backport bug fixes identified by static analysis

ignore known lint issues
fix gating and modernize tests
2023-12-13 21:48:56 -07:00 · 2023-11-25 11:48:28 -07:00 · 2023-11-23 22:41:44 -07:00 · 2023-11-22 08:07:21 -07:00
17 changed files with 631 additions and 290 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,3 +1,2 @@
 /libcap-*.tar.gz
-/libcap-*.tar.sign
-/*.src.rpm
+*.src.rpm
--- a/0001-cap_alloc.c-fix-CVE-2023-2603.patch
+++ b/0001-cap_alloc.c-fix-CVE-2023-2603.patch
@ -0,0 +1,34 @@
+From 59bae31a96003840c064573904a4041427df3890 Mon Sep 17 00:00:00 2001
+From: Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com>
+Date: Wed, 22 Nov 2023 07:53:36 -0700
+Subject: [PATCH 1/2] cap_alloc.c:fix CVE-2023-2603
+
+---
+ libcap/cap_alloc.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/libcap/cap_alloc.c b/libcap/cap_alloc.c
+index 6dab4e6..7456d97 100644
+--- a/libcap/cap_alloc.c
+++ b/libcap/cap_alloc.c
+@@ -81,8 +81,15 @@ char *_libcap_strdup(const char *old)
+ 	errno = EINVAL;
+ 	return NULL;
+     }
+-
+-    raw_data = malloc( sizeof(__u32) + strlen(old) + 1 );
+    size_t len;
+    len = strlen(old);
+    if ((len & 0x3fffffff) != len) {
+        _cap_debug("len is too long for libcap to manage");
+	    errno = EINVAL;
+	    return NULL;
+    }
+    len += sizeof(__u32) + 1;
+    raw_data = malloc(len);
+     if (raw_data == NULL) {
+ 	errno = ENOMEM;
+ 	return NULL;
+-- 
+2.42.0
+
--- a/0002-psx.c-fix-CVE-2023-2602.patch
+++ b/0002-psx.c-fix-CVE-2023-2602.patch
@ -0,0 +1,25 @@
+From 5abae730d176107642d5d24cc14f27595ca88a69 Mon Sep 17 00:00:00 2001
+From: Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com>
+Date: Wed, 22 Nov 2023 07:55:04 -0700
+Subject: [PATCH 2/2] psx.c:fix CVE-2023-2602
+
+---
+ psx/psx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/psx/psx.c b/psx/psx.c
+index 4de3653..eec6db8 100644
+--- a/psx/psx.c
+++ b/psx/psx.c
+@@ -478,7 +478,7 @@ int __wrap_pthread_create(pthread_t *thread, const pthread_attr_t *attr,
+     pthread_sigmask(SIG_BLOCK, &sigbit, NULL);
+ 
+     int ret = __real_pthread_create(thread, attr, _psx_start_fn, starter);
+-    if (ret == -1) {
+    if (ret > 0) {
+ 	psx_new_state(_PSX_CREATE, _PSX_IDLE);
+ 	memset(starter, 0, sizeof(*starter));
+ 	free(starter);
+-- 
+2.42.0
+
--- a/0003-Bug-fixes-identified-by-static-code-analysis.patch
+++ b/0003-Bug-fixes-identified-by-static-code-analysis.patch
@ -0,0 +1,101 @@
+From f7e3aeaf41480a8cfd255dd198f16af9e5e99e5b Mon Sep 17 00:00:00 2001
+From: "Andrew G. Morgan" <morgan@kernel.org>
+Date: Wed, 21 Apr 2021 20:08:50 -0700
+Subject: [PATCH 3/3] Bug fixes identified by static code analysis.
+
+Analysis and much of this commit was contributed by Zoltan
+Fridrich of Redhat.
+
+Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
+---
+ pam_cap/pam_cap.c |  9 ++++-----
+ progs/capsh.c     | 30 ++++++++++++++++++++++--------
+ 2 files changed, 26 insertions(+), 13 deletions(-)
+
+diff --git a/pam_cap/pam_cap.c b/pam_cap/pam_cap.c
+index 6927f7b..5b48b06 100644
+--- a/pam_cap/pam_cap.c
+++ b/pam_cap/pam_cap.c
+@@ -218,7 +218,7 @@ static int set_capabilities(struct pam_cap_s *cs)
+ 	if (!cap_set_proc(cap_s)) {
+ 	    ok = 1;
+ 	}
+-	goto cleanup_cap_s;
+	goto cleanup_conf;
+     }
+ 
+     iab = cap_iab_from_text(conf_caps);
+@@ -238,10 +238,9 @@ cleanup_conf:
+     _pam_drop(conf_caps);
+ 
+ cleanup_cap_s:
+-    if (cap_s) {
+-	cap_free(cap_s);
+-	cap_s = NULL;
+-    }
+    cap_free(cap_s);
+    cap_s = NULL;
+
+     return ok;
+ }
+ 
+diff --git a/progs/capsh.c b/progs/capsh.c
+index a39ceeb..0507ea4 100644
+--- a/progs/capsh.c
+++ b/progs/capsh.c
+@@ -336,8 +336,8 @@ static void arg_change_amb(const char *arg_names, cap_flag_value_t set)
+  */
+ static char *find_self(const char *arg0)
+ {
+-    int i;
+-    char *parts, *dir, *scratch;
+    int i, status=1;
+    char *p = NULL, *parts, *dir, *scratch;
+     const char *path;
+ 
+     for (i = strlen(arg0)-1; i >= 0 && arg0[i] != '/'; i--);
+@@ -352,21 +352,35 @@ static char *find_self(const char *arg0)
+     }
+ 
+     parts = strdup(path);
+    if (parts == NULL) {
+        fprintf(stderr, "insufficient memory for parts of path\n");
+	exit(1);
+    }
+
+     scratch = malloc(2+strlen(path)+strlen(arg0));
+-    if (parts == NULL || scratch == NULL) {
+    if (scratch == NULL) {
+         fprintf(stderr, "insufficient memory for path building\n");
+-	exit(1);
+	goto free_parts;
+     }
+ 
+-    for (i=0; (dir = strtok(parts, ":")); parts = NULL) {
+    for (i=0, p = parts; (dir = strtok(p, ":")); p = NULL) {
+         sprintf(scratch, "%s/%s", dir, arg0);
+ 	if (access(scratch, X_OK) == 0) {
+-            return scratch;
+	    status = 0;
+	    break;
+ 	}
+     }
+    if (status) {
+	fprintf(stderr, "unable to find executable '%s' in PATH\n", arg0);
+	free(scratch);
+    }
+ 
+-    fprintf(stderr, "unable to find executable '%s' in PATH\n", arg0);
+-    exit(1);
+free_parts:
+    free(parts);
+    if (status) {
+	exit(status);
+    }
+    return scratch;
+ }
+ 
+ int main(int argc, char *argv[], char *envp[])
+-- 
+2.42.0
+
--- a/0004-Fruit-of-more-static-analysis-results.patch
+++ b/0004-Fruit-of-more-static-analysis-results.patch
@ -0,0 +1,108 @@
+From bcfd79b07f60746e84899d2854800f161804d5fb Mon Sep 17 00:00:00 2001
+From: "Andrew G. Morgan" <morgan@kernel.org>
+Date: Thu, 22 Apr 2021 20:06:32 -0700
+Subject: [PATCH] Fruit of more static analysis results
+
+Fixes for further analysis issues from Zoltan Fridrich of Redhat.
+
+Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
+---
+ progs/capsh.c              | 24 ++++++++++++++++++------
+ psx/psx.c                  |  4 ++++
+ tests/libcap_launch_test.c | 10 +++++++++-
+ 3 files changed, 31 insertions(+), 7 deletions(-)
+
+diff --git a/progs/capsh.c b/progs/capsh.c
+index 0507ea4..0d0154a 100644
+--- a/progs/capsh.c
+++ b/progs/capsh.c
+@@ -363,7 +363,7 @@ static char *find_self(const char *arg0)
+ 	goto free_parts;
+     }
+ 
+-    for (i=0, p = parts; (dir = strtok(p, ":")); p = NULL) {
+    for (p = parts; (dir = strtok(p, ":")); p = NULL) {
+         sprintf(scratch, "%s/%s", dir, arg0);
+ 	if (access(scratch, X_OK) == 0) {
+ 	    status = 0;
+@@ -383,6 +383,16 @@ free_parts:
+     return scratch;
+ }
+ 
