From fcc53854a76be81fdd715dbbd6085bf1c618bc99 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Mon, 24 Aug 2026 05:39:36 -0400 Subject: [PATCH] import Oracle_OSS mrtg-2.17.10-12.el10_2.1 --- .gitignore | 3 +- mrtg-2.17.10-CVE-2026-72694.patch | 113 +++++++++++++ mrtg-2.17.10.tar.gz.md5 | 1 + mrtg-2.17.4-cfgmaker-ifhighspeed.patch | 8 +- mrtg-configure-c99.patch | 32 ++++ mrtg.crond.in | 1 - mrtg.fc | 16 ++ mrtg.if | 88 ++++++++++ mrtg.service | 2 +- mrtg.spec | 221 ++++++++++++++++++++++--- mrtg.te | 149 +++++++++++++++++ mrtg.tmpfiles | 3 + sources | 3 +- 13 files changed, 609 insertions(+), 31 deletions(-) create mode 100644 mrtg-2.17.10-CVE-2026-72694.patch create mode 100644 mrtg-2.17.10.tar.gz.md5 create mode 100644 mrtg-configure-c99.patch delete mode 100644 mrtg.crond.in create mode 100644 mrtg.fc create mode 100644 mrtg.if create mode 100644 mrtg.te diff --git a/.gitignore b/.gitignore index 7e4f9fb..b8530f0 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1 @@ -/mrtg-2.17.7.tar.gz -/mrtg-2.17.7.tar.gz.md5 +mrtg-2.17.10.tar.gz diff --git a/mrtg-2.17.10-CVE-2026-72694.patch b/mrtg-2.17.10-CVE-2026-72694.patch new file mode 100644 index 0000000..c95a32c --- /dev/null +++ b/mrtg-2.17.10-CVE-2026-72694.patch @@ -0,0 +1,113 @@ +From 3479826b7d4a30b21ccd796fcec093123e97b25e Mon Sep 17 00:00:00 2001 +From: Tobias Oetiker +Date: Tue, 30 Jun 2026 23:34:40 +0200 +Subject: [PATCH] Fix symlink-following chown of pid file in daemon mode + (CWE-59) (#123) + +When mrtg is started as root in daemon mode (--daemon --user), it +created the pid file and chown'ed it to the target user *before* +dropping privileges. Both create_pid()'s `-e`/`open(">...")` and the +subsequent `chown` follow symlinks, so a local attacker who can +pre-place a symlink at the pid path (e.g. a pid file in a writable +directory) could make root chown an arbitrary existing file to the +daemon user, or create a root-owned file at an attacker-chosen path. + +Rather than reorder the privilege drop (which would break the common +case of a root-owned pid directory, where the unprivileged daemon +cannot create the file itself), keep creating the file while +privileged but do it safely: + +- create_pid() refuses symlinks and creates the file with + O_WRONLY|O_CREAT|O_EXCL, closing the symlink-follow / TOCTOU window. +- It chowns the open filehandle (fchown) instead of the path, so the + ownership change cannot be redirected through a swapped-in symlink. + The caller no longer does a separate path-based chown. +- demonize_me()'s later pid write refuses symlinks too. + +Reported by Aisle Research via Vitezslav Crhonek. + +Co-authored-by: Claude Opus 4.8 +--- + bin/mrtg | 8 +++++--- + lib/mrtg2/MRTG_lib.pm | 32 ++++++++++++++++++++++++++------ + 2 files changed, 31 insertions(+), 9 deletions(-) + +diff --git a/bin/mrtg b/bin/mrtg +index ba520ca..3a4efe5 100755 +--- a/bin/mrtg ++++ b/bin/mrtg +@@ -252,9 +252,11 @@ sub main { + + # Run as a daemon, specified on command line (required for FHS compliant daemon) + if (defined $opts{"daemon"}) { +- # Create a pidfile, then chown it so we can use it once we change user +- &create_pid($pidfile); +- chown $uid, $gid, $pidfile; ++ # Create the pidfile