From 445934f4016cb462a57c53a1b72baebdac8eca93 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Thu, 23 Jul 2026 20:54:45 +0200 Subject: [PATCH] Resolves: RHEL-188069 - add mod_security_crs --- .fmf/version | 1 + README.md | 3 -- dead.package | 1 - gating.yaml | 6 ++++ mod_security_crs.spec | 72 +++++++++++++++++++++++++++++++++++++++++++ plans.fmf | 9 ++++++ sources | 1 + 7 files changed, 89 insertions(+), 4 deletions(-) create mode 100644 .fmf/version delete mode 100644 README.md delete mode 100644 dead.package create mode 100644 gating.yaml create mode 100644 mod_security_crs.spec create mode 100644 plans.fmf create mode 100644 sources diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/README.md b/README.md deleted file mode 100644 index 24b9ea2..0000000 --- a/README.md +++ /dev/null @@ -1,3 +0,0 @@ -# Package Not Available -This package is not available on CentOS Stream 10. -It may be available on another branch. \ No newline at end of file diff --git a/dead.package b/dead.package deleted file mode 100644 index f5b9b71..0000000 --- a/dead.package +++ /dev/null @@ -1 +0,0 @@ -mod_security_crs package is retired on branch c10s for CS-2551 \ No newline at end of file diff --git a/gating.yaml b/gating.yaml new file mode 100644 index 0000000..034ef0d --- /dev/null +++ b/gating.yaml @@ -0,0 +1,6 @@ +--- !Policy +product_versions: + - rhel-* +decision_context: osci_compose_gate +rules: + - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/appstream.functional} diff --git a/mod_security_crs.spec b/mod_security_crs.spec new file mode 100644 index 0000000..3f3de64 --- /dev/null +++ b/mod_security_crs.spec @@ -0,0 +1,72 @@ +%{!?_httpd_confdir: %{expand: %%global _httpd_confdir %%{_sysconfdir}/httpd/conf.d}} + +Summary: ModSecurity Core Ruleset +Name: mod_security_crs +Version: 4.22.0 +Release: 1%{?dist} +License: Apache-2.0 +URL: https://coreruleset.org/ +Source: https://github.com/coreruleset/coreruleset/archive/refs/tags/v%{version}.tar.gz +BuildArch: noarch +Requires: mod_security >= 2.9.6 +Obsoletes: mod_security_crs-extras < 3.0.0 + +# Patch0: mod_security_crs-XXX.patch + +%description +This package provides the base rules for mod_security. + +%prep +%autosetup -p1 -S gendiff -n coreruleset-%{version} + +%build + +%install +%{__install} -d %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/ +%{__install} -d %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/activated_rules +%{__install} -d %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/plugins +%{__install} -d %{buildroot}%{_datarootdir}/mod_modsecurity_crs/rules +%{__install} -d %{buildroot}%{_datarootdir}/mod_modsecurity_crs/plugins + +%{__mv} rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/activated_rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf +%{__mv} rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/activated_rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf + +%{__install} -m0644 rules/*.conf %{buildroot}%{_datarootdir}/mod_modsecurity_crs/rules/ +%{__install} -m0644 rules/*.data %{buildroot}%{_datarootdir}/mod_modsecurity_crs/rules/ +%{__install} -m0644 plugins/* %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/plugins/ +%{__mv} crs-setup.conf.example %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/crs-setup.conf + +%post +if [ $1 == 1 ]; then + # activate base_rules + for f in `ls %{_datarootdir}/mod_modsecurity_crs/rules/` ; do + %{__ln_s} %{_datarootdir}/mod_modsecurity_crs/rules/$f %{_sysconfdir}/httpd/modsecurity.d/activated_rules/$f; + done + %{__sed} -i '/IncludeOptional modsecurity\.d\/\*\.conf/ a\ IncludeOptional modsecurity.d\/plugins\/*-config.conf\n IncludeOptional modsecurity.d\/plugins\/*-before.conf' %{_httpd_confdir}/mod_security.conf + %{__sed} -i '/Include modsecurity\.d\/\*\.conf/a\ Include modsecurity.d/plugins/*-config.conf\n Include modsecurity.d/plugins/*-before.conf' %{_httpd_confdir}/mod_security.conf + %{__sed} -i '/IncludeOptional modsecurity\.d\/local_rules\/\*\.conf/a\ IncludeOptional modsecurity.d\/plugins\/*-after.conf' %{_httpd_confdir}/mod_security.conf + %{__sed} -i '/Include modsecurity\.d\/local_rules\/\*\.conf/a\ Include modsecurity.d\/plugins\/*-after.conf' %{_httpd_confdir}/mod_security.conf +fi +exit 0 + +%preun +if [ $1 == 0 ]; then + %{__sed} -i -E '/Include(Optional)? modsecurity\.d\/plugins/d' %{_httpd_confdir}/mod_security.conf + for f in `ls %{_datarootdir}/mod_modsecurity_crs/rules/` ; do + %{__rm} %{_sysconfdir}/httpd/modsecurity.d/activated_rules/$f; + done +fi +exit 0 + +%files +%license LICENSE +%doc CHANGES.md README.md +%{_datarootdir}/mod_modsecurity_crs +%{_sysconfdir}/httpd/modsecurity.d/plugins +%config(noreplace) %{_sysconfdir}/httpd/modsecurity.d/activated_rules/* +%config(noreplace) %{_sysconfdir}/httpd/modsecurity.d/crs-setup.conf +%config(noreplace) %{_sysconfdir}/httpd/modsecurity.d/plugins/* + +%changelog +* Thu Jul 23 2026 Luboš Uhliarik - 4.22.0-1 +- Resolves: RHEL-188069 - add mod_security_crs diff --git a/plans.fmf b/plans.fmf new file mode 100644 index 0000000..2d49cff --- /dev/null +++ b/plans.fmf @@ -0,0 +1,9 @@ +/appstream: + adjust: + - enabled: false + when: distro == centos-stream-10 + because: "These tests should not run on CentOS Stream 10" + plan: + import: + url: https://gitlab.com/redhat/rhel/tests/mod_security.git + name: "/plans/mod_security$" diff --git a/sources b/sources new file mode 100644 index 0000000..8efca5e --- /dev/null +++ b/sources @@ -0,0 +1 @@ +SHA512 (v4.22.0.tar.gz) = 7ebb49b38d3a31ffdb0acda7834c3dd73afde4ba07ee4799a43fd800583d0205040946de75e2e2b855d9deb7e687fd0a679250592423a8172991deb21eae34b2