From 0c9c09d36e5ac6c789fe01cf116155f8ccef7ad1 Mon Sep 17 00:00:00 2001 From: Adam Tkac Date: May 05 2008 09:41:55 +0000 Subject: - port libcap patch to latest upstream source --- diff --git a/bind-9.5-libcap.patch b/bind-9.5-libcap.patch index f4b7c37..3140eff 100644 --- a/bind-9.5-libcap.patch +++ b/bind-9.5-libcap.patch @@ -1,58 +1,57 @@ -diff -up bind-9.5.0b2/configure.in.libcap bind-9.5.0b2/configure.in ---- bind-9.5.0b2/configure.in.libcap 2008-02-20 14:23:42.000000000 +0100 -+++ bind-9.5.0b2/configure.in 2008-02-20 14:47:11.000000000 +0100 -@@ -1875,7 +1875,8 @@ AC_ARG_ENABLE(linux-caps, - [ --disable-linux-caps disable linux capabilities]) - case "$enable_linux_caps" in - yes|'') -- AC_CHECK_HEADERS(linux/capability.h) -+ AC_CHECK_HEADERS(sys/capability.h) -+ AC_CHECK_LIB(cap, cap_set_proc, LIBS="-lcap $LIBS") - ;; - no) - ;; -diff -up bind-9.5.0b2/bin/named/unix/os.c.libcap bind-9.5.0b2/bin/named/unix/os.c ---- bind-9.5.0b2/bin/named/unix/os.c.libcap 2008-02-20 14:24:31.000000000 +0100 -+++ bind-9.5.0b2/bin/named/unix/os.c 2008-02-20 14:45:25.000000000 +0100 -@@ -60,16 +60,16 @@ static int devnullfd = -1; - #endif - - /* -- * If there's no , we don't care about -+ * If there's no , we don't care about - */ --#ifndef HAVE_LINUX_CAPABILITY_H -+#ifndef HAVE_SYS_CAPABILITY_H - #undef HAVE_SYS_PRCTL_H - #endif - +diff -up bind-9.5.0b3/bin/named/unix/os.c.libcap bind-9.5.0b3/bin/named/unix/os.c +--- bind-9.5.0b3/bin/named/unix/os.c.libcap 2008-01-30 05:55:51.000000000 +0100 ++++ bind-9.5.0b3/bin/named/unix/os.c 2008-05-05 10:56:00.000000000 +0200 +@@ -69,7 +69,7 @@ static int devnullfd = -1; /* * Linux defines: * (T) HAVE_LINUXTHREADS - * (C) HAVE_LINUX_CAPABILITY_H -+ * (C) HAVE_SYS_CAPABILITY_H ++ * (C) HAVE_SYS_CAPABILITY_H (or HAVE_LINUX_CAPABILITY_H) * (P) HAVE_SYS_PRCTL_H * The possible cases are: * none: setuid() normally -@@ -111,7 +111,7 @@ static struct passwd *runas_pw = NULL; - static isc_boolean_t done_setuid = ISC_FALSE; - static int dfd[2] = { -1, -1 }; - --#ifdef HAVE_LINUX_CAPABILITY_H -+#ifdef HAVE_SYS_CAPABILITY_H - +@@ -116,16 +116,9 @@ static int dfd[2] = { -1, -1 }; static isc_boolean_t non_root = ISC_FALSE; static isc_boolean_t non_root_caps = ISC_FALSE; -@@ -125,7 +125,7 @@ static isc_boolean_t non_root_caps = ISC - #define _LINUX_FS_H - #include /* Required for syscall(). */ +-#if defined(HAVE_CAPSET) +-#undef _POSIX_SOURCE + #ifdef HAVE_SYS_CAPABILITY_H + #include + #else +-#include +-int capset(cap_user_header_t hdrp, const cap_user_data_t datap); +-#endif +-#include +-#else + /*% + * We define _LINUX_FS_H to prevent it from being included. We don't need + * anything from it, and the files it includes cause warnings with 2.2 +@@ -133,9 +126,20 @@ int capset(cap_user_header_t hdrp, const + * and ) on 2.3 kernels. + */ + #define _LINUX_FS_H +- +-#include /* Required for syscall(). */ -#include /* Required for _LINUX_CAPABILITY_VERSION. */ -+#include /* Required for _LINUX_CAPABILITY_VERSION. */ ++#include ++#ifdef HAVE_CAPSET ++int capset(cap_user_header_t hdrp, const cap_user_data_t datap); ++#else ++/* We don't have libcap or capset, let's use syscall*/ ++#include ++#ifndef SYS_capset ++#ifndef __NR_capset ++#include /* Slackware 4.0 needs this. */ ++#endif /* __NR_capset */ ++#define SYS_capset __NR_capset ++#endif /* SYS_capset */ ++#endif /* HAVE_CAPSET */ ++#endif /* HAVE_SYS_CAPABILITY_H */ #ifdef HAVE_SYS_PRCTL_H #include /* Required for prctl(). */ -@@ -142,32 +142,16 @@ static isc_boolean_t non_root_caps = ISC +@@ -152,23 +156,28 @@ int capset(cap_user_header_t hdrp, const #endif /* HAVE_SYS_PRCTL_H */ @@ -62,110 +61,154 @@ diff -up bind-9.5.0b2/bin/named/unix/os.c.libcap bind-9.5.0b2/bin/named/unix/os. -#endif -#define SYS_capset __NR_capset -#endif -- +-#endif ++#ifdef HAVE_LIBCAP ++#define SETCAPS_FUNC "cap_set_proc " ++#else ++typedef unsigned int cap_t; ++#ifdef HAVE_CAPSET ++#define SETCAPS_FUNC "capset " ++#else ++#define SETCAPS_FUNC "syscall(capset) " ++#endif /* HAVE_CAPSET */ ++#endif /* HAVE_LIBCAP */ + static void -linux_setcaps(unsigned int caps) { -- struct __user_cap_header_struct caphead; -- struct __user_cap_data_struct cap; +linux_setcaps(cap_t caps) { ++#ifndef HAVE_LIBCAP + struct __user_cap_header_struct caphead; + struct __user_cap_data_struct cap; ++#endif char strbuf[ISC_STRERRORSIZE]; if ((getuid() != 0 && !non_root_caps) || non_root) return; - -- memset(&caphead, 0, sizeof(caphead)); -- caphead.version = _LINUX_CAPABILITY_VERSION; -- caphead.pid = 0; -- memset(&cap, 0, sizeof(cap)); -- cap.effective = caps; -- cap.permitted = caps; -- cap.inheritable = 0; -- if (syscall(SYS_capset, &caphead, &cap) < 0) { +- ++#ifndef HAVE_LIBCAP + memset(&caphead, 0, sizeof(caphead)); + caphead.version = _LINUX_CAPABILITY_VERSION; + caphead.pid = 0; +@@ -176,46 +185,76 @@ linux_setcaps(unsigned int caps) { + cap.effective = caps; + cap.permitted = caps; + cap.inheritable = 0; +-#ifdef HAVE_CAPSET ++#endif ++#ifdef HAVE_LIBCAP + if (cap_set_proc(caps) < 0) { - isc__strerror(errno, strbuf, sizeof(strbuf)); ++#elif defined(HAVE_CAPSET) + if (capset(&caphead, &cap) < 0 ) { +- isc__strerror(errno, strbuf, sizeof(strbuf)); - ns_main_earlyfatal("capset failed: %s:" -+ ns_main_earlyfatal("cap_set_proc failed: %s:" +- " please ensure that the capset kernel" +- " module is loaded. see insmod(8)", +- strbuf); +- } + #else + if (syscall(SYS_capset, &caphead, &cap) < 0) { ++#endif + isc__strerror(errno, strbuf, sizeof(strbuf)); +- ns_main_earlyfatal("syscall(capset) failed: %s:" ++ ns_main_earlyfatal(SETCAPS_FUNC "failed: %s:" " please ensure that the capset kernel" " module is loaded. see insmod(8)", strbuf); -@@ -176,7 +160,9 @@ linux_setcaps(unsigned int caps) { + } +-#endif + } ++#ifdef HAVE_LIBCAP ++#define SET_CAP(flag) \ ++ do { \ ++ capval = (flag); \ ++ err = cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); \ ++ if (err == -1) { \ ++ isc__strerror(errno, strbuf, sizeof(strbuf)); \ ++ ns_main_earlyfatal("cap_set_proc failed: %s", strbuf); \ ++ } \ ++ \ ++ err = cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); \ ++ if (err == -1) { \ ++ isc__strerror(errno, strbuf, sizeof(strbuf)); \ ++ ns_main_earlyfatal("cap_set_proc failed: %s", strbuf); \ ++ } \ ++ } while (0) ++#define INIT_CAP \ ++ do { \ ++ caps = cap_init(); \ ++ if (caps == NULL) { \ ++ isc__strerror(errno, strbuf, sizeof(strbuf)); \ ++ ns_main_earlyfatal("cap_init failed: %s", strbuf); \ ++ } \ ++ } while (0) ++#else ++#define SET_CAP(flag) { caps |= (1 << (flag)); } ++#define INIT_CAP { caps = 0; } ++#endif /* HAVE_LIBCAP */ ++ static void linux_initialprivs(void) { - unsigned int caps; + cap_t caps; ++#ifdef HAVE_LIBCAP + cap_value_t capval; + char strbuf[ISC_STRERRORSIZE]; ++ int err; ++#endif /*% * We don't need most privileges, so we drop them right away. -@@ -184,17 +170,26 @@ linux_initialprivs(void) { + * Later on linux_minprivs() will be called, which will drop our * capabilities to the minimum needed to run the server. */ - +- - caps = 0; -+ if ( (caps = cap_init()) == NULL) { -+ isc__strerror(errno, strbuf, sizeof (strbuf)); -+ ns_main_earlyfatal("cap_init failed: %s", strbuf); -+ } ++ INIT_CAP; /* * We need to be able to bind() to privileged ports, notably port 53! */ - caps |= (1 << CAP_NET_BIND_SERVICE); -+ -+ capval = CAP_NET_BIND_SERVICE; -+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); -+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); ++ SET_CAP(CAP_NET_BIND_SERVICE); /* * We need chroot() initially too. */ - caps |= (1 << CAP_SYS_CHROOT); -+ -+ capval = CAP_SYS_CHROOT; -+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); -+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); ++ SET_CAP(CAP_SYS_CHROOT); #if defined(HAVE_SYS_PRCTL_H) || !defined(HAVE_LINUXTHREADS) /* -@@ -203,19 +198,25 @@ linux_initialprivs(void) { +@@ -224,19 +263,19 @@ linux_initialprivs(void) { * tried) or we're not using threads. If either of these is * true, we want the setuid capability. */ - caps |= (1 << CAP_SETUID); -+ capval = CAP_SETUID; -+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); -+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); ++ SET_CAP(CAP_SETUID); #endif /* * Since we call initgroups, we need this. */ - caps |= (1 << CAP_SETGID); -+ capval = CAP_SETGID; -+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); -+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); ++ SET_CAP(CAP_SETGID); /* * Without this, we run into problems reading a configuration file * owned by a non-root user and non-world-readable on startup. */ - caps |= (1 << CAP_DAC_READ_SEARCH); -+ capval = CAP_DAC_READ_SEARCH; -+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); -+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); ++ SET_CAP(CAP_DAC_READ_SEARCH); /* * XXX We might want