_engine_state = STATUS_ENGINE_DISABLED;
diff --git a/apache2/modsecurity.h b/apache2/modsecurity.h
index d1aa1d8..134ed86 100644
--- a/apache2/modsecurity.h
+++ b/apache2/modsecurity.h
@@ -154,6 +154,7 @@ extern DSOLOCAL msc_remote_rules_server *remote_rules_server;
#endif
extern DSOLOCAL int remote_rules_fail_action;
extern DSOLOCAL char *remote_rules_fail_message;
+extern DSOLOCAL unsigned long int remote_rules_timeout;
extern DSOLOCAL int status_engine_state;
diff --git a/apache2/msc_remote_rules.c b/apache2/msc_remote_rules.c
index 37b8864..12890a2 100644
--- a/apache2/msc_remote_rules.c
+++ b/apache2/msc_remote_rules.c
@@ -358,6 +358,11 @@ int msc_remote_download_content(apr_pool_t *mp, const char *uri, const char *key
/* We want Curl to return error in case there is an HTTP error code */
curl_easy_setopt(curl, CURLOPT_FAILONERROR, 1);
+ /* In case we want different timeout than a default one */
+ if (remote_rules_timeout != NOT_SET){
+ curl_easy_setopt(curl, CURLOPT_TIMEOUT, remote_rules_timeout);
+ }
+
res = curl_easy_perform(curl);
if (res != CURLE_OK)

