From 7837f4d4ab8e858957d1d6fad9f087a680248b53 Mon Sep 17 00:00:00 2001 From: Stephen Smoogen Date: Thu, 29 Aug 2019 18:40:12 +0000 Subject: [PATCH 01/52] Move to 4.4.5 Updated patches to cleanly patch --- .gitignore | 1 + nagios-0010-remove-information-leak.patch | 42 +++++++++++------------ nagios-0011-remove-rpmbuild.patch | 13 +++---- nagios.spec | 23 ++++++++----- sources | 2 +- 5 files changed, 45 insertions(+), 36 deletions(-) diff --git a/.gitignore b/.gitignore index d1d0c72..a1b2d77 100644 --- a/.gitignore +++ b/.gitignore @@ -15,3 +15,4 @@ nagios-3.2.1.tar.gz /nagioscore-nagios-4.3.4.tar.gz /nagioscore-nagios-4.4.2.tar.gz /nagioscore-nagios-4.4.3.tar.gz +/nagioscore-nagios-4.4.5.tar.gz diff --git a/nagios-0010-remove-information-leak.patch b/nagios-0010-remove-information-leak.patch index 46c62e1..b417e5b 100644 --- a/nagios-0010-remove-information-leak.patch +++ b/nagios-0010-remove-information-leak.patch @@ -1,6 +1,6 @@ -diff -up ./cgi/extinfo.c.rm_youtube ./cgi/extinfo.c ---- ./cgi/extinfo.c.rm_youtube 2018-11-28 14:23:47.609805066 -0600 -+++ ./cgi/extinfo.c 2018-11-28 14:28:35.513997180 -0600 +diff -up ./cgi/extinfo.c.remove_3rdparty_links ./cgi/extinfo.c +--- ./cgi/extinfo.c.remove_3rdparty_links 2019-08-20 15:29:34.000000000 +0000 ++++ ./cgi/extinfo.c 2019-08-29 18:17:32.321544245 +0000 @@ -557,27 +557,6 @@ void document_header(int use_stylesheet) printf("\n", url_stylesheets_path, NAGFUNCS_CSS); } @@ -29,10 +29,10 @@ diff -up ./cgi/extinfo.c.rm_youtube ./cgi/extinfo.c printf("\n"); printf("\n"); -diff -up ./cgi/status.c.rm_youtube ./cgi/status.c ---- ./cgi/status.c.rm_youtube 2018-11-28 14:28:56.072653859 -0600 -+++ ./cgi/status.c 2018-11-28 14:32:05.038498204 -0600 -@@ -537,31 +537,8 @@ void document_header(int use_stylesheet) +diff -up ./cgi/status.c.remove_3rdparty_links ./cgi/status.c +--- ./cgi/status.c.remove_3rdparty_links 2019-08-20 15:29:34.000000000 +0000 ++++ ./cgi/status.c 2019-08-29 18:17:32.322544264 +0000 +@@ -555,31 +555,8 @@ void document_header(int use_stylesheet) /* JS function to append content to elements on page */ printf(" @@ -152,7 +152,7 @@ diff -up ./html/map.php.rm_youtube ./html/map.php - var vboxText = "" + - "Click here to watch the entire Nagios Core 4 Tour!"; - $(document).ready(function() { -- var user = ""; +- var user = ""; - - vBoxId += ";" + user; - vbox = new vidbox({pos:'lr',vidurl:'https://www.youtube.com/embed/leaRdb3BElI', diff --git a/nagios-0011-remove-rpmbuild.patch b/nagios-0011-remove-rpmbuild.patch index 77c6ce6..88e0049 100644 --- a/nagios-0011-remove-rpmbuild.patch +++ b/nagios-0011-remove-rpmbuild.patch @@ -1,14 +1,15 @@ diff -up ./contrib/Makefile.in.remove_rpmbuild ./contrib/Makefile.in ---- ./contrib/Makefile.in.remove_rpmbuild 2019-01-16 15:00:18.627548108 -0600 -+++ ./contrib/Makefile.in 2019-01-16 15:00:38.756215308 -0600 -@@ -84,35 +84,3 @@ $(CGI_O): $(CGI_C) - +--- ./contrib/Makefile.in.remove_rpmbuild 2019-08-29 18:23:14.113160181 +0000 ++++ ./contrib/Makefile.in 2019-08-29 18:24:20.509445391 +0000 +@@ -85,36 +85,3 @@ $(CGI_O): $(CGI_C) %.cgi : %.c $(CC) $(CFLAGS) $(LDFLAGS) $< $(CGI_O) -o $@ -- + -############################################################################## -# rpm making automation for CentOS/RHEL. - +-ifneq ("$(wildcard /etc/redhat-release)","") +- -ARCH ?= $(shell uname -m) -ifeq ($(ARCH),x86_64) -RPM_ARCH := x86_64 @@ -36,4 +37,4 @@ diff -up ./contrib/Makefile.in.remove_rpmbuild ./contrib/Makefile.in - @rpmbuild -ba --define "_topdir ${PWD}/rpmbuild" ../nagios.spec - @mv rpmbuild/RPMS/$(RPM_ARCH)/*.rpm . - @ls -l *.rpm -- +-endif diff --git a/nagios.spec b/nagios.spec index 6710f9d..0d8becd 100644 --- a/nagios.spec +++ b/nagios.spec @@ -1,8 +1,8 @@ %global _hardened_build 1 Name: nagios -Version: 4.4.3 -Release: 6%{?dist} +Version: 4.4.5 +Release: 1%{?dist} Summary: Host/service/network monitoring program @@ -71,7 +71,7 @@ BuildRequires: libtool # For selinux tools BuildRequires: checkpolicy, selinux-policy-devel -%if 0%{?el7} || 0%{?fedora} > 20 +%if 0%{?rhel} > 6 || 0%{?fedora} > 20 # For necessary macros BuildRequires: systemd %endif @@ -86,7 +86,7 @@ Requires: group(nagios) Requires(pre): group(nagios) Requires(pre): user(nagios) -%if 0%{?el7} || 0%{?fedora} > 20 +%if 0%{?rhel} > 6 || 0%{?fedora} > 20 # For necessary macros BuildRequires: systemd %else @@ -280,7 +280,7 @@ install -d -m 0775 %{buildroot}/%{_localstatedir}/log/%{name}/ install -d -m 0775 %{buildroot}/%{_localstatedir}/log/%{name}/archives # Use systemd unit on rhel7 or any supported Fedora -%if 0%{?el7} || 0%{?fedora} > 20 +%if 0%{?rhel} > 6 || 0%{?fedora} > 20 # Install systemd entry install -D -m 0644 -p %{SOURCE8} %{buildroot}%{_tmpfilesdir}/%{name}.conf @@ -324,7 +324,7 @@ exit 0 %post %{_sbindir}/usermod -a -G %{name} apache || : -%if 0%{?el7} || 0%{?fedora} > 20 +%if 0%{?rhel} > 6 || 0%{?fedora} > 20 %systemd_post %{name}.service > /dev/null 2>&1 || : %else if [ $1 -eq 1 ]; then @@ -347,7 +347,7 @@ fi %endif %preun -%if 0%{?el7} || 0%{?fedora} > 20 +%if 0%{?rhel} > 6 || 0%{?fedora} > 20 %systemd_preun %{name}.service %else if [ $1 -eq 0 ]; then @@ -437,7 +437,7 @@ fi %{_sbindir}/* %{_bindir}/* %{_libdir}/%{name}/cgi-bin/*cgi -%if 0%{?el7} || 0%{?fedora} > 20 +%if 0%{?rhel} > 6 || 0%{?fedora} > 20 %{_unitdir}/%{name}.service %{_tmpfilesdir}/%{name}.conf %else @@ -483,6 +483,13 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Thu Aug 29 2019 Stephen Smoogen - 4.4.5-1 +- Move to 4.4.5 +- Updated patches to cleanly patch + +* Fri Jul 26 2019 Stephen Smoogen - 4.4.3-7 +- Try to put in fixes to allow this to work on EL8 + * Thu Jul 25 2019 Fedora Release Engineering - 4.4.3-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild diff --git a/sources b/sources index ecf78f0..fa4ac42 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (nagioscore-nagios-4.4.3.tar.gz) = 40933521eb76952ec31fc082f040f0863e45c30e8b53a257f3c7bacc7940fd1717955f3bf91b70c847725f9658751af72189d52e7d82f605d90446c0decd0246 +SHA512 (nagioscore-nagios-4.4.5.tar.gz) = b2b4213dc9087c49a96506f514ec672476763e1ca928bf5de8494a0509b612a4a357989e719820328095489138375c9db292ac3c8129925c323220860e17bc49 From b48f1a1e3d8e0ea1617da1bf4d4e3fe46eccd6d1 Mon Sep 17 00:00:00 2001 From: Stephen Smoogen Date: Thu, 29 Aug 2019 18:51:38 +0000 Subject: [PATCH 02/52] remove nagios-socket.te as it is not used --- nagios-socket.te | 16 ---------------- 1 file changed, 16 deletions(-) delete mode 100644 nagios-socket.te diff --git a/nagios-socket.te b/nagios-socket.te deleted file mode 100644 index d9ed56b..0000000 --- a/nagios-socket.te +++ /dev/null @@ -1,16 +0,0 @@ -module nagios-socket 1.1; - -require { - type nagios_t; - type nagios_spool_t; - class sock_file { write create unlink }; - class unix_stream_socket connectto; -} - - -#============= nagios_t ============== - -#!!!! This avc is allowed in the current policy -allow nagios_t nagios_spool_t:sock_file { write create unlink }; -#!!!! This avc can be allowed using the boolean 'daemons_enable_cluster_mode' -allow nagios_t self:unix_stream_socket connectto; From aef6df418ce02d38a47cd2232b9978f7ac4ca24e Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 29 Jan 2020 14:34:11 +0000 Subject: [PATCH 03/52] - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- nagios.