From e03cd8aaa5c0889efab2188d48b2756218d8e119 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Wed, 22 Jul 2026 15:01:47 +0200 Subject: [PATCH] Resolves: RHEL-172046 - add mod_security --- .fmf/version | 1 + .gitignore | 1 + 10-mod_security.conf | 5 + README.md | 3 - dead.package | 1 - gating.yaml | 6 + mod_security-2.9.3-remote-rules-timeout.patch | 83 ++++++++ mod_security-2.9.7-pipedlogs.patch | 192 ++++++++++++++++++ mod_security-2.9.7-send_error_bucket.patch | 30 +++ mod_security.conf | 56 +++++ mod_security.spec | 155 ++++++++++++++ modsecurity-2.9.3-apulibs.patch | 14 ++ modsecurity_localrules.conf | 9 + plans.fmf | 9 + rpminspect.yaml | 5 + sources | 1 + 16 files changed, 567 insertions(+), 4 deletions(-) create mode 100644 .fmf/version create mode 100644 .gitignore create mode 100644 10-mod_security.conf delete mode 100644 README.md delete mode 100644 dead.package create mode 100644 gating.yaml create mode 100644 mod_security-2.9.3-remote-rules-timeout.patch create mode 100644 mod_security-2.9.7-pipedlogs.patch create mode 100644 mod_security-2.9.7-send_error_bucket.patch create mode 100644 mod_security.conf create mode 100644 mod_security.spec create mode 100644 modsecurity-2.9.3-apulibs.patch create mode 100644 modsecurity_localrules.conf create mode 100644 plans.fmf create mode 100644 rpminspect.yaml create mode 100644 sources diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..7c2856c --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +/modsecurity-v2.9.14.tar.gz diff --git a/10-mod_security.conf b/10-mod_security.conf new file mode 100644 index 0000000..dfe0955 --- /dev/null +++ b/10-mod_security.conf @@ -0,0 +1,5 @@ +LoadModule security2_module modules/mod_security2.so + + + LoadModule unique_id_module modules/mod_unique_id.so + diff --git a/README.md b/README.md deleted file mode 100644 index 24b9ea2..0000000 --- a/README.md +++ /dev/null @@ -1,3 +0,0 @@ -# Package Not Available -This package is not available on CentOS Stream 10. -It may be available on another branch. \ No newline at end of file diff --git a/dead.package b/dead.package deleted file mode 100644 index f15568c..0000000 --- a/dead.package +++ /dev/null @@ -1 +0,0 @@ -mod_security package is retired on branch c10s for CS-2551 \ No newline at end of file diff --git a/gating.yaml b/gating.yaml new file mode 100644 index 0000000..034ef0d --- /dev/null +++ b/gating.yaml @@ -0,0 +1,6 @@ +--- !Policy +product_versions: + - rhel-* +decision_context: osci_compose_gate +rules: + - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/appstream.functional} diff --git a/mod_security-2.9.3-remote-rules-timeout.patch b/mod_security-2.9.3-remote-rules-timeout.patch new file mode 100644 index 0000000..cddae98 --- /dev/null +++ b/mod_security-2.9.3-remote-rules-timeout.patch @@ -0,0 +1,83 @@ +diff --git a/apache2/apache2_config.c b/apache2/apache2_config.c +index ca21893..26870a2 100644 +--- a/apache2/apache2_config.c ++++ b/apache2/apache2_config.c +@@ -2690,6 +2690,22 @@ static const char *cmd_remote_rules(cmd_parms *cmd, void *_dcfg, const char *p1, + return NULL; + } + ++static const char *cmd_remote_timeout(cmd_parms *cmd, void *_dcfg, const char *p1) ++{ ++ directory_config *dcfg = (directory_config *)_dcfg; ++ long int timeout; ++ ++ if (dcfg == NULL) return NULL; ++ ++ timeout = strtol(p1, NULL, 