securely and, while still privileged, hand it to ++ # the user we are about to become so the daemon can update it later. ++ # create_pid refuses symlinks and chowns the open handle (not the path), ++ # so a hostile pid path cannot be used to chown an arbitrary file. ++ &create_pid($pidfile, $uid, $gid); + } + + ($(,$)) = ($gid,$gid) ; +diff --git a/lib/mrtg2/MRTG_lib.pm b/lib/mrtg2/MRTG_lib.pm +index 1c12f6c..6359b01 100644 +--- a/lib/mrtg2/MRTG_lib.pm ++++ b/lib/mrtg2/MRTG_lib.pm +@@ -16,6 +16,7 @@ package MRTG_lib; + + require 5.005; + use strict; ++use Fcntl qw(O_WRONLY O_CREAT O_EXCL); + use vars qw($OS $SL $PS @EXPORT @ISA $VERSION %timestrpospattern); + + +@@ -1233,14 +1234,31 @@ sub expistr ($) { + return "$wday, $mday $month ".($year+1900)." $hour:$min:$sec GMT"; + } + +-sub create_pid ($) { +- my $pidfile = shift; ++sub create_pid ($;$$) { ++ my ($pidfile, $uid, $gid) = @_; + return if ($OS eq 'NT' ); ++ ++ # Security: refuse to operate on a symlink. When mrtg is started as root ++ # in daemon mode with a writable pid path, an attacker who pre-places a ++ # symlink here could otherwise make us create or chown an arbitrary file ++ # (CWE-59). A plain stat/-e on the path would follow the link, so check ++ # the link itself first. ++ if (-l $pidfile) { ++ warn "refusing to use pid file $pidfile: it is a symbolic link\n"; ++ return; ++ } + return if -e $pidfile; +- if ( open(PIDFILE,">$pidfile")) { +- close PIDFILE; ++ ++ # O_CREAT|O_EXCL creates the file atomically and fails if anything ++ # (including a symlink that was raced in after the check above) already ++ # exists at the path, closing the symlink-follow / TOCTOU window. ++ if ( sysopen(my $fh, $pidfile, O_WRONLY|O_CREAT|O_EXCL, 0644) ) { ++ # chown the open handle (fchown) rather than the path, so the ++ # ownership change cannot be redirected through a swapped-in symlink. ++ chown $uid, $gid, $fh if defined $uid and defined $gid; ++ close $fh; + } else { +- warn "cannot write to $pidfile: $!\n"; ++ warn "cannot create pid file $pidfile: $!\n"; + } + } + +@@ -1286,7 +1304,9 @@ sub demonize_me ($) { + } else { + if (defined $pidfile){ + $main::Cleanfile3 = $pidfile; +- if (open(PIDFILE,">$pidfile")) { ++ if (-l $pidfile) { ++ warn "refusing to write pid file $pidfile: it is a symbolic link\n"; ++ } elsif (open(PIDFILE,">$pidfile")) { + print PIDFILE "$$\n"; + close PIDFILE; + } else { diff --git a/mrtg-2.17.10.tar.gz.md5 b/mrtg-2.17.10.tar.gz.md5 new file mode 100644 index 0000000..3477c5d --- /dev/null +++ b/mrtg-2.17.10.tar.gz.md5 @@ -0,0 +1 @@ +ab1c14acc9af4221f459707339f361b3 mrtg-2.17.10.tar.gz diff --git a/mrtg-2.17.4-cfgmaker-ifhighspeed.patch b/mrtg-2.17.4-cfgmaker-ifhighspeed.patch index 3ec8bf7..0b401f4 100644 --- a/mrtg-2.17.4-cfgmaker-ifhighspeed.patch +++ b/mrtg-2.17.4-cfgmaker-ifhighspeed.patch @@ -1,9 +1,9 @@ -diff -up mrtg-2.17.7/bin/cfgmaker.orig mrtg-2.17.7/bin/cfgmaker ---- mrtg-2.17.7/bin/cfgmaker.orig 2018-08-08 13:14:19.609048676 +0200 -+++ mrtg-2.17.7/bin/cfgmaker 2018-08-08 13:15:17.795102892 +0200 +diff -up mrtg-2.17.10/bin/cfgmaker.orig mrtg-2.17.10/bin/cfgmaker +--- mrtg-2.17.10/bin/cfgmaker.orig 2022-01-20 08:05:38.441966441 +0100 ++++ mrtg-2.17.10/bin/cfgmaker 