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nagios.spec b/nagios.spec index 0d8becd..bbdfaea 100644 --- a/nagios.spec +++ b/nagios.spec @@ -2,7 +2,7 @@ Name: nagios Version: 4.4.5 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Host/service/network monitoring program @@ -483,6 +483,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Wed Jan 29 2020 Fedora Release Engineering - 4.4.5-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + * Thu Aug 29 2019 Stephen Smoogen - 4.4.5-1 - Move to 4.4.5 - Updated patches to cleanly patch From 06f08ea402d1525348ed91c7a13c2a8f79659968 Mon Sep 17 00:00:00 2001 From: Stephen Smoogen Date: Tue, 18 Feb 2020 15:35:22 +0000 Subject: [PATCH 04/52] Add change to allow for problems found in mass rebuild and gcc10. Fix BZ#1793909 --- nagios.spec | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/nagios.spec b/nagios.spec index bbdfaea..cae8324 100644 --- a/nagios.spec +++ b/nagios.spec @@ -1,8 +1,12 @@ %global _hardened_build 1 +# https://gcc.gnu.org/gcc-10/porting_to.html#common +# attempt to fix bugzilla 1793909 +%define _legacy_common_support 1 + Name: nagios Version: 4.4.5 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Host/service/network monitoring program @@ -483,6 +487,10 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Tue Feb 18 2020 Stephen Smoogen - 4.4.5-3 +- Add change to allow for problems found in mass rebuild and gcc10. +- Fix BZ#1793909 + * Wed Jan 29 2020 Fedora Release Engineering - 4.4.5-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild From 460ff9c51ff6ae59c0902c1a36bc9991fc4403ad Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Tue, 14 Jan 2020 17:40:18 +0100 Subject: [PATCH 05/52] Update nagios-selinux Update nagios-selinux subpackage based on Decentrailized SELinux policy project guidelines https://fedoraproject.org/wiki/SELinux/IndependentPolicy and enable it for Fedora. Lines concerning older rhel where removed in order to simplify the spec file. Distribution nagios policy (rawhide version) was merged with the additional rules that where shipped in nagios_epel policy module. The resulting policy module will override the distribution policy when the nagios-selinux package is installed. --- nagios.fc | 113 +++++++++ nagios.if | 336 ++++++++++++++++++++++++++ nagios.spec | 126 +++++----- nagios.te | 667 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 1176 insertions(+), 66 deletions(-) create mode 100644 nagios.fc create mode 100644 nagios.if create mode 100644 nagios.te diff --git a/nagios.fc b/nagios.fc new file mode 100644 index 0000000..c781b72 --- /dev/null +++ b/nagios.fc @@ -0,0 +1,113 @@ +/etc/nagios(/.*)? gen_context(system_u:object_r:nagios_etc_t,s0) +/etc/icinga(/.*)? gen_context(system_u:object_r:nagios_etc_t,s0) +/etc/nagios/nrpe\.cfg -- gen_context(system_u:object_r:nrpe_etc_t,s0) +/etc/pnp4nagios(/.*)? gen_context(system_u:object_r:nagios_etc_t,s0) +/etc/rc\.d/init\.d/nagios -- gen_context(system_u:object_r:nagios_initrc_exec_t,s0) +/etc/rc\.d/init\.d/nrpe -- gen_context(system_u:object_r:nagios_initrc_exec_t,s0) + + +/usr/bin/nagios -- gen_context(system_u:object_r:nagios_exec_t,s0) +/usr/bin/icinga -- gen_context(system_u:object_r:nagios_exec_t,s0) +/usr/bin/nrpe -- gen_context(system_u:object_r:nrpe_exec_t,s0) + +/usr/sbin/nagios -- gen_context(system_u:object_r:nagios_exec_t,s0) +/usr/sbin/icinga -- gen_context(system_u:object_r:nagios_exec_t,s0) +/usr/sbin/nrpe -- gen_context(system_u:object_r:nrpe_exec_t,s0) + +/usr/lib/cgi-bin/netsaint(/.*)? gen_context(system_u:object_r:nagios_script_exec_t,s0) +/usr/lib/nagios/cgi(/.*)? gen_context(system_u:object_r:nagios_script_exec_t,s0) +/usr/lib/icinga/cgi(/.*)? gen_context(system_u:object_r:nagios_script_exec_t,s0) + +/var/log/nagios(/.*)? gen_context(system_u:object_r:nagios_log_t,s0) +/var/log/icinga(/.*)? gen_context(system_u:object_r:nagios_log_t,s0) +/var/log/netsaint(/.*)? gen_context(system_u:object_r:nagios_log_t,s0) +/var/log/pnp4nagios(/.*)? gen_context(system_u:object_r:nagios_log_t,s0) + +/var/lib/pnp4nagios(/.*)? gen_context(system_u:object_r:nagios_var_lib_t,s0) + +/var/run/nagios.* gen_context(system_u:object_r:nagios_var_run_t,s0) + +/var/spool/nagios(/.*)? gen_context(system_u:object_r:nagios_spool_t,s0) +/var/spool/icinga(/.*)? gen_context(system_u:object_r:nagios_spool_t,s0) + +ifdef(`distro_debian',` +/usr/sbin/nagios -- gen_context(system_u:object_r:nagios_exec_t,s0) +') +/usr/lib/cgi-bin/nagios(/.+)? gen_context(system_u:object_r:nagios_script_exec_t,s0) +/usr/lib/nagios/cgi-bin(/.*)? gen_context(system_u:object_r:nagios_script_exec_t,s0) + +# admin plugins +/usr/lib/nagios/plugins/check_file_age -- gen_context(system_u:object_r:nagios_admin_plugin_exec_t,s0) + +# check disk plugins +/usr/lib/nagios/plugins/check_disk -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_disk_smb -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_ide_smart -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_linux_raid -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0) + +# mail plugins +/usr/lib/nagios/plugins/check_mailq -- gen_context(system_u:object_r:nagios_mail_plugin_exec_t,s0) + +/usr/lib/pnp4nagios(/.*)? gen_context(system_u:object_r:nagios_var_lib_t,s0) + +# system plugins +/usr/lib(64)?/nagios/plugins/check_breeze -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_dummy -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_flexlm -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_ifoperstatus -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_ifstatus -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_load -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_log -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_mrtg -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_mrtgtraf -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_nagios -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_nwstat -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_overcr -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_procs -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_sensors -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_swap -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_users -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_wave -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) + +# services plugins +/usr/lib(64)?/nagios/plugins/check_cluster -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_dhcp -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_dig -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_dns -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_game -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_fping -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_hpjd -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_http -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_icmp -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_ircd -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_ldap -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_mysql -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_mysql_query -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_nrpe -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_nt -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_ntp.* -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_oracle -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_pgsql -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_ping -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_radius -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_real -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_rpc -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_tcp -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_time -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_sip -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_smtp -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_snmp.* -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_ssh -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_ups -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) + +# openshift plugins +/usr/lib64/nagios/plugins/check_node_accept_status -- gen_context(system_u:object_r:nagios_openshift_plugin_exec_t,s0) +/usr/lib64/nagios/plugins/check_number_openshift_apps -- gen_context(system_u:object_r:nagios_openshift_plugin_exec_t,s0) + +# label all nagios plugin as unconfined by default +/usr/lib/nagios/plugins/.* -- gen_context(system_u:object_r:nagios_unconfined_plugin_exec_t,s0) + +# eventhandlers +/usr/lib/nagios/plugins/eventhandlers(/.*) gen_context(system_u:object_r:nagios_eventhandler_plugin_exec_t,s0) +/usr/lib/icinga/plugins/eventhandlers(/.