Ana Guerrero 2024-08-23 20:26:10 +00:00 committed by Git OBS Bridge
commit 7e965d889a
9 changed files with 102 additions and 61 deletions

View File

@ -1,4 +1,4 @@
From 4d32e143124fa47466bbc91f54067674f212c3e3 Mon Sep 17 00:00:00 2001 From a71ec1287fd779d097e9a2b02ada8144eb7de079 Mon Sep 17 00:00:00 2001
From: Thomas Blume <thomas.blume@suse.com> From: Thomas Blume <thomas.blume@suse.com>
Date: Wed, 12 Jun 2019 10:09:01 +0200 Date: Wed, 12 Jun 2019 10:09:01 +0200
Subject: [PATCH] change lockingdir to /run Subject: [PATCH] change lockingdir to /run
@ -8,7 +8,7 @@ Subject: [PATCH] change lockingdir to /run
1 file changed, 1 insertion(+), 1 deletion(-) 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/rpcbind.c b/src/rpcbind.c diff --git a/src/rpcbind.c b/src/rpcbind.c
index cc848b1..65054ff 100644 index ecebe97..9887b82 100644
--- a/src/rpcbind.c --- a/src/rpcbind.c
+++ b/src/rpcbind.c +++ b/src/rpcbind.c
@@ -105,7 +105,7 @@ char *nss_modules = "files"; @@ -105,7 +105,7 @@ char *nss_modules = "files";
@ -21,5 +21,5 @@ index cc848b1..65054ff 100644
int runasdaemon = 0; int runasdaemon = 0;
int insecure = 0; int insecure = 0;
-- --
2.16.4 2.45.2

View File

@ -0,0 +1,39 @@
From 913dc9e39032cf8d06c8f3260ef7fcca636a9ebb Mon Sep 17 00:00:00 2001
From: Johannes Segitz <jsegitz@suse.com>
Date: Fri, 23 Aug 2024 00:51:43 +0200
Subject: [PATCH] systemd/rpcbind.service: Add hardening (bsc#1181400)
Signed-off-by: Johannes Segitz <jsegitz@suse.com>
[ pvorel: Rebased for 1.2.7 ]
Signed-off-by: Petr Vorel <pvorel@suse.cz>
---
systemd/rpcbind.service.in | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/systemd/rpcbind.service.in b/systemd/rpcbind.service.in
index 97207e0..b03409b 100644
--- a/systemd/rpcbind.service.in
+++ b/systemd/rpcbind.service.in
@@ -11,6 +11,19 @@ Wants=rpcbind.target
After=sysinit.target
[Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+PrivateDevices=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions
Type=notify
# distro can provide a drop-in adding EnvironmentFile=-/??? if needed.
EnvironmentFile=-/etc/sysconfig/rpcbind
--
2.45.2

View File

@ -0,0 +1,40 @@
From e400274134c1401359ef38df34fc300e0fba2fba Mon Sep 17 00:00:00 2001
From: Thomas Blume <thomas.blume@suse.com>
Date: Thu, 22 Aug 2024 22:36:49 +0200
Subject: [PATCH] systemd/rpcbind.service: Fix ordering, add
/etc/sysconfig/rpcbind
* Add ordering dependency to rpcbind.service (bsc#1117217)
* Add EnvironmentFile=-/etc/sysconfig/rpcbind to rpcbind.service.in
(bsc#824621)
Link: https://bugzilla.suse.com/show_bug.cgi?id=1117217
Link: https://bugzilla.suse.com/show_bug.cgi?id=824621
Reviewed-by: Petr Vorel <pvorel@suse.cz>
Signed-off-by: Thomas Blume <thomas.blume@suse.com>
[ pvorel: rebased for 1.2.7 ]
Signed-off-by: Petr Vorel <pvorel@suse.cz>
---
systemd/rpcbind.service.in | 2 ++
1 file changed, 2 insertions(+)
diff --git a/systemd/rpcbind.service.in b/systemd/rpcbind.service.in
index c892ca8..97207e0 100644
--- a/systemd/rpcbind.service.in
+++ b/systemd/rpcbind.service.in
@@ -8,10 +8,12 @@ RequiresMountsFor=@statedir@
# rpcbind.socket, no matter how this unit is started.
Requires=rpcbind.socket
Wants=rpcbind.target
+After=sysinit.target
[Service]
Type=notify
# distro can provide a drop-in adding EnvironmentFile=-/??? if needed.
+EnvironmentFile=-/etc/sysconfig/rpcbind
ExecStart=@_sbindir@/rpcbind $RPCBIND_OPTIONS @warmstarts_opt@ -f
[Install]
--
2.45.2