2022-01-20 08:05:59.947909140 +0100 @@ -224,7 +224,7 @@ sub InterfaceInfo($$$$$) { # maximum value (4,294,967,295) and ifHighSpeed must be used - # to report the interace's speed. For a sub-layer which has + # to report the interface's speed. For a sub-layer which has # no concept of bandwidth, this object should be zero." - if ( (not defined $value) || ($value == 2**32-1) ) { + if ( (not defined $value) || ($value == 2**32-1) || ($value == 2**32-2)) { diff --git a/mrtg-configure-c99.patch b/mrtg-configure-c99.patch new file mode 100644 index 0000000..bc0831c --- /dev/null +++ b/mrtg-configure-c99.patch @@ -0,0 +1,32 @@ +Avoid an implicit declaration of exit. This prevents compilation +failures in case compilers switch to rejecting implicit function +declarations by default. + +Submitted upstream: + +diff --git a/configure b/configure +index 07b0fbda88c3847a..8b87d2750822c02b 100755 +--- a/configure ++++ b/configure +@@ -3670,7 +3670,7 @@ else + char buffer[1000]; + sprintf (buffer, "%${format}u", a); + sscanf (buffer, "%${format}u", &b); +- exit (b!=a); ++ return b!=a; + } + + _ACEOF +diff --git a/configure.ac b/configure.ac +index 1416f3c2d6e2f645..939725ccf306fb2f 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -37,7 +37,7 @@ AC_CACHE_VAL(mr_cv_long_long_format_specifier,[ + char buffer[1000]; + sprintf (buffer, "%${format}u", a); + sscanf (buffer, "%${format}u", &b); +- exit (b!=a); ++ return b!=a; + } + ]])],[mr_cv_long_long_format_specifier="%${format}d" + mr_cv_long_long_format="${format}d" diff --git a/mrtg.crond.in b/mrtg.crond.in deleted file mode 100644 index 94bc38f..0000000 --- a/mrtg.crond.in +++ /dev/null @@ -1 +0,0 @@ -*/5 * * * * root LANG=C LC_ALL=C @bindir@/mrtg @sysconfdir@/mrtg/mrtg.cfg --lock-file @localstatedir@/lock/mrtg/mrtg_l --confcache-file @localstatedir@/lib/mrtg/mrtg.ok diff --git a/mrtg.fc b/mrtg.fc new file mode 100644 index 0000000..340735d --- /dev/null +++ b/mrtg.fc @@ -0,0 +1,16 @@ +/etc/mrtg.* gen_context(system_u:object_r:mrtg_etc_t,s0) +/etc/mrtg/mrtg\.ok -- gen_context(system_u:object_r:mrtg_lock_t,s0) + +/etc/rc\.d/init\.d/mrtg -- gen_context(system_u:object_r:mrtg_initrc_exec_t,s0) + +/usr/bin/mrtg -- gen_context(system_u:object_r:mrtg_exec_t,s0) + +/var/lib/mrtg(/.*)? gen_context(system_u:object_r:mrtg_var_lib_t,s0) + +/var/lock/mrtg(/.*)? gen_context(system_u:object_r:mrtg_lock_t,s0) +/var/lock/mrtg-rrd(/.*)? gen_context(system_u:object_r:mrtg_lock_t,s0) +/var/lock/subsys/mrtg -- gen_context(system_u:object_r:mrtg_lock_t,s0) + +/var/log/mrtg.* gen_context(system_u:object_r:mrtg_log_t,s0) + +/var/run/mrtg\.pid -- gen_context(system_u:object_r:mrtg_var_run_t,s0) diff --git a/mrtg.if b/mrtg.if new file mode 100644 index 0000000..2346458 --- /dev/null +++ b/mrtg.if @@ -0,0 +1,88 @@ +## Network traffic graphing. + +######################################## +## +## Read mrtg lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`mrtg_read_lib_files',` + gen_require(` + type mrtg_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, mrtg_var_lib_t, mrtg_var_lib_t) +') + +######################################## +## +## Create and append mrtg log files. +## +## +## +## Domain allowed