From 92d7b543c86f6d1fd6e13f46c50f71a07abfbf05 Mon Sep 17 00:00:00 2001 From: Adam Tkac Date: Feb 20 2008 14:35:02 +0000 Subject: - port named to use libcap library, enable threads (#433102) - removed some unneeded Requires --- diff --git a/bind-9.5-libcap.patch b/bind-9.5-libcap.patch new file mode 100644 index 0000000..f4b7c37 --- /dev/null +++ b/bind-9.5-libcap.patch @@ -0,0 +1,268 @@ +diff -up bind-9.5.0b2/configure.in.libcap bind-9.5.0b2/configure.in +--- bind-9.5.0b2/configure.in.libcap 2008-02-20 14:23:42.000000000 +0100 ++++ bind-9.5.0b2/configure.in 2008-02-20 14:47:11.000000000 +0100 +@@ -1875,7 +1875,8 @@ AC_ARG_ENABLE(linux-caps, + [ --disable-linux-caps disable linux capabilities]) + case "$enable_linux_caps" in + yes|'') +- AC_CHECK_HEADERS(linux/capability.h) ++ AC_CHECK_HEADERS(sys/capability.h) ++ AC_CHECK_LIB(cap, cap_set_proc, LIBS="-lcap $LIBS") + ;; + no) + ;; +diff -up bind-9.5.0b2/bin/named/unix/os.c.libcap bind-9.5.0b2/bin/named/unix/os.c +--- bind-9.5.0b2/bin/named/unix/os.c.libcap 2008-02-20 14:24:31.000000000 +0100 ++++ bind-9.5.0b2/bin/named/unix/os.c 2008-02-20 14:45:25.000000000 +0100 +@@ -60,16 +60,16 @@ static int devnullfd = -1; + #endif + + /* +- * If there's no , we don't care about ++ * If there's no , we don't care about + */ +-#ifndef HAVE_LINUX_CAPABILITY_H ++#ifndef HAVE_SYS_CAPABILITY_H + #undef HAVE_SYS_PRCTL_H + #endif + + /* + * Linux defines: + * (T) HAVE_LINUXTHREADS +- * (C) HAVE_LINUX_CAPABILITY_H ++ * (C) HAVE_SYS_CAPABILITY_H + * (P) HAVE_SYS_PRCTL_H + * The possible cases are: + * none: setuid() normally +@@ -111,7 +111,7 @@ static struct passwd *runas_pw = NULL; + static isc_boolean_t done_setuid = ISC_FALSE; + static int dfd[2] = { -1, -1 }; + +-#ifdef HAVE_LINUX_CAPABILITY_H ++#ifdef HAVE_SYS_CAPABILITY_H + + static isc_boolean_t non_root = ISC_FALSE; + static isc_boolean_t non_root_caps = ISC_FALSE; +@@ -125,7 +125,7 @@ static isc_boolean_t non_root_caps = ISC + #define _LINUX_FS_H + + #include /* Required for syscall(). */ +-#include /* Required for _LINUX_CAPABILITY_VERSION. */ ++#include /* Required for _LINUX_CAPABILITY_VERSION. */ + + #ifdef HAVE_SYS_PRCTL_H + #include /* Required for prctl(). */ +@@ -142,32 +142,16 @@ static isc_boolean_t non_root_caps = ISC + + #endif /* HAVE_SYS_PRCTL_H */ + +-#ifndef SYS_capset +-#ifndef __NR_capset +-#include /* Slackware 4.0 needs this. */ +-#endif +-#define SYS_capset __NR_capset +-#endif +- + static void +-linux_setcaps(unsigned int caps) { +- struct __user_cap_header_struct caphead; +- struct __user_cap_data_struct cap; ++linux_setcaps(cap_t caps) { + char strbuf[ISC_STRERRORSIZE]; + + if ((getuid() != 0 && !non_root_caps) || non_root) + return; + +- memset(&caphead, 0, sizeof(caphead)); +- caphead.version = _LINUX_CAPABILITY_VERSION; +- caphead.pid = 0; +- memset(&cap, 0, sizeof(cap)); +- cap.effective = caps; +- cap.permitted = caps; +- cap.inheritable = 0; +- if (syscall(SYS_capset, &caphead, &cap) < 0) { ++ if (cap_set_proc(caps) < 0) { + isc__strerror(errno, strbuf, sizeof(strbuf)); +- ns_main_earlyfatal("capset failed: %s:" ++ ns_main_earlyfatal("cap_set_proc failed: %s:" + " please ensure that the capset kernel" + " module is loaded. see insmod(8)", + strbuf); +@@ -176,7 +160,9 @@ linux_setcaps(unsigned