192
mod_security-2.9.7-pipedlogs.patch Normal file
View File

@ -0,0 +1,192 @@
https://github.com/owasp-modsecurity/ModSecurity/pull/2823
From bec33810e95ac9ae4d05c74a7fd8cedb61224ca2 Mon Sep 17 00:00:00 2001
From: Tomas Korbar <tkorbar@redhat.com>
Date: Wed, 9 Oct 2024 14:39:14 +0200
Subject: [PATCH] Move log opening to appropriate execution phase
When piped logs are opened during parsing of configuration
it results in unexpected situations in apache httpd
and can cause hang of process which is trying to log
into auditlog.
Code should work as before, with the exception of
one additional condition evaluation when primary
audit log is not set and secondary audit log
path to piped executable is now not relative
to server root.
---
apache2/apache2_config.c | 58 ----------------------------------------
apache2/mod_security2.c | 1 +
apache2/msc_logging.c | 52 +++++++++++++++++++++++++++++++++++
apache2/msc_logging.h | 3 +++
4 files changed, 56 insertions(+), 58 deletions(-)
diff --git a/apache2/apache2_config.c b/apache2/apache2_config.c
index da10b4bfe..8c2ebe3ba 100644
--- a/apache2/apache2_config.c
+++ b/apache2/apache2_config.c
@@ -1239,35 +1239,6 @@ static const char *cmd_audit_log(cmd_parms *cmd, void *_dcfg, const char *p1)
directory_config *dcfg = _dcfg;
dcfg->auditlog_name = (char *)p1;
-
- if (dcfg->auditlog_name[0] == '|') {
- const char *pipe_name = dcfg->auditlog_name + 1;
- piped_log *pipe_log;
-
- pipe_log = ap_open_piped_log(cmd->pool, pipe_name);
- if (pipe_log == NULL) {
- return apr_psprintf(cmd->pool, "ModSecurity: Failed to open the audit log pipe: %s",
- pipe_name);
- }
- dcfg->auditlog_fd = ap_piped_log_write_fd(pipe_log);
- }
- else {
- const char *file_name = ap_server_root_relative(cmd->pool, dcfg->auditlog_name);
- apr_status_t rc;
-
- if (dcfg->auditlog_fileperms == NOT_SET) {
- dcfg->auditlog_fileperms = CREATEMODE;
- }
- rc = apr_file_open(&dcfg->auditlog_fd, file_name,
- APR_WRITE | APR_APPEND | APR_CREATE | APR_BINARY,
- dcfg->auditlog_fileperms, cmd->pool);
-
- if (rc != APR_SUCCESS) {
- return apr_psprintf(cmd->pool, "ModSecurity: Failed to open the audit log file: %s",
- file_name);
- }
- }
-
return NULL;
}
@@ -1283,35 +1254,6 @@ static const char *cmd_audit_log2(cmd_parms *cmd, void *_dcfg, const char *p1)
}
dcfg->auditlog2_name = (char *)p1;
-
- if (dcfg->auditlog2_name[0] == '|') {
- const char *pipe_name = ap_server_root_relative(cmd->pool, dcfg->auditlog2_name + 1);
- piped_log *pipe_log;
-
- pipe_log = ap_open_piped_log(cmd->pool, pipe_name);
- if (pipe_log == NULL) {
- return apr_psprintf(cmd->pool, "ModSecurity: Failed to open the secondary audit log pipe: %s",
- pipe_name);
- }
- dcfg->auditlog2_fd = ap_piped_log_write_fd(pipe_log);
- }
- else {
- const char *file_name = ap_server_root_relative(cmd->pool, dcfg->auditlog2_name);
- apr_status_t rc;
-
- if (dcfg->auditlog_fileperms == NOT_SET) {
- dcfg->auditlog_fileperms = CREATEMODE;
- }
- rc = apr_file_open(&dcfg->auditlog2_fd, file_name,
- APR_WRITE | APR_APPEND | APR_CREATE | APR_BINARY,
- dcfg->auditlog_fileperms, cmd->pool);
-
- if (rc != APR_SUCCESS) {
- return apr_psprintf(cmd->pool, "ModSecurity: Failed to open the secondary audit log file: %s",
- file_name);
- }
- }
-
return NULL;
}
diff --git a/apache2/mod_security2.c b/apache2/mod_security2.c
index 1850191eb..e257978b8 100644
--- a/apache2/mod_security2.c
+++ b/apache2/mod_security2.c
@@ -1735,6 +1735,7 @@ static void register_hooks(apr_pool_t *mp) {
/* Logging */
ap_hook_error_log(hook_error_log, NULL, NULL, APR_HOOK_MIDDLE);
+ ap_hook_open_logs(modsec_open_logs, NULL, NULL, APR_HOOK_MIDDLE);
ap_hook_log_transaction(hook_log_transaction, NULL, transaction_afterme_list, APR_HOOK_MIDDLE);
/* Filter hooks */
diff --git a/apache2/msc_logging.c b/apache2/msc_logging.c
index 39588b10f..b07732adb 100644
--- a/apache2/msc_logging.c
+++ b/apache2/msc_logging.c
@@ -2316,3 +2316,55 @@ void sec_audit_logger(modsec_rec *msr) {
}
#endif
}
+
+static int open_audit_log(char *auditlog_name, unsigned char primary, apr_file_t **auditlog_fd,
+ apr_fileperms_t *auditlog_fileperms, apr_pool_t *p) {
+ if (auditlog_name == NOT_SET_P) {
+ return OK;
+ }
+ if (auditlog_name[0] == '|') {
+ const char *pipe_name = auditlog_name + 1;
+ piped_log *pipe_log;
+
+ pipe_log = ap_open_piped_log(p, pipe_name);
+ if (pipe_log == NULL) {
+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, NULL,
+ "ModSecurity: Failed to open the %saudit log pipe: %s",
+ primary ? "" : "secondary ", pipe_name);
+ return primary ? DONE : OK;
+ }
+ *auditlog_fd = ap_piped_log_write_fd(pipe_log);
+ }
+ else {
+ const char *file_name = ap_server_root_relative(p, auditlog_name);
+ apr_status_t rc;
+
+ if (*auditlog_fileperms == NOT_SET) {
+ *auditlog_fileperms = CREATEMODE;
+ }
+ rc = apr_file_open(auditlog_fd, file_name,
+ APR_WRITE | APR_APPEND | APR_CREATE | APR_BINARY,
+ *auditlog_fileperms, p);
+
+ if (rc != APR_SUCCESS) {
+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, NULL,
+ "ModSecurity: Failed to open the %saudit log file: %s",
+ primary ? "" : "secondary ", file_name);
+ return primary ? DONE : OK;
+ }
+ }
+
+ return OK;
+}
+
+int modsec_open_logs(apr_pool_t *pconf, apr_pool_t *p, apr_pool_t *ptemp, server_rec *s_main) {
+ directory_config *dcfg = ap_get_module_config(s_main->lookup_defaults, &security2_module);
+
+ int primary_log_rc = open_audit_log(dcfg->auditlog_name, 1,
+ &dcfg->auditlog_fd, &dcfg->auditlog_fileperms, p);
+ if (primary_log_rc != OK) {
+ return primary_log_rc;
+ }
+ return open_audit_log(dcfg->auditlog2_name, 0,
+ &dcfg->auditlog2_fd, &dcfg->auditlog_fileperms, p);
+}
diff --git a/apache2/msc_logging.h b/apache2/msc_logging.h
index 5378ddc65..d2e17fe23 100644
--- a/apache2/msc_logging.h
+++ b/apache2/msc_logging.h
@@ -43,6 +43,7 @@
#define AUDITLOG_PART_ENDMARKER 'Z'
#include "modsecurity.h"
+#include "httpd.h"
#include "apr_pools.h"
int DSOLOCAL is_valid_parts_specification(char *p);
@@ -51,4 +52,6 @@ char DSOLOCAL *construct_log_vcombinedus_limited(modsec_rec *msr, int _limit, in
void DSOLOCAL sec_audit_logger(modsec_rec *msr);
+int modsec_open_logs(apr_pool_t *pconf, apr_pool_t *p, apr_pool_t *ptemp, server_rec *s_main);
+
#endif

