mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-06-05 02:50:46 +00:00
Code Issues Projects Releases Wiki Activity

freeradius: upgrade 3.0.19 -> 3.0.20

Browse Source 
* Drop backported patch:
  0001-su-to-radiusd-user-group-when-rotating-logs.patch

* Disable python2 module build and add PACKAGECONFIG for python3 module
  build

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This commit is contained in:
Yi Zhao
2020-02-06 19:22:03 +08:00
committed by Khem Raj
parent a44430fe91
commit 502084cc99
3 changed files with 77 additions and 120 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-networking/recipes-connectivity/freeradius/files/0001-rlm_python3-add-PY_INC_DIR-in-search-dir.patch
+58
View File
@@ -0,0 +1,58 @@
From 733330888fff49e4d2b6c2121a6050fdd9f11a87 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Thu, 6 Feb 2020 09:32:04 +0800
Subject: [PATCH] rlm_python3: add PY_INC_DIR in search dir
The configure option --with-rlm-python3-include-dir is used to set
PY_INC_DIR which is never used and it fails to find Python.h,
so add it into search dir to fix it.
Also remove SMART_LIBS from mod_flags because it introduces rpath
to LDFALGS which causes a do_package_qa error:
ERROR: freeradius-3.0.20-r0 do_package_qa: QA Issue: package freeradius-python contains bad RPATH
/buildarea/build/tmp/work/core2-64-poky-linux/freeradius/3.0.20-r0/recipe-sysroot-native/usr/lib/python3.8/config in file
/buildarea/build/tmp/work/core2-64-poky-linux/freeradius/3.0.20-r0/packages-split/freeradius-python/usr/lib/rlm_python3.so.0.0.0
package freeradius-python contains bad RPATH
/buildarea/build/tmp/work/core2-64-poky-linux/freeradius/3.0.20-r0/recipe-sysroot-native/usr/lib/python3.8/config in file
/buildarea/build/tmp/work/core2-64-poky-linux/freeradius/3.0.20-r0/packages-split/freeradius-python/usr/lib/rlm_python3.so.0.0.0 [rpaths]
Upstream-Status: Inappropriate [OE specific]
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
src/modules/rlm_python3/configure.ac | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/src/modules/rlm_python3/configure.ac b/src/modules/rlm_python3/configure.ac
index a00320f..adbdf19 100644
--- a/src/modules/rlm_python3/configure.ac
+++ b/src/modules/rlm_python3/configure.ac
@@ -95,7 +95,7 @@ if test x$with_[]modname != xno; then
old_CFLAGS=$CFLAGS
CFLAGS="$CFLAGS $PY_CFLAGS"
- smart_try_dir="$PY_PREFIX/include/python$PY_SYS_VERSION"
+ smart_try_dir="$PY_PREFIX/include/python$PY_SYS_VERSION $PY_INC_DIR"
FR_SMART_CHECK_INCLUDE(Python.h)
CFLAGS=$old_CFLAGS
@@ -114,13 +114,13 @@ if test x$with_[]modname != xno; then
eval t=\${ac_cv_lib_${sm_lib_safe}_${sm_func_safe}}
if test "x$t" = "xyes"; then
- mod_ldflags="$PY_LIB_LOC $PY_EXTRA_LIBS $SMART_LIBS -lm"
+ mod_ldflags="$PY_LIB_LOC $PY_EXTRA_LIBS -lm"
targetname=modname
else
FR_SMART_CHECK_LIB(python${PY_SYS_VERSION}m, Py_Initialize)
eval t=\${ac_cv_lib_${sm_lib_safe}_${sm_func_safe}}
if test "x$t" = "xyes"; then
- mod_ldflags="$PY_LIB_LOC $PY_EXTRA_LIBS $SMART_LIBS -lm"
+ mod_ldflags="$PY_LIB_LOC $PY_EXTRA_LIBS -lm"
targetname=modname
else
targetname=
--
2.7.4
meta-networking/recipes-connectivity/freeradius/files/0001-su-to-radiusd-user-group-when-rotating-logs.patch
-104
View File
@@ -1,104 +0,0 @@
From 1f233773962bf1a9c2d228a180eacddb9db2d574 Mon Sep 17 00:00:00 2001
From: Alexander Scheel <ascheel@redhat.com>
Date: Tue, 7 May 2019 16:04:29 -0400
Subject: [PATCH] su to radiusd user/group when rotating logs
The su directive to logrotate ensures that log rotation happens under the
owner of the logs. Otherwise, logrotate runs as root:root, potentially
enabling privilege escalation if a RCE is discovered against the
FreeRADIUS daemon.