access. +## +## +# +interface(`mrtg_append_create_logs',` + gen_require(` + type mrtg_log_t; + ') + + logging_search_logs($1) + append_files_pattern($1, mrtg_log_t, mrtg_log_t) + create_files_pattern($1, mrtg_log_t, mrtg_log_t) +') + +######################################## +## +## All of the rules required to +## administrate an mrtg environment. +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`mrtg_admin',` + gen_require(` + type mrtg_t, mrtg_var_run_t, mrtg_initrc_exec_t; + type mrtg_var_lib_t, mrtg_lock_t, mrtg_log_t; + type mrtg_etc_t; + ') + + allow $1 mrtg_t:process { ptrace signal_perms }; + ps_process_pattern($1, mrtg_t) + + init_labeled_script_domtrans($1, mrtg_initrc_exec_t) + domain_system_change_exemption($1) + role_transition $2 mrtg_initrc_exec_t system_r; + allow $2 system_r; + + files_search_etc($1) + admin_pattern($1, mrtg_etc_t) + + files_search_locks($1) + admin_pattern($1, mrtg_lock_t) + + logging_search_logs($1) + admin_pattern($1, mrtg_log_t) + + files_search_pids($1) + admin_pattern($1, mrtg_var_run_t) + + files_search_var_lib($1) + admin_pattern($1, mrtg_var_lib_t) +') diff --git a/mrtg.service b/mrtg.service index e480970..4d98199 100644 --- a/mrtg.service +++ b/mrtg.service @@ -30,7 +30,7 @@ ExecStart=/usr/bin/mrtg /etc/mrtg/mrtg.cfg --lock-file /var/lock/mrtg/mrtg_l --c # - RunAsDaemon: no; (periodic invocation) : #Type=oneshot Type=simple -StandardOutput=syslog +LogLevelMax=notice [Install] WantedBy=multi-user.target diff --git a/mrtg.spec b/mrtg.spec index 3d9efe4..c368b22 100644 --- a/mrtg.spec +++ b/mrtg.spec @@ -1,12 +1,18 @@ %global _use_internal_dependency_generator 0 %global contentdir %{_localstatedir}/www/%{name} +%global factory_contentdir %{_datadir}/factory/var/www/%{name} %global libdir %{_localstatedir}/lib/mrtg +# defining macros needed by SELinux +%global with_selinux 1 +%global selinuxtype targeted +%global modulename mrtg + Summary: Multi Router Traffic Grapher Name: mrtg -Version: 2.17.7 -Release: 1%{?dist} +Version: 2.17.10 +Release: 12%{?dist}.1 URL: http://oss.oetiker.ch/mrtg/ Source0: http://oss.oetiker.ch/mrtg/pub/mrtg-%{version}.tar.gz Source1: http://oss.oetiker.ch/mrtg/pub/mrtg-%{version}.tar.gz.md5 @@ -24,20 +30,35 @@ Source7: mrtg.tmpfiles Source8: mrtg.service # Source9: systemd timer file Source9: mrtg.timer +# Source100-102: selinux policy for mrtg, extracted +# from https://github.com/fedora-selinux/selinux-policy +Source100: %{modulename}.te +Source101: %{modulename}.if +Source102: %{modulename}.fc Patch0: mrtg-2.15.0-lib64.patch Patch1: mrtg-2.17.2-socket6-fix.patch # Patch2: some devices return 2**32-2 on ifSpeed (e. g. IBM FibreChannel switches) Patch2: mrtg-2.17.4-cfgmaker-ifhighspeed.patch -License: GPLv2+ -Group: Applications/Internet +Patch3: mrtg-configure-c99.patch +# https://github.com/oetiker/mrtg/commit/30e19216bfadc0148f347cb0a42fd5e2016e6269 +Patch4: mrtg-2.17.10-CVE-2026-72694.patch +License: GPL-2.0-or-later Requires(post): systemd-units Requires(preun): systemd-units Requires(postun): systemd-units -Requires: perl-Socket6 perl-IO-Socket-INET6 +Requires: perl-Socket6 perl-IO-Socket-INET6 perl-locale Requires: gd +%if 0%{?with_selinux} +# This ensures that the *-selinux package and all it’s dependencies