to add CAP_SYS_RESOURCE, though it's not -@@ -224,14 +225,18 @@ linux_initialprivs(void) { +@@ -245,15 +284,21 @@ linux_initialprivs(void) { * of files, the stack size, data size, and core dump size to * support named.conf options, this is now being added to test. */ - caps |= (1 << CAP_SYS_RESOURCE); -+ capval = CAP_SYS_RESOURCE; -+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); -+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); ++ SET_CAP(CAP_SYS_RESOURCE); linux_setcaps(caps); } @@ -174,95 +217,43 @@ diff -up bind-9.5.0b2/bin/named/unix/os.c.libcap bind-9.5.0b2/bin/named/unix/os. linux_minprivs(void) { - unsigned int caps; + cap_t caps; ++#ifdef HAVE_LIBCAP + cap_value_t capval; + char strbuf[ISC_STRERRORSIZE]; ++ int err; ++#endif ++ INIT_CAP; /*% * Drop all privileges except the ability to bind() to privileged -@@ -241,8 +246,14 @@ linux_minprivs(void) { + * ports. +@@ -262,8 +307,7 @@ linux_minprivs(void) { * chroot() could be used to escape from the chrooted area. */ - caps = 0; - caps |= (1 << CAP_NET_BIND_SERVICE); -+ if ( (caps = cap_init()) == NULL) { -+ isc__strerror(errno, strbuf, sizeof (strbuf)); -+ ns_main_earlyfatal("cap_init failed: %s", strbuf); -+ } -+ -+ capval = CAP_NET_BIND_SERVICE; -+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); -+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); ++ SET_CAP(CAP_NET_BIND_SERVICE); /* * XXX We might want to add CAP_SYS_RESOURCE, though it's not -@@ -251,7 +262,9 @@ linux_minprivs(void) { +@@ -272,7 +316,7 @@ linux_minprivs(void) { * of files, the stack size, data size, and core dump size to * support named.conf options, this is now being added to test. */ - caps |= (1 << CAP_SYS_RESOURCE); -+ capval = CAP_SYS_RESOURCE; -+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); -+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); ++ SET_CAP(CAP_SYS_RESOURCE); linux_setcaps(caps); } -@@ -278,7 +291,7 @@ linux_keepcaps(void) { - } - #endif - --#endif /* HAVE_LINUX_CAPABILITY_H */ -+#endif /* HAVE_SYS_CAPABILITY_H */ - - - static void -@@ -295,7 +308,7 @@ setup_syslog(const char *progname) { - void - ns_os_init(const char *progname) { - setup_syslog(progname); --#ifdef HAVE_LINUX_CAPABILITY_H -+#ifdef HAVE_SYS_CAPABILITY_H - linux_initialprivs(); - #endif - #ifdef HAVE_LINUXTHREADS -@@ -474,7 +487,7 @@ ns_os_changeuser(void) { - done_setuid = ISC_TRUE; - - #ifdef HAVE_LINUXTHREADS --#ifdef HAVE_LINUX_CAPABILITY_H -+#ifdef HAVE_SYS_CAPABILITY_H - if (!non_root_caps) - ns_main_earlyfatal("-u with Linux threads not supported: " - "requires kernel support for " -@@ -507,7 +520,7 @@ ns_os_changeuser(void) { - strbuf); - } - #endif --#if defined(HAVE_LINUX_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS) -+#if defined(HAVE_SYS_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS) - linux_minprivs(); - #endif - } -@@ -522,7 +535,7 @@ ns_os_minprivs(void) { - ns_os_changeuser(); /* Call