Accepting request 1328801 from network:ha-clustering:Factory

- Update corosync.spec:
  * Stop marking /var/lib/corosyn and /var/log/cluster as %ghost (jsc#PED-14799)

OBS-URL: https://build.opensuse.org/request/show/1328801
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/corosync?expand=0&rev=84

0001-harden-services-with-systemd-sandboxing.patch

@@ -0,0 +1,53 @@
+From 6d977c3f286a39b7e35c46ad3642a34617bdd833 Mon Sep 17 00:00:00 2001
+From: nicholasyang <nicholas.yang@suse.com>
+Date: Wed, 13 Nov 2024 14:28:53 +0800
+Subject: [PATCH] harden services with systemd sandboxing
+
+---
+ init/corosync-notifyd.service.in | 10 ++++++++++
+ init/corosync.service.in         | 10 ++++++++++
+ 2 files changed, 20 insertions(+)
+
+diff --git a/init/corosync-notifyd.service.in b/init/corosync-notifyd.service.in
+index 410a6837..604a2a47 100644
+--- a/init/corosync-notifyd.service.in
++++ b/init/corosync-notifyd.service.in
+@@ -10,5 +10,15 @@ ExecStart=@SBINDIR@/corosync-notifyd -f $OPTIONS
+ Type=notify
+ Restart=on-failure
+ 
++# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
++ProtectSystem=full
++ProtectHome=true
++PrivateDevices=true
++ProtectHostname=true
++ProtectClock=true
++ProtectKernelTunables=true
++ProtectKernelModules=true
++ProtectKernelLogs=true
++
+ [Install]
+ WantedBy=multi-user.target
+diff --git a/init/corosync.service.in b/init/corosync.service.in
+index bd2a48a9..63381f47 100644
+--- a/init/corosync.service.in
++++ b/init/corosync.service.in
+@@ -30,5 +30,15 @@ StandardError=null
+ #  rewrite according to environment.
+ #ExecStartPre=/sbin/modprobe softdog
+ 
++# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
++ProtectSystem=full
++ProtectHome=true
++PrivateDevices=true
++ProtectHostname=true
++ProtectClock=true
++ProtectKernelTunables=true
++ProtectKernelModules=true
++ProtectKernelLogs=true
++
+ [Install]
+ WantedBy=multi-user.target
+-- 
+2.47.0
+

_service

@@ -1,19 +1,19 @@
 <services>
-  <service name="tar_scm" mode="disabled">
+  <service name="tar_scm" mode="manual">
     <param name="url">https://github.com/corosync/corosync.git</param>
     <param name="scm">git</param>
     <param name="filename">corosync</param>
-    <param name="versionformat">3.1.8+%cd.%h</param>
-    <param name="revision">40e08b21</param>
+    <param name="versionformat">3.1.10</param>
+    <param name="revision">v3.1.10</param>
     <param name="changesgenerate">enable</param>
   </service>
 
-  <service name="recompress" mode="disabled">
+  <service name="recompress" mode="manual">
     <param name="file">corosync*.tar</param>
     <param name="compression">gz</param>
   </service>
 
-  <service name="set_version" mode="disabled">
+  <service name="set_version" mode="manual">
     <param name="basename">corosync</param>
   </service>
 </services>

_servicedata

@@ -1,4 +1,4 @@
 <servicedata>
 <service name="tar_scm">
                 <param name="url">https://github.com/corosync/corosync.git</param>
-              <param name="changesrevision">40e08b219de94f3850f8f39291d89a5713e32f06</param></service></servicedata>
+              <param name="changesrevision">ff20c2b123cd05e51c752630c0e9d20471118225</param></service></servicedata>

corosync-3.1.10.tar.gz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:cfb3334bbd1848789f27a4ecb6b3f9c21190c4a02549a43b507c5d74e48ca4a8
+size 505393