+static long safe_sysconf(int name)
+{
+    long ans = sysconf(name);
+    if (ans <= 0) {
+	fprintf(stderr, "sysconf(%d) returned a non-positive number: %ld\n", name, ans);
+	exit(1);
+    }
+    return ans;
+}
+
+ int main(int argc, char *argv[], char *envp[])
+ {
+     pid_t child;
+@@ -631,7 +641,9 @@ int main(int argc, char *argv[], char *envp[])
+ 	     * Given we are now in a new directory tree, its good practice
+ 	     * to start off in a sane location
+ 	     */
+-	    status = chdir("/");
+	    if (status == 0) {
+		status = chdir("/");
+	    }
+ 
+ 	    cap_free(orig);
+ 
+@@ -732,14 +744,14 @@ int main(int argc, char *argv[], char *envp[])
+ 	  gid_t *group_list;
+ 	  int g_count;
+ 
+-	  length = sysconf(_SC_GETGR_R_SIZE_MAX);
+	  length = safe_sysconf(_SC_GETGR_R_SIZE_MAX);
+ 	  buf = calloc(1, length);
+ 	  if (NULL == buf) {
+ 	    fprintf(stderr, "No memory for [%s] operation\n", argv[i]);
+ 	    exit(1);
+ 	  }
+ 
+-	  max_groups = sysconf(_SC_NGROUPS_MAX);
+	  max_groups = safe_sysconf(_SC_NGROUPS_MAX);
+ 	  group_list = calloc(max_groups, sizeof(gid_t));
+ 	  if (NULL == group_list) {
+ 	    fprintf(stderr, "No memory for gid list\n");
+@@ -755,8 +767,7 @@ int main(int argc, char *argv[], char *envp[])
+ 	    }
+ 	    if (!isdigit(*ptr)) {
+ 	      struct group *g, grp;
+-	      getgrnam_r(ptr, &grp, buf, length, &g);
+-	      if (NULL == g) {
+	      if (getgrnam_r(ptr, &grp, buf, length, &g) || NULL == g) {
+ 		fprintf(stderr, "Failed to identify gid for group [%s]\n", ptr);
+ 		exit(1);
+ 	      }
+@@ -849,6 +860,7 @@ int main(int argc, char *argv[], char *envp[])
+ 	    argv[argc] = NULL;
+ 	    execve(argv[i], argv+i, envp);
+ 	    fprintf(stderr, "execve '%s' failed!\n", argv[i]);
+	    free(argv[i]);
+ 	    exit(1);
+ 	} else if (!strncmp("--shell=", argv[i], 8)) {
+ 	    shell = argv[i]+8;
+diff --git a/psx/psx.c b/psx/psx.c
+index eec6db8..1ace898 100644
+--- a/psx/psx.c
+++ b/psx/psx.c
+@@ -454,6 +454,10 @@ static void *_psx_start_fn(void *data) {
+ int __wrap_pthread_create(pthread_t *thread, const pthread_attr_t *attr,
+ 			  void *(*start_routine) (void *), void *arg) {
+     psx_starter_t *starter = calloc(1, sizeof(psx_starter_t));
+    if (starter == NULL) {
+	perror("failed at thread creation");
+	exit(1);
+    }
+     starter->fn = start_routine;
+     starter->arg = arg;
+     /*
+-- 
+2.42.0
+
--- a/29EE848AE2CCF3F4.asc
+++ b/29EE848AE2CCF3F4.asc
@ -1,105 +0,0 @@
-pub   rsa4096 2011-10-07 [SC]
-      38A644698C69787344E954CE29EE848AE2CCF3F4
-uid                      Andrew G. Morgan <morgan@kernel.org>
-uid                      Andrew G. Morgan (Work Address) <agm@google.com>
-sub   rsa4096 2011-10-07 [E]
-      E8BBFE9EBCE94FB48D2F98FC61B996743B143E89
-
-----BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQINBE6OiBIBEADpdtUxC8Fmhn5UK6UCZdU7mFgZwN8U9cabFUPfUIkMqXULhCD0
-hG2/amuiiUoLollPjOopNqk4cc8LcZfszOdBFAYj7MeWzNySVw4KkWrVCEH/bZ0Q
-QzZH2qmoMT5CIrtcNxCAvukYsZLhyZYO0HdfuE05mVhVjtX9Btfxr7Ndvb7L4MRS
-3Qb6+nHTgfn/Oow92/koIWvi0YvskKdZypeU888TQL99E8xdgL2n2Ip3xYwBHRR2
-GPb5MGOuEItF3tJ0kkILW5mzkJq/iLzRphzKjdF76I9QVRP8dZ+uWHPubWePm/5c
-1H9lnlw00ZZ/ucQvSwTesUYk2aKkxzgm6X8fCdJXBLGgW5K6CkynpjN3qJ9KpcNY
-H55smUgp8BaiWuoHe4pLvuBhnN2wiYOe2j9UvGX1OaRstMXFx7YbBvkGgdoZthUe
-VPGAa4K+dnI2oy4wukzl/unAKrlMCBRsRoW2qjy3TDSXqwJhd34ilHzrdAdchrh/
-acBfbBtRzVlcDTnGltDNMuRTXzujaY9C3B0L2E+Jfrds8WcM8ASO4mHwJUTMrBwM
-b5sFSG+/X9Ufg/c2G086HQ7xMERUA5oz66P5ReHCph8WHQN2L5vtZwL7//hZB9hn
-G0K1210YEDXpFPijpis/54MKUSkWEFOLjUbiSPbwEfb79A00CcHojQQinwARAQAB
-tCRBbmRyZXcgRy4gTW9yZ2FuIDxtb3JnYW5Aa2VybmVsLm9yZz6JAhwEEAECAAYF
-Ak6YnFgACgkQINBOWnE2YKdO8Q//fwzZuxAacpWE2wByvuwM7hiYOtzxX9tSsaMA
-NaYtxb8rYwM5YtkjCaBnWoyJ8de7L82HJff/GnxVpw0CWm5Dyj9Pvs/VAIvC4+75
-+5cs6YWQIhIV5NbmD92lKFni2xNcBomzttB1CexjemtmXQIwm0i06HBbfg8Nkv3l
-WnZlHHzgOffnkodR56rJCOq75wTPZPmx9WP87bDW2B5ZwzGs4jcBEP8qz4J5agVk
-97OrYrhy2RrtD6a4f3/VYJq12mvJ/lImgEwNoLsZfMZ6B6wpCvfmx80z1dE/VOmG
-YKpDPhU5v6y0gQm/UOpz0tzgRJw7CYRK3mbM/Ctnc4n6y0UpbVAmAStRvnlM1DgL
-3nuuh3EJ6s1r2m2l1SRT09va+lK6s1GARMD+6tmQE7+89DwwSB0lJtWCHRGP/M8W
-ePdqRAVz3xTkqbRMgcnuvpL6qPveK1Qzv2MxUomB7A8QDxzKzQAIugzm5E1irfmZ
-jg54/8R2bo0uIp8PS6wx8RD7TYHxGpe4cEAkBr/5/5TfMaTDbrx/f/XqRm/89Mx9
-04TLVyMqVDcsXAgd+fIGtv/e8cBVMDIRsE9aZQsSOil168Q8qYrJbYRcWmEGaM4d
-KCGYhEPE7ZaZK4jxshSwfiirozCoAmkTmvOt4E0s2HlljjLPDecAlvoFvn2bSS3Z
-8coir4CJAjsEEwECACUCGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheABQJOmRGP
-AhkBAAoJECnuhIrizPP0wK0P/RMvjmzeXbgoa36cBDvDKReAiC56Au4qGXkNah39
-84tNPT1hVUKCiwiUmULoNJbEI4qFJTtwsMi5QzE+daCA7t+ALJiC+PKiKFG1LDz7
-mxfhmBeS3XcYuqZdjyKrATUFr0SHbsJxtRCslawGD2gKczLknFeBXL0997TfJS9i
-pLibqCtmvyryHn4EbZfoJqcpj/RBN/izVGHNYI8BsZpO5F6z7vXoncDL0dKh65nd
-GaIbhVDUPsDBvzg3i+EzhB51hYTTNKK0QpWbmsXfJBnvztinfLUsnO9HV8aRaygO
-I/DAKAtT7YPXORA1oFYtx69bzulqC+TXUmeV8YW8bETH4xHM9mQb0oNLPibR2nK2
-FSDiLp0/eEM5vgzfPVUX7WzBJUPsf0ah/e1yrXqudGUUZ0R+3VMOdxMryZBKLymk
-zyvu6a5DcLarqAt8y9ciRH67HKNnE1gvHf5K2Q37gwSecwmXCjpMlbVJnIarLKBc
-VRcYKtxgPxCv6483I8heSKF7PB/IFBmzT1cX7lhln9+62Ks/0Gs0pA0iNLaD+POP
-iqWrAwZsFvKjD9PDaCBDFRWjFqZLyJMsMi1qmP8jWsdQqPdUskQC0ftvw3Z6Siyy
-rriSAzglCjmmAcfdt+w4b/EO4SzSZUnd/ApkHkZx1Lbta15WKxGi7S8/5zNdaK72
-1nUdiQIzBBABCAAdFiEEIHnICkX+vZuglRryyyMS4ez3P1cFAl0PDA8ACgkQyyMS
-4ez3P1eHXg//ceYbw0RGvvkpBn41t2D2OEDnowyAqgdrByFoub4mam3lxjKZob6F
-nIVcp0aY6TTOW0Peo0ZMigLh2DkEpF0JZrtTu5Om2tZpn+16d2c9ThROEasTERqI
-AnUHMmpXupRZDSdHJTSD+HdlBSvO9Ve2vtIv/F9AW8pIQqZby3rJeFwsaQl9GUuw
-T6teyBG5GZVFLDvNM2r64moTGvxsZdOEz/2KSZNMONEIFWYJPbBtaKZjlNJebh+i
-YwOda6YqGwmyBpudtMtyHUT5gXBIaaMfKW40CxxTesOuV7YWg52ZkJe8tsURnIUi
-55wCaLnNM+bsqjRIDZ5tAvCqTCj+T5hg6uJbmWOhCHW4VMp3PKEgmajMSZVAfzcW
-iryAT/xol531qwer+3LRRS21qha3lfAJNaDy6rTHBqeDXyo7oeBQwoFIJFA5w9Ia
-DVRfWXiKnHjsma0CEg1JXXnL1eb2Bzh8qInUQEgm92B/w2tJgNDDNPIDQDlbWgQw
-24Wzx5QGOfr4CJM3WMhSdUEn8jyyFj+GmCfCAtRTEPhGIf4op6rZfH5Q8O0UJ865
-iIvshNNLoWtkVx2MTU4juXsz666Vq+HFzyIw2xPeabVIKVzF25+vbTTRQIhohuU9
-FV36IqXOGGwYAlnu8/2NFDWbUIhaCaB0N2AeVH8kQcO9L0OEHB0MJy+0MEFuZHJl
-dyBHLiBNb3JnYW4gKFdvcmsgQWRkcmVzcykgPGFnbUBnb29nbGUuY29tPokCOAQT
-AQIAIgUCTpUPggIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQKe6EiuLM
-8/TM2hAAwOPHeKi+9/SukBgW+8Cg9vOERdwnjX9P6lrFY4mbxISDt9edQeBd5PBb
-dEk8ins+C5y0+iC8pBX7sZxTkNyDXcNk7icytKy8iewtCR94NVT/OXYy4cU60Eyk
-OnqIZxTCNLRthu+XTd8+Ptlcgwv4js5LI16hn+fbO0j1SIgEei+wepmpibh3tU6L