10); ++ if ((timeout == LONG_MAX)||(timeout == LONG_MIN)||(timeout < 0)) { ++ return apr_psprintf(cmd->pool, "ModSecurity: Invalid value for SecRemoteTimeout: %s", p1); ++ } ++ ++ remote_rules_timeout = timeout; ++ ++ return NULL; ++} + + static const char *cmd_status_engine(cmd_parms *cmd, void *_dcfg, const char *p1) + { +@@ -4215,6 +4231,14 @@ const command_rec module_directives[] = { + "Abort or Warn" + ), + ++ AP_INIT_TAKE1 ( ++ "SecRemoteTimeout", ++ cmd_remote_timeout, ++ NULL, ++ CMD_SCOPE_ANY, ++ "timeout in seconds" ++ ), ++ + + AP_INIT_TAKE1 ( + "SecXmlExternalEntity", +diff --git a/apache2/mod_security2.c b/apache2/mod_security2.c +index 1850191..1df6f0b 100644 +--- a/apache2/mod_security2.c ++++ b/apache2/mod_security2.c +@@ -77,6 +77,8 @@ msc_remote_rules_server DSOLOCAL *remote_rules_server = NULL; + #endif + int DSOLOCAL remote_rules_fail_action = REMOTE_RULES_ABORT_ON_FAIL; + char DSOLOCAL *remote_rules_fail_message = NULL; ++unsigned long int DSOLOCAL remote_rules_timeout = NOT_SET; ++ + + int DSOLOCAL status_engine_state = STATUS_ENGINE_DISABLED; + +diff --git a/apache2/modsecurity.h b/apache2/modsecurity.h +index d1aa1d8..134ed86 100644 +--- a/apache2/modsecurity.h ++++ b/apache2/modsecurity.h +@@ -154,6 +154,7 @@ extern DSOLOCAL msc_remote_rules_server *remote_rules_server; + #endif + extern DSOLOCAL int remote_rules_fail_action; + extern DSOLOCAL char *remote_rules_fail_message; ++extern DSOLOCAL unsigned long int remote_rules_timeout; + + extern DSOLOCAL int status_engine_state; + +diff --git a/apache2/msc_remote_rules.c b/apache2/msc_remote_rules.c +index 37b8864..12890a2 100644 +--- a/apache2/msc_remote_rules.c ++++ b/apache2/msc_remote_rules.c +@@ -358,6 +358,11 @@ int msc_remote_download_content(apr_pool_t *mp, const char *uri, const char *key + /* We want Curl to return error in case there is an HTTP error code */ + curl_easy_setopt(curl, CURLOPT_FAILONERROR, 1); + ++ /* In case we want different timeout than a default one */ ++ if (remote_rules_timeout != NOT_SET){ ++ curl_easy_setopt(curl, CURLOPT_TIMEOUT, remote_rules_timeout); ++ } ++ + res = curl_easy_perform(curl); + + if (res != CURLE_OK) diff --git a/mod_security-2.9.7-pipedlogs.patch b/mod_security-2.9.7-pipedlogs.patch new file mode 100644 index 0000000..ad61d5b --- /dev/null +++ b/mod_security-2.9.7-pipedlogs.patch @@ -0,0 +1,192 @@ + +https://github.com/owasp-modsecurity/ModSecurity/pull/2823 + +From bec33810e95ac9ae4d05c74a7fd8cedb61224ca2 Mon Sep 17 00:00:00 2001 +From: Tomas Korbar +Date: Wed, 9 Oct 2024 14:39:14 +0200 +Subject: [PATCH] Move log opening to appropriate execution phase + +When piped logs are opened during parsing of configuration +it results in unexpected situations in apache httpd +and can cause hang of process which is trying to log +into auditlog. + +Code should work as before, with the exception of +one additional condition evaluation when primary +audit log is not set and secondary audit log +path to piped executable is now not relative +to server root. +--- + apache2/apache2_config.c | 58 ---------------------------------------- + apache2/mod_security2.c | 1 + + apache2/msc_logging.c | 52 +++++++++++++++++++++++++++++++++++ + apache2/msc_logging.h | 3 +++ + 4 files changed, 56 insertions(+), 58 deletions(-) + +diff --git a/apache2/apache2_config.c