rpm/bind
SHA256
1
0
Fork 0
forked from pool/bind
Code Pull Requests Activity

OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/bind?expand=0&rev=18

Browse Source
This commit is contained in:
OBS User unknown 2008-07-21 21:25:45 +00:00 committed by Git OBS Bridge
parent 2d7ed1ab97
commit 36f3cb6a7b
6 changed files with 37 additions and 1627 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
bind-9.4.2.tar.gz
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:5add82a67dc98b89b4a0f95a467480b0f6b7d3a6b563a13076d9f701286960bd
size 6574042

3
bind-9.5.0P1.tar.gz Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:53d529b140ec9b9078512bacc26493b8283e1ca422f5e8d90b4e6fd6dc9cd0d9
size 6705907

15
bind.changes
View File

@ -1,3 +1,18 @@
-------------------------------------------------------------------
Wed Jul 16 12:50:46 CEST 2008 - ug@suse.de
- BIND 9.5 offers many new features, including many
behind-the-scenes improvements. For the most part, the non-visible
features help ISC's customers who have run into the upper-end of
what BIND 9.4 could handle.
See CHANGES for details
- Statistics Counters / server
- Cache cleaning enhancements
- GSS TSIG
- DHCID Resource Record (RR)
- Handling EDNS timeouts
- version 9.5.0
------------------------------------------------------------------- -------------------------------------------------------------------
Mon Jun 9 14:18:10 CEST 2008 - ug@suse.de Mon Jun 9 14:18:10 CEST 2008 - ug@suse.de

28
bind.spec
View File

@ -1,5 +1,5 @@
# #
# spec file for package bind (Version 9.4.2) # spec file for package bind (Version 9.5.0P1)
# #
# Copyright (c) 2008 SUSE LINUX Products GmbH, Nuernberg, Germany. # Copyright (c) 2008 SUSE LINUX Products GmbH, Nuernberg, Germany.
# This file and all modifications and additions to the pristine # This file and all modifications and additions to the pristine
@ -13,12 +13,12 @@
Name: bind Name: bind
%define pkg_name bind %define pkg_name bind
%define pkg_vers 9.4.2 %define pkg_vers 9.5.0P1
#BuildRequires: openldap2 openldap2-devel #BuildRequires: openldap2 openldap2-devel
BuildRequires: libcap libcap-devel openssl openssl-devel BuildRequires: libcap libcap-devel libxml2-devel openssl openssl-devel
Summary: Domain Name System (DNS) Server (named) Summary: Domain Name System (DNS) Server (named)
Version: 9.4.2 Version: 9.5.0P1
Release: 45 Release: 1
%define SDB_LDAP_VERSION 1.0-beta %define SDB_LDAP_VERSION 1.0-beta
License: BSD 3-Clause; X11/MIT License: BSD 3-Clause; X11/MIT
Group: Productivity/Networking/DNS/Servers Group: Productivity/Networking/DNS/Servers
@ -40,8 +40,6 @@ Patch4: perl-path.diff
#Patch50: sdb_ldap.diff #Patch50: sdb_ldap.diff
Patch51: pie_compile.diff Patch51: pie_compile.diff
Patch52: named-bootconf.diff Patch52: named-bootconf.diff
Patch53: capset.diff
Patch54: random-generator-fix.diff
%if %ul_version >= 1 %if %ul_version >= 1
%define VENDOR UL %define VENDOR UL
%else %else
@ -199,8 +197,7 @@ Authors:
%patch51 %patch51
%endif %endif
%patch52 %patch52
%patch53 #%patch53
%patch54 -p1
# modify settings of some files regarding to OS version and vendor # modify settings of some files regarding to OS version and vendor
function replaceStrings() function replaceStrings()
{ {
@ -258,6 +255,7 @@ CONFIGURE_OPTIONS="\
--enable-libbind \ --enable-libbind \
--with-libtool \ --with-libtool \
--enable-runidn \ --enable-runidn \
--with-libxml2
" "
./configure ${CONFIGURE_OPTIONS} ./configure ${CONFIGURE_OPTIONS}
%{__make} %{__make}
@ -682,6 +680,18 @@ fi
%doc %{_mandir}/man5/idnrc.5.gz %doc %{_mandir}/man5/idnrc.5.gz
%changelog %changelog
* Wed Jul 16 2008 ug@suse.de
- BIND 9.5 offers many new features, including many
behind-the-scenes improvements. For the most part, the non-visible
features help ISC's customers who have run into the upper-end of
what BIND 9.4 could handle.
See CHANGES for details
- Statistics Counters / server
- Cache cleaning enhancements
- GSS TSIG
- DHCID Resource Record (RR)
- Handling EDNS timeouts
- version 9.5.0
* Mon Jun 09 2008 ug@suse.de * Mon Jun 09 2008 ug@suse.de
- VUL-0: spoofing made easier due to non-random UDP - VUL-0: spoofing made easier due to non-random UDP
source port VU#800113 (bnc#396963) source port VU#800113 (bnc#396963)

