Sync from SUSE:SLFO:Main rpcbind revision 72ecfcb67887aea17bc4c4d0ebae1202

0001-systemd-rpcbind.service-Add-hardening-bsc-1181400.patch

@@ -0,0 +1,39 @@
+From 913dc9e39032cf8d06c8f3260ef7fcca636a9ebb Mon Sep 17 00:00:00 2001
+From: Johannes Segitz <jsegitz@suse.com>
+Date: Fri, 23 Aug 2024 00:51:43 +0200
+Subject: [PATCH] systemd/rpcbind.service: Add hardening (bsc#1181400)
+
+Signed-off-by: Johannes Segitz <jsegitz@suse.com>
+[ pvorel: Rebased for 1.2.7 ]
+Signed-off-by: Petr Vorel <pvorel@suse.cz>
+---
+ systemd/rpcbind.service.in | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/systemd/rpcbind.service.in b/systemd/rpcbind.service.in
+index 97207e0..b03409b 100644
+--- a/systemd/rpcbind.service.in
++++ b/systemd/rpcbind.service.in
+@@ -11,6 +11,19 @@ Wants=rpcbind.target
+ After=sysinit.target
+ 
+ [Service]
++# added automatically, for details please see
++# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
++ProtectSystem=full
++ProtectHome=true
++PrivateDevices=true
++ProtectHostname=true
++ProtectClock=true
++ProtectKernelTunables=true
++ProtectKernelModules=true
++ProtectKernelLogs=true
++ProtectControlGroups=true
++RestrictRealtime=true
++# end of automatic additions
+ Type=notify
+ # distro can provide a drop-in adding EnvironmentFile=-/??? if needed.
+ EnvironmentFile=-/etc/sysconfig/rpcbind
+-- 
+2.45.2
+

0001-systemd-rpcbind.service-Fix-ordering-add-etc-sysconf.patch

@@ -0,0 +1,40 @@
+From e400274134c1401359ef38df34fc300e0fba2fba Mon Sep 17 00:00:00 2001
+From: Thomas Blume <thomas.blume@suse.com>
+Date: Thu, 22 Aug 2024 22:36:49 +0200
+Subject: [PATCH] systemd/rpcbind.service: Fix ordering, add
+ /etc/sysconfig/rpcbind
+
+* Add ordering dependency to rpcbind.service (bsc#1117217)
+* Add EnvironmentFile=-/etc/sysconfig/rpcbind to rpcbind.service.in
+  (bsc#824621)
+
+Link: https://bugzilla.suse.com/show_bug.cgi?id=1117217
+Link: https://bugzilla.suse.com/show_bug.cgi?id=824621
+Reviewed-by: Petr Vorel <pvorel@suse.cz>
+Signed-off-by: Thomas Blume <thomas.blume@suse.com>
+[ pvorel: rebased for 1.2.7 ]
+Signed-off-by: Petr Vorel <pvorel@suse.cz>
+---
+ systemd/rpcbind.service.in | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/systemd/rpcbind.service.in b/systemd/rpcbind.service.in
+index c892ca8..97207e0 100644
+--- a/systemd/rpcbind.service.in
++++ b/systemd/rpcbind.service.in
+@@ -8,10 +8,12 @@ RequiresMountsFor=@statedir@
+ # rpcbind.socket, no matter how this unit is started.
+ Requires=rpcbind.socket
+ Wants=rpcbind.target
++After=sysinit.target
+ 
+ [Service]
+ Type=notify
+ # distro can provide a drop-in adding EnvironmentFile=-/??? if needed.
++EnvironmentFile=-/etc/sysconfig/rpcbind
+ ExecStart=@_sbindir@/rpcbind $RPCBIND_OPTIONS @warmstarts_opt@ -f
+ 
+ [Install]
+-- 
+2.45.2
+