b/apache2/apache2_config.c +index da10b4bfe..8c2ebe3ba 100644 +--- a/apache2/apache2_config.c ++++ b/apache2/apache2_config.c +@@ -1239,35 +1239,6 @@ static const char *cmd_audit_log(cmd_parms *cmd, void *_dcfg, const char *p1) + directory_config *dcfg = _dcfg; + + dcfg->auditlog_name = (char *)p1; +- +- if (dcfg->auditlog_name[0] == '|') { +- const char *pipe_name = dcfg->auditlog_name + 1; +- piped_log *pipe_log; +- +- pipe_log = ap_open_piped_log(cmd->pool, pipe_name); +- if (pipe_log == NULL) { +- return apr_psprintf(cmd->pool, "ModSecurity: Failed to open the audit log pipe: %s", +- pipe_name); +- } +- dcfg->auditlog_fd = ap_piped_log_write_fd(pipe_log); +- } +- else { +- const char *file_name = ap_server_root_relative(cmd->pool, dcfg->auditlog_name); +- apr_status_t rc; +- +- if (dcfg->auditlog_fileperms == NOT_SET) { +- dcfg->auditlog_fileperms = CREATEMODE; +- } +- rc = apr_file_open(&dcfg->auditlog_fd, file_name, +- APR_WRITE | APR_APPEND | APR_CREATE | APR_BINARY, +- dcfg->auditlog_fileperms, cmd->pool); +- +- if (rc != APR_SUCCESS) { +- return apr_psprintf(cmd->pool, "ModSecurity: Failed to open the audit log file: %s", +- file_name); +- } +- } +- + return NULL; + } + +@@ -1283,35 +1254,6 @@ static const char *cmd_audit_log2(cmd_parms *cmd, void *_dcfg, const char *p1) + } + + dcfg->auditlog2_name = (char *)p1; +- +- if (dcfg->auditlog2_name[0] == '|') { +- const char *pipe_name = ap_server_root_relative(cmd->pool, dcfg->auditlog2_name + 1); +- piped_log *pipe_log; +- +- pipe_log = ap_open_piped_log(cmd->pool, pipe_name); +- if (pipe_log == NULL) { +- return apr_psprintf(cmd->pool, "ModSecurity: Failed to open the secondary audit log pipe: %s", +- pipe_name); +- } +- dcfg->auditlog2_fd = ap_piped_log_write_fd(pipe_log); +- } +- else { +- const char *file_name = ap_server_root_relative(cmd->pool, dcfg->auditlog2_name); +- apr_status_t rc; +- +- if (dcfg->auditlog_fileperms == NOT_SET) { +- dcfg->auditlog_fileperms = CREATEMODE; +- } +- rc = apr_file_open(&dcfg->auditlog2_fd, file_name, +- APR_WRITE | APR_APPEND | APR_CREATE | APR_BINARY, +- dcfg->auditlog_fileperms, cmd->pool); +- +- if (rc != APR_SUCCESS) { +- return apr_psprintf(cmd->pool, "ModSecurity: Failed to open the secondary audit log file: %s", +- file_name); +- } +- } +- + return NULL; + } + +diff --git a/apache2/mod_security2.c b/apache2/mod_security2.c +index 1850191eb..e257978b8 100644 +--- a/apache2/mod_security2.c ++++ b/apache2/mod_security2.c +@@ -1735,6 +1735,7 @@ static void register_hooks(apr_pool_t *mp) { + + /* Logging */ + ap_hook_error_log(hook_error_log, NULL, NULL, APR_HOOK_MIDDLE); ++ ap_hook_open_logs(modsec_open_logs, NULL, NULL, APR_HOOK_MIDDLE); + ap_hook_log_transaction(hook_log_transaction, NULL, transaction_afterme_list, APR_HOOK_MIDDLE); + + /* Filter hooks */ +diff --git a/apache2/msc_logging.c b/apache2/msc_logging.c +index 39588b10f..b07732adb 100644 +--- a/apache2/msc_logging.c ++++ b/apache2/msc_logging.c +@@ -2316,3 +2316,55 @@ void sec_audit_logger(modsec_rec *msr) { + } + #endif + } ++ ++static int open_audit_log(char *auditlog_name, unsigned char primary, apr_file_t **auditlog_fd, ++ apr_fileperms_t *auditlog_fileperms, apr_pool_t *p) { ++ if (auditlog_name == NOT_SET_P) { ++ return OK; ++ } ++ if (auditlog_name[0] == '|') { ++ const char *pipe_name = auditlog_name + 1; ++ piped_log *pipe_log; ++ ++ pipe_log = ap_open_piped_log(p, pipe_name); ++ if (pipe_log == NULL) { ++ ap_log_error(APLOG_MARK, APLOG_ERR, 0, NULL, ++ "ModSecurity: Failed to open the %saudit log pipe: %s", ++ primary ? "" : "secondary ", pipe_name); ++ return primary ? DONE : OK; ++ } ++ *auditlog_fd = ap_piped_log_write_fd(pipe_log); ++ } ++ else { ++ const char *file_name = ap_server_root_relative(p, auditlog_name); ++ apr_status_t rc; ++ ++ if (*auditlog_fileperms == NOT_SET) { ++ *auditlog_fileperms = CREATEMODE; ++ } ++ rc = apr_file_open(auditlog_fd, file_name, ++ APR_WRITE | APR_APPEND | APR_CREATE | APR_BINARY, ++ *auditlog_fileperms, p); ++ ++ if (rc != APR_SUCCESS) { ++ ap_log_error(APLOG_MARK, APLOG_ERR, 0, NULL, ++ "ModSecurity: Failed to open the %saudit log file: %s", ++ primary ? "" : "secondary ", file_name); ++ return primary ? DONE : OK; ++ } ++ } ++ ++ return OK; ++} ++ ++int modsec_open_logs(apr_pool_t *pconf, apr_pool_t *p, apr_pool_t *ptemp, server_rec *s_main) { ++ directory_config *dcfg = ap_get_module_config(s_main->lookup_defaults, &security2_module); ++ ++ int primary_log_rc = open_audit_log(dcfg->auditlog_name, 1, ++ &dcfg->auditlog_fd, &dcfg->auditlog_fileperms, p); ++ if (primary_log_rc != OK) { ++ return primary_log_rc; ++ } ++ return open_audit_log(dcfg->auditlog2_name, 0, ++ &dcfg->auditlog2_fd, &dcfg->auditlog_fileperms, p); ++} +diff --git a/apache2/msc_logging.h b/apache2/msc_logging.h +index 5378ddc65..d2e17fe23 100644 +--- a/apache2/msc_logging.h ++++ b/apache2/msc_logging.h +@@ -43,6 +43,7 @@ + #define AUDITLOG_PART_ENDMARKER 'Z' + + #include "modsecurity.h" ++#include "httpd.h" + #include "apr_pools.h" + + int DSOLOCAL is_valid_parts_specification(char *p); +@@ -51,4 +52,6 @@ char DSOLOCAL *construct_log_vcombinedus_limited(modsec_rec *msr, int _limit, in + + void DSOLOCAL sec_audit_logger(modsec_rec *msr); + ++int modsec_open_logs(apr_pool_t *pconf, apr_pool_t *p, apr_pool_t *ptemp, server_rec *s_main); ++ + #endif diff --git a/mod_security-2.9.7-send_error_bucket.patch b/mod_security-2.9.7-send_error_bucket.patch new file mode 100644 index 0000000..7691507 --- /dev/null +++ b/mod_security-2.9.7-send_error_bucket.patch @@ -0,0 +1,30 @@ +From b2fa083522c70368c7ab911696dcb87dde5dc688 Mon Sep 17 00:00:00 2001 +From: Tomas Korbar +Date: Thu, 22 Dec 2022 14:49:34 +0100 +Subject: [PATCH] Clear original response code in send_error_bucket function + +If this is left intact, then apache thinks that this code +was generated during processing of ErrorDocument and does not +handle it properly + +Fix #2849 +--- + apache2/apache2_util.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/apache2/apache2_util.c b/apache2/apache2_util.c +index cdae2b580..520a30f2f 100644 +--- a/apache2/apache2_util.c ++++ b/apache2/apache2_util.c +@@ -31,6 +31,11 @@ apr_status_t send_error_bucket(modsec_rec *msr, ap_filter_t *f, int status) { + /* Set the status line explicitly for the error document */ + f->r->status_line = ap_get_status_line(status); + ++ /* Clear previously set response code to make clear that this is ++ * not a recursive error ++ */ ++ f->r->status = 200; ++ + brigade = apr_brigade_create(f->r->pool, f->r->connection->bucket_alloc); + if (brigade == NULL) return APR_EGENERAL; + diff --git a/mod_security.conf b/mod_security.conf new file mode 100644 index 0000000..e9fe3dd --- /dev/null +++ b/mod_security.conf @@ -0,0 +1,56 @@ + + # Default recommended configuration + SecRuleEngine On + SecRequestBodyAccess On + SecRule REQUEST_HEADERS:Content-Type "text/xml" \ + "id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML" + SecRequestBodyLimit 13107200 + SecRequestBodyNoFilesLimit 131072 + SecRequestBodyInMemoryLimit 131072 + SecRequestBodyLimitAction Reject + SecRule REQBODY_ERROR "!