-idWPVj8ZqT32zDdwu9TCr1/eLyKg3PKeoFPuMD4ZYVp5Um4as4IEEGC4i7QSSDjY
-0BnYBHfbBA/l4S2VICrwiX1FnN7BrW/viWgM0k6X6Rbn+NArq0aPYD2+VOpXMdQO
-Y9n2foOzuHfCjaDeDNhfVy4zeylb1SwDxdQM1jbI0VgML0iwAjT27Xw3t/z2Kwb/
-JiHkxmknPZ/Htx5we3BJW6RMYcOxqgdNcyV+NCZVTl585FklroHHRORpILB5x6be
-r7c5x2BbxfA9aKT/la/wHd0mikwfUzDelGGKu1N3r/zzE3IuQlK2m0ENm9uq8Hac
-yZKKqCHSY96yWfC5vEnn/gVs/3OUs3vOnj1FkcoOX/wQxJcYKOYbpRPFbojdikp1
-zj7IR3X39RS3GpA59uAW+Vxt6xDkgu8s7NmJ2RLvLS/iL2tkF78cTLd4bzPizl2W
-gGulIG8rJLCpa65IOfe0yrDgHPYF7cWC1gDhOc3LuyFwVHYEwWiJAjMEEAEIAB0W
-IQQgecgKRf69m6CVGvLLIxLh7Pc/VwUCXQ8MGwAKCRDLIxLh7Pc/V0F9EACHKNqF
-l5xXDHe/0nlZ+J/OFRNIE8ObZAxQLaPfK3gRkFn/SbKQzkzB84X2il7A/W221Lzi
-me5eTFPhTX3RxUcoSQdrtCCov5gCeuiUbhuJ28zuJxslxLE8bhnmNfpLmFFGtbMI
-kXq+y0uqc08Yj8frPXKgx7KvOoovpm0X/igiAkiuKLhbq8xIwaIN0NL4slFlx+ZP
-Ed0KA6qOvlLr0T/lLVptAeMrzfi2gqY1utSqE5IVrbtU6Kptw3zfURsGFFIaKjIr
-hzu25Cdpg/NxYGqo2GqD0lZ+OeWSy0WI5sxCSDqr0to9lvsJGv2Nc06ixIjH7vG2
-Hc/cC0QyHdBM6GwaLmUH9hrcSCLR5kxTzAW0Cf6lrAZUL36Ivl5l+zoLdJqSgZLY
-YXqMdQf75Y5TRFzry5pWRef3ba4/sgui89W11Uccdq/pGe4OKo0I/vq3bv35/3cZ
-aMGjj3x6v67kk8GWbKg6CPBnzb1dY7VDA5RWOt2lPZr4omUNFwRpxAfZADUz2Q4S
-tMQVE018SSH1i6G9EB8KVQEBeD4qgaWs1z9sqA7K5wlBzGarTa2RspH0GMmYwxBY
-hXtYpKm/47Dkg8j3N01VVwky0XGPFHCVgFbeXGknL1O3thOGs5XPO05jtBcbYI1u
-vvK+h/CNn1yuTG13BSG4pgRF1Sy6CFLHme0d/rkCDQROjogSARAAtLny8nlyr8fy
-YGAocQz0S47a99n/X0Vmgwo1trJsCXWbOrpztznY8IFRK/dRnRHiMwBxWQ4CvdUk
-2p0MweUiOjpEN7bUm92jeFXMr0hpQKf+O4DMExHS4hxLwArnKFuAk2ejRQGXBcEo
-Mv11LiUwuzFbWdXqMsA1TbuA+WvEBnFUYM/6xNiJeRIUIiGydhG1yaw8HrNWLHnh
-hcOfT6z5AO69hZZiJacp9pU/+jnep/M42p4J17x81+ESpJeladwR0Qxc0qxOyWid
-N7oO5hSiBEwU6lYQjdQ23pa7tN1o90P9jyN2nFBEdBu2D/mi4DV/+VXUYHNEy3uN
-hmmLGwMoPVWiZveRmG74+ne7MVyxwb9EIF3IenS4T65ee1dlZvaoMxUlUe8htEK0
-ChrQZOfITs9MyjUwoTiLUVo3kQeMli9HJEQXPRjHqkkZ7W65LhkEVnHSPHWtttRS
-DkuZYtze+he142GzDSQA3dF2zy/tLpBb5CA29ITcQTspgV7AuV8YQqDZ4XWHsR9A
-m5334N83EXk2oouqxl7mKUB0Vg6tujNCBSRn6A3CUaA29w/MyTg4z6Yw6HD3il1J
-8PcWEoOzqlUoPd8tA5pcZCcKngkXndpXgsZCgoCgvx9WNU+LUrHBfhC3TLLsI7iG
-O1JvLghkesKTARF3O2hS3xAhfGZxn8MAEQEAAYkCHwQYAQIACQUCTo6IEgIbDAAK
-CRAp7oSK4szz9HSYD/9hmEsJuSgAGwx/OPweYuDGkA25ajDAu59LpzTbjB/yOU1r
-DVUu3cMH+UEyaEGlhbneGvHF2DsEC9il/8fVL4eaE9EWpopIonYndBE91+YiGHPT
-oiyKcdp0KuQMwm2ENAiEf/qErrB2NLna4wfZUx5lzvEOEk3cNPmNz2ERyMPXIeei
-Q9VKp3MzopWhvBItAyIzzuydKKvJAKzDoTOEL4w60slAphj8rVCsW45k2AurWUH7
-VFM8ezXunieLeygCGb+YJZAet6yVXD3UwnNcWCGQ+xKSPuyKrn4xKG0N5gzxnGIh
-/S/7IOjRaNR5X+pfWd6YzN9qURUfiXmuLSPRHK4Flfam4gMMHul9wL6XBayFo2NU
-PBaxg4U9ACAgSJxgCTNPCKwnovecOsRmIESKtT1F3hbZRRgRGj/TDepJQNfHSyk/
-ZQfuoJggBMQLJKzGII42rb0W90QLMk0SyCzeb3LO3yyNiKpluNpJsl2IqdBJE5t1
-LxhKDnju6JlFyPcGJnP/doTuDTjjL0V+guPAGVbuq0g2hku+ZlJwjMStNwHPWxei
-fuDJbQVIp0xZbI5djdHC8hVJX+d09J5eq0PlgMEidc4F+Vv+mmGJl0GiNfhmTaAC
-SRzbI25/bhvj2xhx8A2LEOuU/+nzYgQzPcFpawiUP1wBnTqi+maxKx5/9ifyrw==
-=6WX5
-----END PGP PUBLIC KEY BLOCK-----
--- a/_makenames-build.patch
+++ b/_makenames-build.patch
@ -1,13 +0,0 @@
-diff --git a/libcap/Makefile b/libcap/Makefile
-index f0eb87e..e90a950 100644
--- a/libcap/Makefile
-+++ b/libcap/Makefile
-@@ -80,7 +80,7 @@ $(PSXTITLE).pc: $(PSXTITLE).pc.in
- 		$< >$@
- 
- _makenames: _makenames.c cap_names.list.h
-	$(BUILD_CC) $(BUILD_CFLAGS) $(BUILD_CPPFLAGS) $< -o $@ $(BUILD_LDFLAGS)
-+	$(BUILD_CC) $(BUILD_CFLAGS) $(BUILD_CPPFLAGS) $< -o $@
- 
- cap_names.h: _makenames
- 	./_makenames > cap_names.h
--- a/capfaq-0.2.txt
+++ b/capfaq-0.2.txt
@ -0,0 +1,264 @@
+This is the Linux kernel capabilities FAQ
+
+Its history, to the extent that I am able to reconstruct it is that
+v2.0 was posted to the Linux kernel list on 1999/04/02 by Boris
+Tobotras. Thanks to Denis Ducamp for forwarding me a copy.
+
+Cheers
+
+Andrew
+
+Linux Capabilities FAQ 0.2
+==========================
+
+1) What is a capability?
+
+The name "capabilities" as used in the Linux kernel can be confusing.
+First there are Capabilities as defined in computer science. A
+capability is a token used by a process to prove that it is allowed to
+do an operation on an object.  The capability identifies the object
+and the operations allowed on that object.  A file descriptor is a
+capability.  You create the file descriptor with the "open" call and
+request read or write permissions.  Later, when doing a read or write
+operation, the kernel uses the file descriptor as an index into a
+data structure that indicates what operations are allowed.  This is an
+efficient way to check permissions.  The necessary data structures are
+created once during the "open" call.  Later read and write calls only
+have to do a table lookup.  Operations on capabilities include copying
+capabilities, transferring capabilities between processes, modifying a
+capability, and revoking a capability.  Modifying a capability can be
+something like taking a read-write filedescriptor and making it
+read-only.  A capability often has a notion of an "owner" which is
+able to invalidate all copies and derived versions of a capability.
+Entire OSes are based on this "capability" model, with varying degrees
+of purity.  There are other ways of implementing capabilities than the
+file descriptor model - traditionally special hardware has been used,
+but modern systems also use the memory management unit of the CPU.
+
+Then there is something quite different called "POSIX capabilities"
+which is what Linux uses.  These capabilities are a partitioning of
+the all powerful root privilege into a set of distinct privileges (but
+look at securelevel emulation to find out that this isn't necessary
+the whole truth).  Users familiar with VMS or "Trusted" versions of
+other UNIX variants will know this under the name "privileges".  The
+name "capabilities" comes from the now defunct POSIX draft 1003.1e
+which used this name.
+
+2) So what is a "POSIX capability"?
+
+A process has three sets of bitmaps called the inheritable(I),
+permitted(P), and effective(E) capabilities.  Each capability is
+implemented as a bit in each of these bitmaps which is either set or
+unset.  When a process tries to do a privileged operation, the
+operating system will check the appropriate bit in the effective set
+of the process (instead of checking whether the effective uid of the
+process i 0 as is normally done).  For example, when a process tries