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
Upstream-Status: Backport
[https://github.com/FreeRADIUS/freeradius-server/commit/1f233773962bf1a9c2d228a180eacddb9db2d574]
CVE: CVE-2019-10143
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
debian/freeradius.logrotate | 3 +++
redhat/freeradius-logrotate | 1 +
scripts/logrotate/freeradius | 3 +++
suse/radiusd-logrotate | 1 +
4 files changed, 8 insertions(+)
diff --git a/debian/freeradius.logrotate b/debian/freeradius.logrotate
index 7d837d5..a8d29b7 100644
--- a/debian/freeradius.logrotate
+++ b/debian/freeradius.logrotate
@@ -9,6 +9,7 @@
notifempty
copytruncate
+ su freerad freerad
}
# (in order)
@@ -26,6 +27,7 @@
notifempty
nocreate
+ su freerad freerad
}
# There are different detail-rotating strategies you can use. One is
@@ -45,4 +47,5 @@
notifempty
nocreate
+ su freerad freerad
}
diff --git a/redhat/freeradius-logrotate b/redhat/freeradius-logrotate
index 360765d..bb97ca5 100644
--- a/redhat/freeradius-logrotate
+++ b/redhat/freeradius-logrotate
@@ -9,6 +9,7 @@ rotate 4
missingok
compress
delaycompress
+su radiusd radiusd
#
# The main server log
diff --git a/scripts/logrotate/freeradius b/scripts/logrotate/freeradius
index 3de435e..eecf631 100644
--- a/scripts/logrotate/freeradius
+++ b/scripts/logrotate/freeradius
@@ -17,6 +17,7 @@
notifempty
copytruncate
+ su radiusd radiusd
}
# (in order)
@@ -34,6 +35,7 @@
notifempty
nocreate
+ su radiusd radiusd
}
# There are different detail-rotating strategies you can use. One is
@@ -53,4 +55,5 @@
notifempty
nocreate
+ su radiusd radiusd
}
diff --git a/suse/radiusd-logrotate b/suse/radiusd-logrotate
index 24d56be..be5a797 100644
--- a/suse/radiusd-logrotate
+++ b/suse/radiusd-logrotate
@@ -11,6 +11,7 @@ missingok
compress
delaycompress
notifempty
+su radiusd radiusd
#
# The main server log
--
2.7.4
meta-networking/recipes-connectivity/freeradius/freeradius_3.0.19.bb → meta-networking/recipes-connectivity/freeradius/freeradius_3.0.20.bb
+19 -16
View File
@@ -26,12 +26,12 @@ SRC_URI = "git://github.com/FreeRADIUS/freeradius-server.git;branch=v3.0.x; \
file://freeradius-fix-quoting-for-BUILT_WITH.patch \
file://freeradius-fix-error-for-expansion-of-macro.patch \
file://0001-rlm_mschap-Use-includedir-instead-of-hardcoding-usr-.patch \
file://0001-su-to-radiusd-user-group-when-rotating-logs.patch \
file://0001-rlm_python3-add-PY_INC_DIR-in-search-dir.patch \
file://radiusd.service \
file://radiusd-volatiles.conf \
"
SRCREV = "ab4c767099f263a7cd4109bcdca80ee74210a769"
SRCREV = "d94c953ab9602a238433ba18533111b845fd8e9e"
PARALLEL_MAKE = ""
@@ -61,9 +61,11 @@ EXTRA_OECONF = " --enable-strict-dependencies \
--without-rlm_sql_iodbc \
--without-rlm_sql_oracle \
--without-rlm_sql_sybase \
--without-rlm_sql_mongo \
--without-rlm_sqlhpwippool \
--without-rlm_securid \
--without-rlm_unbound \
--without-rlm_python \
ac_cv_path_PERL=${bindir}/perl \
ax_cv_cc_builtin_choose_expr=no \
ax_cv_cc_builtin_types_compatible_p=no \
@@ -86,7 +88,7 @@ PACKAGECONFIG[unixodbc] = "--with-rlm_sql_unixodbc,--without-rlm_sql_unixodbc,un
