Accepting request 52163 from home:lnussel:fscaps

Reviewed ok - Thanks - will this go to other repos for maintenance/security ? OBS-URL: https://build.opensuse.org/request/show/52163 OBS-URL: https://build.opensuse.org/package/show/network:utilities/iputils?expand=0&rev=16
2010-11-04 15:51:08 +00:00 · 2010-11-04 15:51:08 +00:00 · b82c79498e
commit b82c79498e
parent c087db1fbb
8 changed files with 1259 additions and 43 deletions
--- a/ifenslave.c
+++ b/ifenslave.c
--- a/iputils-ADDLIB.diff
+++ b/iputils-ADDLIB.diff
@ -1,12 +0,0 @@
--- Makefile	2010-07-14 13:38:32.257045463 +0200
-+++ Makefile	2010-07-14 13:39:00.482319644 +0200
-@@ -4,8 +4,8 @@
- DEFINES= 
- 
- #options if you have a bind>=4.9.4 libresolv (or, maybe, glibc)
-LDLIBS=
- ADDLIB=
-+LDLIBS=-lresolv $(ADDLIB)
- 
- #options if you compile with libc5, and without a bind>=4.9.4 libresolv
- # NOT AVAILABLE. Please, use libresolv.
--- a/iputils-ifenslave.tar.bz2
+++ b/iputils-ifenslave.tar.bz2
@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:8d05d05422bb7b96ec96c3ff61c07ad3fd2335e6599df960539386868aa33ee1
-size 7737
--- a/iputils-s20101006-capabilities.diff
+++ b/iputils-s20101006-capabilities.diff
@ -0,0 +1,109 @@
+From 5701111b91ed61d329deb13768776b84565f785a Mon Sep 17 00:00:00 2001
+From: Ludwig Nussel <ludwig.nussel@suse.de>
+Date: Wed, 3 Nov 2010 17:43:42 +0100
+Subject: [PATCH] drop capabilities
+
+dropping capabilities makes sure that ping also gets rid of privileges
+gained via fscaps. Capabilities are also dropped when called as root so
+the running ping process has no special privileges anymore at all even
+in that case.
+---
+ Makefile |    6 ++++++
+ ping.c   |   15 +++++++++++++++
+ ping6.c  |   15 +++++++++++++++
+ 3 files changed, 36 insertions(+), 0 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index d9a5ca5..6629ebf 100644
+--- a/Makefile
+++ b/Makefile
+@@ -6,6 +6,12 @@ DEFINES=
+ #options if you have a bind>=4.9.4 libresolv (or, maybe, glibc)
+ LDLIBS=
+ ADDLIB=
+CAPABILITIES=
+
+ifeq ($(CAPABILITIES),1)
+DEFINES += -DHAVE_CAPABILITIES
+LDLIBS += -lcap
+endif
+ 
+ #options if you compile with libc5, and without a bind>=4.9.4 libresolv
+ # NOT AVAILABLE. Please, use libresolv.
+diff --git a/ping.c b/ping.c
+index eacb29d..afebeb7 100644
+--- a/ping.c
+++ b/ping.c
+@@ -62,6 +62,9 @@ char copyright[] =
+ 
+ #include <netinet/ip.h>
+ #include <netinet/ip_icmp.h>
+#ifdef HAVE_CAPABILITIES
+#include <sys/capability.h>
+#endif
+ 
+ #ifndef ICMP_FILTER
+ #define ICMP_FILTER	1
+@@ -122,10 +125,22 @@ main(int argc, char **argv)
+ 	u_char *packet;
+ 	char *target, hnamebuf[MAX_HOSTNAMELEN];
+ 	char rspace[3 + 4 * NROUTES + 1];	/* record route space */
+#ifdef HAVE_CAPABILITIES
+	cap_t caps;
+#endif
+ 
+ 	icmp_sock = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP);
+ 	socket_errno = errno;
+ 
+#ifdef HAVE_CAPABILITIES
+	/* drop all capabilities unconditionally so even root isn't special anymore */
+	caps = cap_init();
+	if (cap_set_proc(caps) < 0) {
+		perror("ping: cap_set_proc");
+		exit(-1);
+	}
+#endif
+
+ 	uid = getuid();
+ 	if (setuid(uid)) {
+ 		perror("ping: setuid");
+diff --git a/ping6.c b/ping6.c
+index c5ff881..3c6a75a 100644
+--- a/ping6.c
+++ b/ping6.c
+@@ -72,6 +72,9 @@ char copyright[] =
+ #include <netinet/ip6.h>
+ #include <netinet/icmp6.h>
+ #include <resolv.h>
+#ifdef HAVE_CAPABILITIES
+#include <sys/capability.h>
+#endif
+ 
+ #include "ping6_niquery.h"
+ 
+@@ -528,10 +531,22 @@ int main(int argc, char *argv[])
+ 	int csum_offset, sz_opt;
+ #endif
+ 	static uint32_t scope_id = 0;
+#ifdef HAVE_CAPABILITIES
+	cap_t caps;
+#endif
+ 
+ 	icmp_sock = socket(AF_INET6, SOCK_RAW, IPPROTO_ICMPV6);
+ 	socket_errno = errno;
+ 
+#ifdef HAVE_CAPABILITIES
+	/* drop all capabilities unconditionally so even root isn't special anymore */
+	caps = cap_init();
+	if (cap_set_proc(caps) < 0) {
+		perror("ping: cap_set_proc");
+		exit(-1);
+	}
+#endif
+
+ 	uid = getuid();
+ 	if (setuid(uid)) {
+ 		perror("ping: setuid");
+-- 
+1.7.1
+
--- a/iputils-s20101006.tar.bz2
+++ b/iputils-s20101006.tar.bz2
@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:fd3af46c80ebb99607c2ca1f2a3608b6fe828e25bbec6e54f2afd25f6ddb6ee7
+size 94386
--- a/iputils.changes
+++ b/iputils.changes
@ -1,3 +1,17 @@
+-------------------------------------------------------------------
+Wed Nov  3 14:31:09 UTC 2010 - lnussel@suse.de
+
+- update to version s20100418
+  * ping,ping6: avoid gethostbyaddr during ping flood.
+  * arping: Set correct broadcast address.
+  * tracepath: Fix some small typos in tracepath.sgml.
+  * ping: Fix resource consumption triggered by specially crafted ICMP
+    Echo Reply (CVE-2010-2529)
+- don't install fscaps, rely on /etc/permissions handling instead
+- compile using -fno-strict-aliasing
+- drop capabilities unconditionally (bnc#645423)
+- spec file cleanup
+
 -------------------------------------------------------------------
 Mon Oct 11 03:56:55 UTC 2010 - reddwarf@opensuse.org