+to set the clock, the Linux kernel will check that the process has the
+CAP_SYS_TIME bit (which is currently bit 25) set in its effective set.
+
+The permitted set of the process indicates the capabilities the
+process can use.  The process can have capabilities set in the
+permitted set that are not in the effective set.  This indicates that
+the process has temporarily disabled this capability.  A process is
+allowed to set a bit in its effective set only if it is available in
+the permitted set.  The distinction between effective and permitted
+exists so that processes can "bracket" operations that need privilege.
+
+The inheritable capabilities are the capabilities of the current
+process that should be inherited by a program executed by the current
+process.  The permitted set of a process is masked against the
+inheritable set during exec().  Nothing special happens during fork()
+or clone().  Child processes and threads are given an exact copy of
+the capabilities of the parent process.
+
+3) What about other entities in the system? Users, Groups, Files?
+
+Files have capabilities.  Conceptually they have the same three
+bitmaps that processes have, but to avoid confusion we call them by
+other names.  Only executable files have capabilities, libraries don't
+have capabilities (yet).  The three sets are called the allowed set,
+the forced set, and the effective set.
+
+The allowed set indicates what capabilities the executable is allowed
+to receive from an execing process.  This means that during exec(),
+the capabilities of the old process are first masked against a set
+which indicates what the process gives away (the inheritable set of
+the process), and then they are masked against a set which indicates
+what capabilities the new process image is allowed to receive (the
+allowed set of the executable).
+
+The forced set is a set of capabilities created out of thin air and
+given to the process after execing the executable.  The forced set is
+similar in nature to the setuid feature.  In fact, the setuid bit from
+the filesystem is "read" as a full forced set by the kernel.
+
+The effective set indicates which bits in the permitted set of the new
+process should be transferred to the effective set of the new process.
+The effective set is best thought of as a "capability aware" set.  It
+should consist of only 1s if the executable is capability-dumb, or
+only 0s if the executable is capability-smart.  Since the effective
+set consists of only 0s or only 1s, the filesystem can implement this
+set using a single bit.
+
+NOTE: Filesystem support for capabilities is not part of Linux 2.2.
+
+Users and Groups don't have associated capabilities from the kernel's
+point of view, but it is entirely reasonable to associate users or
+groups with capabilities.  By letting the "login" program set some
+capabilities it is possible to make role users such as a backup user
+that will have the CAP_DAC_READ_SEARCH capability and be able to do
+backups.  This could also be implemented as a PAM module, but nobody
+has implemented one yet.
+
+4) What capabilities exist?
+
+The capabilities available in Linux are listed and documented in the
+file /usr/src/linux/include/linux/capability.h.
+
+5) Are Linux capabilities hierarchical?
+
+No, you cannot make a "subcapability" out of a Linux capability as in
+capability-based OSes.
+
+6) How can I use capabilities to make sure Mr. Evil Luser (eluser)
+can't exploit my "suid" programs?
+
+This is the general outline of how this works given filesystem
+capability support exists.  First, you have a PAM module that sets the
+inheritable capabilities of the login-shell of eluser.  Then for all
+"suid" programs on the system, you decide what capabilities they need
+and set the _allowed_ set of the executable to that set of
+capabilities.  The capability rules
+
+   new permitted = forced | (allowed & inheritable)
+
+means that you should be careful about setting forced capabilities on
+executables.  In a few cases, this can be useful though.  For example
+the login program needs to set the inheritable set of the new user and
+therefore needs an almost full permitted set.  So if you want eluser
+to be able to run login and log in as a different user, you will have
+to set some forced bits on that executable.
+
+7) What about passing capabilities between processes?
+
+Currently this is done by the system call "setcap" which can set the
+capabilities of another process.  This requires the CAP_SETPCAP
+capability which you really only want to grant a _few_ processes.
+CAP_SETPCAP was originally intended as a workaround to be able to
+implement filesystem support for capabilities using a daemon outside
+the kernel.
+
+There has been discussions about implementing socket-level capability
+passing.  This means that you can pass a capability over a socket.  No
+support for this exists in the official kernel yet.
+
+8) I see securelevel has been removed from 2.2 and are superceeded by
+capabilities.  How do I emulate securelevel using capabilities?
+
+The setcap system call can remove a capability from _all_ processes on
+the system in one atomic operation.  The setcap utility from the
+libcap distribution will do this for you.  The utility requires the
+CAP_SETPCAP privilege to do this.  The CAP_SETPCAP capability is not
+enabled by default.
+
+libcap is available from
+ftp://ftp.kernel.org/pub/linux/libs/security/linux-privs/kernel-2.2/
+
+9) I noticed that the capability.h file lacks some capabilities that
+are needed to fully emulate 2.0 securelevel.  Is there a patch for
+this?
+
+Actually yes - funny you should ask :-).  The problem with 2.0
+securelevel is that they for example stop root from accessing block
+devices.  At the same time they restrict the use of iopl.  These two
+changes are fundamentally different.  Blocking access to block devices
+means restricting something that usually isn't restricted.
+Restricting access to the use of iopl on the other hand means
+restricting (blocking) access to something that is already blocked.
+Emulating the parts of 2.0 securelevel that restricts things that are
+normally not restricted means that the capabilites in the kernel has
