1 |
commit: 52949343c8c1ca3d53c9b595f3c549ec08b38a1e |
2 |
Author: Sam James <sam <AT> gentoo <DOT> org> |
3 |
AuthorDate: Sat Sep 18 23:36:24 2021 +0000 |
4 |
Commit: Sam James <sam <AT> gentoo <DOT> org> |
5 |
CommitDate: Sat Sep 18 23:44:21 2021 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=52949343 |
7 |
|
8 |
sys-auth/sssd: add patch for CVE-2021-3621 for 2.5.2 |
9 |
|
10 |
Bug: https://bugs.gentoo.org/808911 |
11 |
Signed-off-by: Sam James <sam <AT> gentoo.org> |
12 |
|
13 |
sys-auth/sssd/Manifest | 1 + |
14 |
sys-auth/sssd/sssd-2.3.1-r3.ebuild | 2 +- |
15 |
.../{sssd-2.3.1-r3.ebuild => sssd-2.5.2-r1.ebuild} | 100 ++++++++++++--------- |
16 |
3 files changed, 58 insertions(+), 45 deletions(-) |
17 |
|
18 |
diff --git a/sys-auth/sssd/Manifest b/sys-auth/sssd/Manifest |
19 |
index cb3f830192c..949f7b2f62e 100644 |
20 |
--- a/sys-auth/sssd/Manifest |
21 |
+++ b/sys-auth/sssd/Manifest |
22 |
@@ -1,3 +1,4 @@ |
23 |
DIST sssd-2.3.1-CVE-2021-3621.patch.bz2 3174 BLAKE2B 201c51fff92dd17d9517834e59a12422850ee3c5aab1efff51bcdc5b82521516589271222b6be36d12da2a388d122d37e9f455d593f22551ba9ea58ead694b49 SHA512 faffe46b710e3f8b2db54fc4f637b176b72f6bc31a2d5d1cae7a5ffc81609c4faa5decee1d6db4b2bf87451677c8eda068e153e38755f013afbce982daf58f65 |
24 |
DIST sssd-2.3.1.tar.gz 7186526 BLAKE2B 6d630fe75b9b426ef54adbe1704fde8e01fc34df7861028c07ce2985db8a151ce743d633061386fea6460fe8eabb89242b816d4bac87975bb9b7b2064ad1d547 SHA512 6aeb52d5222c5992d581296996749327bcaf276e4eb4413a6a32ea6529343432cfe413006aca4245c19b38b515be1c4c2ef88a157c617d889274179253355bc6 |
25 |
+DIST sssd-2.5.2-CVE-2021-3621.patch.bz2 3155 BLAKE2B c50e331f0f1acbb9ef8e6d54a63219da44df5e565608c24635d85a110fcc024f7d5293c4412bca64831a9a3a14e2c1188be1a802c76575ad6d7a83243d3d89c2 SHA512 650af7c67b3a807935c0875ee877d366facdf818492fb4244757448ad351454a279968ea5414e6b3cd116e873abe4f1aef2ccdaf790a4df0cf7f2a0078a41860 |
26 |
DIST sssd-2.5.2.tar.gz 7579208 BLAKE2B ec5d9aeaf5b5e05b56c01f9137f6f24db05544dbd48458d742285b60e7beb6d48af865f3415e11ce89e187f4643bbecf15bbb321859ec80cfe458eb781cea6c9 SHA512 a9bac7b2cc23022dce3bcda314c9c26a0a0914c448f6d5a51c5ba18670f04c1fd1a94cb20173235b6285df1dcc9251cb6b3f3e71a220037b4eb66668e6f33c48 |
27 |
|
28 |
diff --git a/sys-auth/sssd/sssd-2.3.1-r3.ebuild b/sys-auth/sssd/sssd-2.3.1-r3.ebuild |
29 |
index 4df7454beca..cd2099011aa 100644 |
30 |
--- a/sys-auth/sssd/sssd-2.3.1-r3.ebuild |
31 |
+++ b/sys-auth/sssd/sssd-2.3.1-r3.ebuild |
32 |
@@ -14,7 +14,7 @@ SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}-CVE-2021 |
33 |
|
34 |
LICENSE="GPL-3" |
35 |
SLOT="0" |
36 |
-KEYWORDS="amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc x86" |
37 |
+KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86" |
38 |
IUSE="acl doc +locator +netlink nfsv4 nls +man pac python samba selinux sudo systemd test valgrind" |
39 |
RESTRICT="!test? ( test )" |
40 |
|
41 |
|
42 |
diff --git a/sys-auth/sssd/sssd-2.3.1-r3.ebuild b/sys-auth/sssd/sssd-2.5.2-r1.ebuild |
43 |
similarity index 88% |
44 |
copy from sys-auth/sssd/sssd-2.3.1-r3.ebuild |
45 |
copy to sys-auth/sssd/sssd-2.5.2-r1.ebuild |
46 |
index 4df7454beca..b00af4ba567 100644 |
47 |
--- a/sys-auth/sssd/sssd-2.3.1-r3.ebuild |
48 |
+++ b/sys-auth/sssd/sssd-2.5.2-r1.ebuild |
49 |
@@ -3,26 +3,48 @@ |
50 |
|
51 |
EAPI=7 |
52 |
|
53 |
