rpms/unbound
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix verification of unbound-control key files

Browse Source 
Resolves: RHEL-65396
This commit is contained in:
Tomas Korbar 2025-07-16 15:35:44 +02:00
parent 4eaee53407
commit 475374284a
2 changed files with 22 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
unbound-1.16-control-key-perms.patch Normal file
View File

@ -0,0 +1,14 @@
diff --git a/unbound-1.16.2/smallapp/unbound-control-setup.sh.in b/unbound-1.16.2/smallapp/unbound-control-setup.sh.in
index 4a358f6bd..c2a79a242 100644
--- a/unbound-1.16.2/smallapp/unbound-control-setup.sh.in
+++ b/unbound-1.16.2/smallapp/unbound-control-setup.sh.in
@@ -204,7 +204,8 @@ fi
# remove unused permissions
chmod o-rw \
"$SVR_BASE.pem" \
- "$SVR_BASE.key" \
+ "$SVR_BASE.key"
+chmod g+r,o-rw \
"$CTL_BASE.pem" \
"$CTL_BASE.key"

10
unbound.spec
View File

@ -30,7 +30,7 @@
Summary: Validating, recursive, and caching DNS(SEC) resolver
Name: unbound
Version: 1.16.2
Release: 19%{?extra_version:.%{extra_version}}%{?dist}
Release: 20%{?extra_version:.%{extra_version}}%{?dist}
License: BSD
Url: https://nlnetlabs.nl/projects/unbound/
Source: https://nlnetlabs.nl/downloads/%{name}/%{name}-%{version}%{?extra_version}.tar.gz
@ -67,6 +67,8 @@ Patch4: unbound-1.16-CVE-2023-50387-CVE-2023-50868.patch
Patch5: unbound-1.16-control-t-flag.patch
# https://github.com/NLnetLabs/unbound/commit/b7c61d7cc256d6a174e6179622c7fa968272c259
Patch6: unbound-1.21-CVE-2024-8508.patch
# https://github.com/NLnetLabs/unbound/commit/b48958c983f60af40358cca168c403e57bde30d2
Patch7: unbound-1.16-control-key-perms.patch
BuildRequires: gcc, make
BuildRequires: flex, openssl-devel
@ -433,7 +435,7 @@ popd
%ghost %attr(0640,root,unbound) %{_sysconfdir}/%{name}/unbound_control.pem
%ghost %attr(0640,root,unbound) %{_sysconfdir}/%{name}/unbound_control.key
%ghost %attr(0640,root,unbound) %{_sysconfdir}/%{name}/unbound_server.pem
%ghost %attr(0640,root,unbound) %{_sysconfdir}/%{name}/unbound_server.key
%ghost %attr(0600,root,unbound) %{_sysconfdir}/%{name}/unbound_server.key
%{_sbindir}/unbound
%{_sbindir}/unbound-checkconf
%{_sbindir}/unbound-control
@ -498,6 +500,10 @@ popd
%{_prefix}/lib/dracut/modules.d/99unbound
%changelog
* Wed Jul 16 2025 Tomas Korbar <tkorbar@redhat.com> - 1.16.2-20
- Fix verification of unbound-control key files
- Resolves: RHEL-65396
* Tue Jun 24 2025 Tomas Korbar <tkorbar@redhat.com> - 1.16.2-19
- Fix regression on update introduced by local-root symlink
- Resolves: RHEL-92255