PACKAGECONFIG[postgresql] = "--with-rlm_sql_postgresql,--without-rlm_sql_postgresql,postgresql"
PACKAGECONFIG[pcre] = "--with-pcre,--without-pcre,libpcre"
PACKAGECONFIG[perl] = "--with-perl=${STAGING_BINDIR_NATIVE}/perl-native/perl --with-rlm_perl,--without-rlm_perl,perl-native perl,perl"
PACKAGECONFIG[python] = "--with-rlm_python --with-rlm-python-bin=${STAGING_BINDIR_NATIVE}/python-native/python --with-rlm-python-include-dir=${STAGING_INCDIR}/${PYTHON_DIR},--without-rlm_python,python-native python"
PACKAGECONFIG[python3] = "--with-rlm_python3 --with-rlm-python3-bin=${STAGING_BINDIR_NATIVE}/python3-native/python3 --with-rlm-python3-include-dir=${STAGING_INCDIR}/${PYTHON_DIR},--without-rlm_python3,python3-native python3"
PACKAGECONFIG[rest] = "--with-rlm_rest,--without-rlm_rest,curl json-c"
PACKAGECONFIG[ruby] = "--with-rlm_ruby,--without-rlm_ruby,ruby"
PACKAGECONFIG[openssl] = "--with-openssl, --without-openssl"
@@ -145,23 +147,24 @@ do_install() {
rm -f ${D}/${sbindir}/rc.radiusd
chmod +x ${D}/${sysconfdir}/init.d/radiusd
rm -rf ${D}/${localstatedir}/run/
rm -rf ${D}/${localstatedir}/log/
install -m 0644 ${WORKDIR}/volatiles.58_radiusd ${D}${sysconfdir}/default/volatiles/58_radiusd
chown -R radiusd:radiusd ${D}/${sysconfdir}/raddb/
chown -R radiusd:radiusd ${D}/${localstatedir}/lib/radiusd
# For systemd
install -d ${D}${systemd_unitdir}/system
install -m 0644 ${WORKDIR}/radiusd.service ${D}${systemd_unitdir}/system
sed -i -e 's,@BASE_BINDIR@,${base_bindir},g' \
-e 's,@SBINDIR@,${sbindir},g' \
-e 's,@STATEDIR@,${localstatedir},g' \
-e 's,@SYSCONFDIR@,${sysconfdir},g' \
${D}${systemd_unitdir}/system/radiusd.service
if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
install -d ${D}${systemd_unitdir}/system
install -m 0644 ${WORKDIR}/radiusd.service ${D}${systemd_unitdir}/system
sed -i -e 's,@BASE_BINDIR@,${base_bindir},g' \
-e 's,@SBINDIR@,${sbindir},g' \
-e 's,@STATEDIR@,${localstatedir},g' \
-e 's,@SYSCONFDIR@,${sysconfdir},g' \
${D}${systemd_unitdir}/system/radiusd.service
install -d ${D}${sysconfdir}/tmpfiles.d/
install -m 0644 ${WORKDIR}/radiusd-volatiles.conf ${D}${sysconfdir}/tmpfiles.d/
install -m 0644 ${WORKDIR}/radiusd-volatiles.conf ${D}${sysconfdir}/tmpfiles.d/radiusd.conf
fi
}
@@ -171,7 +174,7 @@ pkg_postinst_${PN} () {
if [ -z "$D" ]; then
if command -v systemd-tmpfiles >/dev/null; then
# create /var/log/radius, /var/run/radiusd
systemd-tmpfiles --create ${sysconfdir}/tmpfiles.d/radiusd-volatiles.conf
systemd-tmpfiles --create ${sysconfdir}/tmpfiles.d/radiusd.conf
elif [ -e ${sysconfdir}/init.d/populate-volatile.sh ]; then
${sysconfdir}/init.d/populate-volatile.sh update
fi
@@ -210,9 +213,9 @@ FILES_${PN}-perl = "${libdir}/rlm_perl.so* \
${sysconfdir}/raddb/mods-available/perl \
"
FILES_${PN}-python = "${libdir}/rlm_python.so* \
${sysconfdir}/raddb/mods-config/python \
${sysconfdir}/raddb/mods-available/python \
FILES_${PN}-python = "${libdir}/rlm_python3.so* \
${sysconfdir}/raddb/mods-config/python3 \
${sysconfdir}/raddb/mods-available/python3 \
"
FILES_${PN}-mysql = "${libdir}/rlm_sql_mysql.so* \