*) gen_context(system_u:object_r:nagios_eventhandler_plugin_exec_t,s0) + diff --git a/nagios.if b/nagios.if new file mode 100644 index 0000000..d012e9b --- /dev/null +++ b/nagios.if @@ -0,0 +1,336 @@ +## Net Saint / NAGIOS - network monitoring server + +######################################## +## +## Create a set of derived types for various +## nagios plugins, +## +## +## +## The name to be used for deriving type names. +## +## +# +template(`nagios_plugin_template',` + gen_require(` + attribute nagios_plugin_domain; + type nagios_t, nrpe_t; + ') + + type nagios_$1_plugin_t, nagios_plugin_domain; + type nagios_$1_plugin_exec_t; + application_domain(nagios_$1_plugin_t, nagios_$1_plugin_exec_t) + role system_r types nagios_$1_plugin_t; + + domtrans_pattern(nrpe_t, nagios_$1_plugin_exec_t, nagios_$1_plugin_t) + allow nagios_t nagios_$1_plugin_exec_t:file ioctl; + + # needed by command.cfg + domtrans_pattern(nagios_t, nagios_$1_plugin_exec_t, nagios_$1_plugin_t) + + kernel_read_system_state(nagios_$1_plugin_t) + +') + +######################################## +## +## Execute the nagios unconfined plugins with +## a domain transition. +## +## +## +## Domain allowed access. +## +## +# +interface(`nagios_domtrans_unconfined_plugins',` + gen_require(` + type nagios_unconfined_plugin_t; + type nagios_unconfined_plugin_exec_t; + ') + + domtrans_pattern($1, nagios_unconfined_plugin_exec_t, nagios_unconfined_plugin_t) +') + +######################################## +## +## Do not audit attempts to read or write nagios +## unnamed pipes. +## +## +## +## Domain to not audit. +## +## +# +interface(`nagios_dontaudit_rw_pipes',` + gen_require(` + type nagios_t; + ') + + dontaudit $1 nagios_t:fifo_file rw_fifo_file_perms; +') + +######################################## +## +## Allow the specified domain to read +## nagios configuration files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`nagios_read_config',` + gen_require(` + type nagios_etc_t; + ') + + allow $1 nagios_etc_t:dir list_dir_perms; + allow $1 nagios_etc_t:file read_file_perms; + files_search_etc($1) +') +###################################### +## +## Read nagios lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`nagios_read_lib',` + gen_require(` + type nagios_var_lib_t; + ') + + files_search_var($1) + list_dirs_pattern($1, nagios_var_lib_t, nagios_var_lib_t) + read_files_pattern($1, nagios_var_lib_t, nagios_var_lib_t) +') + +###################################### +## +## Read nagios logs. +## +## +## +## Domain allowed access. +## +## +# +interface(`nagios_read_log',` + gen_require(` + type nagios_log_t; + ') + + logging_search_logs($1) + read_files_pattern($1, nagios_log_t, nagios_log_t) +') + +######################################## +## +## Do not audit attempts to read or write nagios logs. +## +## +## +## Domain to not audit. +## +## +# +interface(`nagios_dontaudit_rw_log',` + gen_require(` + type nagios_log_t; + ') + + dontaudit $1 nagios_log_t:file rw_file_perms; +') + +######################################## +## +## Search nagios spool directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`nagios_search_spool',` + gen_require(` + type nagios_spool_t; + ') + + allow $1 nagios_spool_t:dir search_dir_perms; + files_search_spool($1) +') + +######################################## +## +## Append nagios spool files. +## +## +## +## Domain allowed access. +## +## +# +interface(`nagios_append_spool',` + gen_require(` + type nagios_spool_t; + ') + + allow $1 nagios_spool_t:file append_file_perms; + files_search_spool($1) +') + +######################################## +## +## Allow the specified domain to read +## nagios temporary files. +## +## +## +## Domain allowed access. +## +## +# +interface(`nagios_read_tmp_files',` + gen_require(` + type nagios_tmp_t; + ') + + allow $1 nagios_tmp_t:file read_file_perms; + files_search_tmp($1) +') + +######################################## +## +## Allow the specified domain to read +## nagios temporary files. +## +## +## +## Domain allowed access. +## +## +# +interface(`nagios_rw_inerited_tmp_files',` + gen_require(` + type nagios_tmp_t; + ') + + allow $1 nagios_tmp_t:file rw_inherited_file_perms; + files_search_tmp($1) +') + +######################################## +## +## Execute the nagios NRPE with +## a domain transition. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`nagios_domtrans_nrpe',` + gen_require(` + type nrpe_t, nrpe_exec_t; + ') + + domtrans_pattern($1, nrpe_exec_t, nrpe_t) +') + +###################################### +## +## Do not audit attempts to write nrpe daemon unnamed pipes. +## +## +## +## Domain allowed access. +## +## +# +interface(`nagios_dontaudit_write_pipes_nrpe',` + gen_require(` + type nrpe_t; + ') + + dontaudit $1 nrpe_t:fifo_file write; +') + +######################################## +## +## All of the rules required to administrate +## an nagios environment +## +## +## +## Domain allowed access. +## +## +## +## +## The role to be allowed to manage the nagios domain. +## +## +## +# +interface(`nagios_admin',` + gen_require(` + type nagios_t, nrpe_t, nagios_initrc_exec_t; + type nagios_tmp_t, nagios_log_t, nagios_var_run_t; + type nagios_etc_t, nrpe_etc_t, nagios_spool_t; + ') + + allow $1 nagios_t:process signal_perms; + ps_process_pattern($1, nagios_t) + tunable_policy(`deny_ptrace',`',` + allow $1 nagios_t:process ptrace; + ') + + init_labeled_script_domtrans($1, nagios_initrc_exec_t) + domain_system_change_exemption($1) + role_transition $2 nagios_initrc_exec_t system_r; + allow $2 system_r; + + files_list_tmp($1) + admin_pattern($1, nagios_tmp_t) + + logging_list_logs($1) + admin_pattern($1, nagios_log_t) + + files_list_etc($1) + admin_pattern($1, nagios_etc_t) + + files_list_spool($1) + admin_pattern($1, nagios_spool_t) + + files_list_pids($1) + admin_pattern($1, nagios_var_run_t) + + admin_pattern($1, nrpe_etc_t) +') + +######################################## +## +## Send a null signal to nagios_unconfined_plugin. +## +## +## +## Domain allowed access. +## +## +# +interface(`nagios_unconfined_signull',` + gen_require(` + type nagios_unconfined_plugin_t; + ') + + allow $1 nagios_unconfined_plugin_t:process signull; +') diff --git a/nagios.spec b/nagios.spec index cae8324..f90ab67 100644 --- a/nagios.spec +++ b/nagios.spec @@ -1,4 +1,6 @@ %global _hardened_build 1 +%global with_selinux 1 +%global selinuxtype targeted # https://gcc.gnu.org/gcc-10/porting_to.html#common # attempt to fix bugzilla 1793909 @@ -6,7 +8,7 @@ Name: nagios Version: 4.4.5 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Host/service/network monitoring program @@ -25,9 +27,9 @@ Source10: printer.png Source11: router.png Source12: switch.png Source13: nagios.README.SELinux.rst -Source14: nagios_epel7.te -Source15: nagios_epel.fc -Source16: nagios_epel6.te +Source14: nagios.te +Source15: nagios.fc +Source16: nagios.if # Patch 0 should be a patch that we get from the maint git tree in # order to fix any items upstream wanted. @@ -88,6 +90,12 @@ Requires: nagios-common Requires: user(nagios) Requires: group(nagios) +%if 0%{?with_selinux} +# This ensures that the *-selinux package and all it’s dependencies are not pulled +# into containers and other systems that do not use SELinux +Requires: (%{name}-selinux if selinux-policy-%{selinuxtype}) +%endif # if with_selinux + Requires(pre): group(nagios) Requires(pre): user(nagios) %if 0%{?rhel} > 6 || 0%{?fedora} > 20 @@ -142,17 +150,20 @@ that you specify. This package provides include files that Nagios-related applications may compile against. -%if 0%{?rhel} > 5 +%if 0%{?with_selinux} +# SELinux subpackage %package selinux Summary: SELinux context for %{name} -Requires: %name = %version-%release -Requires(post): policycoreutils -Requires(postun): policycoreutils - +Requires: %{name} = %{version}-%{release} +BuildArch: noarch +Requires: selinux-policy-%{selinuxtype} +Requires(post): selinux-policy-%{selinuxtype} +BuildRequires: checkpolicy, selinux-policy-devel +%{?selinux_requires} %description selinux -SElinux context for %{name}. -%endif +SElinux security policy for %{name}. +%endif # if with_selinux %package contrib Summary: Eventhandlers contributed to nagios @@ -161,6 +172,13 @@ Requires: %name = %version-%release %description contrib Various contributed items used by plugins and other tools. +%if 0%{?with_selinux} +# SELinux contexts are saved so that only affected files can be +# relabeled after the policy module installation +%pre selinux +%selinux_relabel_pre -s %{selinuxtype} +%endif # if with_selinux + %prep %setup -q -n nagioscore-nagios-%{version} @@ -232,19 +250,17 @@ cp -f %{SOURCE5} UpgradeToVersion4.ReadMe cp -f %{SOURCE6} UpgradeToVersion4.sh echo >> html/stylesheets/common.css -%if 0%{?rhel} > 5 -## SELinux configs +%if 0%{?with_selinux} mkdir selinux -install -pm 644 %{SOURCE13} README.SELinux.rst -%if 0%{?rhel} == 6 -cp -p %{SOURCE16} selinux/%{name}_epel.te -%else -cp -p %{SOURCE14} selinux/%{name}_epel.te -%endif -cp -p %{SOURCE15} selinux/%{name}_epel.fc -touch selinux/%{name}_epel.if -make -f %{_datadir}/selinux/devel/Makefile -%endif +# Shipping the whole nagios policy (originally from selinux-policy-contrib) +# this policy module will override the production module +cp -p %{SOURCE14} selinux/ +cp -p %{SOURCE15} selinux/ +cp -p %{SOURCE16} selinux/ + +make -f %{_datadir}/selinux/devel/Makefile %{name}.pp +bzip2 -9 %{name}.pp +%endif # if with_selinux %install @@ -299,10 +315,10 @@ chmod 755 %{buildroot}%{_sbindir}/nagios install -d -m 0755 %{buildroot}%{_datadir}/nagios/html/docs %{__cp} -a Documentation/html/* %{buildroot}%{_datadir}/nagios/html/docs -%if 0%{?rhel} >5 -# Selinux configs -install -p -m 644 -D %{name}_epel.pp $RPM_BUILD_ROOT%{_datadir}/selinux/packages/%{name}/%{name}_epel.pp -%endif +%if 0%{?with_selinux} +install -pm 0644 %{SOURCE13} README.SELinux.rst +install -D -m 0644 %{name}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2 +%endif # if with_selinux ### CONTRIB ITEMS TAKEN FROM UPSTREAM NAGIOS SPEC make install -C contrib DESTDIR="%{buildroot}" INSTALL_OPTS="" @@ -382,49 +398,22 @@ fi /bin/systemctl try-restart %{name}.service >/dev/null 2>&1 || : %endif -%if 0%{?rhel} >5 +%if 0%{?with_selinux} %post selinux -%if 0%{?el5}%{?el6} +%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2 +%selinux_relabel_post -s %{selinuxtype} + if [ "$1" -le "1" ]; then # First install - semodule -i %{_datadir}/selinux/packages/%{name}/%{name}_epel.pp 2>/dev/null || : - fixfiles -R %{name} restore || : - /sbin/service %{name} condrestart > /dev/null 2>&1 || : -fi -%else -if [ "$1" -le "1" ]; then # First install - semodule -i %{_datadir}/selinux/packages/%{name}/%{name}_epel.pp 2>/dev/null || : - fixfiles -R %{name} restore || : %systemd_postun_with_restart %{name}.service fi -%endif -%endif -%if 0%{?rhel} >5 -%preun selinux -%if 0%{?el6} -if [ "$1" -lt "1" ]; then # Final removal - semodule -r %{name}_epel 2>/dev/null || : - fixfiles -R %{name} restore || : - /sbin/service %{name} condrestart > /dev/null 2>&1 || : -fi -%else -if [ "$1" -lt "1" ]; then # Final removal - semodule -r %{name}_epel 2>/dev/null || : - fixfiles -R %{name} restore || : +%postun selinux +if [ $1 -eq 0 ]; then + %selinux_modules_uninstall -s %{selinuxtype} %{name} + %selinux_relabel_post -s %{selinuxtype} %systemd_postun_with_restart %{name}.service fi -%endif -%endif - -%if 0%{?rhel} >5 -%postun selinux -if [ "$1" -ge "1" ]; then # Upgrade - # Replaces the module if it is already loaded - semodule -i %{_datadir}/selinux/packages/%{name}/%{name}_epel.pp 2>/dev/null || : - # no need to restart the daemon -fi -%endif - +%endif # if with_selinux %files @@ -475,11 +464,13 @@ fi %{_includedir}/%{name} %attr(0644,root,root) %{_libdir}/%{name}/libnagios.a -%if 0%{?rhel} > 5 +%if 0%{?with_selinux} %files selinux %doc README.SELinux.rst -%{_datadir}/selinux/packages/%{name}/nagios_epel.pp -%endif +%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.* +%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name} +%endif # if with_selinux + %files contrib %doc contrib/README.contrib @@ -487,6 +478,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Wed Feb 26 2020 Vit Mojzis - 4.4.5-4 +- Update nagios-selinux based on the DSP guidelines + * Tue Feb 18 2020 Stephen Smoogen - 4.4.5-3 - Add change to allow for problems found in mass rebuild and gcc10. - Fix BZ#1793909 diff --git a/nagios.te b/nagios.te new file mode 100644 index 0000000..2d74988 --- /dev/null +++ b/nagios.te @@ -0,0 +1,667 @@ +policy_module(nagios, 1.13.0) + +######################################## +# +# Declarations +# + +## +##

+## Allow nagios/nrpe to call sudo from NRPE utils scripts. +##

+## +gen_tunable(nagios_run_sudo, false) + +## +##

+## Allow nagios run in conjunction with PNP4Nagios. +##

+## +gen_tunable(nagios_run_pnp4nagios, false) + +## +##

+## Determine whether Nagios, NRPE can +## access nfs file systems. +##

+## +gen_tunable(nagios_use_nfs, false) + +gen_require(` + class passwd rootok; + class passwd passwd; +') + +attribute nagios_plugin_domain; + +type nagios_t; +type nagios_exec_t; +init_daemon_domain(nagios_t, nagios_exec_t) + +type nagios_etc_t; +files_config_file(nagios_etc_t) + +type nagios_initrc_exec_t; +init_script_file(nagios_initrc_exec_t) + +type nagios_log_t; +logging_log_file(nagios_log_t) + +type nagios_tmp_t; +files_tmp_file(nagios_tmp_t) + +type nagios_var_run_t; +files_pid_file(nagios_var_run_t) + +type nagios_spool_t; +files_spool_file(nagios_spool_t) + +type nagios_var_lib_t; +files_type(nagios_var_lib_t) + +nagios_plugin_template(admin) +nagios_plugin_template(checkdisk) +nagios_plugin_template(mail) +nagios_plugin_template(services) +nagios_plugin_template(system) +nagios_plugin_template(unconfined) +nagios_plugin_template(eventhandler) +nagios_plugin_template(openshift) + +type nagios_eventhandler_plugin_tmp_t; +files_tmp_file(nagios_eventhandler_plugin_tmp_t) + +type nagios_system_plugin_tmp_t; +files_tmp_file(nagios_system_plugin_tmp_t) + +type nagios_openshift_plugin_tmp_t; +files_tmp_file(nagios_openshift_plugin_tmp_t) + +type nrpe_t; +type nrpe_exec_t; +init_daemon_domain(nrpe_t, nrpe_exec_t) + +type nrpe_etc_t; +files_config_file(nrpe_etc_t) + +type nrpe_var_run_t; +files_pid_file(nrpe_var_run_t) + +###################################### +# +# Common plugin domain local policy +# + +allow nagios_plugin_domain self:fifo_file rw_fifo_file_perms; + +allow nrpe_t nagios_plugin_domain:process { signal sigkill }; + +allow nagios_t nagios_plugin_domain:process signal_perms; +allow nagios_plugin_domain nagios_t:process signal_perms; + +# cjp: leaked file descriptor +dontaudit nagios_plugin_domain nrpe_t:tcp_socket { read write }; +dontaudit nagios_plugin_domain nagios_log_t:file { read write }; + +dev_read_urand(nagios_plugin_domain) +dev_read_rand(nagios_plugin_domain) +dev_read_sysfs(nagios_plugin_domain) + +userdom_use_inherited_user_ptys(nagios_plugin_domain) +userdom_use_inherited_user_ttys(nagios_plugin_domain) + +######################################## +# +# Nagios local policy +# + +allow nagios_t self:capability { chown dac_read_search setgid setuid }; +dontaudit nagios_t self:capability sys_tty_config; +allow nagios_t self:process { setpgid signal_perms }; +allow nagios_t self:fifo_file rw_fifo_file_perms; +allow nagios_t self:tcp_socket { accept listen }; +allow nagios_t self:unix_stream_socket { connectto }; + +allow nagios_t nagios_plugin_domain:process signal_perms; + +allow nagios_t nagios_eventhandler_plugin_exec_t:dir list_dir_perms; + +allow nagios_t nagios_etc_t:dir list_dir_perms; +allow nagios_t nagios_etc_t:file { read_file_perms map }; +allow nagios_t nagios_etc_t:lnk_file read_lnk_file_perms; + +#allow nagios_t nagios_log_t:dir setattr_dir_perms; +#append_files_pattern(nagios_t, nagios_log_t, nagios_log_t) +#create_files_pattern(nagios_t, nagios_log_t, nagios_log_t) +#setattr_files_pattern(nagios_t, nagios_log_t, nagios_log_t) +manage_files_pattern(nagios_t, nagios_log_t, nagios_log_t) +manage_dirs_pattern(nagios_t, nagios_log_t, nagios_log_t) +logging_log_filetrans(nagios_t, nagios_log_t, { dir file }) +allow nagios_t nagios_log_t:file map; + +manage_dirs_pattern(nagios_t, nagios_tmp_t, nagios_tmp_t) +manage_files_pattern(nagios_t, nagios_tmp_t, nagios_tmp_t) +files_tmp_filetrans(nagios_t, nagios_tmp_t, { dir file }) + +manage_files_pattern(nagios_t, nagios_var_run_t, nagios_var_run_t) +files_pid_filetrans(nagios_t, nagios_var_run_t, file) + +manage_fifo_files_pattern(nagios_t, nagios_spool_t, nagios_spool_t) +manage_files_pattern(nagios_t, nagios_spool_t, nagios_spool_t) +manage_sock_files_pattern(nagios_t, nagios_spool_t, nagios_spool_t) +files_spool_filetrans(nagios_t, nagios_spool_t, { file fifo_file }) +allow nagios_t nagios_spool_t:file map; + +manage_files_pattern(nagios_t, nagios_var_lib_t, nagios_var_lib_t) +manage_fifo_files_pattern(nagios_t, nagios_var_lib_t, nagios_var_lib_t) +manage_dirs_pattern(nagios_t, nagios_var_lib_t, nagios_var_lib_t) +files_var_lib_filetrans(nagios_t, nagios_var_lib_t, { dir file fifo_file }) + +kernel_read_system_state(nagios_t) +kernel_read_kernel_sysctls(nagios_t) +kernel_read_software_raid_state(nagios_t) + +corecmd_exec_bin(nagios_t) +corecmd_exec_shell(nagios_t) + +corenet_all_recvfrom_netlabel(nagios_t) +corenet_tcp_sendrecv_generic_if(nagios_t) +corenet_tcp_sendrecv_generic_node(nagios_t) + +corenet_sendrecv_all_client_packets(nagios_t) +corenet_tcp_connect_all_ports(nagios_t) +corenet_tcp_sendrecv_all_ports(nagios_t) + +corenet_dontaudit_tcp_bind_all_reserved_ports(nagios_t) +corenet_dontaudit_udp_bind_all_reserved_ports(nagios_t) + +dev_read_sysfs(nagios_t) +dev_read_urand(nagios_t) + +domain_use_interactive_fds(nagios_t) +domain_read_all_domains_state(nagios_t) + +files_read_etc_runtime_files(nagios_t) +files_read_kernel_symbol_table(nagios_t) +files_search_spool(nagios_t) + +fs_getattr_all_fs(nagios_t) +fs_search_auto_mountpoints(nagios_t) +fs_search_cgroup_dirs(nagios_t) + +hostname_exec(nagios_t) + +auth_use_nsswitch(nagios_t) + +logging_send_syslog_msg(nagios_t) +libs_exec_ldconfig(nagios_t) + +userdom_dontaudit_use_unpriv_user_fds(nagios_t) +userdom_dontaudit_search_user_home_dirs(nagios_t) + +mta_send_mail(nagios_t) +mta_signal_system_mail(nagios_t) +mta_kill_system_mail(nagios_t) + +systemd_exec_systemctl(nagios_t) + +tunable_policy(`nagios_run_sudo',` + allow