30
mod_security-2.9.7-send_error_bucket.patch Normal file
View File

@ -0,0 +1,30 @@
From b2fa083522c70368c7ab911696dcb87dde5dc688 Mon Sep 17 00:00:00 2001
From: Tomas Korbar <tkorbar@redhat.com>
Date: Thu, 22 Dec 2022 14:49:34 +0100
Subject: [PATCH] Clear original response code in send_error_bucket function
If this is left intact, then apache thinks that this code
was generated during processing of ErrorDocument and does not
handle it properly
Fix #2849
---
apache2/apache2_util.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/apache2/apache2_util.c b/apache2/apache2_util.c
index cdae2b580..520a30f2f 100644
--- a/apache2/apache2_util.c
+++ b/apache2/apache2_util.c
@@ -31,6 +31,11 @@ apr_status_t send_error_bucket(modsec_rec *msr, ap_filter_t *f, int status) {
/* Set the status line explicitly for the error document */
f->r->status_line = ap_get_status_line(status);
+ /* Clear previously set response code to make clear that this is
+ * not a recursive error
+ */
+ f->r->status = 200;
+
brigade = apr_brigade_create(f->r->pool, f->r->connection->bucket_alloc);
if (brigade == NULL) return APR_EGENERAL;

56
mod_security.conf Normal file
View File

@ -0,0 +1,56 @@
<IfModule mod_security2.c>
# Default recommended configuration
SecRuleEngine On
SecRequestBodyAccess On
SecRule REQUEST_HEADERS:Content-Type "text/xml" \
"id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
SecRequestBodyLimit 13107200
SecRequestBodyNoFilesLimit 131072
SecRequestBodyInMemoryLimit 131072
SecRequestBodyLimitAction Reject
SecRule REQBODY_ERROR "!@eq 0" \
"id:'200001', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2"
SecRule MULTIPART_STRICT_ERROR "!@eq 0" \
"id:'200002',phase:2,t:none,log,deny,status:400,msg:'Multipart request body \
failed strict validation: \
PE %{REQBODY_PROCESSOR_ERROR}, \
BQ %{MULTIPART_BOUNDARY_QUOTED}, \
BW %{MULTIPART_BOUNDARY_WHITESPACE}, \
DB %{MULTIPART_DATA_BEFORE}, \
DA %{MULTIPART_DATA_AFTER}, \
HF %{MULTIPART_HEADER_FOLDING}, \
LF %{MULTIPART_LF_LINE}, \
SM %{MULTIPART_MISSING_SEMICOLON}, \
IQ %{MULTIPART_INVALID_QUOTING}, \
IP %{MULTIPART_INVALID_PART}, \
IH %{MULTIPART_INVALID_HEADER_FOLDING}, \
FL %{MULTIPART_FILE_LIMIT_EXCEEDED}'"
SecRule MULTIPART_UNMATCHED_BOUNDARY "!@eq 0" \
"id:'200003',phase:2,t:none,log,deny,status:44,msg:'Multipart parser detected a possible unmatched boundary.'"
SecPcreMatchLimit 1000
SecPcreMatchLimitRecursion 1000
SecRule TX:/^MSC_/ "!@streq 0" \
"id:'200004',phase:2,t:none,deny,msg:'ModSecurity internal error flagged: %{MATCHED_VAR_NAME}'"
SecResponseBodyAccess Off
SecDebugLog /var/log/httpd/modsec_debug.log
SecDebugLogLevel 0
SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4(?!04))"
SecAuditLogParts ABIJDEFHZ
SecAuditLogType Serial
SecAuditLog /var/log/httpd/modsec_audit.log
SecArgumentSeparator &
SecCookieFormat 0
SecTmpDir /var/lib/mod_security
SecDataDir /var/lib/mod_security
# ModSecurity Core Rules Set and Local configuration
Include modsecurity.d/*.conf
Include modsecurity.d/activated_rules/*.conf
Include modsecurity.d/local_rules/*.conf
</IfModule>