265
capset.diff
View File

@ -1,265 +0,0 @@
--- bin/named/unix/os.c
+++ bin/named/unix/os.c 2008/05/06 10:18:34
@@ -60,16 +60,16 @@
#endif
/*
- * If there's no <linux/capability.h>, we don't care about <sys/prctl.h>
+ * If there's no <sys/capability.h>, we don't care about <sys/prctl.h>
*/
-#ifndef HAVE_LINUX_CAPABILITY_H
+#ifndef HAVE_SYS_CAPABILITY_H
#undef HAVE_SYS_PRCTL_H
#endif
/*
* Linux defines:
* (T) HAVE_LINUXTHREADS
- * (C) HAVE_LINUX_CAPABILITY_H
+ * (C) HAVE_SYS_CAPABILITY_H
* (P) HAVE_SYS_PRCTL_H
* The possible cases are:
* none: setuid() normally
@@ -111,7 +111,7 @@
static isc_boolean_t done_setuid = ISC_FALSE;
static int dfd[2] = { -1, -1 };
-#ifdef HAVE_LINUX_CAPABILITY_H
+#ifdef HAVE_SYS_CAPABILITY_H
static isc_boolean_t non_root = ISC_FALSE;
static isc_boolean_t non_root_caps = ISC_FALSE;
@@ -125,7 +125,7 @@
#define _LINUX_FS_H
#include <sys/syscall.h> /* Required for syscall(). */
-#include <linux/capability.h> /* Required for _LINUX_CAPABILITY_VERSION. */
+#include <sys/capability.h> /* Required for _LINUX_CAPABILITY_VERSION. */
#ifdef HAVE_SYS_PRCTL_H
#include <sys/prctl.h> /* Required for prctl(). */
@@ -142,32 +142,16 @@
#endif /* HAVE_SYS_PRCTL_H */
-#ifndef SYS_capset
-#ifndef __NR_capset
-#include <asm/unistd.h> /* Slackware 4.0 needs this. */
-#endif
-#define SYS_capset __NR_capset
-#endif
-
static void
-linux_setcaps(unsigned int caps) {
- struct __user_cap_header_struct caphead;
- struct __user_cap_data_struct cap;
+linux_setcaps(cap_t caps) {
char strbuf[ISC_STRERRORSIZE];
if ((getuid() != 0 && !non_root_caps) || non_root)
return;
- memset(&caphead, 0, sizeof(caphead));
- caphead.version = _LINUX_CAPABILITY_VERSION;
- caphead.pid = 0;
- memset(&cap, 0, sizeof(cap));
- cap.effective = caps;
- cap.permitted = caps;
- cap.inheritable = 0;
- if (syscall(SYS_capset, &caphead, &cap) < 0) {
+ if (cap_set_proc(caps) < 0) {
isc__strerror(errno, strbuf, sizeof(strbuf));
- ns_main_earlyfatal("capset failed: %s:"
+ ns_main_earlyfatal("cap_set_proc failed: %s:"
" please ensure that the capset kernel"
" module is loaded. see insmod(8)",
strbuf);
@@ -176,7 +160,9 @@
static void
linux_initialprivs(void) {
- unsigned int caps;
+ cap_t caps;
+ cap_value_t capval;
+ char strbuf[ISC_STRERRORSIZE];
/*%
* We don't need most privileges, so we drop them right away.
@@ -184,17 +170,26 @@
* capabilities to the minimum needed to run the server.
*/
- caps = 0;
+ if ( (caps = cap_init()) == NULL) {
+ isc__strerror(errno, strbuf, sizeof (strbuf));
+ ns_main_earlyfatal("cap_init failed: %s", strbuf);
+ }
/*
* We need to be able to bind() to privileged ports, notably port 53!
*/
- caps |= (1 << CAP_NET_BIND_SERVICE);
+
+ capval = CAP_NET_BIND_SERVICE;
+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
/*
* We need chroot() initially too.
*/
- caps |= (1 << CAP_SYS_CHROOT);
+
+ capval = CAP_SYS_CHROOT;
+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
#if defined(HAVE_SYS_PRCTL_H) || !defined(HAVE_LINUXTHREADS)
/*
@@ -203,19 +198,25 @@
* tried) or we're not using threads. If either of these is
* true, we want the setuid capability.
*/
- caps |= (1 << CAP_SETUID);
+ capval = CAP_SETUID;
+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
#endif
/*
* Since we call initgroups, we need this.
*/
- caps |= (1 << CAP_SETGID);
+ capval = CAP_SETGID;
+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
/*
* Without this, we run into problems reading a configuration file