are not pulled +# into containers and other systems that do not use SELinux +Requires: (%{name}-selinux if selinux-policy-%{selinuxtype}) +%endif +BuildRequires: make BuildRequires: gd-devel, libpng-devel BuildRequires: perl-generators BuildRequires: systemd-units +BuildRequires: systemd-rpm-macros +BuildRequires: gcc %global __find_requires %{SOURCE3} %global __find_provides %{SOURCE6} @@ -47,11 +68,27 @@ The Multi Router Traffic Grapher (MRTG) is a tool to monitor the traffic load on network-links. MRTG generates HTML pages containing PNG images which provide a LIVE visual representation of this traffic. +%if 0%{?with_selinux} +# SELinux subpackage +%package selinux +Summary: mrtg SELinux policy +BuildArch: noarch +Requires: selinux-policy-%{selinuxtype} +Requires(post): selinux-policy-%{selinuxtype} +BuildRequires: selinux-policy-devel +%{?selinux_requires} + +%description selinux +Custom SELinux policy module +%endif + %prep %setup -q -%patch0 -p1 -b .lib64 -%patch1 -p1 -b .socket6 -%patch2 -p1 -b .ifhighspeed +%patch -P 0 -p1 -b .lib64 +%patch -P 1 -p1 -b .socket6 +%patch -P 2 -p1 -b .ifhighspeed +%patch -P 3 -p1 -b .c99 +%patch -P 4 -p1 -b .CVE-2026-72694 for i in doc/mrtg-forum.1 doc/mrtg-squid.1 CHANGES; do iconv -f iso-8859-1 -t utf-8 < "$i" > "${i}_" @@ -71,18 +108,25 @@ find contrib -type f -exec \ find contrib -name "*.pl" -exec %{__perl} -e 's;\015;;gi' -p -i \{\} \; find contrib -type f | xargs chmod a-x +%if 0%{?with_selinux} +# SELinux policy (originally from selinux-policy-contrib) +# this policy module will override the production module +mkdir selinux +cp -p %{SOURCE100} %{SOURCE101} %{SOURCE102} selinux/ +make -f %{_datadir}/selinux/devel/Makefile %{modulename}.pp +bzip2 -9 %{modulename}.pp +%endif + %install rm -rf $RPM_BUILD_ROOT make install DESTDIR=$RPM_BUILD_ROOT mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/mrtg -mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/lib/mrtg -mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/lock/mrtg -mkdir -p $RPM_BUILD_ROOT%{contentdir} +mkdir -p $RPM_BUILD_ROOT%{factory_contentdir} mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.d -install -m 644 images/* $RPM_BUILD_ROOT%{contentdir}/ -sed 's,@CONTENTDIR@,%{contentdir},g; s,@LIBDIR@,%{_localstatedir}/lib/mrtg,g' \ +install -m 644 images/* $RPM_BUILD_ROOT%{factory_contentdir}/ +sed 's,@CONTENTDIR@,%{contentdir},g; s,@LIBDIR@,%{libdir},g' \ %{SOURCE2} > $RPM_BUILD_ROOT%{_sysconfdir}/mrtg/mrtg.cfg chmod 644 $RPM_BUILD_ROOT%{_sysconfdir}/mrtg/mrtg.cfg @@ -103,45 +147,180 @@ done sed -i 's;@@lib@@;%{_lib};g' "$RPM_BUILD_ROOT"%{_mandir}/man1/*.1 +%if 0%{?with_selinux} +install -D -m 0644 %{modulename}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp.bz2 +install -D -p -m 0644 selinux/%{modulename}.if %{buildroot}%{_datadir}/selinux/devel/include/distributed/%{name}.if +%endif + %post -install -d -m 0755 -o root -g root /var/lock/mrtg -restorecon /var/lock/mrtg %systemd_post mrtg.service %preun if [ $1 -eq 0 ]; then # Package removal, not upgrade - rm -rf /var/lock/mrtg + rm -rf %{_localstatedir}/lock/mrtg fi %systemd_preun mrtg.service %postun %systemd_postun_with_restart mrtg.service +%if 0%{?with_selinux} +# SELinux