diff --git a/.gitignore b/.gitignore index 4530dbe..8b82526 100644 --- a/.gitignore +++ b/.gitignore @@ -44,5 +44,3 @@ freeradius-*.src.rpm /freeradius-server-3.2.3.tar.bz2 /freeradius-server-3.2.4.tar.bz2 /freeradius-server-3.2.5.tar.bz2 -/freeradius-server-3.2.7.tar.bz2 -/freeradius-server-3.2.8.tar.bz2 diff --git a/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch b/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch index 33747d0..6b2329b 100644 --- a/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch +++ b/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch @@ -3,27 +3,25 @@ From: Nikolai Kondrashov Date: Mon, 8 Sep 2014 12:32:13 +0300 Subject: [PATCH] Adjust configuration to fit Red Hat specifics -[antorres@redhat.com]: update patch to match 3.2.7 release - --- raddb/mods-available/eap | 4 ++-- raddb/radiusd.conf.in | 7 +++---- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap -index 84660d7c1e..ffcef4b406 100644 +index 2621e183c..94494b2c6 100644 --- a/raddb/mods-available/eap +++ b/raddb/mods-available/eap -@@ -696,7 +696,7 @@ eap { - # and create the temporary directory with the - # systemd `RuntimeDirectory` unit option. +@@ -533,7 +533,7 @@ + # You should also delete all of the files + # in the directory when the server starts. # - # tmpdir = /tmp/radiusd + # tmpdir = /var/run/radiusd/tmp # The command used to verify the client cert. # We recommend using the OpenSSL command-line -@@ -711,7 +711,7 @@ eap { +@@ -548,7 +548,7 @@ # deleted by the server when the command # returns. # @@ -32,7 +30,6 @@ index 84660d7c1e..ffcef4b406 100644 } # OCSP Configuration - diff --git a/raddb/radiusd.conf.in b/raddb/radiusd.conf.in index a83c1f687..e500cf97b 100644 --- a/raddb/radiusd.conf.in diff --git a/freeradius-logrotate b/freeradius-logrotate index 1a2ec6f..c962254 100644 --- a/freeradius-logrotate +++ b/freeradius-logrotate @@ -34,7 +34,7 @@ compress su radiusd radiusd postrotate - /usr/bin/systemctl try-reload-or-restart radiusd + /usr/bin/systemctl reload-or-try-restart radiusd endscript } diff --git a/freeradius-no-buildtime-cert-gen.patch b/freeradius-no-buildtime-cert-gen.patch index 6846827..b435d82 100644 --- a/freeradius-no-buildtime-cert-gen.patch +++ b/freeradius-no-buildtime-cert-gen.patch @@ -3,8 +3,6 @@ From: Alexander Scheel Date: Wed, 8 May 2019 12:58:02 -0400 Subject: [PATCH] Don't generate certificates in reproducible builds -[antorres@redhat.com]: updated to match upstream release 3.2.7 - Signed-off-by: Alexander Scheel --- Make.inc.in | 5 +++++ @@ -29,18 +27,18 @@ index 0b2cd74de8..8c623cf95c 100644 # # For creating documentation via doc/all.mk diff --git a/configure b/configure -index f1dfa97c44..ba5c53768d 100755 +index 5041ca264f..ed01ee2bdd 100755 --- a/configure +++ b/configure -@@ -681,6 +681,7 @@ ACLOCAL - LAST +@@ -679,6 +679,7 @@ AUTOCONF + ACLOCAL RUSERS SNMPWALK +ENABLE_REPRODUCIBLE_BUILDS SNMPGET openssl_version_check_config - WITH_RADLAST -@@ -7001,6 +7002,7 @@ fi + WITH_DHCP +@@ -6976,6 +6977,7 @@ fi # Check whether --enable-reproducible-builds was given. @@ -48,7 +46,7 @@ index f1dfa97c44..ba5c53768d 100755 if test ${enable_reproducible_builds+y} then : enableval=$enable_reproducible_builds; case "$enableval" in -@@ -7012,6 +7014,7 @@ printf "%s\n" "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h +@@ -6987,6 +6989,7 @@ printf "%s\n" "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h ;; *) reproducible_builds=no @@ -56,7 +54,6 @@ index f1dfa97c44..ba5c53768d 100755 esac fi - diff --git a/configure.ac