diff --git a/harden_mariadb.service.patch b/harden_mariadb.service.patch deleted file mode 100644 index dbe7d1a..0000000 --- a/harden_mariadb.service.patch +++ /dev/null @@ -1,21 +0,0 @@ -Index: mariadb-10.6.4/support-files/mariadb.service.in -=================================================================== ---- mariadb-10.6.4.orig/support-files/mariadb.service.in -+++ mariadb-10.6.4/support-files/mariadb.service.in -@@ -29,6 +29,16 @@ WantedBy=multi-user.target - - - [Service] -+# added automatically, for details please see -+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort -+ProtectHostname=true -+ProtectClock=true -+ProtectKernelTunables=true -+ProtectKernelModules=true -+ProtectKernelLogs=true -+ProtectControlGroups=true -+RestrictRealtime=true -+# end of automatic additions - - ############################################################################## - ## Core requirements diff --git a/mariadb.changes b/mariadb.changes index 8aed92f..83a4324 100644 --- a/mariadb.changes +++ b/mariadb.changes @@ -1,3 +1,25 @@ +------------------------------------------------------------------- +Tue Nov 16 13:28:35 UTC 2021 - Danilo Spinella + +- Fix rpmlint errors +- Run spec-cleaner + +------------------------------------------------------------------- +Mon Nov 15 16:59:26 UTC 2021 - Danilo Spinella + +- Enable LZ4 compression for INNODB and ROCKSDB, fixes bsc#1186031 + +------------------------------------------------------------------- +Mon Nov 15 11:02:55 UTC 2021 - Danilo Spinella + +- Revert systemd hardening + * Remove harden_mariadb.service.patch + +------------------------------------------------------------------- +Fri Nov 12 21:44:03 UTC 2021 - Callum Farmer + +- Add CONFIG parameter to %sysusers_generate_pre + ------------------------------------------------------------------- Tue Nov 9 08:34:26 UTC 2021 - Danilo Spinella diff --git a/mariadb.service.in b/mariadb.service.in index 21d4d8e..993c6d3 100644 --- a/mariadb.service.in +++ b/mariadb.service.in @@ -63,17 +63,6 @@ ProtectSystem=full # Prevent accessing /home, /root and /run/user ProtectHome=true -# added automatically, for details please see -# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort -PrivateDevices=true -ProtectHostname=true -ProtectClock=true -ProtectKernelTunables=true -ProtectKernelModules=true -ProtectKernelLogs=true -ProtectControlGroups=true -RestrictRealtime=true -# end of automatic additions # Execute pre and post scripts as root, otherwise it does it as User= PermissionsStartOnly=true diff --git a/mariadb.spec b/mariadb.spec index 819b418..654aa6c 100644 --- a/mariadb.spec +++ b/mariadb.spec @@ -78,7 +78,6 @@ Patch3: mariadb-10.0.15-logrotate-su.patch Patch4: mariadb-10.2.4-fortify-and-O.patch Patch6: mariadb-10.4.12-harden_setuid.patch Patch7: mariadb-10.4.12-fix-install-db.patch -Patch8: harden_mariadb.service.patch Patch9: func_math_tests_MDEV-26645.diff Patch10: fix-pamdir.patch # needed for bison SQL parser and wsrep API @@ -97,6 +96,7 @@ BuildRequires: libbz2-devel # commands history feature BuildRequires: libedit-devel BuildRequires: libevent-devel +BuildRequires: liblz4-devel BuildRequires: libtool BuildRequires: libxml2-devel # CLI graphic and wsrep API @@ -113,7 +113,6 @@ BuildRequires: procps # Some tests and myrocks_hotbackup script need python3 BuildRequires: python3 BuildRequires: sqlite -BuildRequires: sysuser-shadow BuildRequires: sysuser-tools BuildRequires: tcpd-devel # Tests requires time and ps and some perl modules @@ -365,7 +364,6 @@ find . -name "*.jar" -type f -exec rm --verbose -f {} \; %patch4 %patch6 -p1 %patch7 -p1 -%patch8 -p1 %if 0%{?suse_version} > 1500 %ifarch s390x ppc64 ppc64le %patch9 @@ -396,8 +394,8 @@ sed -i 's|@localstatedir@|%{_localstatedir}/log|' support-files/mysql-log-rotate rm -f mysql-test/t/file_contents.test mysql-test/r/file_contents.result # Specify perl path on shebangs -for i in `grep -Rl '^#!@PERL@$' .`; do - sed -i 's|@PERL@|%{_bindir}/perl|' $i +for i in `grep -Rl '^#!%{_bindir}/env perl$' .`; do + sed -i 's|%{_bindir}/env perl|%{_bindir}/perl|' $i done # Add our list of tests that fail (correctly or temporarily) to the list of such @@ -474,7 +472,7 @@ export CXXFLAGS="$CFLAGS -felide-constructors" %make_build nm --numeric-sort sql/mysqld > sql/mysqld.sym cd .. -%sysusers_generate_pre %{SOURCE12} mysql +%sysusers_generate_pre %{SOURCE12} mysql mysql-user.conf %install # Helper function to generate filelist for binaries and their manpages @@ -770,10 +768,10 @@ cd mysql-test # client does not require server and needs the user too %pre client -f mysql.pre %pre -%service_add_pre mariadb.service +%service_add_pre mariadb.service mariadb.socket mariadb-extra.socket mariadb.target %post -%service_add_post mariadb.service +%service_add_post mariadb.service mariadb@.service mariadb.socket mariadb-extra.socket mariadb.target %tmpfiles_create %{_tmpfilesdir}/mariadb.conf %set_permissions %{_libdir}/mysql/plugin/auth_pam_tool_dir/auth_pam_tool @@ -846,10 +844,10 @@ exit 0 %verify_permissions %{_libdir}/mysql/plugin/auth_pam_tool_dir/auth_pam_tool %preun -%service_del_preun mariadb.service +%service_del_preun mariadb.service mariadb.socket mariadb-extra.socket mariadb.target %postun -%service_del_postun mariadb.service +%service_del_postun mariadb.service mariadb.socket mariadb-extra.socket mariadb.target %post -n libmariadbd%{soname} -p /sbin/ldconfig %postun -n libmariadbd%{soname} -p /sbin/ldconfig