int caps) { + + static void + linux_initialprivs(void) { +- unsigned int caps; ++ cap_t caps; ++ cap_value_t capval; ++ char strbuf[ISC_STRERRORSIZE]; + + /*% + * We don't need most privileges, so we drop them right away. +@@ -184,17 +170,26 @@ linux_initialprivs(void) { + * capabilities to the minimum needed to run the server. + */ + +- caps = 0; ++ if ( (caps = cap_init()) == NULL) { ++ isc__strerror(errno, strbuf, sizeof (strbuf)); ++ ns_main_earlyfatal("cap_init failed: %s", strbuf); ++ } + + /* + * We need to be able to bind() to privileged ports, notably port 53! + */ +- caps |= (1 << CAP_NET_BIND_SERVICE); ++ ++ capval = CAP_NET_BIND_SERVICE; ++ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); ++ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); + + /* + * We need chroot() initially too. + */ +- caps |= (1 << CAP_SYS_CHROOT); ++ ++ capval = CAP_SYS_CHROOT; ++ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); ++ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); + + #if defined(HAVE_SYS_PRCTL_H) || !defined(HAVE_LINUXTHREADS) + /* +@@ -203,19 +198,25 @@ linux_initialprivs(void) { + * tried) or we're not using threads. If either of these is + * true, we want the setuid capability. + */ +- caps |= (1 << CAP_SETUID); ++ capval = CAP_SETUID; ++ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); ++ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); + #endif + + /* + * Since we call initgroups, we need this. + */ +- caps |= (1 << CAP_SETGID); ++ capval = CAP_SETGID; ++ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); ++ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); + + /* + * Without this, we run into problems reading a configuration file + * owned by a non-root user and non-world-readable on startup. + */ +- caps |= (1 << CAP_DAC_READ_SEARCH); ++ capval = CAP_DAC_READ_SEARCH; ++ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); ++ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); + + /* + * XXX We might want to add CAP_SYS_RESOURCE, though it's not +@@ -224,14 +225,18 @@ linux_initialprivs(void) { + * of files, the stack size, data size, and core dump size to + * support named.conf options, this is now being added to test. + */ +- caps |= (1 << CAP_SYS_RESOURCE); ++ capval = CAP_SYS_RESOURCE; ++ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); ++ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); + + linux_setcaps(caps); + } + + static void + linux_minprivs(void) { +- unsigned int caps; ++ cap_t caps; ++ cap_value_t capval; ++ char strbuf[ISC_STRERRORSIZE]; + + /*% + * Drop all privileges except the ability to bind() to privileged +@@ -241,8 +246,14 @@ linux_minprivs(void) { + * chroot() could be used to escape from the chrooted area. + */ + +- caps = 0; +- caps |= (1 << CAP_NET_BIND_SERVICE); ++ if ( (caps = cap_init()) == NULL) { ++ isc__strerror(errno, strbuf, sizeof (strbuf)); ++ ns_main_earlyfatal("cap_init failed: %s", strbuf); ++ } ++ ++ capval = CAP_NET_BIND_SERVICE; ++ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); ++ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); + + /* + * XXX We might want to add CAP_SYS_RESOURCE, though it's not +@@ -251,7 +262,9 @@ linux_minprivs(void) { + * of files, the stack