corosync.changes

@@ -1,3 +1,134 @@
+-------------------------------------------------------------------
+Mon Jan 12 09:19:23 UTC 2026 - Nicholas Yang <nicholas.yang@suse.com>
+
+- Update corosync.spec:
+  * Stop marking /var/lib/corosyn and /var/log/cluster as %ghost (jsc#PED-14799)
+
+-------------------------------------------------------------------
+Fri Dec 26 08:56:37 UTC 2025 - Nicholas Yang <nicholas.yang@suse.com>
+
+- Update corosync.spec:
+  * Drop /var/lib/corosync and /var/log/cluster for compatibility with immutable mode (jsc#PED-14799)
+  * Add tmpfiles.d/corosync.conf to create /var/log/cluster and /var/lib/corosync (jsc#PED-14799)
+  * Drop %config(noreplace) for fillup templates to ensure correct updates.
+  * Drop %config(noreplace) for config examples in /usr/share/doc.
+  * Add the missing %service_del_postun script.
+  * Remove legacy dir /usr/lib/corosync
+  * Remove legacy SLE 12 compatibility conditionals and macros.
+  * Migrate D-Bus configuration files from /etc to /usr/share.
+
+-------------------------------------------------------------------
+Fri Dec 12 05:54:36 UTC 2025 - Nicholas Yang <nicholas.yang@suse.com>
+
+- Update to version 3.1.10:
+  * Unit tests for fd_get() calls
+  * rust: fix fd_get() pointer dereference
+  * configure.ac: Remove MSGHDR fields detection
+  * totemudp: Remove MSGHDR conditionals
+  * totemudp: Rework truncated packet detection
+  * totemudpu: Remove MSGHDR conditionals
+  * totemudpu: Fix weird indentation
+  * totemudpu: Rework truncated packet detection
+  * totemknet: Remove MSGHDR conditionals
+  * totemknet: Rework truncated packet detection
+  * clang: Add missing void to function declarations
+  * configure: Remove unsupported -Wunsigned-char
+  * Handle knet's removal of SCTP gracefully
+  * SCTP in knet is deprecated
+  * allow to use dscp for traffic prioritization
+  * totemknet: Remove usage of struct ether_header
+  * sam: Do not lock sam_register
+  * cmapctl: Check return code of cmap_set_uint32
+  * sam: Refactor locking
+  * testsam: Add sam_finalize deadlock test
+  * testsam: Refactor test
+  * testsam: Make test work with votequorum
+  * testsam: Try to turn off coredump
+  * cfg: Fix cfg_get_node_addrs incorrect retype
+  * totemknet: Fix msg_msg_hdr typo
+  * totemknet: Handle trncated packets and msg_flags
+  * totemknet: Include ethernet.h only for nozzle
+  * totempg: Retype iovec iov_base
+  * main: Retype iovec iov_base
+  * pload: Retype iovec iov_base
+  * cmap: Retype iovec iov_base
+  * vsf_quorum: Include alloca header file
+  * logsys: Remove config mutex
+  * coroparse: Suppress coverity toctou error
+  * cpg: Add comment about potential resource leak
+  * totempg: Suppress coverity sleep error
+  * totemconfig: Suppress coverity unused_value errors
+  * totemconfig: Suppress coverity no_effect error
+  * coverity: Suppress weak_crypto errors
+  * keygen: Enhance read random loop
+  * cpg: Don't call cpg_deliver_fn if unset
+  * totempg: Fix signedness for result of mcast_msg
+  * logsys: Fix signedness of get_unblocked
+  * cpg: Fix signedness of munmap result
+  * man: Clarify processor scaling
+  * init: Use LogsDirectory in systemd unit file
+  * exec: Add support for env STATE_DIRECTORY
+  * config: Cleanup dropped options
+  * totemconfig: Store mcastport in icmap
+  * man: Enhance description of mcastport
+  * coroparse: Implement handler for str_to_ull error
+  * coroparse: Remove kv_items from list
+  * coroparse: Initialize logger_subsys_items_head
+  * coroparse: Fix memory leaks
+  * coroparse: Store key with prefix for nodelist.node
+  * coroparse: Don't allow sections within member
+  * coroparse: Don't allow sections within uidgid
+  * coroparse: Store subsections of logging_daemon
+  * coroparse: Store subsections of logger_subsys
+  * coroparse: Handle end of special sections
+  * coroparse: Remove unused code
+  * coroparse: Mark path in parse_section as const
+  * coroparse: Check emptiness of key name
+  * Fix stack buffer overflow in remove_whitespace()
+  * totemsrp: Check size of orf_token msg
+  * totemknet: Handle new knet2 datafd API
+  * spec: Use GitHub source URL
+- Remove a patch as it is included in 3.1.10
+  * 779.patch
+
+-------------------------------------------------------------------
+Wed Mar 26 09:20:06 UTC 2025 - Nicholas Yang <nicholas.yang@suse.com>
+
+- Add a patch to fix CVE-2025-30472 (bsc#1239987)
+  * 779.patch
+
+-------------------------------------------------------------------
+Mon Nov 18 03:51:09 UTC 2024 - nicholas.yang@suse.com
+
+- Update to version 3.1.9:
+  * rust: Update to latest standards
+  * totemsrp: Fix orf_token stats
+  * totem: Use uint64_t type and QB_TIME_NS_IN_MSEC
+  * totem: Use proper timestamp type for token warning
+  * stats: Store token rx and tx timestamps as 64-bit
+  * rust: fix clippy warning in rust 1.81
+  * coroparse: Free kv_item key and value on failure
+  * icmap: Free memory if qb_map_notify_add fails
+  * cfg: Free new_config interfaces on failure
+  * main: support lock pid file arg
+  * man: fix a typo in cpg_model_initialize
+  * man: Improve quorum provider formatting
+  * rust: tests return errors and don't hang
+  * rust: Improve Rust bindings
+  * Move corosync-notifyd policy file into $(datadir)/dbus-1/system.d
+  * man: corosync.conf: Multi improvements
+  * totem: Fix reference links
+  * Report crypto errors back to cfg reload
+  * Fix up the library .versions files
+  * configure: Fix building of rust for release
+  * License: Fix year (mainly to fix rust building)
+
+-------------------------------------------------------------------
+Wed Nov 13 06:48:08 UTC 2024 - Nicholas Yang <nicholas.yang@suse.com>
+
+- Add a patch to harden services with systemd sandboxing:
+  * 0001-harden-services-with-systemd-sandboxing.patch
+
 -------------------------------------------------------------------
 Wed May 15 12:18:23 UTC 2024 - Emil Penchev <emil.penchev@suse.com>
 
