diff --git a/.gitignore b/.gitignore index e3dc947..f1e876b 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,2 @@ /libcap-*.tar.gz -/libcap-*.tar.sign -/*.src.rpm +*.src.rpm diff --git a/0001-cap_alloc.c-fix-CVE-2023-2603.patch b/0001-cap_alloc.c-fix-CVE-2023-2603.patch new file mode 100644 index 0000000..2ee9161 --- /dev/null +++ b/0001-cap_alloc.c-fix-CVE-2023-2603.patch @@ -0,0 +1,34 @@ +From 59bae31a96003840c064573904a4041427df3890 Mon Sep 17 00:00:00 2001 +From: Carlos Rodriguez-Fernandez +Date: Wed, 22 Nov 2023 07:53:36 -0700 +Subject: [PATCH 1/2] cap_alloc.c:fix CVE-2023-2603 + +--- + libcap/cap_alloc.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/libcap/cap_alloc.c b/libcap/cap_alloc.c +index 6dab4e6..7456d97 100644 +--- a/libcap/cap_alloc.c ++++ b/libcap/cap_alloc.c +@@ -81,8 +81,15 @@ char *_libcap_strdup(const char *old) + errno = EINVAL; + return NULL; + } +- +- raw_data = malloc( sizeof(__u32) + strlen(old) + 1 ); ++ size_t len; ++ len = strlen(old); ++ if ((len & 0x3fffffff) != len) { ++ _cap_debug("len is too long for libcap to manage"); ++ errno = EINVAL; ++ return NULL; ++ } ++ len += sizeof(__u32) + 1; ++ raw_data = malloc(len); + if (raw_data == NULL) { + errno = ENOMEM; + return NULL; +-- +2.42.0 + diff --git a/0002-psx.c-fix-CVE-2023-2602.patch b/0002-psx.c-fix-CVE-2023-2602.patch new file mode 100644 index 0000000..a297465 --- /dev/null +++ b/0002-psx.c-fix-CVE-2023-2602.patch @@ -0,0 +1,25 @@ +From 5abae730d176107642d5d24cc14f27595ca88a69 Mon Sep 17 00:00:00 2001 +From: Carlos Rodriguez-Fernandez +Date: Wed, 22 Nov 2023 07:55:04 -0700 +Subject: [PATCH 2/2] psx.c:fix CVE-2023-2602 + +--- + psx/psx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/psx/psx.c b/psx/psx.c +index 4de3653..eec6db8 100644 +--- a/psx/psx.c ++++ b/psx/psx.c +@@ -478,7 +478,7 @@ int __wrap_pthread_create(pthread_t *thread, const pthread_attr_t *attr, + pthread_sigmask(SIG_BLOCK, &sigbit, NULL); + + int ret = __real_pthread_create(thread, attr, _psx_start_fn, starter); +- if (ret == -1) { ++ if (ret > 0) { + psx_new_state(_PSX_CREATE, _PSX_IDLE); + memset(starter, 0, sizeof(*starter)); + free(starter); +-- +2.42.0 + diff --git a/0003-Bug-fixes-identified-by-static-code-analysis.patch b/0003-Bug-fixes-identified-by-static-code-analysis.patch new file mode 100644 index 0000000..6365d12 --- /dev/null +++ b/0003-Bug-fixes-identified-by-static-code-analysis.patch @@ -0,0 +1,101 @@ +From f7e3aeaf41480a8cfd255dd198f16af9e5e99e5b Mon Sep 17 00:00:00 2001 +From: "Andrew G. Morgan" +Date: Wed, 21 Apr 2021 20:08:50 -0700 +Subject: [PATCH 3/3] Bug fixes identified by static code analysis. + +Analysis and much of this commit was contributed by Zoltan +Fridrich of Redhat. + +Signed-off-by: Andrew G. Morgan +--- + pam_cap/pam_cap.c | 9 ++++----- + progs/capsh.c | 30 ++++++++++++++++++++++-------- + 2 files changed, 26 insertions(+), 13 deletions(-) + +diff --git a/pam_cap/pam_cap.c b/pam_cap/pam_cap.c +index 6927f7b..5b48b06 100644 +--- a/pam_cap/pam_cap.c ++++ b/pam_cap/pam_cap.c +@@ -218,7 +218,7 @@ static int set_capabilities(struct pam_cap_s *cs) + if (!cap_set_proc(cap_s)) { + ok = 1; + } +- goto cleanup_cap_s; ++ goto cleanup_conf; + } + + iab = cap_iab_from_text(conf_caps); +@@ -238,10 +238,9 @@ cleanup_conf: + _pam_drop(conf_caps); + + cleanup_cap_s: +- if (cap_s) { +- cap_free(cap_s); +- cap_s = NULL; +- } ++ cap_free(cap_s); ++ cap_s = NULL; ++ + return ok; + } + +diff --git a/progs/capsh.c b/progs/capsh.c +index a39ceeb..0507ea4 100644 +--- a/progs/capsh.c ++++ b/progs/capsh.c +@@ -336,8 +336,8 @@ static void arg_change_amb(const char *arg_names, cap_flag_value_t set) + */ + static char *find_self(const char *arg0) + { +- int i; +- char *parts, *dir, *scratch; ++ int i, status=1; ++ char *p = NULL, *parts, *dir, *scratch; + const char *path; + + for (i = strlen(arg0)-1; i >= 0 && arg0[i] != '/'; i--); +@@ -352,21 +352,35 @@ static char *find_self(const char *arg0) + } + + parts = strdup(path); ++ if (parts == NULL) { ++ fprintf(stderr, "insufficient memory for parts of path\n"); ++ exit(1); ++ } ++ + scratch = malloc(2+strlen(path)+strlen(arg0)); +- if (parts == NULL || scratch == NULL) { ++ if (scratch == NULL) { + fprintf(stderr, "insufficient memory for path building\n"); +- exit(1); ++ goto free_parts; + } + +- for (i=0; (dir = strtok(parts, ":")); parts = NULL) { ++ for (i=0, p = parts; (dir = strtok(p, ":")); p = NULL) { + sprintf(scratch, "%s/%s", dir, arg0); + if (access(scratch, X_OK) == 0) { +- return scratch; ++ status = 0; ++ break; + } + } ++ if (status) { ++ fprintf(stderr, "unable to find executable '%s' in PATH\n", arg0); ++ free(scratch); ++ } + +- fprintf(stderr, "unable to find executable '%s' in PATH\n", arg0); +- exit(1); ++free_parts: ++ free(parts); ++ if (status) { ++ exit(status); ++ } ++ return scratch; + } + + int main(int argc, char *argv[], char *envp[]) +-- +2.42.0 + diff --git a/0004-Fruit-of-more-static-analysis-results.patch b/0004-Fruit-of-more-static-analysis-results.patch new file mode 100644 index 0000000..56d604e --- /dev/null +++ b/0004-Fruit-of-more-static-analysis-results.patch @@ -0,0 +1,108 @@ +From bcfd79b07f60746e84899d2854800f161804d5fb Mon Sep 17 00:00:00 2001 +From: "Andrew G. Morgan" +Date: Thu, 22 Apr 2021 20:06:32 -0700 +Subject: [PATCH] Fruit of more static analysis results + +Fixes for further analysis issues from Zoltan Fridrich of Redhat. + +Signed-off-by: Andrew G. Morgan +--- + progs/capsh.c | 24 ++++++++++++++++++------ + psx/psx.c | 4 ++++ + tests/libcap_launch_test.c | 10 +++++++++- + 3 files changed, 31 insertions(+), 7 deletions(-) + +diff --git a/progs/capsh.c b/progs/capsh.c +index 0507ea4..0d0154a 100644 +--- a/progs/capsh.c ++++ b/progs/capsh.c +@@ -363,7 +363,7 @@ static char *find_self(const char *arg0) + goto free_parts; + } + +- for (i=0, p = parts; (dir = strtok(p, ":")); p = NULL) { ++ for (p = parts; (dir = strtok(p, ":")); p = NULL) { + sprintf(scratch, "%s/%s", dir, arg0); + if (access(scratch, X_OK) == 0) { + status = 0; +@@ -383,6 +383,16 @@ free_parts: + return scratch; + } + ++static long safe_sysconf(int name) ++{ ++ long ans = sysconf(name); ++ if (ans <= 0) { ++ fprintf(stderr, "sysconf(%d) returned a non-positive number: %ld\n", name, ans); ++ exit(1); ++ } ++ return ans; ++} ++ + int main(int argc, char *argv[], char *envp[]) + { + pid_t child; +@@ -631,7 +641,9 @@ int main(int argc, char *argv[], char *envp[]) + * Given we are now in a new directory tree, its good practice + * to start off in a sane location + */ +- status = chdir("/"); ++ if (status == 0) { ++ status = chdir("/"); ++ } + + cap_free(orig); + +@@ -732,14 +744,14 @@ int main(int argc, char *argv[], char *envp[]) + gid_t *group_list; + int g_count; + +- length = sysconf(_SC_GETGR_R_SIZE_MAX); ++ length = safe_sysconf(_SC_GETGR_R_SIZE_MAX); + buf = calloc(1, length); + if (NULL == buf) { + fprintf(stderr, "No memory for [%s] operation\n", argv[i]); + exit(1); + } + +- max_groups = sysconf(_SC_NGROUPS_MAX); ++ max_groups = safe_sysconf(_SC_NGROUPS_MAX); + group_list = calloc(max_groups, sizeof(gid_t)); + if (NULL == group_list) { + fprintf(stderr, "No memory for gid list\n"); +@@ -755,8 +767,7 @@ int main(int argc, char *argv[], char *envp[]) + } + if (!isdigit(*ptr)) { + struct group *g, grp; +- getgrnam_r(ptr, &grp, buf, length, &g); +- if (NULL == g) { ++ if (getgrnam_r(ptr, &grp, buf, length, &g) || NULL == g) { + fprintf(stderr, "Failed to identify gid for group [%s]\n", ptr); + exit(1); + } +@@ -849,6 +860,7 @@ int main(int argc, char *argv[], char *envp[]) + argv[argc] = NULL; + execve(argv[i], argv+i, envp); + fprintf(stderr, "execve '%s' failed!\n", argv[i]); ++ free(argv[i]); + exit(1); + } else if (!strncmp("--shell=", argv[i], 8)) { + shell = argv[i]+8; +diff --git a/psx/psx.c b/psx/psx.c +index eec6db8..1ace898 100644 +--- a/psx/psx.c ++++ b/psx/psx.c +@@ -454,6 +454,10 @@ static void *_psx_start_fn(void *data) { + int __wrap_pthread_create(pthread_t *thread, const pthread_attr_t *attr, + void *(*start_routine) (void *), void *arg) { + psx_starter_t *starter = calloc(1, sizeof(psx_starter_t)); ++ if (starter == NULL) { ++ perror("failed at thread creation"); ++ exit(1); ++ } + starter->fn = start_routine; + starter->arg = arg; + /* +-- +2.42.0 + diff --git a/29EE848AE2CCF3F4.asc b/29EE848AE2CCF3F4.asc deleted file mode 100644 index 6d95430..0000000 --- a/29EE848AE2CCF3F4.asc +++ /dev/null @@ -1,105 +0,0 @@ -pub rsa4096 2011-10-07 [SC] - 38A644698C69787344E954CE29EE848AE2CCF3F4 -uid Andrew G. Morgan -uid Andrew G. Morgan (Work Address) -sub rsa4096 2011-10-07 [E] - E8BBFE9EBCE94FB48D2F98FC61B996743B143E89 - ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBE6OiBIBEADpdtUxC8Fmhn5UK6UCZdU7mFgZwN8U9cabFUPfUIkMqXULhCD0 -hG2/amuiiUoLollPjOopNqk4cc8LcZfszOdBFAYj7MeWzNySVw4KkWrVCEH/bZ0Q -QzZH2qmoMT5CIrtcNxCAvukYsZLhyZYO0HdfuE05mVhVjtX9Btfxr7Ndvb7L4MRS -3Qb6+nHTgfn/Oow92/koIWvi0YvskKdZypeU888TQL99E8xdgL2n2Ip3xYwBHRR2 -GPb5MGOuEItF3tJ0kkILW5mzkJq/iLzRphzKjdF76I9QVRP8dZ+uWHPubWePm/5c -1H9lnlw00ZZ/ucQvSwTesUYk2aKkxzgm6X8fCdJXBLGgW5K6CkynpjN3qJ9KpcNY -H55smUgp8BaiWuoHe4pLvuBhnN2wiYOe2j9UvGX1OaRstMXFx7YbBvkGgdoZthUe -VPGAa4K+dnI2oy4wukzl/unAKrlMCBRsRoW2qjy3TDSXqwJhd34ilHzrdAdchrh/ -acBfbBtRzVlcDTnGltDNMuRTXzujaY9C3B0L2E+Jfrds8WcM8ASO4mHwJUTMrBwM -b5sFSG+/X9Ufg/c2G086HQ7xMERUA5oz66P5ReHCph8WHQN2L5vtZwL7//hZB9hn -G0K1210YEDXpFPijpis/54MKUSkWEFOLjUbiSPbwEfb79A00CcHojQQinwARAQAB -tCRBbmRyZXcgRy4gTW9yZ2FuIDxtb3JnYW5Aa2VybmVsLm9yZz6JAhwEEAECAAYF -Ak6YnFgACgkQINBOWnE2YKdO8Q//fwzZuxAacpWE2wByvuwM7hiYOtzxX9tSsaMA -NaYtxb8rYwM5YtkjCaBnWoyJ8de7L82HJff/GnxVpw0CWm5Dyj9Pvs/VAIvC4+75 -+5cs6YWQIhIV5NbmD92lKFni2xNcBomzttB1CexjemtmXQIwm0i06HBbfg8Nkv3l -WnZlHHzgOffnkodR56rJCOq75wTPZPmx9WP87bDW2B5ZwzGs4jcBEP8qz4J5agVk -97OrYrhy2RrtD6a4f3/VYJq12mvJ/lImgEwNoLsZfMZ6B6wpCvfmx80z1dE/VOmG -YKpDPhU5v6y0gQm/UOpz0tzgRJw7CYRK3mbM/Ctnc4n6y0UpbVAmAStRvnlM1DgL -3nuuh3EJ6s1r2m2l1SRT09va+lK6s1GARMD+6tmQE7+89DwwSB0lJtWCHRGP/M8W -ePdqRAVz3xTkqbRMgcnuvpL6qPveK1Qzv2MxUomB7A8QDxzKzQAIugzm5E1irfmZ -jg54/8R2bo0uIp8PS6wx8RD7TYHxGpe4cEAkBr/5/5TfMaTDbrx/f/XqRm/89Mx9 -04TLVyMqVDcsXAgd+fIGtv/e8cBVMDIRsE9aZQsSOil168Q8qYrJbYRcWmEGaM4d -KCGYhEPE7ZaZK4jxshSwfiirozCoAmkTmvOt4E0s2HlljjLPDecAlvoFvn2bSS3Z -8coir4CJAjsEEwECACUCGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheABQJOmRGP -AhkBAAoJECnuhIrizPP0wK0P/RMvjmzeXbgoa36cBDvDKReAiC56Au4qGXkNah39 -84tNPT1hVUKCiwiUmULoNJbEI4qFJTtwsMi5QzE+daCA7t+ALJiC+PKiKFG1LDz7 -mxfhmBeS3XcYuqZdjyKrATUFr0SHbsJxtRCslawGD2gKczLknFeBXL0997TfJS9i -pLibqCtmvyryHn4EbZfoJqcpj/RBN/izVGHNYI8BsZpO5F6z7vXoncDL0dKh65nd -GaIbhVDUPsDBvzg3i+EzhB51hYTTNKK0QpWbmsXfJBnvztinfLUsnO9HV8aRaygO -I/DAKAtT7YPXORA1oFYtx69bzulqC+TXUmeV8YW8bETH4xHM9mQb0oNLPibR2nK2 -FSDiLp0/eEM5vgzfPVUX7WzBJUPsf0ah/e1yrXqudGUUZ0R+3VMOdxMryZBKLymk -zyvu6a5DcLarqAt8y9ciRH67HKNnE1gvHf5K2Q37gwSecwmXCjpMlbVJnIarLKBc -VRcYKtxgPxCv6483I8heSKF7PB/IFBmzT1cX7lhln9+62Ks/0Gs0pA0iNLaD+POP -iqWrAwZsFvKjD9PDaCBDFRWjFqZLyJMsMi1qmP8jWsdQqPdUskQC0ftvw3Z6Siyy -rriSAzglCjmmAcfdt+w4b/EO4SzSZUnd/ApkHkZx1Lbta15WKxGi7S8/5zNdaK72 -1nUdiQIzBBABCAAdFiEEIHnICkX+vZuglRryyyMS4ez3P1cFAl0PDA8ACgkQyyMS -4ez3P1eHXg//ceYbw0RGvvkpBn41t2D2OEDnowyAqgdrByFoub4mam3lxjKZob6F -nIVcp0aY6TTOW0Peo0ZMigLh2DkEpF0JZrtTu5Om2tZpn+16d2c9ThROEasTERqI -AnUHMmpXupRZDSdHJTSD+HdlBSvO9Ve2vtIv/F9AW8pIQqZby3rJeFwsaQl9GUuw -T6teyBG5GZVFLDvNM2r64moTGvxsZdOEz/2KSZNMONEIFWYJPbBtaKZjlNJebh+i -YwOda6YqGwmyBpudtMtyHUT5gXBIaaMfKW40CxxTesOuV7YWg52ZkJe8tsURnIUi -55wCaLnNM+bsqjRIDZ5tAvCqTCj+T5hg6uJbmWOhCHW4VMp3PKEgmajMSZVAfzcW -iryAT/xol531qwer+3LRRS21qha3lfAJNaDy6rTHBqeDXyo7oeBQwoFIJFA5w9Ia -DVRfWXiKnHjsma0CEg1JXXnL1eb2Bzh8qInUQEgm92B/w2tJgNDDNPIDQDlbWgQw -24Wzx5QGOfr4CJM3WMhSdUEn8jyyFj+GmCfCAtRTEPhGIf4op6rZfH5Q8O0UJ865 -iIvshNNLoWtkVx2MTU4juXsz666Vq+HFzyIw2xPeabVIKVzF25+vbTTRQIhohuU9 -FV36IqXOGGwYAlnu8/2NFDWbUIhaCaB0N2AeVH8kQcO9L0OEHB0MJy+0MEFuZHJl -dyBHLiBNb3JnYW4gKFdvcmsgQWRkcmVzcykgPGFnbUBnb29nbGUuY29tPokCOAQT -AQIAIgUCTpUPggIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQKe6EiuLM -8/TM2hAAwOPHeKi+9/SukBgW+8Cg9vOERdwnjX9P6lrFY4mbxISDt9edQeBd5PBb -dEk8ins+C5y0+iC8pBX7sZxTkNyDXcNk7icytKy8iewtCR94NVT/OXYy4cU60Eyk -OnqIZxTCNLRthu+XTd8+Ptlcgwv4js5LI16hn+fbO0j1SIgEei+wepmpibh3tU6L -idWPVj8ZqT32zDdwu9TCr1/eLyKg3PKeoFPuMD4ZYVp5Um4as4IEEGC4i7QSSDjY -0BnYBHfbBA/l4S2VICrwiX1FnN7BrW/viWgM0k6X6Rbn+NArq0aPYD2+VOpXMdQO -Y9n2foOzuHfCjaDeDNhfVy4zeylb1SwDxdQM1jbI0VgML0iwAjT27Xw3t/z2Kwb/ -JiHkxmknPZ/Htx5we3BJW6RMYcOxqgdNcyV+NCZVTl585FklroHHRORpILB5x6be -r7c5x2BbxfA9aKT/la/wHd0mikwfUzDelGGKu1N3r/zzE3IuQlK2m0ENm9uq8Hac -yZKKqCHSY96yWfC5vEnn/gVs/3OUs3vOnj1FkcoOX/wQxJcYKOYbpRPFbojdikp1 -zj7IR3X39RS3GpA59uAW+Vxt6xDkgu8s7NmJ2RLvLS/iL2tkF78cTLd4bzPizl2W -gGulIG8rJLCpa65IOfe0yrDgHPYF7cWC1gDhOc3LuyFwVHYEwWiJAjMEEAEIAB0W -IQQgecgKRf69m6CVGvLLIxLh7Pc/VwUCXQ8MGwAKCRDLIxLh7Pc/V0F9EACHKNqF -l5xXDHe/0nlZ+J/OFRNIE8ObZAxQLaPfK3gRkFn/SbKQzkzB84X2il7A/W221Lzi -me5eTFPhTX3RxUcoSQdrtCCov5gCeuiUbhuJ28zuJxslxLE8bhnmNfpLmFFGtbMI -kXq+y0uqc08Yj8frPXKgx7KvOoovpm0X/igiAkiuKLhbq8xIwaIN0NL4slFlx+ZP -Ed0KA6qOvlLr0T/lLVptAeMrzfi2gqY1utSqE5IVrbtU6Kptw3zfURsGFFIaKjIr -hzu25Cdpg/NxYGqo2GqD0lZ+OeWSy0WI5sxCSDqr0to9lvsJGv2Nc06ixIjH7vG2 -Hc/cC0QyHdBM6GwaLmUH9hrcSCLR5kxTzAW0Cf6lrAZUL36Ivl5l+zoLdJqSgZLY -YXqMdQf75Y5TRFzry5pWRef3ba4/sgui89W11Uccdq/pGe4OKo0I/vq3bv35/3cZ -aMGjj3x6v67kk8GWbKg6CPBnzb1dY7VDA5RWOt2lPZr4omUNFwRpxAfZADUz2Q4S -tMQVE018SSH1i6G9EB8KVQEBeD4qgaWs1z9sqA7K5wlBzGarTa2RspH0GMmYwxBY -hXtYpKm/47Dkg8j3N01VVwky0XGPFHCVgFbeXGknL1O3thOGs5XPO05jtBcbYI1u -vvK+h/CNn1yuTG13BSG4pgRF1Sy6CFLHme0d/rkCDQROjogSARAAtLny8nlyr8fy -YGAocQz0S47a99n/X0Vmgwo1trJsCXWbOrpztznY8IFRK/dRnRHiMwBxWQ4CvdUk -2p0MweUiOjpEN7bUm92jeFXMr0hpQKf+O4DMExHS4hxLwArnKFuAk2ejRQGXBcEo -Mv11LiUwuzFbWdXqMsA1TbuA+WvEBnFUYM/6xNiJeRIUIiGydhG1yaw8HrNWLHnh -hcOfT6z5AO69hZZiJacp9pU/+jnep/M42p4J17x81+ESpJeladwR0Qxc0qxOyWid -N7oO5hSiBEwU6lYQjdQ23pa7tN1o90P9jyN2nFBEdBu2D/mi4DV/+VXUYHNEy3uN -hmmLGwMoPVWiZveRmG74+ne7MVyxwb9EIF3IenS4T65ee1dlZvaoMxUlUe8htEK0 -ChrQZOfITs9MyjUwoTiLUVo3kQeMli9HJEQXPRjHqkkZ7W65LhkEVnHSPHWtttRS -DkuZYtze+he142GzDSQA3dF2zy/tLpBb5CA29ITcQTspgV7AuV8YQqDZ4XWHsR9A -m5334N83EXk2oouqxl7mKUB0Vg6tujNCBSRn6A3CUaA29w/MyTg4z6Yw6HD3il1J -8PcWEoOzqlUoPd8tA5pcZCcKngkXndpXgsZCgoCgvx9WNU+LUrHBfhC3TLLsI7iG -O1JvLghkesKTARF3O2hS3xAhfGZxn8MAEQEAAYkCHwQYAQIACQUCTo6IEgIbDAAK -CRAp7oSK4szz9HSYD/9hmEsJuSgAGwx/OPweYuDGkA25ajDAu59LpzTbjB/yOU1r -DVUu3cMH+UEyaEGlhbneGvHF2DsEC9il/8fVL4eaE9EWpopIonYndBE91+YiGHPT -oiyKcdp0KuQMwm2ENAiEf/qErrB2NLna4wfZUx5lzvEOEk3cNPmNz2ERyMPXIeei -Q9VKp3MzopWhvBItAyIzzuydKKvJAKzDoTOEL4w60slAphj8rVCsW45k2AurWUH7 -VFM8ezXunieLeygCGb+YJZAet6yVXD3UwnNcWCGQ+xKSPuyKrn4xKG0N5gzxnGIh -/S/7IOjRaNR5X+pfWd6YzN9qURUfiXmuLSPRHK4Flfam4gMMHul9wL6XBayFo2NU -PBaxg4U9ACAgSJxgCTNPCKwnovecOsRmIESKtT1F3hbZRRgRGj/TDepJQNfHSyk/ -ZQfuoJggBMQLJKzGII42rb0W90QLMk0SyCzeb3LO3yyNiKpluNpJsl2IqdBJE5t1 -LxhKDnju6JlFyPcGJnP/doTuDTjjL0V+guPAGVbuq0g2hku+ZlJwjMStNwHPWxei -fuDJbQVIp0xZbI5djdHC8hVJX+d09J5eq0PlgMEidc4F+Vv+mmGJl0GiNfhmTaAC -SRzbI25/bhvj2xhx8A2LEOuU/+nzYgQzPcFpawiUP1wBnTqi+maxKx5/9ifyrw== -=6WX5 ------END PGP PUBLIC KEY BLOCK----- diff --git a/_makenames-build.patch b/_makenames-build.patch deleted file mode 100644 index 460de75..0000000 --- a/_makenames-build.