+to have a set of capabilities that are usually _on_ for a normal
+process (note that this breaks the explanation that capabilities are a
+partitioning of the root privileges).  There is an experimental patch at
+
+ftp://ftp.guardian.no/pub/free/linux/capabilities/patch-cap-exp-1
+
+which implements a set of capabilities with the "CAP_USER" prefix:
+
+cap_user_sock  - allowed to use socket()
+cap_user_dev   - allowed to open char/block devices
+cap_user_fifo  - allowed to use pipes
+
+These should be enough to emulate 2.0 securelevel (tell me if we need
+something more).
+
+10) Seems I need a CAP_SETPCAP capability that I don't have to make use
+of capabilities.  How do I enable this capability?
+
+Change the definition of CAP_INIT_EFF_SET and CAP_INIT_INH_SET to the
+following in include/linux/capability.h:
+
+#define CAP_INIT_EFF_SET    { ~0 }
+#define CAP_INIT_INH_SET    { ~0 }
+
+This will start init with a full capability set and not with
+CAP_SETPCAP removed.
+
+11) How do I start a process with a limited set of capabilities?
+
+Get the libcap library and use the execcap utility.  The following
+example starts the update daemon with only the CAP_SYS_ADMIN
+capability.
+
+execcap 'cap_sys_admin=eip' update
+
+12) How do I start a process with a limited set of capabilities under
+another uid?
+
+Use the sucap utility which changes uid from root without loosing any
+capabilities.  Normally all capabilities are cleared when changing uid
+from root.  The sucap utility requires the CAP_SETPCAP capability.
+The following example starts updated under uid updated and gid updated
+with CAP_SYS_ADMIN raised in the Effective set.
+
+sucap updated updated execcap 'cap_sys_admin=eip' update
+
+[ Sucap is currently available from
+ftp://ftp.guardian.no/pub/free/linux/capabilities/sucap.c. Put it in
+the progs directory of libcap to compile.]
+
+13) What are the "capability rules"
+
+The capability rules are the rules used to set the capabilities of the
+new process image after an exec.  They work like this:
+
+        pI' = pI
+  (***) pP' = fP | (fI & pI)
+        pE' = pP' & fE          [NB. fE is 0 or ~0]
+
+  I=Inheritable, P=Permitted, E=Effective // p=process, f=file
+  ' indicates post-exec().
+
+Now to make sense of the equations think of fP as the Forced set of
+the executable, and fI as the Allowed set of the executable.  Notice
+how the Inheritable set isn't touched at all during exec().
+
+14) What are the laws for setting capability bits in the Inheritable,
+Permitted, and Effective sets?
+
+Bits can be transferred from Permitted to either Effective or
+Inheritable set.
+
+Bits can be removed from all sets.
+
+15) Where is the standard on which the Linux capabilities are based?
+
+There used to be a POSIX draft called POSIX.6 and later POSIX 1003.1e.
+However after the committee had spent over 10 years, POSIX decided
+that enough is enough and dropped the draft.  There will therefore not
+be a POSIX standard covering security anytime soon.  This may lead to
+that the POSIX draft is available for free, however.
+
+--
+        Best regards, -- Boris.
+
--- a/gating.yaml
+++ b/gating.yaml
@ -4,6 +4,7 @@ product_versions:
 decision_context: bodhi_update_push_testing
 subject_type: koji_build
 rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.rpmdeplint.functional}
  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.rpminspect.static-analysis}
  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.installability.functional}
  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
@ -13,6 +14,7 @@ product_versions:
 decision_context: bodhi_update_push_stable
 subject_type: koji_build
 rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.rpmdeplint.functional}
  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.rpminspect.static-analysis}
  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.installability.functional}
  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
--- a/getpcaps.8
+++ b/getpcaps.8
@ -0,0 +1,23 @@
+.\"                                      Hey, EMACS: -*- nroff -*-
+.TH GETPCAPS 8 "2001-05-29"
+.\" Please adjust this date whenever revising the manpage.
+.SH NAME
+getpcaps \- display process capabilities
+.SH SYNOPSIS
+.B getpcaps
+.IR pid ...
+.SH DESCRIPTION
+.B getpcaps
+displays the capabilities on the processes indicated by the
+.I pid
+value(s) given on the commandline. The capabilities
+are displayed in the
+.BR cap_from_text (3)
+format.
+.SH SEE ALSO
+.BR execcap (8).
+.br
+.SH AUTHOR
+This manual page was written by Robert Bihlmeyer <robbe@debian.org>,
+for the Debian GNU/Linux system (but may be used by others).
+
--- a/libcap-use-compiler-flag-options.patch
+++ b/libcap-use-compiler-flag-options.patch
@ -0,0 +1,37 @@
+From 7c13fa4e4c044941afd3b3766de71821cdc04397 Mon Sep 17 00:00:00 2001
+From: "H.J. Lu" <hjl.tools@gmail.com>
+Date: Sun, 14 Feb 2021 14:06:49 -0800
+Subject: [PATCH] Update Make.Rules for Fedora RPM build
+
+---
+ Make.Rules | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/Make.Rules b/Make.Rules
+index ded9014..537cb6c 100644
+--- a/Make.Rules
+++ b/Make.Rules
+@@ -56,10 +56,10 @@ IPATH += -fPIC -I$(KERNEL_HEADERS) -I$(topdir)/libcap/include
+ 
+ CC := $(CROSS_COMPILE)gcc
+ DEFINES := -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64
+-COPTS ?= -O2
+COPTS ?= $(RPM_OPT_FLAGS)
+ CFLAGS ?= $(COPTS) $(DEFINES)
+ BUILD_CC ?= $(CC)
+-BUILD_COPTS ?= -O2
+BUILD_COPTS ?= $(RPM_OPT_FLAGS)
+ BUILD_CFLAGS ?= $(BUILD_COPTS) $(DEFINES) $(IPATH)
+ AR := $(CROSS_COMPILE)ar
+ RANLIB := $(CROSS_COMPILE)ranlib
+@@ -69,7 +69,7 @@ WARNINGS=-Wall -Wwrite-strings \
+         -Wstrict-prototypes -Wmissing-prototypes \
+         -Wnested-externs -Winline -Wshadow
+ LD=$(CC) -Wl,-x -shared
+-LDFLAGS ?= #-g
+LDFLAGS ?= $(RPM_LD_FLAGS)
+ LIBCAPLIB := -L$(topdir)/libcap -lcap
+ PSXLINKFLAGS :=  -lpthread -Wl,-wrap,pthread_create
+ LIBPSXLIB := -L$(topdir)/libcap -lpsx $(PSXLINKFLAGS)
+-- 
+2.29.2
--- a/libcap.spec
+++ b/libcap.spec
@ -1,30 +1,19 @@
 Name: libcap
-Version: 2.77
-Release: 1%{?dist}
+Version: 2.48
+Release: 8%{?dist}
 Summary: Library for getting and setting POSIX.1e capabilities
 URL: https://sites.google.com/site/fullycapable/
-License: BSD-3-Clause OR GPL-2.0-only
+License: BSD or GPLv2