* owned by a non-root user and non-world-readable on startup.
*/
- caps |= (1 << CAP_DAC_READ_SEARCH);
+ capval = CAP_DAC_READ_SEARCH;
+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
/*
* XXX We might want to add CAP_SYS_RESOURCE, though it's not
@@ -224,14 +225,18 @@
* of files, the stack size, data size, and core dump size to
* support named.conf options, this is now being added to test.
*/
- caps |= (1 << CAP_SYS_RESOURCE);
+ capval = CAP_SYS_RESOURCE;
+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
linux_setcaps(caps);
}
static void
linux_minprivs(void) {
- unsigned int caps;
+ cap_t caps;
+ cap_value_t capval;
+ char strbuf[ISC_STRERRORSIZE];
/*%
* Drop all privileges except the ability to bind() to privileged
@@ -241,8 +246,14 @@
* chroot() could be used to escape from the chrooted area.
*/
- caps = 0;
- caps |= (1 << CAP_NET_BIND_SERVICE);
+ if ( (caps = cap_init()) == NULL) {
+ isc__strerror(errno, strbuf, sizeof (strbuf));
+ ns_main_earlyfatal("cap_init failed: %s", strbuf);
+ }
+
+ capval = CAP_NET_BIND_SERVICE;
+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
/*
* XXX We might want to add CAP_SYS_RESOURCE, though it's not
@@ -251,7 +262,9 @@
* of files, the stack size, data size, and core dump size to
* support named.conf options, this is now being added to test.
*/
- caps |= (1 << CAP_SYS_RESOURCE);
+ capval = CAP_SYS_RESOURCE;
+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
+ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
linux_setcaps(caps);
}
@@ -278,7 +291,7 @@
}
#endif
-#endif /* HAVE_LINUX_CAPABILITY_H */
+#endif /* HAVE_SYS_CAPABILITY_H */
static void
@@ -295,7 +308,7 @@
void
ns_os_init(const char *progname) {
setup_syslog(progname);
-#ifdef HAVE_LINUX_CAPABILITY_H
+#ifdef HAVE_SYS_CAPABILITY_H
linux_initialprivs();
#endif
#ifdef HAVE_LINUXTHREADS
@@ -474,7 +487,7 @@
done_setuid = ISC_TRUE;
#ifdef HAVE_LINUXTHREADS
-#ifdef HAVE_LINUX_CAPABILITY_H
+#ifdef HAVE_SYS_CAPABILITY_H
if (!non_root_caps)
ns_main_earlyfatal("-u with Linux threads not supported: "
"requires kernel support for "
@@ -496,7 +509,7 @@
ns_main_earlyfatal("setuid(): %s", strbuf);
}
-#if defined(HAVE_LINUX_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
+#if defined(HAVE_SYS_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
linux_minprivs();
#endif
#if defined(HAVE_SYS_PRCTL_H) && defined(PR_SET_DUMPABLE)
@@ -518,7 +531,7 @@
ns_os_changeuser(); /* Call setuid() before threads are started */
#endif
-#if defined(HAVE_LINUX_CAPABILITY_H) && defined(HAVE_LINUXTHREADS)
+#if defined(HAVE_SYS_CAPABILITY_H) && defined(HAVE_LINUXTHREADS)
linux_minprivs();
#endif
}
--- config.h.in
+++ config.h.in 2008/05/06 10:17:46
@@ -187,8 +187,8 @@
/* Define to 1 if you have the `thr' library (-lthr). */
#undef HAVE_LIBTHR
-/* Define to 1 if you have the <linux/capability.h> header file. */
-#undef HAVE_LINUX_CAPABILITY_H
+/* Define to 1 if you have the <sys/capability.h> header file. */
+#undef HAVE_SYS_CAPABILITY_H
/* Define to 1 if you have the <locale.h> header file. */
#undef HAVE_LOCALE_H
--- configure.in
+++ configure.in 2008/05/06 10:17:46
@@ -1695,7 +1695,8 @@
[ --disable-linux-caps disable linux capabilities])
case "$enable_linux_caps" in
yes|'')
- AC_CHECK_HEADERS(linux/capability.h)
+ AC_CHECK_HEADERS(sys/capability.h)
+ AC_CHECK_LIB(cap, cap_set_proc, LIBS="-lcap $LIBS")
;;
no)
;;

1350
random-generator-fix.diff
View File

File diff suppressed because it is too large Load Diff