@eq 0" \ + "id:'200001', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2" + SecRule MULTIPART_STRICT_ERROR "!@eq 0" \ + "id:'200002',phase:2,t:none,log,deny,status:400,msg:'Multipart request body \ + failed strict validation: \ + PE %{REQBODY_PROCESSOR_ERROR}, \ + BQ %{MULTIPART_BOUNDARY_QUOTED}, \ + BW %{MULTIPART_BOUNDARY_WHITESPACE}, \ + DB %{MULTIPART_DATA_BEFORE}, \ + DA %{MULTIPART_DATA_AFTER}, \ + HF %{MULTIPART_HEADER_FOLDING}, \ + LF %{MULTIPART_LF_LINE}, \ + SM %{MULTIPART_MISSING_SEMICOLON}, \ + IQ %{MULTIPART_INVALID_QUOTING}, \ + IP %{MULTIPART_INVALID_PART}, \ + IH %{MULTIPART_INVALID_HEADER_FOLDING}, \ + FL %{MULTIPART_FILE_LIMIT_EXCEEDED}'" + + SecRule MULTIPART_UNMATCHED_BOUNDARY "!@eq 0" \ + "id:'200003',phase:2,t:none,log,deny,status:44,msg:'Multipart parser detected a possible unmatched boundary.'" + + SecPcreMatchLimit 1000 + SecPcreMatchLimitRecursion 1000 + + SecRule TX:/^MSC_/ "!@streq 0" \ + "id:'200004',phase:2,t:none,deny,msg:'ModSecurity internal error flagged: %{MATCHED_VAR_NAME}'" + + SecResponseBodyAccess Off + SecDebugLog /var/log/httpd/modsec_debug.log + SecDebugLogLevel 0 + SecAuditEngine RelevantOnly + SecAuditLogRelevantStatus "^(?:5|4(?!04))" + SecAuditLogParts ABIJDEFHZ + SecAuditLogType Serial + SecAuditLog /var/log/httpd/modsec_audit.log + SecArgumentSeparator & + SecCookieFormat 0 + SecTmpDir /var/lib/mod_security + SecDataDir /var/lib/mod_security + + # ModSecurity Core Rules Set and Local configuration + Include modsecurity.d/*.conf + Include modsecurity.d/activated_rules/*.conf + Include modsecurity.d/local_rules/*.conf + + diff --git a/mod_security.spec b/mod_security.spec new file mode 100644 index 0000000..df48e08 --- /dev/null +++ b/mod_security.spec @@ -0,0 +1,155 @@ +%{!?_httpd_apxs: %{expand: %%global _httpd_apxs %%{_sbindir}/apxs}} +%{!?_httpd_mmn: %{expand: %%global _httpd_mmn %%(cat %{_includedir}/httpd/.mmn || echo 0-0)}} +# /etc/httpd/conf.d with httpd < 2.4 and defined as /etc/httpd/conf.modules.d with httpd >= 2.4 +%{!?_httpd_modconfdir: %{expand: %%global _httpd_modconfdir %%{_sysconfdir}/httpd/conf.d}} +%{!?_httpd_confdir: %{expand: %%global _httpd_confdir %%{_sysconfdir}/httpd/conf.d}} +%{!?_httpd_moddir: %{expand: %%global _httpd_moddir %%{_libdir}/httpd/modules}} + +%bcond_without mlogc +%bcond ssdeep %{undefined rhel} +%bcond yajl %[0%{?rhel} < 10] + +Summary: Security module for the Apache HTTP Server +Name: mod_security +Version: 2.9.14 +Release: 1%{?dist} +License: Apache-2.0 +URL: http://www.modsecurity.org/ +Source: https://github.com/owasp-modsecurity/ModSecurity/releases/download/v%{version}/modsecurity-v%{version}.tar.gz +Source1: mod_security.conf +Source2: 10-mod_security.conf +Source3: modsecurity_localrules.conf +Patch1: modsecurity-2.9.3-apulibs.patch +Patch2: mod_security-2.9.3-remote-rules-timeout.patch +Patch3: mod_security-2.9.7-send_error_bucket.patch +Patch4: mod_security-2.9.7-pipedlogs.patch + +# Security patches +# Patch100: mod_security-2.9.13-.....patch + +Requires: httpd httpd-mmn = %{_httpd_mmn} +%if 0%{?fedora} || 0%{?rhel} > 7 +# Ensure apache user exists for file ownership +Requires(pre): httpd-filesystem +%endif + +BuildRequires: gcc, make, autoconf, automake, libtool, git-core +BuildRequires: httpd-devel +BuildRequires: perl-generators +BuildRequires: pcre2-devel +BuildRequires: pkgconfig(libcurl) +BuildRequires: pkgconfig(libxml-2.0) +BuildRequires: pkgconfig(lua) +BuildRequires: libxcrypt-devel +%if %{with ssdeep} +BuildRequires: ssdeep-devel +%endif +%if %{with yajl} +BuildRequires: pkgconfig(yajl) +%endif + +%description +ModSecurity is an open source intrusion detection and prevention engine +for web applications. It operates embedded into the web server, acting +as a powerful umbrella - shielding web applications from attacks. + +%if %{with mlogc} +%package mlogc +Summary: ModSecurity Audit Log Collector +Requires: mod_security +%if 0%{?fedora} || 0%{?rhel} > 7 +# Ensure apache user exists for file ownership +Requires(pre): httpd-filesystem +%endif + +%description mlogc +This package contains the ModSecurity Audit Log Collector. +%endif + +%prep +%autosetup -p1 -n modsecurity-v%{version} -S git + +: Building with YAJL=%{with yajl} ssdeep=%{with ssdeep} + +%build +./autogen.sh +%configure --enable-pcre-match-limit=1000000 \ + --enable-pcre-match-limit-recursion=1000000 \ + --with-apxs=%{_httpd_apxs} \ + --with-yajl \ + --with-pcre2 \ + --disable-static + +# remove rpath +sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool +sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool + +make %{_smp_mflags} + +%check +# Test suite does not start because of some issue in shipped httpd config (fix upstreamed in PR #669) +# After the fix, the test suite starts but still fails +#make test +#make test-regression + +%install +install -d %{buildroot}%{_sbindir} +install -d %{buildroot}%{_bindir} +install -d %{buildroot}%{_httpd_moddir} +install -d %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/ +install -d %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/activated_rules +install -d %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/local_rules + +install -m0755 apache2/.libs/mod_security2.so %{buildroot}%{_httpd_moddir}/mod_security2.so + +%if "%{_httpd_modconfdir}" != "%{_httpd_confdir}" +# 2.4-style +install -Dp -m0644 %{SOURCE2} %{buildroot}%{_httpd_modconfdir}/10-mod_security.conf +install -Dp -m0644 %{SOURCE1} %{buildroot}%{_httpd_confdir}/mod_security.conf +sed -i 's/Include/IncludeOptional/' %{buildroot}%{_httpd_confdir}/mod_security.conf +%else +# 2.2-style +install -d -m0755 %{buildroot}%{_httpd_confdir} +cat %{SOURCE2} %{SOURCE1} > %{buildroot}%{_httpd_confdir}/mod_security.conf +%endif +install -m 700 -d $RPM_BUILD_ROOT%{_localstatedir}/lib/%{name} + +# Local rules example +install -Dp -m0644 %{SOURCE3} %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/local_rules/ + +# mlogc +%if %{with mlogc} +install -d %{buildroot}%{_localstatedir}/log/mlogc +install -d %{buildroot}%{_localstatedir}/log/mlogc/data +install -m0755 mlogc/mlogc %{buildroot}%{_bindir}/mlogc +install -m0755 mlogc/mlogc-batch-load.pl %{buildroot}%{_bindir}/mlogc-batch-load +install -m0644 mlogc/mlogc-default.conf %{buildroot}%{_sysconfdir}/mlogc.conf +%endif + + +%files +%doc CHANGES LICENSE README.