nagios_t self:capability { chown setuid setgid sys_resource sys_ptrace }; + allow nagios_t self:process { setrlimit setsched }; + + allow nagios_t self:key write; + + allow nagios_t self:passwd { passwd rootok }; + + auth_rw_lastlog(nagios_t) + auth_rw_faillog(nagios_t) + + auth_domtrans_chkpwd(nagios_t) + + selinux_compute_access_vector(nagios_t) + + systemd_write_inherited_logind_sessions_pipes(nagios_t) + systemd_dbus_chat_logind(nagios_t) + + logging_send_audit_msgs(nagios_t) +') + +optional_policy(` + apache_systemctl(nagios_t) +') + +optional_policy(` + dbus_system_bus_client(nagios_t) +') + +optional_policy(` + tunable_policy(`nagios_run_sudo',` + sudo_exec(nagios_t) + sudo_manage_db(nagios_t) + ') +') + +optional_policy(` + tunable_policy(`nagios_run_sudo',` + init_read_utmp(nagios_t) + ') +') + +tunable_policy(`nagios_run_pnp4nagios',` + allow nagios_t nagios_log_t:file execute; +') + +tunable_policy(`nagios_use_nfs',` + fs_manage_nfs_files(nagios_t) + fs_manage_nfs_dirs(nagios_t) + fs_manage_nfs_symlinks(nagios_t) +') + +optional_policy(` + netutils_kill_ping(nagios_t) +') + +optional_policy(` + seutil_sigchld_newrole(nagios_t) +') + +optional_policy(` + udev_read_db(nagios_t) +') + +######################################## +# +# CGI local policy +# + +optional_policy(` + apache_content_template(nagios) + apache_content_alias_template(nagios, nagios) + typealias nagios_script_t alias nagios_cgi_t; + typealias nagios_script_exec_t alias nagios_cgi_exec_t; + + allow nagios_script_t self:process signal_perms; + + read_files_pattern(nagios_script_t, nagios_t, nagios_t) + read_lnk_files_pattern(nagios_script_t, nagios_t, nagios_t) + + allow nagios_script_t nagios_etc_t:dir list_dir_perms; + allow nagios_script_t nagios_etc_t:file { map read_file_perms }; + allow nagios_script_t nagios_etc_t:lnk_file read_lnk_file_perms; + + files_search_spool(nagios_script_t) + rw_fifo_files_pattern(nagios_script_t, nagios_spool_t, nagios_spool_t) + read_files_pattern(nagios_script_t, nagios_spool_t, nagios_spool_t) + allow nagios_script_t nagios_spool_t:file map; + + allow nagios_script_t nagios_log_t:dir list_dir_perms; + read_files_pattern(nagios_script_t, nagios_etc_t, nagios_log_t) + read_lnk_files_pattern(nagios_script_t, nagios_etc_t, nagios_log_t) + allow nagios_script_t nagios_log_t:file map; + + kernel_read_system_state(nagios_script_t) + + domain_dontaudit_read_all_domains_state(nagios_script_t) + + files_read_etc_runtime_files(nagios_script_t) + files_read_kernel_symbol_table(nagios_script_t) + + dev_list_sysfs(nagios_script_t) + + logging_send_syslog_msg(nagios_script_t) +') + +######################################## +# +# Nrpe local policy +# + +allow nrpe_t self:capability { setuid setgid kill }; +dontaudit nrpe_t self:capability { sys_tty_config sys_resource }; +allow nrpe_t self:process { setpgid signal_perms setsched setrlimit }; +allow nrpe_t self:fifo_file rw_fifo_file_perms; +allow nrpe_t self:tcp_socket { accept listen }; + +allow nrpe_t nagios_plugin_domain:process { signal sigkill }; + +read_files_pattern(nrpe_t, nagios_etc_t, nrpe_etc_t) + +manage_files_pattern(nrpe_t, nrpe_var_run_t, nrpe_var_run_t) +files_pid_filetrans(nrpe_t, nrpe_var_run_t, file) + +domtrans_pattern(nrpe_t, nagios_checkdisk_plugin_exec_t, nagios_checkdisk_plugin_t) + +kernel_read_system_state(nrpe_t) +kernel_read_kernel_sysctls(nrpe_t) +kernel_read_software_raid_state(nrpe_t) +kernel_read_fs_sysctls(nrpe_t) + +can_exec(nagios_t, nagios_exec_t) + +corecmd_exec_bin(nrpe_t) +corecmd_exec_shell(nrpe_t) + +corenet_all_recvfrom_unlabeled(nrpe_t) +corenet_all_recvfrom_netlabel(nrpe_t) +corenet_tcp_sendrecv_generic_if(nrpe_t) +corenet_tcp_sendrecv_generic_node(nrpe_t) +corenet_tcp_bind_generic_node(nrpe_t) + +corenet_sendrecv_inetd_child_server_packets(nrpe_t) +corenet_tcp_bind_inetd_child_port(nrpe_t) +corenet_tcp_sendrecv_inetd_child_port(nrpe_t) + +dev_read_sysfs(nrpe_t) +dev_read_urand(nrpe_t) +dev_rw_lvm_control(nrpe_t) + +domain_use_interactive_fds(nrpe_t) +domain_read_all_domains_state(nrpe_t) + +files_list_var(nrpe_t) +files_read_etc_runtime_files(nrpe_t) + +fs_getattr_all_fs(nrpe_t) +fs_search_auto_mountpoints(nrpe_t) + +auth_use_nsswitch(nrpe_t) + +logging_send_syslog_msg(nrpe_t) + +userdom_dontaudit_use_unpriv_user_fds(nrpe_t) + +tunable_policy(`nagios_run_sudo',` + allow nrpe_t self:capability { setuid setgid sys_resource sys_ptrace }; + allow nrpe_t self:process { setrlimit setsched }; + + allow nrpe_t self:key write; + + allow nrpe_t self:passwd { passwd rootok }; + + auth_rw_lastlog(nrpe_t) + auth_rw_faillog(nrpe_t) + + auth_domtrans_chkpwd(nrpe_t) + + init_read_utmp(nrpe_t) + + selinux_compute_access_vector(nrpe_t) + + systemd_write_inherited_logind_sessions_pipes(nrpe_t) + systemd_dbus_chat_logind(nrpe_t) + systemd_logind_read_state(nrpe_t) + + logging_send_audit_msgs(nrpe_t) +') + +optional_policy(` + tunable_policy(`nagios_run_sudo',` + sudo_exec(nrpe_t) + sudo_manage_db(nrpe_t) + ') +') + +optional_policy(` + tunable_policy(`nagios_run_sudo',` + sssd_read_config(nrpe_t) + sssd_manage_lib_files(nrpe_t) + sssd_read_pid_files(nrpe_t) + sssd_signull(nrpe_t) + ') +') + +tunable_policy(`nagios_use_nfs',` + fs_manage_nfs_files(nrpe_t) + fs_manage_nfs_dirs(nrpe_t) + fs_manage_nfs_symlinks(nrpe_t) +') + +optional_policy(` + dbus_system_bus_client(nrpe_t) +') + +optional_policy(` + inetd_tcp_service_domain(nrpe_t, nrpe_exec_t) +') + +optional_policy(` + lvm_read_metadata(nrpe_t) +') + +optional_policy(` + mta_send_mail(nrpe_t) +') + +optional_policy(` + seutil_sigchld_newrole(nrpe_t) +') + +optional_policy(` + tcpd_wrapped_domain(nrpe_t, nrpe_exec_t) +') + +optional_policy(` + udev_read_db(nrpe_t) +') + +##################################### +# +# Admin local policy +# + +corecmd_read_bin_files(nagios_admin_plugin_t) +corecmd_read_bin_symlinks(nagios_admin_plugin_t) + +dev_getattr_all_chr_files(nagios_admin_plugin_t) +dev_getattr_all_blk_files(nagios_admin_plugin_t) + +files_getattr_all_dirs(nagios_admin_plugin_t) +files_getattr_all_files(nagios_admin_plugin_t) +files_getattr_all_symlinks(nagios_admin_plugin_t) +files_getattr_all_pipes(nagios_admin_plugin_t) +files_getattr_all_sockets(nagios_admin_plugin_t) +files_getattr_all_file_type_fs(nagios_admin_plugin_t) + +###################################### +# +# Mail local policy +# + +allow nagios_mail_plugin_t self:capability { setuid setgid dac_read_search }; +allow nagios_mail_plugin_t self:netlink_route_socket r_netlink_socket_perms; +allow nagios_mail_plugin_t self:tcp_socket create_stream_socket_perms; +allow nagios_mail_plugin_t self:udp_socket create_socket_perms; + +kernel_read_kernel_sysctls(nagios_mail_plugin_t) + +corecmd_read_bin_files(nagios_mail_plugin_t) +corecmd_read_bin_symlinks(nagios_mail_plugin_t) + +logging_send_syslog_msg(nagios_mail_plugin_t) + +sysnet_dns_name_resolve(nagios_mail_plugin_t) + +optional_policy(` + mta_send_mail(nagios_mail_plugin_t) +') + +optional_policy(` + nscd_dontaudit_search_pid(nagios_mail_plugin_t) +') + +optional_policy(` + postfix_stream_connect_master(nagios_mail_plugin_t) + postfix_exec_postqueue(nagios_mail_plugin_t) +') + +###################################### +# +# Disk local policy +# + +allow nagios_checkdisk_plugin_t self:capability { sys_admin sys_rawio }; + +kernel_read_software_raid_state(nagios_checkdisk_plugin_t) + +corecmd_exec_bin(nagios_checkdisk_plugin_t) + +files_getattr_all_dirs(nagios_checkdisk_plugin_t) +files_getattr_all_mountpoints(nagios_checkdisk_plugin_t) +files_read_etc_runtime_files(nagios_checkdisk_plugin_t) + +fs_read_configfs_files(nagios_checkdisk_plugin_t) +fs_read_configfs_dirs(nagios_checkdisk_plugin_t) +fs_getattr_all_fs(nagios_checkdisk_plugin_t) + +storage_raw_read_fixed_disk(nagios_checkdisk_plugin_t) + +####################################### +# +# Services local policy +# + +allow nagios_services_plugin_t self:capability { setuid net_bind_service net_raw }; +allow nagios_services_plugin_t self:process { signal sigkill }; +allow nagios_services_plugin_t