b/configure.ac index ce4d9b0ae5..790cbf02a0 100644 --- a/configure.ac diff --git a/freeradius-no-sqlippool-tool.patch b/freeradius-no-sqlippool-tool.patch deleted file mode 100644 index 58d3282..0000000 --- a/freeradius-no-sqlippool-tool.patch +++ /dev/null @@ -1,28 +0,0 @@ -From: Antonio Torres -Date: Wed, 5 Mar 2025 -Subject: Remove sqlippool tool - -This script relies on a Perl package, perl-Net-IP, that won't be available. -Remove it from build script and let the user pull it manually instead, as it's -just a helper script for SQL module users. - ---- -diff --git a/scripts/all.mk b/scripts/all.mk -index a6e90aa3eb..517adb8590 100644 ---- a/scripts/all.mk -+++ b/scripts/all.mk -@@ -1,5 +1,5 @@ - install: $(R)$(sbindir)/rc.radiusd $(R)$(sbindir)/raddebug \ -- $(R)$(bindir)/radsqlrelay $(R)$(bindir)/radcrypt $(R)$(bindir)/rlm_sqlippool_tool -+ $(R)$(bindir)/radsqlrelay $(R)$(bindir)/radcrypt - - $(R)$(sbindir)/rc.radiusd: scripts/rc.radiusd - @mkdir -p $(dir $@) -@@ -16,7 +16,3 @@ $(R)$(bindir)/radsqlrelay: scripts/sql/radsqlrelay - $(R)$(bindir)/radcrypt: scripts/cryptpasswd - @mkdir -p $(dir $@) - @$(INSTALL) -m 755 $< $@ -- --$(R)$(bindir)/rlm_sqlippool_tool: scripts/sql/rlm_sqlippool_tool -- @mkdir -p $(dir $@) -- @$(INSTALL) -m 755 $< $@ diff --git a/freeradius.spec b/freeradius.spec index 7b65a15..4360f5b 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.2.8 -Release: 2%{?dist} +Version: 3.2.5 +Release: 6%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -14,7 +14,7 @@ URL: http://www.freeradius.org/ %global dist_base freeradius-server-%{version} -Source0: https://www.freeradius.org/ftp/pub/freeradius/%{dist_base}.tar.bz2 +Source0: ftp://ftp.freeradius.org/pub/radius/%{dist_base}.tar.bz2 Source100: radiusd.service Source102: freeradius-logrotate Source103: freeradius-pam-conf @@ -30,7 +30,6 @@ Patch6: freeradius-ldap-infinite-timeout-on-starttls.patch Patch7: freeradius-ease-openssl-version-check.patch Patch8: freeradius-configure-c99.patch Patch9: freeradius-openssl-no-engine.patch -Patch10: freeradius-no-sqlippool-tool.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -60,7 +59,7 @@ BuildRequires: ykclient-devel # Require OpenSSL version we built with, or newer, to avoid startup failures # due to runtime OpenSSL version checks. Requires: openssl >= %(rpm -q --queryformat '%%{EPOCH}:%%{VERSION}' openssl) -Requires(pre): glibc-common +Requires(pre): shadow-utils glibc-common Requires(post): systemd-sysv Requires(post): systemd-units # Needed for certificate generation as upstream bootstrap script isn't @@ -204,16 +203,6 @@ BuildRequires: json-c-devel %description rest This plugin provides the REST support for the FreeRADIUS server project. - -%package kafka -Summary: Kafka producer support for FreeRADIUS -Requires: %{name} = %{version}-%{release} -Requires: librdkafka -BuildRequires: librdkafka-devel - -%description kafka -This plugin provides Kafka producer support for the FreeRADIUS server project. - %prep %setup -q -n %{dist_base} # Note: We explicitly do not make patch backup files because 'make install' @@ -227,7 +216,6 @@ This plugin provides Kafka producer support for the FreeRADIUS server project. %patch -P7 -p1 %patch -P8 -p1 %patch -P9 -p1 -%patch -P10 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -368,22 +356,15 @@ All documentation is in the freeradius-doc sub-package. EOF + +# Make sure our user/group is present prior to any package or subpackage installation +%pre +%sysusers_create_compat %{SOURCE105} + %preun %systemd_preun