View File

@ -1,27 +0,0 @@
From 9c5efb3a0973d57b79e4fc7a96debe0e6ce2d000 Mon Sep 17 00:00:00 2001
From: Thomas Blume <thomas.blume@suse.com>
Date: Thu, 25 Oct 2018 11:14:32 +0200
Subject: [PATCH] systemd unit files
Add EnvironmentFile=-/etc/sysconfig/rpcbind to rpcbind.service
---
systemd/rpcbind.service.in | 1 +
1 file changed, 1 insertion(+)
Index: rpcbind-1.2.5/systemd/rpcbind.service.in
===================================================================
--- rpcbind-1.2.5.orig/systemd/rpcbind.service.in
+++ rpcbind-1.2.5/systemd/rpcbind.service.in
@@ -8,10 +8,12 @@ RequiresMountsFor=@statedir@
# rpcbind.socket, no matter how this unit is started.
Requires=rpcbind.socket
Wants=rpcbind.target
+After=sysinit.target
[Service]
Type=notify
# distro can provide a drop-in adding EnvironmentFile=-/??? if needed.
+EnvironmentFile=-/etc/sysconfig/rpcbind
ExecStart=@_sbindir@/rpcbind $RPCBIND_OPTIONS -w -f
[Install]

View File

@ -1,24 +0,0 @@
Index: rpcbind-1.2.6/systemd/rpcbind.service.in
===================================================================
--- rpcbind-1.2.6.orig/systemd/rpcbind.service.in
+++ rpcbind-1.2.6/systemd/rpcbind.service.in
@@ -11,6 +11,19 @@ Wants=rpcbind.target
After=sysinit.target
[Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+PrivateDevices=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions
Type=notify
# distro can provide a drop-in adding EnvironmentFile=-/??? if needed.
EnvironmentFile=-/etc/sysconfig/rpcbind

BIN
rpcbind-1.2.6.tar.bz2 (Stored with Git LFS)

Binary file not shown.

3
rpcbind-1.2.7.tar.bz2 Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:f6edf8cdf562aedd5d53b8bf93962d61623292bfc4d47eedd3f427d84d06f37e
size 125792

View File

@ -1,3 +1,16 @@
-------------------------------------------------------------------
Thu Aug 22 20:26:41 UTC 2024 - Petr Vorel <pvorel@suse.cz>
- Update to rpcbind 1.2.7
https://sourceforge.net/projects/rpcbind/files/rpcbind/1.2.7/1.2.7-ChangeLog/download
* rpcinfo: try connecting using abstract address
* Listen on an AF_UNIX abstract address if supported
* autotools/systemd: call rpcbind with -w only on enabled warm starts
* rpcbind: fix double free in init_transport
- Refresh and rename patches (while turning them into git patches)
* 0001-systemd-unit-files.patch -> 0001-systemd-rpcbind.service-Fix-ordering-add-etc-sysconf.patch
* harden_rpcbind.service.patch -> 0001-systemd-rpcbind.service-Add-hardening-bsc-1181400.patch
------------------------------------------------------------------- -------------------------------------------------------------------
Wed Jan 25 14:53:11 UTC 2023 - Thorsten Kukuk <kukuk@suse.com> Wed Jan 25 14:53:11 UTC 2023 - Thorsten Kukuk <kukuk@suse.com>

View File

@ -1,7 +1,7 @@
# #
# spec file for package rpcbind # spec file for package rpcbind
# #
# Copyright (c) 2023 SUSE LLC # Copyright (c) 2024 SUSE LLC
# #
# All modifications and additions to the file contributed by third parties # All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed # remain the property of their copyright owners, unless otherwise agreed
@ -21,7 +21,7 @@
%define _fillupdir %{_localstatedir}/adm/fillup-templates %define _fillupdir %{_localstatedir}/adm/fillup-templates
%endif %endif
Name: rpcbind Name: rpcbind
Version: 1.2.6 Version: 1.2.7
Release: 0 Release: 0
Summary: Transport independent RPC portmapper Summary: Transport independent RPC portmapper
# Git-Web: http://git.linux-nfs.org/?p=steved/rpcbind.git;a=summary # Git-Web: http://git.linux-nfs.org/?p=steved/rpcbind.git;a=summary
@ -31,9 +31,9 @@ URL: http://rpcbind.sourceforge.net
Source: https://downloads.sourceforge.net/sourceforge/%{name}/%{name}-%{version}.tar.bz2 Source: https://downloads.sourceforge.net/sourceforge/%{name}/%{name}-%{version}.tar.bz2
Source2: sysconfig.rpcbind Source2: sysconfig.rpcbind
Source5: rpc-user.conf Source5: rpc-user.conf
Patch1: 0001-systemd-unit-files.patch Patch1: 0001-systemd-rpcbind.service-Fix-ordering-add-etc-sysconf.patch
Patch2: 0001-change-lockingdir-to-run.patch Patch2: 0001-change-lockingdir-to-run.patch
Patch3: harden_rpcbind.service.patch Patch3: 0001-systemd-rpcbind.service-Add-hardening-bsc-1181400.patch
BuildRequires: libtirpc-devel >= 1.0.1 BuildRequires: libtirpc-devel >= 1.0.1
BuildRequires: libtool BuildRequires: libtool
BuildRequires: pkgconfig BuildRequires: pkgconfig