size, data size, and core dump size to + * support named.conf options, this is now being added to test. + */ +- caps |= (1 << CAP_SYS_RESOURCE); ++ capval = CAP_SYS_RESOURCE; ++ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); ++ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); + + linux_setcaps(caps); + } +@@ -278,7 +291,7 @@ linux_keepcaps(void) { + } + #endif + +-#endif /* HAVE_LINUX_CAPABILITY_H */ ++#endif /* HAVE_SYS_CAPABILITY_H */ + + + static void +@@ -295,7 +308,7 @@ setup_syslog(const char *progname) { + void + ns_os_init(const char *progname) { + setup_syslog(progname); +-#ifdef HAVE_LINUX_CAPABILITY_H ++#ifdef HAVE_SYS_CAPABILITY_H + linux_initialprivs(); + #endif + #ifdef HAVE_LINUXTHREADS +@@ -474,7 +487,7 @@ ns_os_changeuser(void) { + done_setuid = ISC_TRUE; + + #ifdef HAVE_LINUXTHREADS +-#ifdef HAVE_LINUX_CAPABILITY_H ++#ifdef HAVE_SYS_CAPABILITY_H + if (!non_root_caps) + ns_main_earlyfatal("-u with Linux threads not supported: " + "requires kernel support for " +@@ -507,7 +520,7 @@ ns_os_changeuser(void) { + strbuf); + } + #endif +-#if defined(HAVE_LINUX_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS) ++#if defined(HAVE_SYS_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS) + linux_minprivs(); + #endif + } +@@ -522,7 +535,7 @@ ns_os_minprivs(void) { + ns_os_changeuser(); /* Call setuid() before threads are started */ + #endif + +-#if defined(HAVE_LINUX_CAPABILITY_H) && defined(HAVE_LINUXTHREADS) ++#if defined(HAVE_SYS_CAPABILITY_H) && defined(HAVE_LINUXTHREADS) + linux_minprivs(); + #endif + } +diff -up bind-9.5.0b2/config.h.in.libcap bind-9.5.0b2/config.h.in +--- bind-9.5.0b2/config.h.in.libcap 2008-02-20 14:23:57.000000000 +0100 ++++ bind-9.5.0b2/config.h.in 2008-02-20 14:24:17.000000000 +0100 +@@ -196,8 +196,8 @@ int sigwait(const unsigned int *set, int + /* Define if libxml2 was found */ + #undef HAVE_LIBXML2 + +-/* Define to 1 if you have the header file. */ +-#undef HAVE_LINUX_CAPABILITY_H ++/* Define to 1 if you have the header file. */ ++#undef HAVE_SYS_CAPABILITY_H + + /* Define to 1 if you have the header file. */ + #undef HAVE_LOCALE_H diff --git a/bind.spec b/bind.spec index 3a62150..07bc23d 100644 --- a/bind.spec +++ b/bind.spec @@ -19,7 +19,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind License: ISC Version: 9.5.0 -Release: 27.%{RELEASEVER}%{?dist} +Release: 28.%{RELEASEVER}%{?dist} Epoch: 32 Url: http://www.isc.org/products/BIND/ Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) @@ -61,6 +61,7 @@ Patch72: bind-9.5-dlz-64bit.patch Patch87: bind-9.5-parallel-build.patch Patch88: bind-9.5-transfer-segv.patch Patch89: bind-9.5-mudflap.patch +Patch90: bind-9.5-libcap.patch # SDB patches Patch11: bind-9.3.2b2-sdbsrc.patch @@ -83,13 +84,15 @@ Patch83: bind-9.5-libidn2.patch Patch85: bind-9.5-libidn3.patch # -Requires: bind-libs = %{epoch}:%{version}-%{release}, glibc >= 2.2, mktemp +Requires: mktemp Requires(post): grep, chkconfig >= 1.3.26 Requires(pre): shadow-utils Requires(preun):chkconfig >= 1.3.26 Obsoletes: bind-config, caching-nameserver Provides: bind-config, caching-nameserver -BuildRequires: gcc, glibc-devel >= 2.2.5-26, glibc-kernheaders >= 2.4-7.10, openssl-devel, libtool, autoconf, pkgconfig +BuildRequires: gcc, glibc-devel >= 