--- a/iputils.spec
+++ b/iputils.spec
@ -25,23 +25,22 @@ BuildRequires:  sysfsutils-devel
 %else
 BuildRequires:  sysfsutils
 %endif
-Summary:        IPv4and IPv6 Networking Utilities
-Version:        s20100418
-Release:        2
+BuildRequires:  libcap-devel
+Summary:        IPv4 and IPv6 Networking Utilities
+Version:        s20101006
+Release:        1
 License:        BSD3c ; GPLv2+
 Group:          Productivity/Networking/Other
-Provides:       nkitb
-Obsoletes:      nkitb
 Url:            http://www.skbuff.net/iputils
-Source:         iputils.tar.bz2
-Source1:        iputils-ifenslave.tar.bz2
-Patch1:         %name-pingnamelookuponce.diff
-Patch2:         %name-traceroute6-stdint.diff
-Patch3:         %name-ifenslave.diff
-Patch4:         %name-arping-set_device_broadcast.diff
-Patch5:         %name-ADDLIB.diff
-Prefix:         %_prefix
+Source:         http://www.skbuff.net/iputils/iputils-%{version}.tar.bz2
+# XXX: from linux/Documentation/networking/ifenslave.c
+Source1:        ifenslave.c
+Patch1:         iputils-pingnamelookuponce.diff
+Patch2:         iputils-traceroute6-stdint.diff
+Patch3:         iputils-ifenslave.diff
+Patch6:         iputils-s20101006-capabilities.diff
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
+PreReq:         permissions

 %description
 This package contains some small network tools for IPv4 and IPv6 like
@ -55,17 +54,22 @@ Authors:
 	YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

 %prep
-%setup -q -n %name -b1
+%setup -q
+cp -a %SOURCE1 . 
 %patch1
 %patch2
 %patch3
-%patch4
-%patch5
+#patch4
+#patch5
+%patch6 -p1
 mkdir linux
 touch linux/autoconf.h

 %build
-make %{?_smp_mflags} KERNEL_INCLUDE=$PWD DEFINES='%optflags -fpie' ADDLIB='-pie'
+make %{?_smp_mflags} KERNEL_INCLUDE=$PWD \
+	CCOPT='%optflags -fno-strict-aliasing -fpie -D_GNU_SOURCE' \
+	LDLIBS='-pie -lcap -lresolv' \
+	CAPABILITIES=1
 gcc $RPM_OPT_FLAGS -o ifenslave ifenslave.c

 make man
@ -94,20 +98,21 @@ install  -m 644 doc/rdisc.8		$RPM_BUILD_ROOT%_mandir/man8/
 %clean
 rm -rf $RPM_BUILD_ROOT

+%post
+%run_permissions
+
+%verifyscript
+%verify_permissions -e /bin/ping
+%verify_permissions -e /bin/ping6
+
 %files
 %defattr(-,root,root)
 %doc RELNOTES
 /sbin/arping
 /sbin/ifenslave
 /sbin/clockdiff
-# Official rpm packages prior to 11.4 hadn't libcap support
-%if 0%{?suse_version} <= 1130
-%attr(4755,root,root) /bin/ping
-%attr(4755,root,root) /bin/ping6
-%else
-%caps(cap_net_raw=ep) /bin/ping
-%caps(cap_net_raw=ep) /bin/ping6
-%endif
+%verify(not mode) %attr(4755,root,root) /bin/ping
+%verify(not mode) %attr(4755,root,root) /bin/ping6
 /bin/ipg
 /sbin/tracepath
 /sbin/tracepath6
--- a/iputils.tar.bz2
+++ b/iputils.tar.bz2
@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:183d4f767dab69dc7cf3782e0ded63cc5066bfc102a981ec4766334ff33d0ae1
-size 115376