From 76f3cf18a4ee4cc0465139cb87352fa3a63acf89 Mon Sep 17 00:00:00 2001 From: Adam Tkac Date: May 22 2008 15:26:41 +0000 Subject: - 9.5.0rc1 release - bind-9.5-libcap.patch merged to upstream - initialize memory in ACL code correctly (#446848) --- diff --git a/.cvsignore b/.cvsignore index a75ba58..4ee1ba9 100644 --- a/.cvsignore +++ b/.cvsignore @@ -1,4 +1,4 @@ -bind-9.5.0b3.tar.gz bind-chroot.tar.bz2 config-3.tar.bz2 libbind-man.tar.gz +bind-9.5.0rc1.tar.gz diff --git a/bind-9.5-initialize.patch b/bind-9.5-initialize.patch new file mode 100644 index 0000000..39101ff --- /dev/null +++ b/bind-9.5-initialize.patch @@ -0,0 +1,19 @@ +diff -up bind-9.5.0rc1/lib/isc/radix.c.init bind-9.5.0rc1/lib/isc/radix.c +--- bind-9.5.0rc1/lib/isc/radix.c.init 2008-05-22 17:11:59.000000000 +0200 ++++ bind-9.5.0rc1/lib/isc/radix.c 2008-05-22 17:12:43.000000000 +0200 +@@ -323,6 +323,7 @@ isc_radix_insert(isc_radix_tree_t *radix + if (node == NULL) + return (ISC_R_NOMEMORY); + node->bit = bitlen; ++ node->node_num[0] = node->node_num[1] = -1; + result = _ref_prefix(radix->mctx, &node->prefix, prefix); + if (result != ISC_R_SUCCESS) { + isc_mem_put(radix->mctx, node, +@@ -351,7 +352,6 @@ isc_radix_insert(isc_radix_tree_t *radix + } else { + node->node_num[ISC_IS6(family)] = + ++radix->num_added_node; +- node->node_num[!ISC_IS6(family)] = -1; + node->data[0] = NULL; + node->data[1] = NULL; + } diff --git a/bind-9.5-libcap.patch b/bind-9.5-libcap.patch deleted file mode 100644 index 3140eff..0000000 --- a/bind-9.5-libcap.patch +++ /dev/null @@ -1,259 +0,0 @@ -diff -up bind-9.5.0b3/bin/named/unix/os.c.libcap bind-9.5.0b3/bin/named/unix/os.c ---- bind-9.5.0b3/bin/named/unix/os.c.libcap 2008-01-30 05:55:51.000000000 +0100 -+++ bind-9.5.0b3/bin/named/unix/os.c 2008-05-05 10:56:00.000000000 +0200 -@@ -69,7 +69,7 @@ static int devnullfd = -1; - /* - * Linux defines: - * (T) HAVE_LINUXTHREADS -- * (C) HAVE_LINUX_CAPABILITY_H -+ * (C) HAVE_SYS_CAPABILITY_H (or HAVE_LINUX_CAPABILITY_H) - * (P) HAVE_SYS_PRCTL_H - * The possible cases are: - * none: setuid() normally -@@ -116,16 +116,9 @@ static int dfd[2] = { -1, -1 }; - static isc_boolean_t non_root = ISC_FALSE; - static isc_boolean_t non_root_caps = ISC_FALSE; - --#if defined(HAVE_CAPSET) --#undef _POSIX_SOURCE - #ifdef HAVE_SYS_CAPABILITY_H - #include - #else --#include --int capset(cap_user_header_t hdrp, const cap_user_data_t datap); --#endif --#include --#else - /*% - * We define _LINUX_FS_H to prevent it from being included. We don't need - * anything from it, and the files it includes cause warnings with 2.2 -@@ -133,9 +126,20 @@ int capset(cap_user_header_t hdrp, const - * and ) on 2.3 kernels. - */ - #define _LINUX_FS_H -- --#include /* Required for syscall(). */ --#include /* Required for _LINUX_CAPABILITY_VERSION. */ -+#include -+#ifdef HAVE_CAPSET -+int