forked from pool/nfs-utils
Accepting request 732555 from Base:System
- Delete 0006-nfs.conf-silence-include-error.patch replaced with better version - 0006-conffile-allow-optional-include-files.patch Avoid error if /etc/nfs.conf.local doesn't exist (bsc#1151044 bsc#1150807) - 0008-mountd-Initialize-logging-early.patch Don't close the loging socket - it causes problems. (bsc#1151044 bsc#1150807) - Don't make /var/lib/nfs owned by statd. Only sm and sm.bak need to be accessible by statd or sm-notify after they drop privs. Providing they get created, the parent directory can be root-owned. - 0007-statd-user-from-sm Change rpc.statd and sm-notify to take uid from the sm directory. (bsc#1150733 CVE-2019-3689) - 0006-nfs.conf-silence-include-error.patch Avoid an unhelpful warning (bsc#1150807) OBS-URL: https://build.opensuse.org/request/show/732555 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/nfs-utils?expand=0&rev=149
This commit is contained in:
Git OBS Bridge
commit
d4d7191993
61
0006-conffile-allow-optional-include-files.patch
Normal file
61
0006-conffile-allow-optional-include-files.patch
Normal file
@ -0,0 +1,61 @@
|
||||
From f608217f6136c0e9fedc7bc728e4ba13ed295c4c Mon Sep 17 00:00:00 2001
|
||||
From: NeilBrown <neilb@suse.de>
|
||||
Date: Mon, 23 Sep 2019 11:20:39 +1000
|
||||
Subject: [PATCH] conffile: allow optional include files.
|
||||
|
||||
If nfs.conf contains, for example
|
||||
include = /etc/nfs.conf.local
|
||||
and /etc/nfs.conf.local doesn't exist, then a warning is given.
|
||||
Sometimes it is useful to have an optional include file which is
|
||||
included if present, but for which an absence doesn't give a
|
||||
warning.
|
||||
|
||||
Systemd has a convention that a hyphen at the start of
|
||||
an include file name marks it as optional, so add this convention
|
||||
to nfs-utils.
|
||||
So
|
||||
include = -/etc/nfs.conf.local
|
||||
will not give a warning if the file doesn't exist.
|
||||
|
||||
Signed-off-by: NeilBrown <neilb@suse.de>
|
||||
---
|
||||
support/nfs/conffile.c | 13 ++++++++++---
|
||||
systemd/nfs.conf.man | 3 +++
|
||||
2 files changed, 13 insertions(+), 3 deletions(-)
|
||||
|
||||
--- a/support/nfs/conffile.c
|
||||
+++ b/support/nfs/conffile.c
|
||||
@@ -413,11 +413,18 @@ conf_parse_line(int trans, char *line, c
|
||||
|
||||
if (strcasecmp(line, "include")==0) {
|
||||
/* load and parse subordinate config files */
|
||||
+ _Bool optional = false;
|
||||
+
|
||||
+ if (val && *val == '-') {
|
||||
+ optional = true;
|
||||
+ val++;
|
||||
+ }
|
||||
+
|
||||
relpath = relative_path(filename, val);
|
||||
if (relpath == NULL) {
|
||||
- xlog_warn("config error at %s:%d: "
|
||||
- "error loading included config",
|
||||
- filename, lineno);
|
||||
+ if (!optional)
|
||||
+ xlog_warn("config error at %s:%d: error loading included config",
|
||||
+ filename, lineno);
|
||||
return;
|
||||
}
|
||||
|
||||
--- a/systemd/nfs.conf.man
|
||||
+++ b/systemd/nfs.conf.man
|
||||
@@ -65,6 +65,9 @@ section headers, then new sections will
|
||||
included file appeared in place of the
|
||||
.B include
|
||||
line.
|
||||
+If the file name starts with a hyphen then that is stripped off
|
||||
+before the file is opened, and if file doesn't exist no warning is
|
||||
+given. Normally a non-existent include file generates a warning.
|
||||
.PP
|
||||
Lookup of section and value names is case-insensitive.
|
||||
|
||||
45
0007-statd-user-from-sm
Normal file
45
0007-statd-user-from-sm
Normal file
@ -0,0 +1,45 @@
|
||||
statd: take user-id from /var/lib/nfs/sm
|
||||
|
||||
Having /var/lib/nfs writeable by statd is not ideal
|
||||
as there are files in there that statd doesn't need
|
||||
to access.
|
||||
Aftger dropping privs, statd and sm-notify only need to
|
||||
access files in the directories sm and sm.bak.
|
||||
So take the uid for these deamons from 'sm'.