self:tcp_socket create_stream_socket_perms; +allow nagios_services_plugin_t self:udp_socket create_socket_perms; +allow nagios_services_plugin_t self:unix_dgram_socket create_socket_perms; +allow nagios_services_plugin_t self:rawip_socket create_socket_perms; + +corecmd_exec_bin(nagios_services_plugin_t) + +corenet_all_recvfrom_unlabeled(nagios_services_plugin_t) +corenet_all_recvfrom_netlabel(nagios_services_plugin_t) +corenet_tcp_sendrecv_generic_if(nagios_services_plugin_t) +corenet_udp_sendrecv_generic_if(nagios_services_plugin_t) +corenet_tcp_sendrecv_generic_node(nagios_services_plugin_t) +corenet_udp_sendrecv_generic_node(nagios_services_plugin_t) +corenet_udp_bind_generic_node(nagios_services_plugin_t) + +corenet_sendrecv_all_client_packets(nagios_services_plugin_t) +corenet_tcp_connect_all_ports(nagios_services_plugin_t) +corenet_tcp_sendrecv_all_ports(nagios_services_plugin_t) + +corenet_sendrecv_dhcpc_server_packets(nagios_services_plugin_t) +corenet_udp_bind_dhcpc_port(nagios_services_plugin_t) +corenet_udp_sendrecv_dhcpc_port(nagios_services_plugin_t) + +auth_use_nsswitch(nagios_services_plugin_t) + +domain_read_all_domains_state(nagios_services_plugin_t) +logging_send_syslog_msg(nagios_services_plugin_t) + +optional_policy(` + netutils_domtrans_ping(nagios_services_plugin_t) + netutils_signal_ping(nagios_services_plugin_t) + netutils_kill_ping(nagios_services_plugin_t) +') + +optional_policy(` + mysql_stream_connect(nagios_services_plugin_t) + mysql_read_config(nagios_services_plugin_t) +') + +optional_policy(` + postgresql_stream_connect(nagios_services_plugin_t) +') + +optional_policy(` + snmp_read_snmp_var_lib_files(nagios_services_plugin_t) +') + +###################################### +# +# System local policy +# + +allow nagios_system_plugin_t self:capability { dac_read_search }; +dontaudit nagios_system_plugin_t self:capability { setuid setgid }; + +allow nagios_system_plugin_t nrpe_exec_t:file read_file_perms; +allow nagios_system_plugin_t nagios_exec_t:file read_file_perms; + +read_files_pattern(nagios_system_plugin_t, nagios_log_t, nagios_log_t) +read_files_pattern(nagios_system_plugin_t, nagios_spool_t, nagios_spool_t) +manage_files_pattern(nagios_system_plugin_t, nagios_system_plugin_tmp_t, nagios_system_plugin_tmp_t) +manage_dirs_pattern(nagios_system_plugin_t, nagios_system_plugin_tmp_t, nagios_system_plugin_tmp_t) +files_tmp_filetrans(nagios_system_plugin_t, nagios_system_plugin_tmp_t, { dir file }) + +kernel_read_system_state(nagios_system_plugin_t) +kernel_read_kernel_sysctls(nagios_system_plugin_t) + +corecmd_exec_bin(nagios_system_plugin_t) +corecmd_exec_shell(nagios_system_plugin_t) +corecmd_getattr_all_executables(nagios_system_plugin_t) + +dev_read_sysfs(nagios_system_plugin_t) + +domain_read_all_domains_state(nagios_system_plugin_t) + +fs_getattr_all_fs(nagios_system_plugin_t) + +auth_read_passwd(nagios_system_plugin_t) + +optional_policy(` + init_read_utmp(nagios_system_plugin_t) +') + +optional_policy(` + mrtg_read_lib_files(nagios_system_plugin_t) +') + +####################################### +# +# Event local policy +# + +manage_files_pattern(nagios_eventhandler_plugin_t, nagios_eventhandler_plugin_tmp_t, nagios_eventhandler_plugin_tmp_t) +manage_dirs_pattern(nagios_eventhandler_plugin_t, nagios_eventhandler_plugin_tmp_t, nagios_eventhandler_plugin_tmp_t) +files_tmp_filetrans(nagios_eventhandler_plugin_t, nagios_eventhandler_plugin_tmp_t, { dir file }) + +corecmd_exec_bin(nagios_eventhandler_plugin_t) +corecmd_exec_shell(nagios_eventhandler_plugin_t) + +init_domtrans_script(nagios_eventhandler_plugin_t) + +systemd_exec_systemctl(nagios_eventhandler_plugin_t) + +allow nagios_t nagios_eventhandler_plugin_exec_t:dir list_dir_perms; + +optional_policy(` + unconfined_domain(nagios_eventhandler_plugin_t) +') + +######################################## +# +# nagios openshift plugin policy +# + +allow nagios_openshift_plugin_t self:capability sys_ptrace; + +manage_dirs_pattern(nagios_openshift_plugin_t, nagios_openshift_plugin_tmp_t, nagios_openshift_plugin_tmp_t) +manage_files_pattern(nagios_openshift_plugin_t, nagios_openshift_plugin_tmp_t, nagios_openshift_plugin_tmp_t) +files_tmp_filetrans(nagios_openshift_plugin_t, nagios_openshift_plugin_tmp_t, { file dir }) + +corecmd_exec_bin(nagios_openshift_plugin_t) +corecmd_exec_shell(nagios_openshift_plugin_t) + +domain_read_all_domains_state(nagios_openshift_plugin_t) + +fs_getattr_all_fs(nagios_openshift_plugin_t) + +optional_policy(` + apache_read_config(nagios_openshift_plugin_t) +') + +###################################### +# +# nagios plugin domain policy +# + +optional_policy(` + unconfined_domain(nagios_unconfined_plugin_t) +') + +optional_policy(` + systemd_dbus_chat_logind(nagios_unconfined_plugin_t) +') From 1fa79c4c7790e79e0f6a4e49f5869aa58c2d9e94 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Wed, 26 Feb 2020 09:55:22 +0100 Subject: [PATCH 06/52] selinux: set file context for /etc/nrpe.d folder Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1749156 --- nagios.fc | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/nagios.fc b/nagios.fc index c781b72..d66d7b7 100644 --- a/nagios.fc +++ b/nagios.fc @@ -1,7 +1,8 @@ /etc/nagios(/.*)? gen_context(system_u:object_r:nagios_etc_t,s0) /etc/icinga(/.*)? gen_context(system_u:object_r:nagios_etc_t,s0) /etc/nagios/nrpe\.cfg -- gen_context(system_u:object_r:nrpe_etc_t,s0) -/etc/pnp4nagios(/.*)? gen_context(system_u:object_r:nagios_etc_t,s0) +/etc/nrpe\.d(/.*)? gen_context(system_u:object_r:nrpe_etc_t,s0) +/etc/pnp4nagios(/.*)? gen_context(system_u:object_r:nagios_etc_t,s0) /etc/rc\.d/init\.d/nagios -- gen_context(system_u:object_r:nagios_initrc_exec_t,s0) /etc/rc\.d/init\.d/nrpe -- gen_context(system_u:object_r:nagios_initrc_exec_t,s0) From 10ba2039fbb4d899aee947ef410cff43c024e447 Mon Sep 17 00:00:00 2001 From: Martin Jackson Date: Wed, 26 Feb 2020 18:20:05 -0600 Subject: [PATCH 07/52] Update selinux subpackage to fix BZ#1749156 - thanks for the patch vmojzis --- nagios.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nagios.spec b/nagios.spec index f90ab67..cc7f990 100644 --- a/nagios.spec +++ b/nagios.spec @@ -8,7 +8,7 @@ Name: nagios Version: 4.4.5 -Release: 4%{?dist} +Release: 5%{?dist} Summary: Host/service/network monitoring program @@ -478,6 +478,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Thu Feb 27 2020 Martin Jackson - 4.4.5-5 +- Update selinux subpackage to fix BZ#1749156 - thanks for the patch vmojzis + * Wed Feb 26 2020 Vit Mojzis - 4.4.5-4 - Update nagios-selinux based on the DSP guidelines From 4cfb87930ab29f6103ff6516eec3c5e15a6c53a1 Mon Sep 17 00:00:00 2001 From: Martin Jackson Date: Sun, 1 Mar 2020 17:51:09 -0600 Subject: [PATCH 08/52] Remove with_selinux flags after endifs --- nagios.spec | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/nagios.spec b/nagios.spec index cc7f990..8dbf400 100644 --- a/nagios.spec +++ b/nagios.spec @@ -94,7 +94,7 @@ Requires: group(nagios) # This ensures that the *-selinux package and all it’s dependencies are not pulled # into containers and other systems that do not use SELinux Requires: (%{name}-selinux if selinux-policy-%{selinuxtype}) -%endif # if with_selinux +%endif Requires(pre): group(nagios) Requires(pre): user(nagios) @@ -163,7 +163,7 @@ BuildRequires: checkpolicy, selinux-policy-devel %description selinux SElinux security policy for %{name}. -%endif # if with_selinux +%endif %package contrib Summary: Eventhandlers contributed to nagios @@ -177,7 +177,7 @@ Various contributed items used by plugins and other tools. # relabeled after the policy module installation %pre selinux %selinux_relabel_pre -s %{selinuxtype} -%endif # if with_selinux +%endif %prep %setup -q -n nagioscore-nagios-%{version} @@ -260,7 +260,7 @@ cp -p %{SOURCE16} selinux/ make -f %{_datadir}/selinux/devel/Makefile %{name}.pp bzip2 -9 %{name}.pp -%endif # if with_selinux +%endif %install @@ -318,7 +318,7 @@ install -d -m 0755 %{buildroot}%{_datadir}/nagios/html/docs %if 0%{?with_selinux} install -pm 0644 %{SOURCE13} README.SELinux.rst install -D -m 0644 %{name}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2 -%endif # if with_selinux +%endif ### CONTRIB ITEMS TAKEN FROM UPSTREAM NAGIOS SPEC make install -C contrib DESTDIR="%{buildroot}" INSTALL_OPTS="" @@ -413,7 +413,7 @@ if [ $1 -eq 0 ]; then %selinux_relabel_post -s %{selinuxtype} %systemd_postun_with_restart %{name}.service fi -%endif # if with_selinux +%endif %files @@ -469,7 +469,7 @@ fi %doc README.SELinux.rst %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.