capset(cap_user_header_t hdrp, const cap_user_data_t datap); -+#else -+/* We don't have libcap or capset, let's use syscall*/ -+#include -+#ifndef SYS_capset -+#ifndef __NR_capset -+#include /* Slackware 4.0 needs this. */ -+#endif /* __NR_capset */ -+#define SYS_capset __NR_capset -+#endif /* SYS_capset */ -+#endif /* HAVE_CAPSET */ -+#endif /* HAVE_SYS_CAPABILITY_H */ - - #ifdef HAVE_SYS_PRCTL_H - #include /* Required for prctl(). */ -@@ -152,23 +156,28 @@ int capset(cap_user_header_t hdrp, const - - #endif /* HAVE_SYS_PRCTL_H */ - --#ifndef SYS_capset --#ifndef __NR_capset --#include /* Slackware 4.0 needs this. */ --#endif --#define SYS_capset __NR_capset --#endif --#endif -+#ifdef HAVE_LIBCAP -+#define SETCAPS_FUNC "cap_set_proc " -+#else -+typedef unsigned int cap_t; -+#ifdef HAVE_CAPSET -+#define SETCAPS_FUNC "capset " -+#else -+#define SETCAPS_FUNC "syscall(capset) " -+#endif /* HAVE_CAPSET */ -+#endif /* HAVE_LIBCAP */ - - static void --linux_setcaps(unsigned int caps) { -+linux_setcaps(cap_t caps) { -+#ifndef HAVE_LIBCAP - struct __user_cap_header_struct caphead; - struct __user_cap_data_struct cap; -+#endif - char strbuf[ISC_STRERRORSIZE]; - - if ((getuid() != 0 && !non_root_caps) || non_root) - return; -- -+#ifndef HAVE_LIBCAP - memset(&caphead, 0, sizeof(caphead)); - caphead.version = _LINUX_CAPABILITY_VERSION; - caphead.pid = 0; -@@ -176,46 +185,76 @@ linux_setcaps(unsigned int caps) { - cap.effective = caps; - cap.permitted = caps; - cap.inheritable = 0; --#ifdef HAVE_CAPSET -+#endif -+#ifdef HAVE_LIBCAP -+ if (cap_set_proc(caps) < 0) { -+#elif defined(HAVE_CAPSET) - if (capset(&caphead, &cap) < 0 ) { -- isc__strerror(errno, strbuf, sizeof(strbuf)); -- ns_main_earlyfatal("capset failed: %s:" -- " please ensure that the capset kernel" -- " module is loaded. see insmod(8)", -- strbuf); -- } - #else - if (syscall(SYS_capset, &caphead, &cap) < 0) { -+#endif - isc__strerror(errno, strbuf, sizeof(strbuf)); -- ns_main_earlyfatal("syscall(capset) failed: %s:" -+ ns_main_earlyfatal(SETCAPS_FUNC "failed: %s:" - " please ensure that the capset kernel" - " module is loaded. see insmod(8)", - strbuf); - } --#endif - } - -+#ifdef HAVE_LIBCAP -+#define SET_CAP(flag) \ -+ do { \ -+ capval = (flag); \ -+ err = cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); \ -+ if (err == -1) { \ -+ isc__strerror(errno, strbuf, sizeof(strbuf)); \ -+ ns_main_earlyfatal("cap_set_proc failed: %s", strbuf); \ -+ } \ -+ \ -+ err = cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); \ -+ if (err == -1) { \ -+ isc__strerror(errno, strbuf, sizeof(strbuf)); \ -+ ns_main_earlyfatal("cap_set_proc failed: %s", strbuf); \ -+ } \ -+ } while (0) -+#define INIT_CAP \ -+ do { \ -+ caps = cap_init(); \ -+ if (caps == NULL) { \ -+ isc__strerror(errno, strbuf, sizeof(strbuf)); \ -+ ns_main_earlyfatal("cap_init failed: %s", strbuf); \ -+ } \ -+ } while (0) -+#else -+#define SET_CAP(flag) { caps |= (1 << (flag)); } -+#define INIT_CAP { caps = 0; } -+#endif /* HAVE_LIBCAP */ -+ - static void - linux_initialprivs(void) { -- unsigned int caps; -+ cap_t caps; -+#ifdef HAVE_LIBCAP -+ cap_value_t capval; -+ char strbuf[ISC_STRERRORSIZE]; -+ int err; -+#endif - - /*% - * We don't need most privileges, so we drop them right away. - * Later on linux_minprivs() will be called, which will drop our - * capabilities to the minimum needed to run the server. - */ -- -- caps = 0; -+ INIT_CAP; - - /* - * We need to be able to bind() to privileged ports, notably port 53! - */ -- caps |= (1 << CAP_NET_BIND_SERVICE); -+ SET_CAP(CAP_NET_BIND_SERVICE); - - /* - * We need chroot() initially too. - */ -- caps |= (1 << CAP_SYS_CHROOT); -+ SET_CAP(CAP_SYS_CHROOT); - - #if defined(HAVE_SYS_PRCTL_H) || !defined(HAVE_LINUXTHREADS) - /* -@@ -224,19 +263,19 @@ linux_initialprivs(void) { - * tried) or we're not using threads. If either of these is - * true, we want the setuid capability. - */ -- caps |= (1 << CAP_SETUID); -+ SET_CAP(CAP_SETUID); - #endif - - /* - * Since we call initgroups, we need this. - */ -- caps |= (1 << CAP_SETGID); -+ SET_CAP(CAP_SETGID); - - /* - * Without this, we run into problems reading a configuration file - * owned by a non-root user and non-world-readable on startup. - */ -- caps |= (1 << CAP_DAC_READ_SEARCH); -+ SET_CAP(CAP_DAC_READ_SEARCH); - - /* - * XXX We might want to add CAP_SYS_RESOURCE, though it's not -@@ -245,15 +284,21 @@ linux_initialprivs(void) { - * of files, the stack size, data size, and core dump size to - * support named.conf options, this is now being added to test. - */ -- caps |= (1 << CAP_SYS_RESOURCE); -+ SET_CAP(CAP_SYS_RESOURCE); - - linux_setcaps(caps); - } - - static void - linux_minprivs(void) { -- unsigned int caps; -+ cap_t caps; -+#ifdef HAVE_LIBCAP -+ cap_value_t capval; -+ char strbuf[ISC_STRERRORSIZE]; -+ int err; -+#endif - -+ INIT_CAP; - /*% - * Drop all privileges except the ability to bind() to privileged - * ports. -@@ -262,8 +307,7 @@ linux_minprivs(void) { - * chroot() could be used to escape from the chrooted area. - */ - -- caps = 0; -- caps |= (1 << CAP_NET_BIND_SERVICE); -+ SET_CAP(CAP_NET_BIND_SERVICE); - - /* - * XXX We might want to add CAP_SYS_RESOURCE, though it's not -@@ -272,7 +316,7 @@ linux_minprivs(void) { - * of files, the stack size, data size, and core dump size to - * support named.conf options, this is now being added to test. - */ -- caps |= (1 << CAP_SYS_RESOURCE); -+ SET_CAP(CAP_SYS_RESOURCE); - - linux_setcaps(caps); - } -diff -up bind-9.5.0b3/configure.in.libcap bind-9.5.0b3/configure.in ---- bind-9.5.0b3/configure.in.libcap 2008-01-30 05:55:51.000000000 +0100 -+++ bind-9.5.0b3/configure.in 2008-05-05 10:53:11.000000000 +0200 -@@ -1876,6 +1876,7 @@ AC_ARG_ENABLE(linux-caps, - case "$enable_linux_caps" in - yes|'') - AC_CHECK_HEADERS(linux/capability.h sys/capability.h) -+ AC_CHECK_LIB(cap, cap_set_proc) - AC_CHECK_FUNCS(capset) - ;; - no) diff --git a/bind.spec b/bind.spec index 5c111f5..d24da7e 100644 --- a/bind.spec +++ b/bind.spec @@ -2,7 +2,7 @@ # Red Hat BIND package .spec file # -%define RELEASEVER b3 +%define RELEASEVER rc1 %{?!SDB: %define SDB 1} %{?!LIBBIND: %define LIBBIND 1} @@ -18,7 +18,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind License: ISC Version: 9.5.0 -Release: 31.1.%{RELEASEVER}%{?dist} +Release: 32.%{RELEASEVER}%{?dist} Epoch: 32 Url: http://www.isc.org/products/BIND/ Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) @@ -57,9 +57,9 @@ Patch63: bind-9.4.0-dnssec-directory.patch Patch71: bind-9.5-overflow.patch Patch72: bind-9.5-dlz-64bit.patch Patch87: bind-9.5-parallel-build.patch -Patch90: bind-9.5-libcap.patch Patch91: bind-9.5-recv-race.patch Patch92: bind-9.5-edns.patch +Patch93: bind-9.5-initialize.patch # SDB patches Patch11: bind-9.3.2b2-sdbsrc.patch @@ -182,7 +182,6 @@ Based on the code from Jan "Yenya" Kasprzak %patch5 -p1 -b .nonexec %patch10 -p1 -b .PIE %patch16 -p1 -b .redhat_doc -%patch90 -p1 -b .libcap %if %{SDB} mkdir bin/named-sdb cp -r bin/named/* bin/named-sdb @@ -241,6 +240,7 @@ cp -fp contrib/dbus/{dbus_mgr.h,dbus_service.h} bin/named/include/named %patch87 -p1 -b .parallel %patch91 -p1 -b .recv-race %patch92 -p1 -b .edns +%patch93 -p1 -b .init :; @@ -395,7 +395,7 @@ for f in my.internal.zone.db slaves/my.slave.internal.zone.db slaves/my.ddns.int echo '@ in soa localhost. root 1 3H 15M 1W 1D ns localhost.' > sample/var/named/$f; done -/usr/bin/tail -n '+'`/bin/egrep -n '\\$Id: bind.spec,v 1.261 2008/05/21 10:30:55 atkac Exp $/+1/' | bc` bin/rndc/rndc.conf | sed '/Sample rndc configuration file./{p;i\ +/usr/bin/tail -n '+'`/bin/egrep -n '\\$Id: bind.spec,v 1.262 2008/05/22 15:26:41 atkac Exp $/+1/' | bc` bin/rndc/rndc.conf | sed '/Sample rndc configuration file./{p;i\ *\ * NOTE: you only need to create this file if it is to\ * differ from the following default contents: @@ -646,6 +646,11 @@ rm -rf ${RPM_BUILD_ROOT} %{_sbindir}/bind-chroot-admin %changelog +* Thu May 22 2008 Adam Tkac 32:9.5.0-31.9.rc1 +- 9.5.0rc1 release +- bind-9.5-libcap.patch merged to upstream +- initialize memory in ACL code correctly (#446848) + * Tue May 20 2008 Adam Tkac 32:9.5.0-31.1.b3 - bind-chroot now depends on bind (#446477) diff --git a/sources b/sources index 42af33a..9682981 100644 --- a/sources +++ b/sources @@ -1,4 +1,4 @@ -9dbacfd7a957efd36e30736d579ed519 bind-9.5.0b3.tar.gz 4faa4395b955e5f8a3d50f308b9fabc8 bind-chroot.tar.bz2 d4bc7234a0d7b93328335ed9c076c6e9 config-3.tar.bz2 13fef79f99fcefebb51d84b08805de51 libbind-man.tar.gz +bf50ba674a8e2f9a762d423eba7dc01a bind-9.5.0rc1.tar.gz