|
||||
|
||||
Signed-off-by: NeilBrown <neilb@suse.com>
|
||||
---
|
||||
support/nsm/file.c | 16 +++++-----------
|
||||
1 file changed, 5 insertions(+), 11 deletions(-)
|
||||
|
||||
--- a/support/nsm/file.c
|
||||
+++ b/support/nsm/file.c
|
||||
@@ -388,23 +388,17 @@ nsm_drop_privileges(const int pidfd)
|
||||
|
||||
(void)umask(S_IRWXO);
|
||||
|
||||
- /*
|
||||
- * XXX: If we can't stat dirname, or if dirname is owned by
|
||||
- * root, we should use "statduser" instead, which is set up
|
||||
- * by configure.ac. Nothing in nfs-utils seems to use
|
||||
- * "statduser," though.
|
||||
- */
|
||||
- if (lstat(nsm_base_dirname, &st) == -1) {
|
||||
- xlog(L_ERROR, "Failed to stat %s: %m", nsm_base_dirname);
|
||||
- return false;
|
||||
- }
|
||||
-
|
||||
if (chdir(nsm_base_dirname) == -1) {
|
||||
xlog(L_ERROR, "Failed to change working directory to %s: %m",
|
||||
nsm_base_dirname);
|
||||
return false;
|
||||
}
|
||||
|
||||
+ if (lstat(NSM_MONITOR_DIR, &st) == -1) {
|
||||
+ xlog(L_ERROR, "Failed to stat %s/%s: %m", nsm_base_dirname, NSM_MONITOR_DIR);
|
||||
+ return false;
|
||||
+ }
|
||||
+
|
||||
if (!prune_bounding_set())
|
||||
return false;
|
||||
|
||||
61
0008-mountd-Initialize-logging-early.patch
Normal file
61
0008-mountd-Initialize-logging-early.patch
Normal file
@ -0,0 +1,61 @@
|
||||
From 30961f1bf9be6117aa825e7bfc8b327c93d3aacd Mon Sep 17 00:00:00 2001
|
||||
From: NeilBrown <neilb@suse.de>
|
||||
Date: Mon, 23 Sep 2019 11:10:31 +1000
|
||||
Subject: [PATCH] mountd: Initialize logging early.
|
||||
|
||||
Reading the config file can generate log messages,
|
||||
so we should initialize logging before reading the
|
||||
config file.
|
||||
|
||||
If any log message are generated, syslog will leave
|
||||
a file descriptor open (a socket), so calling
|
||||
closeall(3) after this can cause problem.
|
||||
Before this we initialize login we don't know if
|
||||
Foreground (-F) has been selected, so closeall()
|
||||
cannot be conditional on that.
|
||||
|
||||
closeall() isn't needed - daemon are almost always run
|
||||
from a management daemon like systemd, and they are given
|
||||
a clean environment. It is really best if they just take
|
||||
what they are given.
|
||||
|
||||
So remove the closeall() call.
|
||||
|
||||
Signed-off-by: NeilBrown <neilb@suse.de>
|
||||
---
|
||||
utils/mountd/mountd.c | 9 +++------
|
||||
1 file changed, 3 insertions(+), 6 deletions(-)
|
||||
|
||||
--- a/utils/mountd/mountd.c
|
||||
+++ b/utils/mountd/mountd.c
|
||||
@@ -679,6 +679,9 @@ main(int argc, char **argv)
|
||||
else
|
||||
progname = argv[0];
|
||||
|
||||
+ /* Initialize logging. */
|
||||
+ xlog_open(progname);
|
||||
+
|
||||
conf_init_file(NFS_CONFFILE);
|
||||
xlog_from_conffile("mountd");
|
||||
manage_gids = conf_get_bool("mountd", "manage-gids", manage_gids);
|
||||
@@ -818,9 +821,7 @@ main(int argc, char **argv)
|
||||
}
|
||||
}
|
||||
}
|
||||
- /* Initialize logging. */
|
||||
if (!foreground) xlog_stderr(0);
|
||||
- xlog_open(progname);
|
||||
|
||||
sa.sa_handler = SIG_IGN;
|
||||
sa.sa_flags = 0;
|
||||
@@ -832,10 +833,6 @@ main(int argc, char **argv)
|
||||
/* WARNING: the following works on Linux and SysV, but not BSD! */
|
||||
sigaction(SIGCHLD, &sa, NULL);
|
||||
|
||||
- /* Daemons should close all extra filehandles ... *before* RPC init. */
|
||||
- if (!foreground)
|
||||
- closeall(3);
|
||||
-
|
||||
cache_open();
|
||||
|
||||
unregister_services();
|
||||
@ -1,3 +1,34 @@
|
||||
-------------------------------------------------------------------
|
||||
Mon Sep 23 01:52:29 UTC 2019 - Neil Brown <nfbrown@suse.com>
|
||||
|
||||
- Delete 0006-nfs.conf-silence-include-error.patch
|
||||
replaced with better version
|
||||
- 0006-conffile-allow-optional-include-files.patch
|
||||
Avoid error if /etc/nfs.conf.local doesn't exist
|
||||
(bsc#1151044 bsc#1150807)
|
||||
- 0008-mountd-Initialize-logging-early.patch
|
||||
Don't close the loging socket - it causes problems.