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/libcap/Makefile b/libcap/Makefile -index f0eb87e..e90a950 100644 ---- a/libcap/Makefile -+++ b/libcap/Makefile -@@ -80,7 +80,7 @@ $(PSXTITLE).pc: $(PSXTITLE).pc.in - $< >$@ - - _makenames: _makenames.c cap_names.list.h -- $(BUILD_CC) $(BUILD_CFLAGS) $(BUILD_CPPFLAGS) $< -o $@ $(BUILD_LDFLAGS) -+ $(BUILD_CC) $(BUILD_CFLAGS) $(BUILD_CPPFLAGS) $< -o $@ - - cap_names.h: _makenames - ./_makenames > cap_names.h diff --git a/capfaq-0.2.txt b/capfaq-0.2.txt new file mode 100644 index 0000000..e3e272b --- /dev/null +++ b/capfaq-0.2.txt @@ -0,0 +1,264 @@ +This is the Linux kernel capabilities FAQ + +Its history, to the extent that I am able to reconstruct it is that +v2.0 was posted to the Linux kernel list on 1999/04/02 by Boris +Tobotras. Thanks to Denis Ducamp for forwarding me a copy. + +Cheers + +Andrew + +Linux Capabilities FAQ 0.2 +========================== + +1) What is a capability? + +The name "capabilities" as used in the Linux kernel can be confusing. +First there are Capabilities as defined in computer science. A +capability is a token used by a process to prove that it is allowed to +do an operation on an object. The capability identifies the object +and the operations allowed on that object. A file descriptor is a +capability. You create the file descriptor with the "open" call and +request read or write permissions. Later, when doing a read or write +operation, the kernel uses the file descriptor as an index into a +data structure that indicates what operations are allowed. This is an +efficient way to check permissions. The necessary data structures are +created once during the "open" call. Later read and write calls only +have to do a table lookup. Operations on capabilities include copying +capabilities, transferring capabilities between processes, modifying a +capability, and revoking a capability. Modifying a capability can be +something like taking a read-write filedescriptor and making it +read-only. A capability often has a notion of an "owner" which is +able to invalidate all copies and derived versions of a capability. +Entire OSes are based on this "capability" model, with varying degrees +of purity. There are other ways of implementing capabilities than the +file descriptor model - traditionally special hardware has been used, +but modern systems also use the memory management unit of the CPU. + +Then there is something quite different called "POSIX capabilities" +which is what Linux uses. These capabilities are a partitioning of +the all powerful root privilege into a set of distinct privileges (but +look at securelevel emulation to find out that this isn't necessary +the whole truth). Users familiar with VMS or "Trusted" versions of +other UNIX variants will know this under the name "privileges". The +name "capabilities" comes from the now defunct POSIX draft 1003.1e +which used this name. + +2) So what is a "POSIX capability"? + +A process has three sets of bitmaps called the inheritable(I), +permitted(P), and effective(E) capabilities. Each capability is +implemented as a bit in each of these bitmaps which is either set or +unset. When a process tries to do a privileged operation, the +operating system will check the appropriate bit in the effective set +of the process (instead of checking whether the effective uid of the +process i 0 as is normally done). For example, when a process tries +to set the clock, the Linux kernel will check that the process has the +CAP_SYS_TIME bit (which is currently bit 25) set in its effective set. + +The permitted set of the process indicates the capabilities the +process can use. The process can have capabilities set in the +permitted set that are not in the effective set. This indicates that +the process has temporarily disabled this capability. A process is +allowed to set a bit in its effective set only if it is available in +the permitted set. The distinction between effective and permitted +exists so that processes can "bracket" operations that need privilege. + +The inheritable capabilities are the capabilities of the current +process that should be inherited by a program executed by the current +process. The permitted set of a process is masked against the +inheritable set during exec(). Nothing special happens during fork() +or clone(). Child processes and threads are given an exact copy of +the capabilities of the parent process. + +3) What about other entities in the system? Users, Groups, Files? + +Files have capabilities. Conceptually they have the same three +bitmaps that processes have, but to avoid confusion we call them by +other names. Only executable files have capabilities, libraries don't +have capabilities (yet). The three sets are called the allowed set, +the forced set, and the effective set. + +The allowed set indicates what capabilities the executable is allowed +to receive from an execing process. This means that during exec(), +the capabilities of the old process are first masked against a set +which indicates what the process gives away (the inheritable set of +the process), and then they are masked against a set which indicates +what capabilities the new process image is allowed to receive (the +allowed set of the executable). + +The forced set is a set of capabilities created out of thin air and +given to the process after execing the executable. The forced set is +similar in nature to the setuid feature. In fact, the setuid bit from +the filesystem is "read" as a full forced set by the kernel. + +The effective set indicates which bits in the permitted set of the new +process should be transferred to the effective set of the new process. +The effective set is best thought of as a "capability aware" set. It +should consist of only 1s if the executable is capability-dumb, or +only 0s if the executable is capability-smart. Since the effective +set consists of only 0s or only 1s, the filesystem can implement this +set using a single bit. + +NOTE: Filesystem support for capabilities is not part of Linux 2.2. + +Users and Groups don't have associated capabilities from the kernel's +point of view, but it is entirely reasonable to associate users or +groups with capabilities. By letting the "login" program set some +capabilities it is possible to make role users such as a backup user +that will have the CAP_DAC_READ_SEARCH capability and be able to do +backups. This could also be implemented as a PAM module, but nobody +has implemented one yet. + +4) What capabilities exist? + +The capabilities available in Linux are listed and documented in the +file /usr/src/linux/include/linux/capability.h. + +5) Are Linux capabilities hierarchical? + +No, you cannot make a "subcapability" out of a Linux capability as in +capability-based OSes. + +6) How can I use capabilities to make sure Mr. Evil Luser (eluser) +can't exploit my "suid" programs? + +This is the general outline of how this works given filesystem +capability support exists. First, you have a PAM module that sets the +inheritable capabilities of the login-shell of eluser. Then for all +"suid" programs on the system, you decide what capabilities they need +and set the _allowed_ set of the executable to that set of +capabilities. The capability rules + + new permitted = forced | (allowed & inheritable) + +means that you should be careful about setting forced capabilities on +executables. In a few cases, this can be useful though. For example +the login program needs to set the inheritable set of the new user and +therefore needs an almost full permitted set. So if you want eluser +to be able to run login and log in as a different user, you will have +to set some forced bits on that executable. + +7) What about passing capabilities between processes? + +Currently this is done by the system call "setcap" which can set the +capabilities of another process. This requires the CAP_SETPCAP +capability which you really only want to grant a _few_ processes. +CAP_SETPCAP was originally intended as a workaround to be able to +implement filesystem support for capabilities using a daemon outside +the kernel. + +There has been discussions about implementing socket-level capability +passing. This means that you can pass a capability over a socket. No +support for this exists in the official kernel yet. + +8) I see securelevel has been removed from 2.2 and are superceeded by +capabilities. How do I emulate securelevel using capabilities? + +The setcap system call can remove a capability from _all_ processes on +the system in one atomic operation. The setcap utility from the +libcap distribution will do this for you. The utility requires the +CAP_SETPCAP privilege to do this. The CAP_SETPCAP capability is not +enabled by default. + +libcap is available from +ftp://ftp.kernel.org/pub/linux/libs/security/linux-privs/kernel-2.2/ + +9) I noticed that the capability.h file lacks some capabilities that +are needed to fully emulate 2.0 securelevel. Is there a patch for +this? + +Actually yes - funny you should ask :-). The problem with 2.0 +securelevel is that they for example stop root from accessing block +devices. At the same time they restrict the use of iopl. These two +changes are fundamentally different. Blocking access to block devices +means restricting something that usually isn't restricted. +Restricting access to the use of iopl on the other hand means +restricting (blocking) access to something that is already blocked. +Emulating the parts of 2.0 securelevel that restricts things that are +normally not restricted means that the capabilites in the kernel has +to have a set of capabilities that are usually _on_ for a normal +process (note that this breaks the explanation that capabilities are a +partitioning of the root privileges). There is an experimental patch at + +ftp://ftp.guardian.no/pub/free/linux/capabilities/patch-cap-exp-1 + +which implements a set of capabilities with the "CAP_USER" prefix: + +cap_user_sock - allowed to use socket() +cap_user_dev - allowed to open char/block devices +cap_user_fifo - allowed to use pipes + +These should be enough to emulate 2.0 securelevel (tell me if we need +something more). + +10) Seems I need a CAP_SETPCAP capability that I don't have to make use +of capabilities. How do I enable this capability? + +Change