0001-systemd-unit-files.patch

@@ -1,27 +0,0 @@
-From 9c5efb3a0973d57b79e4fc7a96debe0e6ce2d000 Mon Sep 17 00:00:00 2001
-From: Thomas Blume <thomas.blume@suse.com>
-Date: Thu, 25 Oct 2018 11:14:32 +0200
-Subject: [PATCH] systemd unit files
-
-Add EnvironmentFile=-/etc/sysconfig/rpcbind to rpcbind.service
----
- systemd/rpcbind.service.in | 1 +
- 1 file changed, 1 insertion(+)
-
-Index: rpcbind-1.2.5/systemd/rpcbind.service.in
-===================================================================
---- rpcbind-1.2.5.orig/systemd/rpcbind.service.in
-+++ rpcbind-1.2.5/systemd/rpcbind.service.in
-@@ -8,10 +8,12 @@ RequiresMountsFor=@statedir@
- # rpcbind.socket, no matter how this unit is started.
- Requires=rpcbind.socket
- Wants=rpcbind.target
-+After=sysinit.target
- 
- [Service]
- Type=notify
- # distro can provide a drop-in adding EnvironmentFile=-/??? if needed.
-+EnvironmentFile=-/etc/sysconfig/rpcbind
- ExecStart=@_sbindir@/rpcbind $RPCBIND_OPTIONS -w -f
- 
- [Install]

harden_rpcbind.service.patch

@@ -1,24 +0,0 @@
-Index: rpcbind-1.2.6/systemd/rpcbind.service.in
-===================================================================
---- rpcbind-1.2.6.orig/systemd/rpcbind.service.in
-+++ rpcbind-1.2.6/systemd/rpcbind.service.in
-@@ -11,6 +11,19 @@ Wants=rpcbind.target
- After=sysinit.target
- 
- [Service]
-+# added automatically, for details please see
-+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
-+ProtectSystem=full
-+ProtectHome=true
-+PrivateDevices=true
-+ProtectHostname=true
-+ProtectClock=true
-+ProtectKernelTunables=true
-+ProtectKernelModules=true
-+ProtectKernelLogs=true
-+ProtectControlGroups=true
-+RestrictRealtime=true
-+# end of automatic additions 
- Type=notify
- # distro can provide a drop-in adding EnvironmentFile=-/??? if needed.
- EnvironmentFile=-/etc/sysconfig/rpcbind

rpcbind.changes

@@ -1,3 +1,18 @@
+-------------------------------------------------------------------
+Mon Feb 17 08:51:10 UTC 2025 - Thomas Blume <thomas.blume@suse.com>
+
+- Require system-user-nobody for as the rpc user relies on `nobody`
+  from this package
+
+- Update to rpcbind 1.2.7
+  * rpcinfo: try connecting using abstract address
+  * Listen on an AF_UNIX abstract address if supported
+  * autotools/systemd: call rpcbind with -w only on enabled warm starts
+  * rpcbind: fix double free in init_transport
+- Refresh and rename patches (while turning them into git patches)
+  * 0001-systemd-unit-files.patch -> 0001-systemd-rpcbind.service-Fix-ordering-add-etc-sysconf.patch
+  * harden_rpcbind.service.patch -> 0001-systemd-rpcbind.service-Add-hardening-bsc-1181400.patch
+
 -------------------------------------------------------------------
 Wed Jan 25 14:53:11 UTC 2023 - Thorsten Kukuk <kukuk@suse.com>
 

rpcbind.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package rpcbind
 #
-# Copyright (c) 2023 SUSE LLC
+# Copyright (c) 2024 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -21,7 +21,7 @@
   %define _fillupdir %{_localstatedir}/adm/fillup-templates
 %endif
 Name:           rpcbind
-Version:        1.2.6
+Version:        1.2.7
 Release:        0
 Summary:        Transport independent RPC portmapper
 # Git-Web:      http://git.linux-nfs.org/?p=steved/rpcbind.git;a=summary
@@ -31,9 +31,9 @@ URL:            http://rpcbind.sourceforge.net
 Source:         https://downloads.sourceforge.net/sourceforge/%{name}/%{name}-%{version}.tar.bz2
 Source2:        sysconfig.rpcbind
 Source5:        rpc-user.conf
-Patch1:         0001-systemd-unit-files.patch
+Patch1:         0001-systemd-rpcbind.service-Fix-ordering-add-etc-sysconf.patch
 Patch2:         0001-change-lockingdir-to-run.patch
-Patch3:         harden_rpcbind.service.patch
+Patch3:         0001-systemd-rpcbind.service-Add-hardening-bsc-1181400.patch
 BuildRequires:  libtirpc-devel >= 1.0.1
 BuildRequires:  libtool
 BuildRequires:  pkgconfig
@@ -41,6 +41,8 @@ BuildRequires:  sysuser-shadow
 BuildRequires:  sysuser-tools
 BuildRequires:  tcpd-devel
 BuildRequires:  pkgconfig(libsystemd)
+# The rpc user relies on the group `nobody`
+Requires:       system-user-nobody
 Requires(post): %fillup_prereq
 Provides:       portmap
 %{?systemd_ordering}