* NOTICE +%{_httpd_moddir}/mod_security2.so +%config(noreplace) %{_httpd_confdir}/*.conf +%if "%{_httpd_modconfdir}" != "%{_httpd_confdir}" +%config(noreplace) %{_httpd_modconfdir}/*.conf +%endif +%dir %{_sysconfdir}/httpd/modsecurity.d +%dir %{_sysconfdir}/httpd/modsecurity.d/activated_rules +%dir %{_sysconfdir}/httpd/modsecurity.d/local_rules +%config(noreplace) %{_sysconfdir}/httpd/modsecurity.d/local_rules/*.conf +%attr(770,apache,root) %dir %{_localstatedir}/lib/%{name} + +%if %{with mlogc} +%files mlogc +%doc mlogc/INSTALL +%attr(0640,root,apache) %config(noreplace) %{_sysconfdir}/mlogc.conf +%attr(0755,root,root) %dir %{_localstatedir}/log/mlogc +%attr(0770,root,apache) %dir %{_localstatedir}/log/mlogc/data +%attr(0755,root,root) %{_bindir}/mlogc +%attr(0755,root,root) %{_bindir}/mlogc-batch-load +%endif + +%changelog +* Wed Jul 22 2026 Luboš Uhliarik - 2.9.14-1 +- Resolves: RHEL-172046 - add mod_security diff --git a/modsecurity-2.9.3-apulibs.patch b/modsecurity-2.9.3-apulibs.patch new file mode 100644 index 0000000..bde44bb --- /dev/null +++ b/modsecurity-2.9.3-apulibs.patch @@ -0,0 +1,14 @@ + +Strip redundant APR-util dependent libraries, it is sufficient to link against -laprutil-1. + +--- modsecurity-2.9.3/build/find_apu.m4.apulibs ++++ modsecurity-2.9.3/build/find_apu.m4 +@@ -59,7 +59,7 @@ + APU_CFLAGS="`${APU_CONFIG} --includes`" + if test "$verbose_output" -eq 1; then AC_MSG_NOTICE(apu CFLAGS: $APU_CFLAGS); fi + APU_LDFLAGS="`${APU_CONFIG} --ldflags`" +- APU_LDFLAGS="$APU_LDFLAGS `${APU_CONFIG} --libs`" ++ APU_LDFLAGS="$APU_LDFLAGS `${APU_CONFIG} --avoid-ldap --avoid-dbm --libs`" + if test "$verbose_output" -eq 1; then AC_MSG_NOTICE(apu LDFLAGS: $APU_LDFLAGS); fi + APU_LDADD="`${APU_CONFIG} --link-libtool`" + if test "$verbose_output" -eq 1; then AC_MSG_NOTICE(apu LDADD: $APU_LDADD); fi diff --git a/modsecurity_localrules.conf b/modsecurity_localrules.conf new file mode 100644 index 0000000..983d7df --- /dev/null +++ b/modsecurity_localrules.conf @@ -0,0 +1,9 @@ +# User defined rules and settings . +# +# You can use this file/directory to drop your local rules or +# to remove some rules provided by mod_security_crs package with SecRuleRemoveById +# +# You can also disable mod_security for some incompatible web applications (eg. phpMyAdmin). +# +# + diff --git a/plans.fmf b/plans.fmf new file mode 100644 index 0000000..2d49cff --- /dev/null +++ b/plans.fmf @@ -0,0 +1,9 @@ +/appstream: + adjust: + - enabled: false + when: distro == centos-stream-10 + because: "These tests should not run on CentOS Stream 10" + plan: + import: + url: https://gitlab.com/redhat/rhel/tests/mod_security.git + name: "/plans/mod_security$" diff --git a/rpminspect.yaml b/rpminspect.yaml new file mode 100644 index 0000000..239b859 --- /dev/null +++ b/rpminspect.yaml @@ -0,0 +1,5 @@ +badfuncs: + allowed: + '/usr/lib*/httpd/modules/mod_security2.so': + - gethostbyname + - inet_ntoa \ No newline at end of file diff --git a/sources b/sources new file mode 100644 index 0000000..d0e35b8 --- /dev/null +++ b/sources @@ -0,0 +1 @@ +SHA512 (modsecurity-v2.9.14.tar.gz) = 788acc877295daa82d8e1aed7845e904194e54fda66ee5f6c24e57b2d9cf073feff124048942f1551ea1730e3d288818c57f6db27ea2b2c21d841267680535ff