@@ -232,7 +363,7 @@ Wed May 15 12:18:23 UTC 2024 - Emil Penchev <emil.penchev@suse.com>
   * totemconfig: Enhance totem.ip_version
   * totemip: Add debug information to totemip_parse
   * totemconfig: Add IPs to family mismatch error
-  * config: Look up hostnames in a defined order
+  * config: Look up hostnames in a defined order
   * Fix corosync.conf.5 manpage typos
   * man: Add some information about address resolution
   * totemconfig: Really use totemip_parse results

corosync.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package corosync
 #
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2026 SUSE LLC and contributors
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -12,68 +12,52 @@
 # license that conforms to the Open Source Definition (Version 1.9)
 # published by the Open Source Initiative.
 
-# Please submit bugfixes or comments via http://bugs.opensuse.org/
+# Please submit bugfixes or comments via https://bugs.opensuse.org/
 #
 
 
-#Compat macro for new _fillupdir macro introduced in Nov 2017
-%if ! %{defined _fillupdir}
-  %define _fillupdir /var/adm/fillup-templates
-%endif
-
-# Conditionals
-# Invoke "rpmbuild --without <feature>" or "rpmbuild --with <feature>"
-# to disable or enable specific features
 %bcond_with watchdog
 %bcond_with monitoring
 %bcond_with snmp
-%bcond_with nozzle
 %bcond_with dbus
+%bcond_without systemd
 %bcond_with xmlconf
+%bcond_with nozzle
 %bcond_with vqsim
 %bcond_without runautogen
-%bcond_without systemd
 %bcond_with userflags
 
 %global gitver %{?numcomm:.%{numcomm}}%{?alphatag:.%{alphatag}}%{?dirty:.%{dirty}}
 %global gittarver %{?numcomm:.%{numcomm}}%{?alphatag:-%{alphatag}}%{?dirty:-%{dirty}}
 
-%if 0%{?sles_version} == 12
-%ifnarch s390 s390x
-%define buildib 1
-%endif
-%endif
-%if 0%{?suse_version}
-%define _libexecdir %{_libdir}
-%endif
-
 Name:           corosync
 Summary:        The Corosync Cluster Engine and Application Programming Interfaces
 License:        BSD-3-Clause
 Group:          Productivity/Clustering/HA
-Version:        3.1.8
-Release:        3
-Url:            http://corosync.github.io/corosync/
-Source0:        https://build.clusterlabs.org/corosync/releases/%{name}-%{version}%{?gittarver}.tar.gz
+Version:        3.1.10
+Release:        0
+URL:            http://corosync.github.io/corosync/
+Source0:        %{name}-%{version}.tar.gz
+Source1:        %{name}.tmpfiles.d.conf
+Patch0:         0001-harden-services-with-systemd-sandboxing.patch
 
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
-# provide openais on purpose, the package has been deleted.
 