2.2.5-26, glibc-kernheaders >= 2.4-7.10 +BuildRequires: openssl-devel, libtool, autoconf, pkgconfig, libcap-devel +BuildRequires: libidn-devel %if %{SDB} BuildRequires: openldap-devel, postgresql-devel, sqlite-devel, mysql-devel, unixODBC-devel %endif @@ -101,13 +104,10 @@ BuildRequires: net-tools, perl %endif %if %{GSSTSIG} BuildRequires: krb5-devel -Requires: krb5-libs %endif %if %{DEBUG} BuildRequires: libmudflap-devel %endif -BuildRequires: libidn-devel -Requires: libidn %description BIND (Berkeley Internet Name Domain) is an implementation of the DNS @@ -120,7 +120,6 @@ tools for verifying that the DNS server is operating properly. %package sdb Summary: BIND server with database backends and DLZ suppport Group: System Environment/Daemons -Requires: bind = %{epoch}:%{version}-%{release} %description sdb BIND (Berkeley Internet Name Domain) is an implementation of the DNS @@ -145,7 +144,6 @@ Contains libraries used by both the bind server package as well as the utils pac %package utils Summary: Utilities for querying DNS name servers Group: Applications/System -Requires: bind-libs = %{epoch}:%{version}-%{release} %description utils Bind-utils contains a collection of utilities for querying DNS (Domain @@ -161,7 +159,6 @@ servers. %package devel Summary: Header files and libraries needed for BIND DNS development Group: Development/Libraries -Requires: bind-libs = %{epoch}:%{version}-%{release} Obsoletes: bind-libbind-devel %description devel @@ -173,7 +170,6 @@ required for development with ISC BIND 9 and BIND 8 Summary: A chroot runtime environment for the ISC BIND DNS server, named(8) Group: System Environment/Daemons Prefix: %{chroot_prefix} -Requires: bind = %{epoch}:%{version}-%{release} Requires(post): grep Requires(preun): grep @@ -192,6 +188,7 @@ Based on the code from Jan "Yenya" Kasprzak %patch10 -p1 -b .PIE %patch69 -p1 -b .generate-xml %patch16 -p1 -b .redhat_doc +%patch90 -p1 -b .libcap %if %{SDB} mkdir bin/named-sdb cp -r bin/named/* bin/named-sdb @@ -278,11 +275,10 @@ fi %configure \ --with-libtool \ --localstatedir=/var \ - --disable-threads \ + --enable-threads \ --enable-ipv6 \ --with-pic \ --disable-openssl-version-check \ - --disable-linux-caps \ %if %{LIBBIND} --enable-libbind \ %endif @@ -408,7 +404,7 @@ for f in my.internal.zone.db slaves/my.slave.internal.zone.db slaves/my.ddns.int echo '@ in soa localhost. root 1 3H 15M 1W 1D ns localhost.' > sample/var/named/$f; done -/usr/bin/tail -n '+'`/bin/egrep -n '\\$Id: bind.spec,v 1.249 2008/02/19 10:20:49 atkac Exp $/+1/' | bc` bin/rndc/rndc.conf | sed '/Sample rndc configuration file./{p;i\ +/usr/bin/tail -n '+'`/bin/egrep -n '\\$Id: bind.spec,v 1.250 2008/02/20 14:35:02 atkac Exp $/+1/' | bc` bin/rndc/rndc.conf | sed '/Sample rndc configuration file./{p;i\ *\ * NOTE: you only need to create this file if it is to\ * differ from the following default contents: @@ -659,6 +655,10 @@ rm -rf ${RPM_BUILD_ROOT} %{_sbindir}/bind-chroot-admin %changelog +* Wed Feb 20 2008 Adam Tkac 32:9.5.0-28.b2 +- port named to use libcap library, enable threads (#433102) +- removed some unneeded Requires + * Tue Feb 19 2008 Adam Tkac 32:9.5.0-27.b2 - removed conditional build with libefence (use -fmudflapth instead) - fixed building of DLZ stuff (#432497)