155
mod_security.spec Normal file
View File

@ -0,0 +1,155 @@
%{!?_httpd_apxs: %{expand: %%global _httpd_apxs %%{_sbindir}/apxs}}
%{!?_httpd_mmn: %{expand: %%global _httpd_mmn %%(cat %{_includedir}/httpd/.mmn || echo 0-0)}}
# /etc/httpd/conf.d with httpd < 2.4 and defined as /etc/httpd/conf.modules.d with httpd >= 2.4
%{!?_httpd_modconfdir: %{expand: %%global _httpd_modconfdir %%{_sysconfdir}/httpd/conf.d}}
%{!?_httpd_confdir: %{expand: %%global _httpd_confdir %%{_sysconfdir}/httpd/conf.d}}
%{!?_httpd_moddir: %{expand: %%global _httpd_moddir %%{_libdir}/httpd/modules}}
%bcond_without mlogc
%bcond ssdeep %{undefined rhel}
%bcond yajl %[0%{?rhel} < 10]
Summary: Security module for the Apache HTTP Server
Name: mod_security
Version: 2.9.14
Release: 1%{?dist}
License: Apache-2.0
URL: http://www.modsecurity.org/
Source: https://github.com/owasp-modsecurity/ModSecurity/releases/download/v%{version}/modsecurity-v%{version}.tar.gz
Source1: mod_security.conf
Source2: 10-mod_security.conf
Source3: modsecurity_localrules.conf
Patch1: modsecurity-2.9.3-apulibs.patch
Patch2: mod_security-2.9.3-remote-rules-timeout.patch
Patch3: mod_security-2.9.7-send_error_bucket.patch
Patch4: mod_security-2.9.7-pipedlogs.patch
# Security patches
# Patch100: mod_security-2.9.13-.....patch
Requires: httpd httpd-mmn = %{_httpd_mmn}
%if 0%{?fedora} || 0%{?rhel} > 7
# Ensure apache user exists for file ownership
Requires(pre): httpd-filesystem
%endif
BuildRequires: gcc, make, autoconf, automake, libtool, git-core
BuildRequires: httpd-devel
BuildRequires: perl-generators
BuildRequires: pcre2-devel
BuildRequires: pkgconfig(libcurl)
BuildRequires: pkgconfig(libxml-2.0)
BuildRequires: pkgconfig(lua)
BuildRequires: libxcrypt-devel
%if %{with ssdeep}
BuildRequires: ssdeep-devel
%endif
%if %{with yajl}
BuildRequires: pkgconfig(yajl)
%endif
%description
ModSecurity is an open source intrusion detection and prevention engine
for web applications. It operates embedded into the web server, acting
as a powerful umbrella - shielding web applications from attacks.
%if %{with mlogc}
%package mlogc
Summary: ModSecurity Audit Log Collector
Requires: mod_security
%if 0%{?fedora} || 0%{?rhel} > 7
# Ensure apache user exists for file ownership
Requires(pre): httpd-filesystem
%endif
%description mlogc
This package contains the ModSecurity Audit Log Collector.
%endif
%prep
%autosetup -p1 -n modsecurity-v%{version} -S git
: Building with YAJL=%{with yajl} ssdeep=%{with ssdeep}
%build
./autogen.sh
%configure --enable-pcre-match-limit=1000000 \
--enable-pcre-match-limit-recursion=1000000 \
--with-apxs=%{_httpd_apxs} \
--with-yajl \
--with-pcre2 \
--disable-static
# remove rpath
sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool
sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
make %{_smp_mflags}
%check
# Test suite does not start because of some issue in shipped httpd config (fix upstreamed in PR #669)
# After the fix, the test suite starts but still fails
#make test
#make test-regression
%install
install -d %{buildroot}%{_sbindir}
install -d %{buildroot}%{_bindir}
install -d %{buildroot}%{_httpd_moddir}
install -d %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/
install -d %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/activated_rules
install -d %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/local_rules
install -m0755 apache2/.libs/mod_security2.so %{buildroot}%{_httpd_moddir}/mod_security2.so
%if "%{_httpd_modconfdir}" != "%{_httpd_confdir}"
# 2.4-style
install -Dp -m0644 %{SOURCE2} %{buildroot}%{_httpd_modconfdir}/10-mod_security.conf
install -Dp -m0644 %{SOURCE1} %{buildroot}%{_httpd_confdir}/mod_security.conf
sed -i 's/Include/IncludeOptional/' %{buildroot}%{_httpd_confdir}/mod_security.conf
%else
# 2.2-style
install -d -m0755 %{buildroot}%{_httpd_confdir}
cat %{SOURCE2} %{SOURCE1} > %{buildroot}%{_httpd_confdir}/mod_security.conf
%endif
install -m 700 -d $RPM_BUILD_ROOT%{_localstatedir}/lib/%{name}
# Local rules example
install -Dp -m0644 %{SOURCE3} %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/local_rules/
# mlogc
%if %{with mlogc}
install -d %{buildroot}%{_localstatedir}/log/mlogc
install -d %{buildroot}%{_localstatedir}/log/mlogc/data
install -m0755 mlogc/mlogc %{buildroot}%{_bindir}/mlogc
install -m0755 mlogc/mlogc-batch-load.pl %{buildroot}%{_bindir}/mlogc-batch-load
install -m0644 mlogc/mlogc-default.conf %{buildroot}%{_sysconfdir}/mlogc.conf
%endif
%files
%doc CHANGES LICENSE README.* NOTICE
%{_httpd_moddir}/mod_security2.so
%config(noreplace) %{_httpd_confdir}/*.conf
%if "%{_httpd_modconfdir}" != "%{_httpd_confdir}"
%config(noreplace) %{_httpd_modconfdir}/*.conf
%endif
%dir %{_sysconfdir}/httpd/modsecurity.d
%dir %{_sysconfdir}/httpd/modsecurity.d/activated_rules
%dir %{_sysconfdir}/httpd/modsecurity.d/local_rules
%config(noreplace) %{_sysconfdir}/httpd/modsecurity.d/local_rules/*.conf
%attr(770,apache,root) %dir %{_localstatedir}/lib/%{name}
%if %{with mlogc}
%files mlogc
%doc mlogc/INSTALL
%attr(0640,root,apache) %config(noreplace) %{_sysconfdir}/mlogc.conf
%attr(0755,root,root) %dir %{_localstatedir}/log/mlogc
%attr(0770,root,apache) %dir %{_localstatedir}/log/mlogc/data
%attr(0755,root,root) %{_bindir}/mlogc
%attr(0755,root,root) %{_bindir}/mlogc-batch-load
%endif
%changelog
* Wed Jul 22 2026 Luboš Uhliarik <luhliari@redhat.com> - 2.9.14-1
- Resolves: RHEL-172046 - add mod_security