the definition of CAP_INIT_EFF_SET and CAP_INIT_INH_SET to the +following in include/linux/capability.h: + +#define CAP_INIT_EFF_SET { ~0 } +#define CAP_INIT_INH_SET { ~0 } + +This will start init with a full capability set and not with +CAP_SETPCAP removed. + +11) How do I start a process with a limited set of capabilities? + +Get the libcap library and use the execcap utility. The following +example starts the update daemon with only the CAP_SYS_ADMIN +capability. + +execcap 'cap_sys_admin=eip' update + +12) How do I start a process with a limited set of capabilities under +another uid? + +Use the sucap utility which changes uid from root without loosing any +capabilities. Normally all capabilities are cleared when changing uid +from root. The sucap utility requires the CAP_SETPCAP capability. +The following example starts updated under uid updated and gid updated +with CAP_SYS_ADMIN raised in the Effective set. + +sucap updated updated execcap 'cap_sys_admin=eip' update + +[ Sucap is currently available from +ftp://ftp.guardian.no/pub/free/linux/capabilities/sucap.c. Put it in +the progs directory of libcap to compile.] + +13) What are the "capability rules" + +The capability rules are the rules used to set the capabilities of the +new process image after an exec. They work like this: + + pI' = pI + (***) pP' = fP | (fI & pI) + pE' = pP' & fE [NB. fE is 0 or ~0] + + I=Inheritable, P=Permitted, E=Effective // p=process, f=file + ' indicates post-exec(). + +Now to make sense of the equations think of fP as the Forced set of +the executable, and fI as the Allowed set of the executable. Notice +how the Inheritable set isn't touched at all during exec(). + +14) What are the laws for setting capability bits in the Inheritable, +Permitted, and Effective sets? + +Bits can be transferred from Permitted to either Effective or +Inheritable set. + +Bits can be removed from all sets. + +15) Where is the standard on which the Linux capabilities are based? + +There used to be a POSIX draft called POSIX.6 and later POSIX 1003.1e. +However after the committee had spent over 10 years, POSIX decided +that enough is enough and dropped the draft. There will therefore not +be a POSIX standard covering security anytime soon. This may lead to +that the POSIX draft is available for free, however. + +-- + Best regards, -- Boris. + diff --git a/gating.yaml b/gating.yaml index 3738107..fba44d0 100644 --- a/gating.yaml +++ b/gating.yaml @@ -4,6 +4,7 @@ product_versions: decision_context: bodhi_update_push_testing subject_type: koji_build rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.rpmdeplint.functional} - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.rpminspect.static-analysis} - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.installability.functional} - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} @@ -13,6 +14,7 @@ product_versions: decision_context: bodhi_update_push_stable subject_type: koji_build rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.rpmdeplint.functional} - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.rpminspect.static-analysis} - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.installability.functional} - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} diff --git a/getpcaps.8 b/getpcaps.8 new file mode 100644 index 0000000..6bbf46a --- /dev/null +++ b/getpcaps.8 @@ -0,0 +1,23 @@ +.\" Hey, EMACS: -*- nroff -*- +.TH GETPCAPS 8 "2001-05-29" +.\" Please adjust this date whenever revising the manpage. +.SH NAME +getpcaps \- display process capabilities +.SH SYNOPSIS +.B getpcaps +.IR pid ... +.SH DESCRIPTION +.B getpcaps +displays the capabilities on the processes indicated by the +.I pid +value(s) given on the commandline. The capabilities +are displayed in the +.BR cap_from_text (3) +format. +.SH SEE ALSO +.BR execcap (8). +.br +.SH AUTHOR +This manual page was written by Robert Bihlmeyer , +for the Debian GNU/Linux system (but may be used by others). + diff --git a/libcap-use-compiler-flag-options.patch b/libcap-use-compiler-flag-options.patch new file mode 100644 index 0000000..9728330 --- /dev/null +++ b/libcap-use-compiler-flag-options.patch @@ -0,0 +1,37 @@ +From 7c13fa4e4c044941afd3b3766de71821cdc04397 Mon Sep 17 00:00:00 2001 +From: "H.J. Lu" +Date: Sun, 14 Feb 2021 14:06:49 -0800 +Subject: [PATCH] Update Make.Rules for Fedora RPM build + +--- + Make.Rules | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/Make.Rules b/Make.Rules +index ded9014..537cb6c 100644 +--- a/Make.Rules ++++ b/Make.Rules +@@ -56,10 +56,10 @@ IPATH += -fPIC -I$(KERNEL_HEADERS) -I$(topdir)/libcap/include + + CC := $(CROSS_COMPILE)gcc + DEFINES := -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 +-COPTS ?= -O2 ++COPTS ?= $(RPM_OPT_FLAGS) + CFLAGS ?= $(COPTS) $(DEFINES) + BUILD_CC ?= $(CC) +-BUILD_COPTS ?= -O2 ++BUILD_COPTS ?= $(RPM_OPT_FLAGS) + BUILD_CFLAGS ?= $(BUILD_COPTS) $(DEFINES) $(IPATH) + AR := $(CROSS_COMPILE)ar + RANLIB := $(CROSS_COMPILE)ranlib +@@ -69,7 +69,7 @@ WARNINGS=-Wall -Wwrite-strings \ + -Wstrict-prototypes -Wmissing-prototypes \ + -Wnested-externs -Winline -Wshadow + LD=$(CC) -Wl,-x -shared +-LDFLAGS ?