contexts are saved so that only affected files can be +# relabeled after the policy module installation +%pre selinux +%selinux_relabel_pre -s %{selinuxtype} + +%post selinux +%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp.bz2 +%selinux_relabel_post -s %{selinuxtype} + +if [ "$1" -le "1" ]; then # First install + # the service needs to be restarted for the custom label to be applied + %systemd_postun_with_restart mrtg.service &> /dev/null || : +fi + +%postun selinux +if [ $1 -eq 0 ]; then + %selinux_modules_uninstall -s %{selinuxtype} %{modulename} + %selinux_relabel_post -s %{selinuxtype} +fi +%endif + %files %license COPYING %doc contrib CHANGES COPYRIGHT README THANKS %dir %{_sysconfdir}/mrtg %config(noreplace) %{_sysconfdir}/mrtg/mrtg.cfg %config(noreplace) %{_sysconfdir}/httpd/conf.d/mrtg.conf -%{contentdir} +%{factory_contentdir} %{_bindir}/* %{_libdir}/mrtg2 %exclude %{_libdir}/mrtg2/Pod %{_mandir}/*/* %exclude %{_datadir}/mrtg2/icons %exclude %{_datadir}/doc/mrtg2 -%dir %{_localstatedir}/lib/mrtg +%ghost %attr(0755,root,root) %dir %{libdir} +%ghost %attr(0755,root,root) %dir %{contentdir} %{_tmpfilesdir}/mrtg.conf -%ghost /var/lock/mrtg +%ghost %attr(0755,root,root) %dir %{_localstatedir}/lock/mrtg %{_unitdir}/mrtg.service %{_unitdir}/mrtg.timer +%if 0%{?with_selinux} +%files selinux +%{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp.* +%{_datadir}/selinux/devel/include/distributed/%{modulename}.if +%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{modulename} +%endif + %changelog -* Mon Aug 13 2018 Vitezslav Crhonek - 2.17.7-1 +* Tue Aug 11 2026 RHEL Packaging Agent - 2.17.10-12.1 +- Fix symlink-following chown of pid file in daemon mode (CVE-2026-72694) + Resolves: RHEL-236045 + +* Mon Jan 26 2026 Vitezslav Crhonek - 2.17.10-12 +- Add support for Image Mode + Resolves: RHEL-142231 + +* Wed Jan 15 2025 Vitezslav Crhonek - 2.17.10-11 +- Remove redundand restorecon call, redirect safe to ignore output + to /dev/null, mark module directory to avoid rpm verification + Resolves: RHEL-67894 + +* Tue Oct 29 2024 Troy Dawson - 2.17.10-10 +- Bump release for October 2024 mass rebuild: + Resolves: RHEL-64018 + +* Mon Jun 24 2024 Troy Dawson - 2.17.10-9 +- Bump release for June 2024 mass rebuild + +* Thu Jan 25 2024 Fedora Release Engineering - 2.17.10-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Sun Jan 21 2024 Fedora Release Engineering - 2.17.10-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Thu Jul 20 2023 Fedora Release Engineering - 2.17.10-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Tue Apr 25 2023 Vitezslav Crhonek - 2.17.10-5 +- SPDX migration + +* Thu Jan 19 2023 Fedora Release Engineering - 2.17.10-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Fri Dec 16 2022 Florian Weimer - 2.17.10-3 +- Port configure script to C99 + +* Thu Jul 21 2022 Fedora Release Engineering - 2.17.10-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Thu Jan 20 2022 Vitezslav Crhonek - 2.17.10-1 +- Update to mrtg-2.17.10 + Resolves: #2041965 + +* Thu Sep 23 2021 Vitezslav Crhonek - 2.17.8-1 +- Update to mrtg-2.17.8 + Resolves: #1990765 + +* Thu Jul 22 2021 Fedora Release Engineering - 2.17.7-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Tue