-PYTHON_COMPAT=( python3_{7,8,9} ) |
54 |
+PYTHON_COMPAT=( python3_{8..10} ) |
55 |
|
56 |
inherit autotools flag-o-matic linux-info multilib-minimal python-single-r1 pam systemd toolchain-funcs |
57 |
|
58 |
DESCRIPTION="System Security Services Daemon provides access to identity and authentication" |
59 |
HOMEPAGE="https://github.com/SSSD/sssd" |
60 |
-SRC_URI="https://github.com/SSSD/sssd/releases/download/${PN}-${PV//./_}/${P}.tar.gz" |
61 |
+SRC_URI="https://github.com/SSSD/sssd/releases/download/${PV}/${P}.tar.gz" |
62 |
SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}-CVE-2021-3621.patch.bz2" |
63 |
|
64 |
LICENSE="GPL-3" |
65 |
SLOT="0" |
66 |
-KEYWORDS="amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc x86" |
67 |
-IUSE="acl doc +locator +netlink nfsv4 nls +man pac python samba selinux sudo systemd test valgrind" |
68 |
+KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86" |
69 |
+IUSE="acl doc +locator +netlink nfsv4 nls +man pac python samba selinux sudo systemd systemtap test valgrind" |
70 |
RESTRICT="!test? ( test )" |
71 |
|
72 |
-REQUIRED_USE="pac? ( samba ) |
73 |
- python? ( ${PYTHON_REQUIRED_USE} )" |
74 |
+REQUIRED_USE="${PYTHON_REQUIRED_USE} |
75 |
+ pac? ( samba ) |
76 |
+ test? ( sudo ) |
77 |
+ valgrind? ( test )" |
78 |
|
79 |
-DEPEND=" |
80 |
- >=app-crypt/mit-krb5-1.10.3 |
81 |
+BDEPEND=">=sys-devel/autoconf-2.69-r5 |
82 |
+ virtual/pkgconfig |
83 |
+ ${PYTHON_DEPS} |
84 |
+ doc? ( app-doc/doxygen ) |
85 |
+ test? ( |
86 |
+ dev-libs/check |
87 |
+ dev-libs/softhsm:2 |
88 |
+ dev-util/cmocka |
89 |
+ net-libs/gnutls[pkcs11,tools] |
90 |
+ sys-libs/libfaketime |
91 |
+ sys-libs/nss_wrapper |
92 |
+ sys-libs/pam_wrapper |
93 |
+ sys-libs/uid_wrapper |
94 |
+ valgrind? ( dev-util/valgrind ) |
95 |
+ ) |
96 |
+ man? ( |
97 |
+ app-text/docbook-xml-dtd:4.4 |
98 |
+ >=dev-libs/libxslt-1.1.26 |
99 |
+ nls? ( app-text/po4a ) |
100 |
+ )" |
101 |
+ |
102 |
+DEPEND=">=app-crypt/mit-krb5-1.19.1[${MULTILIB_USEDEP}] |
103 |
app-crypt/p11-kit |
104 |
>=dev-libs/ding-libs-0.2 |
105 |
dev-libs/glib:2 |
106 |
@@ -42,7 +64,6 @@ DEPEND=" |
107 |
>=sys-libs/ldb-1.1.17-r1:= |
108 |
virtual/libintl |
109 |
locator? ( |
110 |
- >=app-crypt/mit-krb5-1.12.2[${MULTILIB_USEDEP}] |
111 |
>=net-dns/c-ares-1.10.0-r1[${MULTILIB_USEDEP}] |
112 |
) |
113 |
acl? ( net-fs/cifs-utils[acl] ) |
114 |
@@ -50,7 +71,6 @@ DEPEND=" |
115 |
nfsv4? ( || ( >=net-fs/nfs-utils-2.3.1-r2 net-libs/libnfsidmap ) ) |
116 |
nls? ( >=sys-devel/gettext-0.18 ) |
117 |
pac? ( |
118 |
- app-crypt/mit-krb5[${MULTILIB_USEDEP}] |
119 |
net-fs/samba |
120 |
) |
121 |
python? ( ${PYTHON_DEPS} ) |
122 |
@@ -63,29 +83,11 @@ DEPEND=" |
123 |
dev-libs/jansson:0= |
124 |
net-libs/http-parser:0= |
125 |
net-misc/curl:0= |
126 |
- )" |
127 |
+ ) |
128 |
+ systemtap? ( dev-util/systemtap )" |
129 |
RDEPEND="${DEPEND} |
130 |
>=sys-libs/glibc-2.17[nscd] |
131 |
selinux? ( >=sec-policy/selinux-sssd-2.20120725-r9 )" |
132 |
-BDEPEND=">=sys-devel/autoconf-2.69-r5 |
133 |
- virtual/pkgconfig |
134 |
- doc? ( app-doc/doxygen ) |
135 |
- test? ( |
136 |
- dev-libs/check |
137 |
- dev-libs/softhsm:2 |
138 |
- dev-util/cmocka |
139 |
- net-libs/gnutls[pkcs11,tools] |
140 |
- sys-libs/libfaketime |
141 |
- sys-libs/nss_wrapper |
142 |
- sys-libs/pam_wrapper |
143 |
- sys-libs/uid_wrapper |
144 |