= #-g ++LDFLAGS ?= $(RPM_LD_FLAGS) + LIBCAPLIB := -L$(topdir)/libcap -lcap + PSXLINKFLAGS := -lpthread -Wl,-wrap,pthread_create + LIBPSXLIB := -L$(topdir)/libcap -lpsx $(PSXLINKFLAGS) +-- +2.29.2 diff --git a/libcap.spec b/libcap.spec index 3476fd1..7fad386 100644 --- a/libcap.spec +++ b/libcap.spec @@ -1,30 +1,19 @@ Name: libcap -Version: 2.77 -Release: 1%{?dist} +Version: 2.48 +Release: 8%{?dist} Summary: Library for getting and setting POSIX.1e capabilities URL: https://sites.google.com/site/fullycapable/ -License: BSD-3-Clause OR GPL-2.0-only +License: BSD or GPLv2 -Source0: https://mirrors.edge.kernel.org/pub/linux/libs/security/linux-privs/libcap2/%{name}-%{version}.tar.gz -Source1: https://mirrors.edge.kernel.org/pub/linux/libs/security/linux-privs/libcap2/%{name}-%{version}.tar.sign -Source2: https://git.kernel.org/pub/scm/docs/kernel/pgpkeys.git/plain/keys/29EE848AE2CCF3F4.asc -Patch0: _makenames-build.patch +Source: https://git.kernel.org/pub/scm/libs/libcap/libcap.git/snapshot/%{name}-%{version}.tar.gz +Patch0: libcap-use-compiler-flag-options.patch +Patch1: 0001-cap_alloc.c-fix-CVE-2023-2603.patch +Patch2: 0002-psx.c-fix-CVE-2023-2602.patch +Patch3: 0003-Bug-fixes-identified-by-static-code-analysis.patch +Patch4: 0004-Fruit-of-more-static-analysis-results.patch -BuildRequires: pam-devel gcc +BuildRequires: libattr-devel pam-devel perl-interpreter gcc BuildRequires: make -BuildRequires: glibc-static -BuildRequires: gnupg2 - -%ifarch %{golang_arches} -BuildRequires: golang >= 1.22 -%endif - -%if "%{_sbindir}" == "%{_bindir}" -# Compat symlinks for Requires in other packages. -# We rely on filesystem to create the symlinks for us. -Requires: filesystem(unmerged-sbin-symlinks) -Provides: /usr/sbin/setcap -%endif %description libcap is a library for getting and setting POSIX.1e (formerly POSIX 6) @@ -54,31 +43,22 @@ draft 15 capabilities. Install libcap-devel if you want to develop or compile applications using libcap. -%ifarch %{golang_arches} -%package -n captree -Summary: Capability inspection utility - -%description -n captree -The captree program was inspired by the utility pstree, but it uses the -libcap/cap (Go package) API to explore process runtime state and display -the capability status of processes and threads. -%endif - %prep -gzip -cd %{SOURCE0} | %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data=- %autosetup -p1 - %build -%make_build prefix=%{_prefix} lib=%{_lib} SBINDIR=%{_sbindir} CGO_REQUIRED=1 CGO_CFLAGS="${CFLAGS}" CGO_LDFLAGS="${LDFLAGS}" GO_BUILD_FLAGS="-buildmode=pie -a -v -x -ldflags='-compressdwarf=false -B gobuildid'" all - -%check -make test +# libcap can not be build with _smp_mflags: +make prefix=%{_prefix} lib=%{_lib} LIBDIR=%{_libdir} SBINDIR=%{_sbindir} \ + INCDIR=%{_includedir} MANDIR=%{_mandir} PKGCONFIGDIR=%{_libdir}/pkgconfig/ %install -%make_install prefix=%{_prefix} lib=%{_lib} SBINDIR=%{_sbindir} CGO_REQUIRED=1 CGO_CFLAGS="${CFLAGS}" CGO_LDFLAGS="${LDFLAGS}" GO_BUILD_FLAGS="-buildmode=pie -ldflags='-compressdwarf=false -B gobuildid'" +make install RAISE_SETFCAP=no \ + DESTDIR=%{buildroot} \ + LIBDIR=%{_libdir} \ + SBINDIR=%{_sbindir} \ + PKGCONFIGDIR=%{_libdir}/pkgconfig/ -mkdir -p %{buildroot}/%{_mandir}/man{2,3,5,8} +mkdir -p %{buildroot}/%{_mandir}/man{2,3,8} mv -f doc/*.3 %{buildroot}/%{_mandir}/man3/ chmod +x %{buildroot}/%{_libdir}/*.so.* @@ -87,112 +67,31 @@ chmod +x %{buildroot}/%{_libdir}/*.so.* %files %license License -%doc doc/capability.md -%{_libdir}/libcap.so.2{,.*} -%{_libdir}/libpsx.so.2{,.*} -%{_sbindir}/{capsh,getcap,getpcaps,setcap} -%{_mandir}/man1/capsh.1* -%{_mandir}/man5/capability.conf.5* -%{_mandir}/man7/cap_text_formats.7* -%{_mandir}/man8/{getcap,getpcaps,setcap,pam_cap}.8* +%doc doc/capability.notes +%{_libdir}/*.so.* +%{_sbindir}/* +%{_mandir}/man1/* +%{_mandir}/man8/* %{_libdir}/security/pam_cap.so -%exclude %{_mandir}/man8/captree.8* %files static %{_libdir}/libcap.a %{_libdir}/libpsx.a %files devel -%{_includedir}/sys/capability.h -%{_includedir}/sys/psx_syscall.h -%{_libdir}/libcap.so -%{_libdir}/libpsx.so -%{_mandir}/man3/cap*.3* -%{_mandir}/man3/libcap.3* -%{_mandir}/man3/libpsx.3* -%{_mandir}/man3/psx_*.3* -%{_mandir}/man3/__psx_syscall.3* -%{_libdir}/pkgconfig/{libcap,libpsx}.pc +%{_includedir}/* +%{_libdir}/*.so +%{_mandir}/man3/* +%{_libdir}/pkgconfig/libcap.pc +%{_libdir}/pkgconfig/libpsx.pc -%ifarch %{golang_arches} -%files -n captree -%license License -%{_sbindir}/captree -%{_mandir}/man8/captree.8* -%endif %changelog -* Tue Oct 28 2025 Carlos Rodriguez-Fernandez - 2.77-1 -- Update to version 2.77 (rhbz#2406446) +* Tue Dec 12 2023 Carlos Rodriguez-Fernandez - 2.48-8 +- Backport bug fixes identified by static analysis -* Fri Oct 10 2025 Alejandro Sáez - 2.76-4 -- rebuild - -* Fri Aug 15 2025 Maxwell G - 2.76-3 -- Rebuild for golang-1.25.0 - -* Thu Jul 24 2025 Fedora Release Engineering - 2.76-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - - -* Mon Apr 14 2025 Carlos Rodriguez-Fernandez - 2.76-1 -- Update to