 # Runtime bits
 # The automatic dependency overridden in favor of explicit version lock
 Requires:       %{name}-libs = %{version}-%{release}
 
 # Support crypto reload
-Requires: libknet1 >= 1.28
+Requires:       libknet1 >= 1.28
 # NSS crypto plugin should be always installed
-Requires: libknet1-crypto-nss-plugin >= 1.28
+Requires:       libknet1-crypto-nss-plugin >= 1.28
 
 # Build bits
 BuildRequires:  gcc
 
 BuildRequires:  groff-full
-BuildRequires:  libqb-devel
 BuildRequires:  libknet-devel >= 1.28
+BuildRequires:  libqb-devel
 BuildRequires:  zlib-devel
 %if %{with runautogen}
 BuildRequires:  autoconf
@@ -90,34 +74,32 @@ BuildRequires:  net-snmp-devel
 BuildRequires:  dbus-1-devel
 %endif
 %if %{with nozzle}
-BuildRequires: libnozzle-devel
+BuildRequires:  libnozzle-devel
 %endif
 %if %{with systemd}
+%{?systemd_requires}
+BuildRequires:  systemd-devel
 BuildRequires:  pkgconfig(systemd)
-BuildRequires:	systemd-devel
-Requires(post): systemd
-Requires(preun): systemd
-Requires(postun): systemd
 %endif
 %if %{with xmlconf}
 Requires:       libxslt
 %endif
 %if %{with vqsim}
-BuildRequires: readline-devel
+BuildRequires:  readline-devel
 %endif
-Obsoletes: libcfg6
-Obsoletes: libcmap4
-Obsoletes: libcorosync_common4
-Obsoletes: libcpg4
-Obsoletes: libquorum5
-Obsoletes: libsam4
-Obsoletes: libtotem_pg5
-Obsoletes: libvotequorum8
+Obsoletes:      libcfg6
+Obsoletes:      libcmap4
+Obsoletes:      libcorosync_common4
+Obsoletes:      libcpg4
+Obsoletes:      libquorum5
+Obsoletes:      libsam4
+Obsoletes:      libtotem_pg5
+Obsoletes:      libvotequorum8
 
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 
 %prep
-%setup -q -n %{name}-%{version}
+%autosetup -p1 -n %{name}-%{version}
 
 rm -f .git*
 echo %{version} > .tarball-version
@@ -165,10 +147,11 @@ make %{_smp_mflags}
 %make_install
 
 %if %{with dbus}
-mkdir -p -m 0700 %{buildroot}/%{_sysconfdir}/dbus-1/system.d
-install -m 644 %{_builddir}/%{name}-%{version}/conf/corosync-signals.conf %{buildroot}/%{_sysconfdir}/dbus-1/system.d/corosync-signals.conf
+mkdir -p -m 0700 %{buildroot}/%{_datadir}/dbus-1/system.d
+install -m 644 %{_builddir}/%{name}-%{version}/conf/corosync-signals.conf %{buildroot}/%{_datadir}/dbus-1/system.d/corosync-signals.conf
 %endif
 %if %{with systemd}
+install -D -m 0644 %{SOURCE1} %{buildroot}%{_tmpfilesdir}/%{name}.conf
 ln -s /usr/sbin/service %{buildroot}%{_sbindir}/rccorosync
 ln -s /usr/sbin/service %{buildroot}%{_sbindir}/rccorosync-notifyd
 %endif
@@ -179,21 +162,21 @@ rm -f %{buildroot}%{_libdir}/*.a
 rm -f %{buildroot}%{_libdir}/*.la
 # drop docs and html docs for now
 rm -rf %{buildroot}%{_docdir}/*
-mkdir -p %{buildroot}%{_sysconfdir}/sysconfig
-mkdir -p  %{buildroot}/usr/share/doc/packages/corosync/
+
+rm -rf %{buildroot}/etc/logrotate.d/
+rm -rf %{buildroot}/etc/corosync/corosync.conf.example*
+rm -rf %{buildroot}%{localstatedir}/run/
+
 mkdir -p  %{buildroot}%{_fillupdir}/
-mkdir -p  %{buildroot}%{_sysconfdir}/init.d/
 # /etc/sysconfig/corosync-notifyd
 install -m 644 tools/corosync-notifyd.sysconfig.example \
    %{buildroot}%{_fillupdir}/sysconfig.corosync-notifyd
-install -m 0644 conf/corosync.conf.example* %{buildroot}/usr/share/doc/packages/corosync/
-mkdir -p %{buildroot}/usr/lib/corosync
-rm -rf %{buildroot}/etc/corosync/corosync.conf.example*
-rm -rf %{buildroot}/etc/logrotate.d/
-mkdir -p %{buildroot}%{_sysconfdir}/sysconfig
+# /etc/sysconfig/corosync
 install -m 644 init/corosync.sysconfig.example \
    %{buildroot}%{_fillupdir}/sysconfig.corosync
-rm -rf %{buildroot}%{localstatedir}/run/
+
+mkdir -p  %{buildroot}/%{_datadir}/doc/packages/corosync/
+install -m 0644 conf/corosync.conf.example* %{buildroot}/%{_datadir}/doc/packages/corosync/
 