- valgrind? ( dev-util/valgrind ) |
145 |
- ) |
146 |
- man? ( |
147 |
- app-text/docbook-xml-dtd:4.4 |
148 |
- >=dev-libs/libxslt-1.1.26 |
149 |
- nls? ( app-text/po4a ) |
150 |
- )" |
151 |
|
152 |
CONFIG_CHECK="~KEYS" |
153 |
|
154 |
@@ -101,24 +103,31 @@ MULTILIB_WRAPPED_HEADERS=( |
155 |
) |
156 |
|
157 |
PATCHES=( |
158 |
- "${FILESDIR}"/${P}-test_ca-Look-for-libsofthsm2.so-in-usr-libdir-sofths.patch |
159 |
"${WORKDIR}"/${P}-CVE-2021-3621.patch |
160 |
) |
161 |
|
162 |
pkg_setup() { |
163 |
linux-info_pkg_setup |
164 |
+ python-single-r1_pkg_setup |
165 |
} |
166 |
|
167 |
src_prepare() { |
168 |
- sed -i 's:/var/run:/run:' \ |
169 |
- "${S}"/src/examples/logrotate || die |
170 |
- |
171 |
default |
172 |
+ |
173 |
+ sed -i \ |
174 |
+ -e 's:/var/run:/run:' \ |
175 |
+ "${S}"/src/examples/logrotate \ |
176 |
+ || die |
177 |
+ |
178 |
+ # disable flaky test, see https://github.com/SSSD/sssd/issues/5631 |
179 |
+ sed -i \ |
180 |
+ -e '/^\s*pam-srv-tests[ \\]*$/d' \ |
181 |
+ "${S}"/Makefile.am \ |
182 |
+ || die |
183 |
+ |
184 |
eautoreconf |
185 |
+ |
186 |
multilib_copy_sources |
187 |
- if use python && multilib_is_native_abi; then |
188 |
- python_setup |
189 |
- fi |
190 |
} |
191 |
|
192 |
src_configure() { |
193 |
@@ -148,8 +157,8 @@ multilib_src_configure() { |
194 |
--with-nscd="${EPREFIX}"/usr/sbin/nscd |
195 |
--with-unicode-lib="glib2" |
196 |
--disable-rpath |
197 |
+ --disable-static |
198 |
--sbindir=/usr/sbin |
199 |
- --with-crypto="libcrypto" |
200 |
--enable-local-provider |
201 |
$(multilib_native_use_with systemd kcm) |
202 |
$(multilib_native_use_with systemd secrets) |
203 |
@@ -167,6 +176,7 @@ multilib_src_configure() { |
204 |
$(multilib_native_use_with sudo) |
205 |
$(multilib_native_with autofs) |
206 |
$(multilib_native_with ssh) |
207 |
+ $(use_enable systemtap) |
208 |
$(use_enable valgrind) |
209 |
--without-python2-bindings |
210 |
$(multilib_native_use_with python python3-bindings) |
211 |
@@ -219,6 +229,13 @@ multilib_src_compile() { |
212 |
fi |
213 |
} |
214 |
|
215 |
+multilib_src_test() { |
216 |
+ if multilib_is_native_abi; then |
217 |
+ local -x CK_TIMEOUT_MULTIPLIER=10 |
218 |
+ emake check VERBOSE=yes |
219 |
+ fi |
220 |
+} |
221 |
+ |
222 |
multilib_src_install() { |
223 |
if multilib_is_native_abi; then |
224 |
emake -j1 DESTDIR="${D}" "${_at_args[@]}" install |
225 |
@@ -226,7 +243,6 @@ multilib_src_install() { |
226 |
python_optimize |
227 |
python_fix_shebang "${ED}" |
228 |
fi |
229 |
- |
230 |
else |
231 |
# easier than playing with automake... |
232 |
dopammod .libs/pam_sss.so |
233 |
@@ -271,7 +287,7 @@ multilib_src_install_all() { |
234 |
keepdir /var/log/sssd |
235 |
|
236 |
# strip empty dirs |
237 |
- if ! use doc ; then |
238 |
+ if ! use doc; then |
239 |
rm -r "${ED}"/usr/share/doc/"${PF}"/doc || die |
240 |
rm -r "${ED}"/usr/share/doc/"${PF}"/{hbac,idmap,nss_idmap,sss_simpleifp}_doc || die |
241 |
fi |
242 |
@@ -279,10 +295,6 @@ multilib_src_install_all() { |
243 |
rm -r "${ED}"/run || die |
244 |
} |
245 |
|
246 |
-multilib_src_test() { |
247 |
- multilib_is_native_abi && emake check |
248 |
-} |
249 |
- |
250 |
pkg_postinst() { |
251 |
elog "You must set up sssd.conf (default installed into /etc/sssd)" |
252 |
elog "and (optionally) configuration in /etc/pam.d in order to use SSSD" |