Jun 08 2021 Vitezslav Crhonek - 2.17.7-12 +- Ship interface file within -selinux subpackage + +* Tue May 18 2021 Vitezslav Crhonek - 2.17.7-11 +- Remove deprecated StandardOutput=syslog +- Add LogLevelMax=notice to avoid loggin each start/stop of the service + when mrtg.timer is used + Resolves: #911766 + +* Mon Apr 12 2021 Vitezslav Crhonek - 2.17.7-10 +- Incorporate -selinux subpackage + See https://fedoraproject.org/wiki/SELinux/IndependentPolicy + +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 2.17.7-9 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + +* Tue Jan 26 2021 Fedora Release Engineering - 2.17.7-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Mon Nov 09 2020 Vitezslav Crhonek - 2.17.7-7 +- Add Requires perl-locale + Resolves: #1895580 + +* Tue Jul 28 2020 Fedora Release Engineering - 2.17.7-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Wed Jan 29 2020 Fedora Release Engineering - 2.17.7-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Thu Jul 25 2019 Fedora Release Engineering - 2.17.7-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Fri Feb 01 2019 Fedora Release Engineering - 2.17.7-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Thu Oct 18 2018 Vitezslav Crhonek - 2.17.7-2 +- Fix mrtg-traffic-sum incorrectly ignores 'man' option + Resolves: #1612188 + +* Thu Aug 09 2018 Vitezslav Crhonek - 2.17.7-1 - Use %%license - Update to mrtg-2.17.7 - Resolves: #1615340 + Resolves: #1600933 + +* Fri Jul 13 2018 Fedora Release Engineering - 2.17.4-24 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Thu Feb 22 2018 Vitezslav Crhonek - 2.17.4-23 +- Add BuildRequires gcc +- Remove Group tag + +* Thu Feb 08 2018 Fedora Release Engineering - 2.17.4-22 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild * Thu Aug 03 2017 Fedora Release Engineering - 2.17.4-21 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild diff --git a/mrtg.te b/mrtg.te new file mode 100644 index 0000000..9636408 --- /dev/null +++ b/mrtg.te @@ -0,0 +1,149 @@ +policy_module(mrtg, 1.9.0) + +######################################## +# +# Declarations +# + +type mrtg_t; +type mrtg_exec_t; +init_system_domain(mrtg_t, mrtg_exec_t) + +type mrtg_initrc_exec_t; +init_script_file(mrtg_initrc_exec_t) + +type mrtg_etc_t; +files_config_file(mrtg_etc_t) + +type mrtg_lock_t; +files_lock_file(mrtg_lock_t) + +type mrtg_log_t; +logging_log_file(mrtg_log_t) + +type mrtg_var_lib_t; +files_type(mrtg_var_lib_t) + +type mrtg_var_run_t; +files_pid_file(mrtg_var_run_t) + +######################################## +# +# Local policy +# + +allow mrtg_t self:capability { chown setgid setuid }; +dontaudit mrtg_t self:capability sys_tty_config; +allow mrtg_t self:process signal_perms; +allow mrtg_t self:fifo_file rw_fifo_file_perms; + +allow mrtg_t mrtg_etc_t:dir list_dir_perms; +allow mrtg_t mrtg_etc_t:file read_file_perms; +allow mrtg_t mrtg_etc_t:lnk_file read_lnk_file_perms; + +allow mrtg_t mrtg_lock_t:dir manage_dir_perms; +allow mrtg_t mrtg_lock_t:file manage_file_perms; +allow mrtg_t mrtg_lock_t:lnk_file manage_lnk_file_perms; +files_lock_filetrans(mrtg_t, mrtg_lock_t, { dir file }) + +manage_dirs_pattern(mrtg_t, mrtg_log_t, mrtg_log_t) +append_files_pattern(mrtg_t, mrtg_log_t, mrtg_log_t) +create_files_pattern(mrtg_t, mrtg_log_t, mrtg_log_t) +setattr_files_pattern(mrtg_t, mrtg_log_t, mrtg_log_t) +logging_log_filetrans(mrtg_t, mrtg_log_t, { dir file }) + +manage_files_pattern(mrtg_t, mrtg_var_lib_t, mrtg_var_lib_t) +manage_lnk_files_pattern(mrtg_t, mrtg_var_lib_t, mrtg_var_lib_t) + +allow mrtg_t mrtg_var_run_t:file manage_file_perms; +files_pid_filetrans(mrtg_t, mrtg_var_run_t, file) + +kernel_read_system_state(mrtg_t) +kernel_read_network_state(mrtg_t) +kernel_read_kernel_sysctls(mrtg_t) + +corecmd_exec_bin(mrtg_t) +corecmd_exec_shell(mrtg_t) + +corenet_all_recvfrom_netlabel(mrtg_t) +corenet_tcp_sendrecv_generic_if(mrtg_t) +corenet_tcp_sendrecv_generic_node(mrtg_t) + +corenet_sendrecv_all_client_packets(mrtg_t) +corenet_tcp_connect_all_ports(mrtg_t) +corenet_tcp_sendrecv_all_ports(mrtg_t) + +dev_read_sysfs(mrtg_t) +dev_read_urand(mrtg_t) + +domain_use_interactive_fds(mrtg_t) +domain_dontaudit_search_all_domains_state(mrtg_t) + +files_getattr_tmp_dirs(mrtg_t) +files_read_etc_runtime_files(mrtg_t) +files_search_var(mrtg_t) +files_search_locks(mrtg_t) +files_search_var_lib(mrtg_t) +files_search_spool(mrtg_t) + +fs_search_auto_mountpoints(mrtg_t) +fs_getattr_all_fs(mrtg_t) +fs_list_inotifyfs(mrtg_t) + +term_dontaudit_use_console(mrtg_t) + +init_use_fds(mrtg_t) +init_use_script_ptys(mrtg_t) +init_read_utmp(mrtg_t) +init_dontaudit_write_utmp(mrtg_t) + +auth_use_nsswitch(mrtg_t) + +libs_read_lib_files(mrtg_t) + +logging_send_syslog_msg(mrtg_t) + +selinux_dontaudit_getattr_dir(mrtg_t) + +userdom_use_inherited_user_terminals(mrtg_t) +userdom_dontaudit_read_user_home_content_files(mrtg_t) +userdom_dontaudit_use_unpriv_user_fds(mrtg_t) +userdom_dontaudit_list_admin_dir(mrtg_t) + +netutils_domtrans_ping(mrtg_t) + +ifdef(`enable_mls',` + corenet_udp_sendrecv_lo_if(mrtg_t) +') + +optional_policy(` + apache_manage_sys_content(mrtg_t) +') + +optional_policy(` + cron_system_entry(mrtg_t, mrtg_exec_t) +') + +optional_policy(` + hostname_exec(mrtg_t) +') + +optional_policy(` + hddtemp_domtrans(mrtg_t) +') + +optional_policy(` + seutil_sigchld_newrole(mrtg_t) +') + +optional_policy(` + quota_dontaudit_getattr_db(mrtg_t) +') + +optional_policy(` + snmp_read_snmp_var_lib_files(mrtg_t) +') + +optional_policy(` + udev_read_db(mrtg_t) +') diff --git a/mrtg.tmpfiles b/mrtg.tmpfiles index 80ad928..b38d21b 100644 --- a/mrtg.tmpfiles +++ b/mrtg.tmpfiles @@ -1 +1,4 @@ d /var/lock/mrtg 0755 root root - +d /var/lib/mrtg 0755 root root - +# populate /var/www/mrtg with content from /usr/share/factory/var/www/mrtg +C /var/www/mrtg - - - - diff --git a/sources b/sources index c80672a..cc82c85 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -SHA512 (mrtg-2.17.7.tar.gz) = b25ab38416213bc5128612724530f36f4a855bb66a65f8bbe4bdafef05d2688eed68f5c3df1e13193102507a4114e71ec226ad32dd6b4d3ae2e2291320d8e768 -SHA512 (mrtg-2.17.7.tar.gz.md5) = 146bf77c985e54e949daceb3bfe2b7c8f67f7f1c495a3e666957a91514c6fcadeb02ecc5d42d8536fef1b9e70779018736ffe602c216f6c283c9f784f0cad50f +SHA512 (mrtg-2.17.10.tar.gz) = b1c5232f1b3dcec39adc4fb5a423738f9470ad470e91c6a918cf3f875e71af263d8e03694c3d66129b2653fa498d8d9d9b95349fe90e9d2e0b3ed6c09d06e080