version 2.76 (rhbz#2349318, rhbz#2352529) - -* Fri Jan 24 2025 Carlos Rodriguez-Fernandez - 2.73-2 -- Update internal CI tests - -* Fri Jan 24 2025 Carlos Rodriguez-Fernandez - 2.73-1 -- Update to version 2.73 (rhbz#2340722) - -* Fri Jan 17 2025 Fedora Release Engineering - 2.71-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek - 2.71-2 -- Rebuilt for the bin-sbin merge (2nd attempt) - -* Mon Oct 28 2024 Carlos Rodriguez-Fernandez - 2.71-1 -- Update to version 2.71 - -* Thu Jul 18 2024 Fedora Release Engineering - 2.70-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek - 2.70-3 -- Rebuilt for the bin-sbin merge - -* Tue Jun 04 2024 Anderson Toshiyuki Sasaki - 2.70-2 -- Set CGO_CFLAGS=$CFLAGS and CGO_LDFLAGS=$LDFLAGS to build Go code - -* Mon May 20 2024 Carlos Rodriguez-Fernandez - 2.70-1 -- Update to version 2.70 - -* Fri Apr 05 2024 Carlos Rodriguez-Fernandez - 2.69-8 -- Make correction to the capability.conf manpage - -* Fri Apr 05 2024 Carlos Rodriguez-Fernandez - 2.69-7 -- Reenable PIE in the captree tool - -* Thu Apr 04 2024 Carlos Rodriguez-Fernandez - 2.69-6 -- Fix incompatibility of the build with go 1.22. - -* Wed Apr 03 2024 Carlos Rodriguez-Fernandez - 2.69-5 -- Add manpages for pam_cap and capability.conf - -* Sun Feb 11 2024 Maxwell G - 2.69-4 -- Rebuild for golang 1.22.0 - -* Thu Jan 25 2024 Fedora Release Engineering - 2.69-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Sun Jan 21 2024 Fedora Release Engineering - 2.69-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Mon Nov 06 2023 Carlos Rodriguez-Fernandez - 2.69-1 -- Update to 2.69 (with contribs from Yanko Kaneti , and Andrew G. Morgan ) -- Update license to SPDX (by Anderson Toshiyuki Sasaki ) -- Make file lists more explicit to avoid accidental ABI changes (Dominik Mierzejewski ) - -* Thu Jul 20 2023 Fedora Release Engineering - 2.48-7 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild +* Wed Nov 22 2023 Carlos Rodriguez-Fernandez - 2.48-7 +- Backport fix for CVE-2023-2602 and CVE-2023-2603 * Thu Jan 19 2023 Fedora Release Engineering - 2.48-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild diff --git a/sources b/sources index 3dbe9ea..22a2095 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -SHA512 (libcap-2.77.tar.gz) = e5471afc4f149a8330e6df07effe58cac44d8a773b1fff0686e7039c41888e33402e1942fe5271a142e159a6088abbdbb7a82133389b3a9351749c2bf797b6b8 -SHA512 (libcap-2.77.tar.sign) = c362eefb80bbc110b7d7c676cc2b37e04bd3dab1b8b4577d62a0774b6300258743156c57102e8dc11c35d2ea876053dc57eae44197137273413b959df33ef0c0 +SHA512 (libcap-2.48.tar.gz) = 90ac6e46531e4893b78b14171537c6dfd06cf617af9e90f38ea0ce4b50161451528aefff41dbe983719e76582cf39f8d7d432f99756e976f62403d5bc3c209c8 diff --git a/tests/captree/main.fmf b/tests/captree/main.fmf deleted file mode 100644 index e401668..0000000 --- a/tests/captree/main.fmf +++ /dev/null @@ -1,2 +0,0 @@ -summary: captree smoke test -description: tests basic captree functionality diff --git a/tests/captree/test.sh b/tests/captree/test.sh deleted file mode 100755 index 2992c2c..0000000 --- a/tests/captree/test.sh +++ /dev/null @@ -1,23 +0,0 @@ -#!/bin/bash - -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -rlJournalStart - -if rpm --eval '%{golang_arches}' | tr ' ' '\n' | grep -q -e "$(rpm --eval '%{_arch}')"; then - rlPhaseStartTest "Should display help" - rlRun "captree -h" - rlPhaseEnd - - rlPhaseStartTest "Should list capabilities of pid 1" - rlRun -s "captree --depth 1 1" - rlAssertGrep 'systemd.*=ep' $rlRun_LOG - rlPhaseEnd - - rlPhaseStartTest "Should display sys admin capability" - rlRun -s "capsh --drop=cap_sys_admin -- -c 'captree --verbose \$\$'" - rlAssertGrep "!cap_sys_admin" $rlRun_LOG - rlPhaseEnd -fi - -rlJournalEnd diff --git a/tests/manpages/test.sh b/tests/manpages/test.sh index db05935..0796a1f 100755 --- a/tests/manpages/test.sh +++ b/tests/manpages/test.sh @@ -5,11 +5,9 @@ expected_manpages=( 'capsh(1)' 'libcap(3)' # there are many more but if these are present then it verifies it because of the glob install 'libpsx(3)' - 'capability.conf(5)' 'getcap(8)' 'getpcaps(8)' - 'setcap(8)' - 'pam_cap(8)' + 'setcap(8)' ) rlJournalStart @@ -18,9 +16,4 @@ rlJournalStart rlRun "man --pager=cat '${page}'" rlPhaseEnd done - if rpm --eval '%{golang_arches}' | tr ' ' '\n' | grep -q -e "$(rpm --eval '%{_arch}')"; then - rlPhaseStartTest 'test captree(8)' - rlRun "man --pager=cat 'captree(8)'" - rlPhaseEnd - fi rlJournalEnd diff --git a/tests/pkg-configs/test.sh b/tests/pkg-configs/test.sh index cc28259..45f98a4 100755 --- a/tests/pkg-configs/test.sh +++ b/tests/pkg-configs/test.sh @@ -26,7 +26,7 @@ rlJournalStart rlRun "rpm -ql libcap-devel | grep libpsx.pc" 0 "There must be libpsx.pc" if [ $? -eq 0 ]; then PCFILE=$(rpm -ql libcap-devel | grep libpsx.pc) - rlRun "pkg-config --libs libpsx | grep -- '-lpsx'" + rlRun "pkg-config --libs libpsx | grep -- '-lpsx -lpthread -Wl,-wrap,pthread_create'" VER=$(awk '/Version:/ { print $2 }' $PCFILE | tail -1) rlRun "pkg-config --modversion libpsx | grep $VER" rlRun -s "pkg-config --print-variables libpsx"