setuid() before threads are started */ - #endif - --#if defined(HAVE_LINUX_CAPABILITY_H) && defined(HAVE_LINUXTHREADS) -+#if defined(HAVE_SYS_CAPABILITY_H) && defined(HAVE_LINUXTHREADS) - linux_minprivs(); - #endif - } -diff -up bind-9.5.0b2/config.h.in.libcap bind-9.5.0b2/config.h.in ---- bind-9.5.0b2/config.h.in.libcap 2008-02-20 14:23:57.000000000 +0100 -+++ bind-9.5.0b2/config.h.in 2008-02-20 14:24:17.000000000 +0100 -@@ -196,8 +196,8 @@ int sigwait(const unsigned int *set, int - /* Define if libxml2 was found */ - #undef HAVE_LIBXML2 - --/* Define to 1 if you have the header file. */ --#undef HAVE_LINUX_CAPABILITY_H -+/* Define to 1 if you have the header file. */ -+#undef HAVE_SYS_CAPABILITY_H - - /* Define to 1 if you have the header file. */ - #undef HAVE_LOCALE_H +diff -up bind-9.5.0b3/configure.in.libcap bind-9.5.0b3/configure.in +--- bind-9.5.0b3/configure.in.libcap 2008-01-30 05:55:51.000000000 +0100 ++++ bind-9.5.0b3/configure.in 2008-05-05 10:53:11.000000000 +0200 +@@ -1876,6 +1876,7 @@ AC_ARG_ENABLE(linux-caps, + case "$enable_linux_caps" in + yes|'') + AC_CHECK_HEADERS(linux/capability.h sys/capability.h) ++ AC_CHECK_LIB(cap, cap_set_proc) + AC_CHECK_FUNCS(capset) + ;; + no) diff --git a/bind.spec b/bind.spec index 19282b1..0c9d489 100644 --- a/bind.spec +++ b/bind.spec @@ -18,7 +18,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind License: ISC Version: 9.5.0 -Release: 29.3.%{RELEASEVER}%{dist} +Release: 30.%{RELEASEVER}%{?dist} Epoch: 32 Url: http://www.isc.org/products/BIND/ Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) @@ -244,7 +244,7 @@ export CFLAGS="$CFLAGS $RPM_OPT_FLAGS" export CPPFLAGS="$CPPFLAGS -D_GNU_SOURCE" export STD_CDEFINES="$CPPFLAGS" -libtoolize -c -f; aclocal --force; autoconf -f +libtoolize -c -f; aclocal --force; autoheader -f; autoconf -f %if %{WITH_DBUS} %ifarch s390x x86_64 ppc64 @@ -390,7 +390,7 @@ for f in my.internal.zone.db slaves/my.slave.internal.zone.db slaves/my.ddns.int echo '@ in soa localhost. root 1 3H 15M 1W 1D ns localhost.' > sample/var/named/$f; done -/usr/bin/tail -n '+'`/bin/egrep -n '\\$Id: bind.spec,v 1.256 2008/04/30 09:49:23 atkac Exp $/+1/' | bc` bin/rndc/rndc.conf | sed '/Sample rndc configuration file./{p;i\ +/usr/bin/tail -n '+'`/bin/egrep -n '\\$Id: bind.spec,v 1.257 2008/05/05 09:41:55 atkac Exp $/+1/' | bc` bin/rndc/rndc.conf | sed '/Sample rndc configuration file./{p;i\ *\ * NOTE: you only need to create this file if it is to\ * differ from the following default contents: @@ -641,12 +641,13 @@ rm -rf ${RPM_BUILD_ROOT} %{_sbindir}/bind-chroot-admin %changelog -* Wed Apr 30 2008 Adam Tkac 32:9.5.0-30.b3 +* Mon May 05 2008 Adam Tkac 32:9.5.0-30.b3 - 9.5.0b3 release - dropped patches (upstream) - bind-9.5.0-generate-xml.patch - bind-9.5-transfer-segv.patch - bind-9.5-mudflap.patch +- updated bind-9.5-libcap.patch * Wed Apr 02 2008 Adam Tkac 32:9.5.0-29.3.b2 - fixed named.conf.sample file (#437569)