14
modsecurity-2.9.3-apulibs.patch Normal file
View File

@ -0,0 +1,14 @@
Strip redundant APR-util dependent libraries, it is sufficient to link against -laprutil-1.
--- modsecurity-2.9.3/build/find_apu.m4.apulibs
+++ modsecurity-2.9.3/build/find_apu.m4
@@ -59,7 +59,7 @@
APU_CFLAGS="`${APU_CONFIG} --includes`"
if test "$verbose_output" -eq 1; then AC_MSG_NOTICE(apu CFLAGS: $APU_CFLAGS); fi
APU_LDFLAGS="`${APU_CONFIG} --ldflags`"
- APU_LDFLAGS="$APU_LDFLAGS `${APU_CONFIG} --libs`"
+ APU_LDFLAGS="$APU_LDFLAGS `${APU_CONFIG} --avoid-ldap --avoid-dbm --libs`"
if test "$verbose_output" -eq 1; then AC_MSG_NOTICE(apu LDFLAGS: $APU_LDFLAGS); fi
APU_LDADD="`${APU_CONFIG} --link-libtool`"
if test "$verbose_output" -eq 1; then AC_MSG_NOTICE(apu LDADD: $APU_LDADD); fi

9
modsecurity_localrules.conf Normal file
View File

@ -0,0 +1,9 @@
# User defined rules and settings .
#
# You can use this file/directory to drop your local rules or
# to remove some rules provided by mod_security_crs package with SecRuleRemoveById
#
# You can also disable mod_security for some incompatible web applications (eg. phpMyAdmin).
#
#

9
plans.fmf Normal file
View File

@ -0,0 +1,9 @@
/appstream:
adjust:
- enabled: false
when: distro == centos-stream-10
because: "These tests should not run on CentOS Stream 10"
plan:
import:
url: https://gitlab.com/redhat/rhel/tests/mod_security.git
name: "/plans/mod_security$"

5
rpminspect.yaml Normal file
View File

@ -0,0 +1,5 @@
badfuncs:
allowed:
'/usr/lib*/httpd/modules/mod_security2.so':
- gethostbyname
- inet_ntoa

1
sources Normal file
View File

@ -0,0 +1 @@
SHA512 (modsecurity-v2.9.14.tar.gz) = 788acc877295daa82d8e1aed7845e904194e54fda66ee5f6c24e57b2d9cf073feff124048942f1551ea1730e3d288818c57f6db27ea2b2c21d841267680535ff