radiusd.service -%post -# related: https://bugzilla.redhat.com/show_bug.cgi?id=2427017 -# https://github.com/FreeRADIUS/freeradius-server/commit/7d9fcdff99113b7eb3413f436fecccbc5d34bd96 -if [ -x /usr/sbin/setsebool ]; then - /usr/sbin/setsebool -P radius_use_jit on || : -fi - %postun -if [ $1 -eq 0 ]; then - if [ -x /usr/sbin/setsebool ]; then - /usr/sbin/setsebool -P radius_use_jit off || : - fi -fi %systemd_postun_with_restart radiusd.service /bin/systemctl try-restart radiusd.service >/dev/null 2>&1 || : @@ -565,7 +546,6 @@ fi %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/wimax %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/yubikey %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dpsk -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/proxy_rate_limit # mods-enabled # symlink: /etc/raddb/mods-enabled/xxx -> ../mods-available/xxx @@ -600,7 +580,6 @@ fi %config(missingok) /etc/raddb/mods-enabled/unix %config(missingok) /etc/raddb/mods-enabled/unpack %config(missingok) /etc/raddb/mods-enabled/utf8 -%config(missingok) /etc/raddb/mods-enabled/proxy_rate_limit # policy %dir %attr(750,root,radiusd) /etc/raddb/policy.d @@ -694,7 +673,6 @@ fi %{_libdir}/freeradius/rlm_yubikey.so %{_libdir}/freeradius/rlm_dpsk.so %{_libdir}/freeradius/rlm_eap_teap.so -%{_libdir}/freeradius/rlm_proxy_rate_limit.so # main man pages %doc %{_mandir}/man5/clients.conf.5.gz @@ -924,39 +902,7 @@ fi %{_libdir}/freeradius/rlm_rest.so %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest -%files kafka -%{_libdir}/freeradius/rlm_kafka.so -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/kafka -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/kafka_async -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/kafka/messages-json.conf - %changelog -* Mon Jan 05 2026 Antonio Torres - 3.2.8-2 -- Enable selinux flag for JIT usage - Resolves: #2427017 - -* Mon Nov 10 2025 Antonio Torres - 3.2.8-1 -- Update to upstream release 3.2.8 - -* Wed Jul 23 2025 Fedora Release Engineering - 3.2.7-6 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Tue Jul 08 2025 Jitka Plesnikova - 3.2.7-5 -- Perl 5.42 rebuild - -* Wed Jun 11 2025 Antonio Torres - 3.2.7-4 -- Update logrotate postrotate script with `systemctl try-reload-or-restart` - Resolves: rhbz#2371329 - -* Mon Jun 02 2025 Python Maint - 3.2.7-3 -- Rebuilt for Python 3.14 - -* Wed Mar 5 2025 Antonio Torres - 3.2.7-1 -- Update to upstream release 3.2.7 - -* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - 3.2.5-7 -- Drop call to %sysusers_create_compat - * Sat Feb 01 2025 Björn Esser - 3.2.5-6 - Add explicit BR: libxcrypt-devel diff --git a/radiusd.service b/radiusd.service index 9bfa3cd..f545280 100644 --- a/radiusd.service +++ b/radiusd.service @@ -5,7 +5,7 @@ After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.serv [Service] Type=forking PIDFile=/var/run/radiusd/radiusd.pid -ExecStartPre=-/bin/chown -R radiusd:radiusd /var/run/radiusd +ExecStartPre=-/bin/chown -R radiusd.radiusd /var/run/radiusd ExecStartPre=/usr/sbin/radiusd -C ExecStart=/usr/sbin/radiusd -d /etc/raddb ExecReload=/usr/sbin/radiusd -C diff --git a/sources b/sources index 3fdee90..4768856 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.2.8.tar.bz2) = 31db199c3847bfdb80b726e16cece0d660bd741fae0fca8ba96aaaee30972c657438c4e1fdaa7ef070f84d8b7889a8da8db1defc542b0c0e18f247156f17e0ae +SHA512 (freeradius-server-3.2.5.tar.bz2) = 55e653630674a957dcd52ae58e5fd7b5a510b84aaa80e0552bce8089221e02f652618b53753f438981472a5f47df7c8426b9a5ecda0b06ad9f4c25b23604c86b