 %description
 This package contains the Corosync Cluster Engine Executive, several default
@@ -205,15 +188,22 @@ APIs and libraries, default configuration files, and an init script.
 %post
 %{fillup_and_insserv -n corosync}
 %{fillup_and_insserv -n corosync-notifyd}
+%tmpfiles_create %{_tmpfilesdir}/%{name}.conf
 %service_add_post corosync.service corosync-notifyd.service
 
 rm -rf  %{_sysconfdir}/corosync/corosync.conf.example %{_sysconfdir}/corosync/corosync.conf.example.unicast
-ln -s /usr/share/doc/packages/corosync/corosync.conf.example %{_sysconfdir}/corosync/
+ln -s %{_datadir}/doc/packages/corosync/corosync.conf.example %{_sysconfdir}/corosync/
 
 %preun
+%if %{with systemd}
 %service_del_preun corosync.service corosync-notifyd.service
+%endif
 
 %postun
+%if %{with systemd}
+%service_del_postun corosync.service corosync-notifyd.service
+%endif
+
 if [ -f /etc/sysconfig/corosync ]; then
     rm /etc/sysconfig/corosync
 fi
@@ -244,13 +234,12 @@ fi
 %dir %{_sysconfdir}/corosync
 %dir %{_sysconfdir}/corosync/uidgid.d
 %dir %{_datadir}/doc/corosync/
-%dir /usr/lib/corosync/
-%config(noreplace) /usr/share/doc/packages/corosync/corosync.conf.example
-%config(noreplace) %{_fillupdir}/sysconfig.corosync-notifyd
-%config(noreplace) %{_fillupdir}/sysconfig.corosync
+%{_datadir}/doc/packages/corosync/corosync.conf.example
+%{_fillupdir}/sysconfig.corosync-notifyd
+%{_fillupdir}/sysconfig.corosync
 
 %if %{with dbus}
-%{_sysconfdir}/dbus-1/system.d/corosync-signals.conf
+%{_datadir}/dbus-1/system.d/corosync-signals.conf
 %endif
 %if %{with snmp}
 %{_datadir}/snmp/mibs/COROSYNC-MIB.txt
@@ -258,13 +247,12 @@ fi
 %if %{with systemd}
 %{_unitdir}/corosync.service
 %{_unitdir}/corosync-notifyd.service
+%{_tmpfilesdir}/%{name}.conf
 %else
 %dir %{_datadir}/corosync
 %{_datadir}/corosync/corosync
 %{_datadir}/corosync/corosync-notifyd
 %endif
-%dir %{_localstatedir}/lib/corosync
-%dir %{_localstatedir}/log/cluster
 %{_mandir}/man7/corosync_overview.7*
 %{_mandir}/man8/corosync.8*
 %{_mandir}/man8/corosync-blackbox.8*
@@ -279,10 +267,10 @@ fi
 %{_mandir}/man7/cmap_keys.7*
 %{_datadir}/doc/corosync/*
 
-#library
+# library
 #
 %package libs
-Summary: The corosync Cluster Engine Libraries
+Summary:        The corosync Cluster Engine Libraries
 
 %description libs
 This package contains corosync libraries.
@@ -298,6 +286,7 @@ This package contains corosync libraries.
 %{_libdir}/libcorosync_common.so.*
 
 %post libs -p /sbin/ldconfig
+
 %postun libs -p /sbin/ldconfig
 
 %package devel
@@ -340,9 +329,9 @@ The Corosync Cluster Engine APIs.
 
 %if %{with vqsim}
 %package vqsim
-Summary: The Corosync Cluster Engine - Votequorum Simulator
-Requires: %{name}-libs = %{version}-%{release}
-Requires: pkgconfig
+Summary:        The Corosync Cluster Engine - Votequorum Simulator
+Requires:       %{name}-libs = %{version}-%{release}
+Requires:       pkgconfig
 
 %description vqsim
 A command-line simulator for the corosync votequorum subsystem.

corosync.tmpfiles.d.conf

@@ -0,0 +1,2 @@
+d   /var/log/cluster    0755    root    root    -
+d   /var/lib/corosync   0755    root    root    -