|
||||
(bsc#1151044 bsc#1150807)
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Sep 16 23:43:37 UTC 2019 - Neil Brown <nfbrown@suse.com>
|
||||
|
||||
- Don't make /var/lib/nfs owned by statd.
|
||||
Only sm and sm.bak need to be accessible by
|
||||
statd or sm-notify after they drop privs.
|
||||
Providing they get created, the parent
|
||||
directory can be root-owned.
|
||||
- 0007-statd-user-from-sm
|
||||
Change rpc.statd and sm-notify to take uid from the sm
|
||||
directory.
|
||||
(bsc#1150733 CVE-2019-3689)
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Sep 16 05:56:12 UTC 2019 - Neil Brown <nfbrown@suse.com>
|
||||
|
||||
- 0006-nfs.conf-silence-include-error.patch
|
||||
Avoid an unhelpful warning (bsc#1150807)
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Sep 2 05:25:07 UTC 2019 - Neil Brown <nfbrown@suse.com>
|
||||
|
||||
|
||||
@ -50,6 +50,9 @@ Patch2: 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
|
||||
Patch3: 0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
|
||||
Patch4: 0004-nfsidmap-honour-with-pluginpath-for-instalation.patch
|
||||
Patch5: 0005-nfs.conf-fail-to-disable-major-NFS-version-4-using-v.patch
|
||||
Patch6: 0006-conffile-allow-optional-include-files.patch
|
||||
Patch7: 0007-statd-user-from-sm
|
||||
Patch8: 0008-mountd-Initialize-logging-early.patch
|
||||
|
||||
BuildRequires: e2fsprogs-devel
|
||||
BuildRequires: fedfs-utils-devel
|
||||
@ -152,6 +155,9 @@ This package contains additional NFS documentation.
|
||||
%patch3 -p1
|
||||
%patch4 -p1
|
||||
%patch5 -p1
|
||||
%patch6 -p1
|
||||
%patch7 -p1
|
||||
%patch8 -p1
|
||||
|
||||
cp %{SOURCE6} .
|
||||
|
||||
@ -218,9 +224,9 @@ chmod 644 %{buildroot}%{_sbindir}/{mountstats,nfsiostat}
|
||||
%service_add_pre auth-rpcgss-module.service nfs-idmapd.service nfs-blkmap.service rpc-statd-notify.service rpc-gssd.service rpc-statd.service rpc-svcgssd.service
|
||||
|
||||
%post -n nfs-client
|
||||
chown statd:nogroup %{_localstatedir}/lib/nfs > /dev/null 2>&1 || :
|
||||
for i in state sm sm.bak; do
|
||||
chown -R statd %{_localstatedir}/lib/nfs/$i > /dev/null 2>&1 || :
|
||||
chown root:root %{_localstatedir}/lib/nfs > /dev/null 2>&1 || :
|
||||
for i in sm sm.bak; do
|
||||
chown -R statd:nogroup %{_localstatedir}/lib/nfs/$i > /dev/null 2>&1 || :
|
||||
done
|
||||
### migrate from /var/lock/subsys
|
||||
[ -d /run/nfs ] || mkdir /run/nfs
|
||||
@ -342,12 +348,12 @@ fi
|
||||
%{_mandir}/man8/blkmapd.8%{ext_man}
|
||||
%{_mandir}/man8/rpc.svcgssd.8%{ext_man}
|
||||
%{_fillupdir}/sysconfig.nfs
|
||||
%attr(0711,statd,nogroup) %dir %{_localstatedir}/lib/nfs
|
||||
%dir %{_localstatedir}/lib/nfs
|
||||
%dir %{_localstatedir}/lib/nfs/rpc_pipefs
|
||||
%dir %{_localstatedir}/lib/nfs/v4recovery
|
||||
%attr(0700,statd,nogroup) %dir %{_localstatedir}/lib/nfs/sm
|
||||
%attr(0700,statd,nogroup) %dir %{_localstatedir}/lib/nfs/sm.bak
|
||||
%attr(0700,statd,nogroup) %ghost %{_localstatedir}/lib/nfs/state
|
||||
%ghost %{_localstatedir}/lib/nfs/state
|
||||
|
||||
%files -n nfs-kernel-server
|
||||
%defattr(-,root,root)
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user