-Source0: https://mirrors.edge.kernel.org/pub/linux/libs/security/linux-privs/libcap2/%{name}-%{version}.tar.gz
-Source1: https://mirrors.edge.kernel.org/pub/linux/libs/security/linux-privs/libcap2/%{name}-%{version}.tar.sign
-Source2: https://git.kernel.org/pub/scm/docs/kernel/pgpkeys.git/plain/keys/29EE848AE2CCF3F4.asc
-Patch0: _makenames-build.patch
+Source: https://git.kernel.org/pub/scm/libs/libcap/libcap.git/snapshot/%{name}-%{version}.tar.gz
+Patch0: libcap-use-compiler-flag-options.patch
+Patch1: 0001-cap_alloc.c-fix-CVE-2023-2603.patch
+Patch2: 0002-psx.c-fix-CVE-2023-2602.patch
+Patch3: 0003-Bug-fixes-identified-by-static-code-analysis.patch
+Patch4: 0004-Fruit-of-more-static-analysis-results.patch

-BuildRequires: pam-devel gcc
+BuildRequires: libattr-devel pam-devel perl-interpreter gcc
 BuildRequires: make
-BuildRequires: glibc-static
-BuildRequires: gnupg2
-
-%ifarch %{golang_arches}
-BuildRequires: golang >= 1.22
-%endif
-
-%if "%{_sbindir}" == "%{_bindir}"
-# Compat symlinks for Requires in other packages.
-# We rely on filesystem to create the symlinks for us.
-Requires:       filesystem(unmerged-sbin-symlinks)
-Provides:       /usr/sbin/setcap
-%endif

 %description
 libcap is a library for getting and setting POSIX.1e (formerly POSIX 6)
@ -54,31 +43,22 @@ draft 15 capabilities.
 Install libcap-devel if you want to develop or compile applications using
 libcap.

-%ifarch %{golang_arches}
-%package -n captree
-Summary: Capability inspection utility
-
-%description -n captree
-The captree program was inspired by the utility pstree, but it uses the
-libcap/cap (Go package) API to explore process runtime state and display
-the capability status of processes and threads.
-%endif
-
 %prep
-gzip -cd %{SOURCE0} | %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data=-
 %autosetup -p1

-
 %build
-%make_build prefix=%{_prefix} lib=%{_lib} SBINDIR=%{_sbindir} CGO_REQUIRED=1 CGO_CFLAGS="${CFLAGS}" CGO_LDFLAGS="${LDFLAGS}" GO_BUILD_FLAGS="-buildmode=pie -a -v -x -ldflags='-compressdwarf=false -B gobuildid'" all
-
-%check
-make test
+# libcap can not be build with _smp_mflags:
+make prefix=%{_prefix} lib=%{_lib} LIBDIR=%{_libdir} SBINDIR=%{_sbindir} \
+     INCDIR=%{_includedir} MANDIR=%{_mandir} PKGCONFIGDIR=%{_libdir}/pkgconfig/

 %install
-%make_install prefix=%{_prefix} lib=%{_lib} SBINDIR=%{_sbindir} CGO_REQUIRED=1 CGO_CFLAGS="${CFLAGS}" CGO_LDFLAGS="${LDFLAGS}" GO_BUILD_FLAGS="-buildmode=pie -ldflags='-compressdwarf=false -B gobuildid'"
+make install RAISE_SETFCAP=no \
+             DESTDIR=%{buildroot} \
+             LIBDIR=%{_libdir} \
+             SBINDIR=%{_sbindir} \
+             PKGCONFIGDIR=%{_libdir}/pkgconfig/

-mkdir -p %{buildroot}/%{_mandir}/man{2,3,5,8}
+mkdir -p %{buildroot}/%{_mandir}/man{2,3,8}
 mv -f doc/*.3 %{buildroot}/%{_mandir}/man3/

 chmod +x %{buildroot}/%{_libdir}/*.so.*
@ -87,112 +67,31 @@ chmod +x %{buildroot}/%{_libdir}/*.so.*

 %files
 %license License
-%doc doc/capability.md
-%{_libdir}/libcap.so.2{,.*}
-%{_libdir}/libpsx.so.2{,.*}
-%{_sbindir}/{capsh,getcap,getpcaps,setcap}
-%{_mandir}/man1/capsh.1*
-%{_mandir}/man5/capability.conf.5*
-%{_mandir}/man7/cap_text_formats.7*
-%{_mandir}/man8/{getcap,getpcaps,setcap,pam_cap}.8*
+%doc doc/capability.notes
+%{_libdir}/*.so.*
+%{_sbindir}/*
+%{_mandir}/man1/*
+%{_mandir}/man8/*
 %{_libdir}/security/pam_cap.so
-%exclude %{_mandir}/man8/captree.8*

 %files static
 %{_libdir}/libcap.a
 %{_libdir}/libpsx.a

 %files devel
-%{_includedir}/sys/capability.h
-%{_includedir}/sys/psx_syscall.h
-%{_libdir}/libcap.so
-%{_libdir}/libpsx.so
-%{_mandir}/man3/cap*.3*
-%{_mandir}/man3/libcap.3*
-%{_mandir}/man3/libpsx.3*
-%{_mandir}/man3/psx_*.3*
-%{_mandir}/man3/__psx_syscall.3*
-%{_libdir}/pkgconfig/{libcap,libpsx}.pc
+%{_includedir}/*
+%{_libdir}/*.so
+%{_mandir}/man3/*
+%{_libdir}/pkgconfig/libcap.pc
+%{_libdir}/pkgconfig/libpsx.pc

-%ifarch %{golang_arches}
-%files -n captree
-%license License
-%{_sbindir}/captree
-%{_mandir}/man8/captree.8*
-%endif

 %changelog
-* Tue Oct 28 2025 Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> - 2.77-1
- Update to version 2.77 (rhbz#2406446)
+* Tue Dec 12 2023 Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> - 2.48-8
+- Backport bug fixes identified by static analysis

-* Fri Oct 10 2025 Alejandro Sáez <asm@redhat.com> - 2.76-4
- rebuild
-
-* Fri Aug 15 2025 Maxwell G <maxwell@gtmx.me> - 2.76-3
- Rebuild for golang-1.25.0
-
-* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.76-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-
-* Mon Apr 14 2025 Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> - 2.76-1
- Update to version 2.76 (rhbz#2349318, rhbz#2352529)
-
-* Fri Jan 24 2025 Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> - 2.73-2
- Update internal CI tests
-
-* Fri Jan 24 2025 Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> - 2.73-1
- Update to version 2.73 (rhbz#2340722)
-
-* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.71-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.71-2
- Rebuilt for the bin-sbin merge (2nd attempt)
-
-* Mon Oct 28 2024 Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> - 2.71-1
- Update to version 2.71
-
-* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.70-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.70-3
- Rebuilt for the bin-sbin merge
-
-* Tue Jun 04 2024 Anderson Toshiyuki Sasaki <ansasaki@redhat.com> - 2.70-2
- Set CGO_CFLAGS=$CFLAGS and CGO_LDFLAGS=$LDFLAGS to build Go code
-
-* Mon May 20 2024 Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> - 2.70-1
- Update to version 2.70
-
-* Fri Apr 05 2024 Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> - 2.69-8
- Make correction to the capability.conf manpage
-
-* Fri Apr 05 2024 Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> - 2.69-7
- Reenable PIE in the captree tool
-
-* Thu Apr 04 2024 Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> - 2.69-6
- Fix incompatibility of the build with go 1.22.
-
-* Wed Apr 03 2024 Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> - 2.69-5
- Add manpages for pam_cap and capability.conf
-
-* Sun Feb 11 2024 Maxwell G <maxwell@gtmx.me> - 2.69-4
- Rebuild for golang 1.22.0
-
-* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.69-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.69-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Mon Nov 06 2023 Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> - 2.69-1
- Update to 2.69 (with contribs from Yanko Kaneti <yaneti@declera.com>, and Andrew G. Morgan <morgan@kernel.org>)
- Update license to SPDX (by Anderson Toshiyuki Sasaki <ansasaki@redhat.com>)
- Make file lists more explicit to avoid accidental ABI changes (Dominik Mierzejewski <dominik@greysector.net>)
-
-* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.48-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+* Wed Nov 22 2023 Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> - 2.48-7
+- Backport fix for CVE-2023-2602 and CVE-2023-2603

 * Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.48-6
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
--- a/3
+++ b/3
@ -1,2 +1 @@
-SHA512 (libcap-2.77.tar.gz) = e5471afc4f149a8330e6df07effe58cac44d8a773b1fff0686e7039c41888e33402e1942fe5271a142e159a6088abbdbb7a82133389b3a9351749c2bf797b6b8
-SHA512 (libcap-2.77.tar.sign) = c362eefb80bbc110b7d7c676cc2b37e04bd3dab1b8b4577d62a0774b6300258743156c57102e8dc11c35d2ea876053dc57eae44197137273413b959df33ef0c0
+SHA512 (libcap-2.48.tar.gz) = 90ac6e46531e4893b78b14171537c6dfd06cf617af9e90f38ea0ce4b50161451528aefff41dbe983719e76582cf39f8d7d432f99756e976f62403d5bc3c209c8
--- a/tests/captree/main.fmf
+++ b/tests/captree/main.fmf
@ -1,2 +0,0 @@
-summary: captree smoke test
-description: tests basic captree functionality
--- a/tests/captree/test.sh
+++ b/tests/captree/test.sh
@ -1,23 +0,0 @@
-#!/bin/bash
-
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-rlJournalStart
-
-if rpm --eval '%{golang_arches}' | tr ' ' '\n' | grep -q -e "$(rpm --eval '%{_arch}')"; then
-    rlPhaseStartTest "Should display help"
-    rlRun "captree -h"
-    rlPhaseEnd
-
-    rlPhaseStartTest "Should list capabilities of pid 1"
-    rlRun -s "captree --depth 1 1"
-    rlAssertGrep 'systemd.*=ep' $rlRun_LOG
-    rlPhaseEnd
-
-    rlPhaseStartTest "Should display sys admin capability"
-    rlRun -s "capsh --drop=cap_sys_admin -- -c 'captree --verbose \$\$'"
-    rlAssertGrep "!cap_sys_admin" $rlRun_LOG
-    rlPhaseEnd
-fi
-
-rlJournalEnd
--- a/tests/manpages/test.sh
+++ b/tests/manpages/test.sh
@ -5,11 +5,9 @@ expected_manpages=(
    'capsh(1)'
    'libcap(3)' # there are many more but if these are present then it verifies it because of the glob install
    'libpsx(3)'
-    'capability.conf(5)'
    'getcap(8)'
    'getpcaps(8)'
-    'setcap(8)'
-    'pam_cap(8)'
+    'setcap(8)'    
 )

 rlJournalStart
@ -18,9 +16,4 @@ rlJournalStart
        rlRun "man --pager=cat '${page}'"
    rlPhaseEnd
  done
-  if rpm --eval '%{golang_arches}' | tr ' ' '\n' | grep -q -e "$(rpm --eval '%{_arch}')"; then
-    rlPhaseStartTest 'test captree(8)'
-        rlRun "man --pager=cat 'captree(8)'"
-    rlPhaseEnd
-  fi
 rlJournalEnd
--- a/tests/pkg-configs/test.sh
+++ b/tests/pkg-configs/test.sh
@ -26,7 +26,7 @@ rlJournalStart
        rlRun "rpm -ql libcap-devel | grep libpsx.pc" 0 "There must be libpsx.pc"
        if [ $? -eq 0 ]; then
          PCFILE=$(rpm -ql libcap-devel | grep libpsx.pc)
-          rlRun "pkg-config --libs libpsx | grep -- '-lpsx'"
+          rlRun "pkg-config --libs libpsx | grep -- '-lpsx -lpthread -Wl,-wrap,pthread_create'"
          VER=$(awk '/Version:/ { print $2 }' $PCFILE | tail -1)
          rlRun "pkg-config --modversion libpsx | grep $VER"
          rlRun -s "pkg-config --print-variables libpsx"
Author	SHA1	Message	Date
Carlos Rodriguez-Fernandez	b89e794d41	backport bug fixes identified by static analysis	2023-12-13 21:48:56 -07:00
Carlos Rodriguez-Fernandez	f3b197e5d9	ignore known lint issues	2023-11-25 11:48:28 -07:00
Carlos Rodriguez-Fernandez	27444a9506	fix gating and modernize tests	2023-11-23 22:41:44 -07:00
Carlos Rodriguez-Fernandez	679a97c1ab	Backport fix for CVE-2023-2602 and CVE-2023-2603	2023-11-22 08:07:21 -07:00