* %ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name} -%endif # if with_selinux +%endif %files contrib From 2dca4ac09ee484f5b7557b739e46766928bc59b4 Mon Sep 17 00:00:00 2001 From: Martin Jackson Date: Mon, 2 Mar 2020 22:57:33 -0600 Subject: [PATCH 09/52] Apply patch from new PR --- nagios.te | 1 + 1 file changed, 1 insertion(+) diff --git a/nagios.te b/nagios.te index 2d74988..60c9803 100644 --- a/nagios.te +++ b/nagios.te @@ -324,6 +324,7 @@ allow nrpe_t self:tcp_socket { accept listen }; allow nrpe_t nagios_plugin_domain:process { signal sigkill }; +list_dirs_pattern(nrpe_t, nrpe_etc_t, nrpe_etc_t) read_files_pattern(nrpe_t, nagios_etc_t, nrpe_etc_t) manage_files_pattern(nrpe_t, nrpe_var_run_t, nrpe_var_run_t) From b9411f29a2685d3b6fbcd83c1300d2a9eea10697 Mon Sep 17 00:00:00 2001 From: Martin Jackson Date: Mon, 2 Mar 2020 22:58:55 -0600 Subject: [PATCH 10/52] Update specfile --- nagios.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nagios.spec b/nagios.spec index 8dbf400..e055921 100644 --- a/nagios.spec +++ b/nagios.spec @@ -8,7 +8,7 @@ Name: nagios Version: 4.4.5 -Release: 5%{?dist} +Release: 7%{?dist} Summary: Host/service/network monitoring program @@ -478,6 +478,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Mon Mar 2 2020 Martin Jackson - 4.4.5-7 +- Update nrpe_etc_t policy in previous PR + * Thu Feb 27 2020 Martin Jackson - 4.4.5-5 - Update selinux subpackage to fix BZ#1749156 - thanks for the patch vmojzis From 04c906b8216af7216951f8e0d27017a257a1b00f Mon Sep 17 00:00:00 2001 From: Martin Jackson Date: Mon, 2 Mar 2020 23:29:15 -0600 Subject: [PATCH 11/52] Remove parens from selinux requires --- nagios.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nagios.spec b/nagios.spec index e055921..2f15f71 100644 --- a/nagios.spec +++ b/nagios.spec @@ -93,7 +93,7 @@ Requires: group(nagios) %if 0%{?with_selinux} # This ensures that the *-selinux package and all it’s dependencies are not pulled # into containers and other systems that do not use SELinux -Requires: (%{name}-selinux if selinux-policy-%{selinuxtype}) +Requires: %{name}-selinux if selinux-policy-%{selinuxtype} %endif Requires(pre): group(nagios) From 94927f28453b22cef3c54052714eef32db71d15c Mon Sep 17 00:00:00 2001 From: Martin Jackson Date: Tue, 7 Apr 2020 11:14:35 -0500 Subject: [PATCH 12/52] Correct parenthesized deps --- nagios.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nagios.spec b/nagios.spec index 2f15f71..e055921 100644 --- a/nagios.spec +++ b/nagios.spec @@ -93,7 +93,7 @@ Requires: group(nagios) %if 0%{?with_selinux} # This ensures that the *-selinux package and all it’s dependencies are not pulled # into containers and other systems that do not use SELinux -Requires: %{name}-selinux if selinux-policy-%{selinuxtype} +Requires: (%{name}-selinux if selinux-policy-%{selinuxtype}) %endif Requires(pre): group(nagios) From d01ca16f6da4bf7b471ae7af83eea4f88bc0caf7 Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Tue, 23 Jun 2020 11:07:22 +0200 Subject: [PATCH 13/52] Perl 5.32 rebuild --- nagios.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nagios.spec b/nagios.spec index e055921..63a0da5 100644 --- a/nagios.spec +++ b/nagios.spec @@ -8,7 +8,7 @@ Name: nagios Version: 4.4.5 -Release: 7%{?dist} +Release: 8%{?dist} Summary: Host/service/network monitoring program @@ -478,6 +478,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Tue Jun 23 2020 Jitka Plesnikova - 4.4.5-8 +- Perl 5.32 rebuild + * Mon Mar 2 2020 Martin Jackson - 4.4.5-7 - Update nrpe_etc_t policy in previous PR From 3354790fe08fa24da6cc45498723f2dbe9b0fb8e Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 28 Jul 2020 08:49:55 +0000 Subject: [PATCH 14/52] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- nagios.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nagios.spec b/nagios.spec index 63a0da5..fd39a0c 100644 --- a/nagios.spec +++ b/nagios.spec @@ -8,7 +8,7 @@ Name: nagios Version: 4.4.5 -Release: 8%{?dist} +Release: 9%{?dist} Summary: Host/service/network monitoring program @@ -478,6 +478,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Tue Jul 28 2020 Fedora Release Engineering - 4.4.5-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Tue Jun 23 2020 Jitka Plesnikova - 4.4.5-8 - Perl 5.32 rebuild From 2ebf19920b967e08e46637f564b3a91b496734ae Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Thu, 7 Jan 2021 02:14:03 +0000 Subject: [PATCH 15/52] Add BuildRequires: make https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot --- nagios.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/nagios.spec b/nagios.spec index fd39a0c..dc7da35 100644 --- a/nagios.spec +++ b/nagios.spec @@ -53,6 +53,7 @@ Patch12: nagios-0012-fix-spool.patch Patch13: nagios-0013-fix-plugin.patch Patch14: nagios-0014-fix-uidgid.patch +BuildRequires: make BuildRequires: doxygen BuildRequires: gcc BuildRequires: gd-devel > 1.8 From bb2160d49509e5a3d5d600fe73ae7b0f55960218 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 26 Jan 2021 21:12:37 +0000 Subject: [PATCH 16/52] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- nagios.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nagios.spec b/nagios.spec index dc7da35..a61d9e9 100644 --- a/nagios.spec +++ b/nagios.spec @@ -8,7 +8,7 @@ Name: nagios Version: 4.4.5 -Release: 9%{?dist} +Release: 10%{?dist} Summary: Host/service/network monitoring program @@ -479,6 +479,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Tue Jan 26 2021 Fedora Release Engineering - 4.4.5-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Tue Jul 28 2020 Fedora Release Engineering - 4.4.5-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild From 61e247242cb59e31f60d6070de1ea7d2d2ff1304 Mon Sep 17 00:00:00 2001 From: Guido Aulisi Date: Sat, 20 Feb 2021 23:50:47 +0100 Subject: [PATCH 17/52] Update to 4.4.6 Fix for CVE-2020-13977 #BZ1849087 Some spec cleanup --- .gitignore | 1 + nagios-0003-Install-config-files-too.patch | 9 ++-- nagios-0009-fix-localstatedir-for-linux.patch | 2 +- nagios-0011-remove-rpmbuild.patch | 35 ++++++++---- nagios-0015-Changelog.patch | 13 +++++ nagios.spec | 53 +++++++------------ sources | 2 +- 7 files changed, 66 insertions(+), 49 deletions(-) create mode 100644 nagios-0015-Changelog.patch diff --git a/.gitignore b/.gitignore index a1b2d77..3ac2d64 100644 --- a/.gitignore +++ b/.gitignore @@ -16,3 +16,4 @@ nagios-3.2.1.tar.gz /nagioscore-nagios-4.4.2.tar.gz /nagioscore-nagios-4.4.3.tar.gz /nagioscore-nagios-4.4.5.tar.gz +/nagioscore-nagios-4.4.6.tar.gz diff --git a/nagios-0003-Install-config-files-too.patch b/nagios-0003-Install-config-files-too.patch index 4bf4aa2..3194a02 100644 --- a/nagios-0003-Install-config-files-too.patch +++ b/nagios-0003-Install-config-files-too.patch @@ -1,7 +1,8 @@ -diff -up ./Makefile.in.install_config ./Makefile.in ---- ./Makefile.in.install_config 2017-04-19 19:11:47.783707415 -0400 -+++ ./Makefile.in 2017-04-19 19:11:47.785707384 -0400 -@@ -377,7 +377,7 @@ dox: +diff --git a/Makefile.in b/Makefile.in +index b992ab1e..ef2a797f 100644 +--- a/Makefile.in ++++ b/Makefile.in +@@ -439,7 +439,7 @@ dox: doxygen doxy.conf diff --git a/nagios-0009-fix-localstatedir-for-linux.patch b/nagios-0009-fix-localstatedir-for-linux.patch index 3c18043..070285f 100644 --- a/nagios-0009-fix-localstatedir-for-linux.patch +++ b/nagios-0009-fix-localstatedir-for-linux.patch @@ -264,9 +264,9 @@ diff -up ./startup/default-service.in.fix_localstatedir ./startup/default-servic ExecStop=@BIN_KILL@ -s TERM ${MAINPID} -ExecStopPost=@BIN_RM@ -f @localstatedir@/rw/nagios.cmd +ExecStopPost=@BIN_RM@ -f @localstatedir@/spool/nagios/cmd/nagios.cmd + ExecReload=@bindir@/nagios -v @sysconfdir@/nagios.cfg ExecReload=@BIN_KILL@ -s HUP ${MAINPID} - [Install] diff -up ./t-tap/Makefile.in.fix_localstatedir ./t-tap/Makefile.in --- ./t-tap/Makefile.in.fix_localstatedir 2019-01-16 14:24:14.944312569 -0600 +++ ./t-tap/Makefile.in 2019-01-16 14:24:42.359858604 -0600 diff --git a/nagios-0011-remove-rpmbuild.patch b/nagios-0011-remove-rpmbuild.patch index 88e0049..401cad0 100644 --- a/nagios-0011-remove-rpmbuild.patch +++ b/nagios-0011-remove-rpmbuild.patch @@ -1,12 +1,14 @@ -diff -up ./contrib/Makefile.in.remove_rpmbuild ./contrib/Makefile.in ---- ./contrib/Makefile.in.remove_rpmbuild 2019-08-29 18:23:14.113160181 +0000 -+++ ./contrib/Makefile.in 2019-08-29 18:24:20.509445391 +0000 -@@ -85,36 +85,3 @@ $(CGI_O): $(CGI_C) +diff --git a/contrib/Makefile.in b/contrib/Makefile.in +index 72e4d4a9..62415152 100644 +--- a/contrib/Makefile.in ++++ b/contrib/Makefile.in +@@ -84,52 +84,3 @@ $(CGI_O): $(CGI_C) + %.cgi : %.c $(CC) $(CFLAGS) $(LDFLAGS) $< $(CGI_O) -o $@ - +- -############################################################################## --# rpm making automation for CentOS/RHEL. +-# making similiar EPEL rpm for Fedora/RHEL/CentOS - -ifneq ("$(wildcard /etc/redhat-release)","") - @@ -25,16 +27,31 @@ diff -up ./contrib/Makefile.in.remove_rpmbuild ./contrib/Makefile.in - endif -endif - --rpm: +-# Create our own tarball and put ino rpmbuild/SOURCES +-localsrc-rpm: - # create nagios tar ball. - @(cd ..;rm -f nagios-@VERSION@) - @(cd ..;ln -s . nagios-@VERSION@) - @(cd ..;tar zhcf nagios-@VERSION@.tar.gz --exclude nagios-@VERSION@/nagios-@VERSION@.tar.gz --exclude nagios-@VERSION@/nagios-@VERSION@ --exclude RCS --exclude CVS --exclude build-* --exclude *~ --exclude .git* nagios-@VERSION@/) - @(cd ..;rm -f nagios-@VERSION@) - # build the rpm using rpmbuild from ./rmbuild as topdir -- @rm -rf rpmbuild && mkdir -p rpmbuild/SOURCES +- @rm -rf rpmbuild && mkdir -p ./rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS} - @cp ../nagios-@VERSION@.tar.gz rpmbuild/SOURCES/nagios-@VERSION@.tar.gz -- @rpmbuild -ba --define "_topdir ${PWD}/rpmbuild" ../nagios.spec +- @cp epel-patches/* ./rpmbuild/SOURCES +- @rpmbuild -ba --define "_topdir ${PWD}/rpmbuild" epel-nagios.spec +- @cp rpmbuild/RPMS/$(RPM_ARCH)/*.rpm . +- @cp rpmbuild/SRPMS/*.src.rpm . +- @ls -l *.rpm +- +-# tarball from https://github.com/NagiosEnterprises/nagioscore/releases/download/nagios-%{version}/nagios-%{version}.tar.gz +-rpm: init-epelrpm build-epelrpm - @mv rpmbuild/RPMS/$(RPM_ARCH)/*.rpm . - @ls -l *.rpm +-init-epelrpm: +- # build the rpm using rpmbuild from ./rmbuild as topdir +- @rm -rf ./rpmbuild && mkdir -p ./rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS} +- @spectool -C ./rpmbuild/SOURCES -g epel-nagios.spec +- @cp epel-patches/* ./rpmbuild/SOURCES +-build-epelrpm: +- @rpmbuild -ba --define "_topdir ${PWD}/rpmbuild" epel-nagios.spec -endif diff --git a/nagios-0015-Changelog.patch b/nagios-0015-Changelog.patch new file mode 100644 index 0000000..5ef3490 --- /dev/null +++ b/nagios-0015-Changelog.patch @@ -0,0 +1,13 @@ +diff --git a/Changelog b/Changelog +index a5fd04c6..51394645 100644 +--- a/Changelog ++++ b/Changelog +@@ -9,7 +9,7 @@ FIXES + * Fixed duplicate properties appearing in statusjson.cgi (#718) (Sebastian Wolf) + * Fixed NERD not building when enabled in ./configure (#723) (Sebastian Wolf) + * Fixed build process when using GCC 10 (#721) (Michael Orlitzky) +-* Fixed postauth vulnerabilities in histogram.js, map.js, trends.js (CVE-2020-1408) (Thanks UraSec Team) (Sebastian Wolf) ++* Fixed postauth vulnerabilities in histogram.js, map.js, trends.js (CVE-2020-13977) (Thanks UraSec Team) (Sebastian Wolf) + * When using systemd, configuration will be verified before reloading (#715) (tatref) + * Fixed HARD OK states triggering on the maximum check attempt (#757) (Sebastian Wolf) + diff --git a/nagios.spec b/nagios.spec index a61d9e9..e85f9b2 100644 --- a/nagios.spec +++ b/nagios.spec @@ -1,14 +1,9 @@ -%global _hardened_build 1 %global with_selinux 1 %global selinuxtype targeted -# https://gcc.gnu.org/gcc-10/porting_to.html#common -# attempt to fix bugzilla 1793909 -%define _legacy_common_support 1 - Name: nagios -Version: 4.4.5 -Release: 10%{?dist} +Version: 4.4.6 +Release: 1%{?dist} Summary: Host/service/network monitoring program @@ -52,8 +47,9 @@ Patch11: nagios-0011-remove-rpmbuild.patch Patch12: nagios-0012-fix-spool.patch Patch13: nagios-0013-fix-plugin.patch Patch14: nagios-0014-fix-uidgid.patch +Patch15: %{name}-0015-Changelog.patch -BuildRequires: make +BuildRequires: make BuildRequires: doxygen BuildRequires: gcc BuildRequires: gd-devel > 1.8 @@ -181,23 +177,7 @@ Various contributed items used by plugins and other tools. %endif %prep -%setup -q -n nagioscore-nagios-%{version} - -# patch0 would go here -%patch1 -p1 -b .fix_el6_init -%patch2 -p1 -b .fix_httpd_conf_d -%patch3 -p0 -b .install_config -%patch4 -p1 -b .fix_path_to_cgi -%patch5 -p1 -b .fix_path_to_passwd -%patch6 -p1 -b .more_images - -#%patch8 -p1 -b .conf_d -%patch9 -p1 -b .fix_localstatedir -%patch10 -p1 -b .remove_3rdparty_links -%patch11 -p1 -b .remove_rpmbuild -%patch12 -p1 -b .fix_spool -%patch13 -p1 -b .fix_plugin -%patch14 -p1 -b .fix_uidgid +%autosetup -p1 -n nagioscore-nagios-%{version} install -p -m 0644 %{SOURCE10} %{SOURCE11} %{SOURCE12} html/images/logos/ @@ -236,13 +216,14 @@ install -p -m 0644 %{SOURCE10} %{SOURCE11} %{SOURCE12} html/images/logos/ --with-template-extinfo \ --enable-event-broker \ STRIP=/bin/true -make %{?_smp_mflags} all + +%make_build all ### Build our documentation -%{__make} dox +%make_build dox ### Apparently contrib does not obey configure ! -%{__make} %{?_smp_mflags} -C contrib +%make_build -C contrib sed -e "s|/usr/lib/|%{_libdir}/|" %{SOURCE2} > %{name}.htaccess @@ -259,15 +240,13 @@ cp -p %{SOURCE14} selinux/ cp -p %{SOURCE15} selinux/ cp -p %{SOURCE16} selinux/ -make -f %{_datadir}/selinux/devel/Makefile %{name}.pp +%make_build -f %{_datadir}/selinux/devel/Makefile %{name}.pp bzip2 -9 %{name}.pp %endif %install -rm -rf $RPM_BUILD_ROOT - -make DESTDIR=%{buildroot} INIT_OPTS="" INSTALL_OPTS="" COMMAND_OPTS="" CGIDIR="%{_libdir}/%{name}/cgi-bin" CFGDIR="%{_sysconfdir}/%{name}" fullinstall +%make_install INIT_OPTS="" INSTALL_OPTS="" COMMAND_OPTS="" CGIDIR="%{_libdir}/%{name}/cgi-bin" CFGDIR="%{_sysconfdir}/%{name}" fullinstall # relocated to sbin (Fedora-specific) install -d -m 0755 %{buildroot}%{_bindir} @@ -322,7 +301,7 @@ install -D -m 0644 %{name}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{sel %endif ### CONTRIB ITEMS TAKEN FROM UPSTREAM NAGIOS SPEC -make install -C contrib DESTDIR="%{buildroot}" INSTALL_OPTS="" +%make_install -C contrib INSTALL_OPTS="" install -p -m 644 contrib/eventhandlers/disable_active_service_checks %{buildroot}%{_libdir}/nagios/plugins/eventhandlers/ install -p -m 644 contrib/eventhandlers/disable_notifications %{buildroot}%{_libdir}/nagios/plugins/eventhandlers/ install -p -m 644 contrib/eventhandlers/enable_active_service_checks %{buildroot}%{_libdir}/nagios/plugins/eventhandlers/ @@ -422,8 +401,9 @@ fi %dir %{_datadir}/%{name} %dir %{_datadir}/%{name}/html %doc %{_datadir}/%{name}/html/docs -%doc Changelog INSTALLING LICENSE README.md UPGRADING UpgradeToVersion4.ReadMe UpgradeToVersion4.sh +%doc Changelog INSTALLING README.md UPGRADING UpgradeToVersion4.ReadMe UpgradeToVersion4.sh %doc internet.cfg +%license LICENSE %{_datadir}/%{name}/html/[^cd]* %{_datadir}/%{name}/html/contexthelp/ %{_datadir}/%{name}/html/d3/ @@ -479,6 +459,11 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Sat Feb 20 2021 Guido Aulisi - 4.4.6-1 +- Update to 4.4.6 +- Fix for CVE-2020-13977 #BZ1849087 +- Some spec cleanup + * Tue Jan 26 2021 Fedora Release Engineering - 4.4.5-10 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild diff --git a/sources b/sources index fa4ac42..8d9f3c3 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (nagioscore-nagios-4.4.5.tar.gz) = b2b4213dc9087c49a96506f514ec672476763e1ca928bf5de8494a0509b612a4a357989e719820328095489138375c9db292ac3c8129925c323220860e17bc49 +SHA512 (nagioscore-nagios-4.4.6.tar.gz) = db3a205f1675693301c059b0ecdc767cdc423923cff0729c5584a48e04fb18d6c119d51991dd24290a539eb8578b2cb82316275039b36827871bb028883b495f From c8c4e234959449514c8c4cdd128cce4e2f4ded4f Mon Sep 17 00:00:00 2001 From: Guido Aulisi Date: Tue, 23 Feb 2021 21:01:12 +0100 Subject: [PATCH 18/52] Fix systemd unit file permissions #1676334 --- nagios.spec | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/nagios.spec b/nagios.spec index e85f9b2..a0a14e1 100644 --- a/nagios.spec +++ b/nagios.spec @@ -3,7 +3,7 @@ Name: nagios Version: 4.4.6 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Host/service/network monitoring program @@ -286,6 +286,9 @@ install -D -m 0644 -p %{SOURCE8} %{buildroot}%{_tmpfilesdir}/%{name}.conf # Remove SystemV init-script rm -f %{buildroot}%{_initrddir}/nagios + +# Fix systemd unit file permissions #1676334 +chmod -x %{buildroot}%{_unitdir}/%{name}.service %endif # Fix permissions - FIXME remove this when unneeded @@ -459,6 +462,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Tue Feb 23 2021 Guido Aulisi - 4.4.6-2 +- Fix systemd unit file permissions #1676334 + * Sat Feb 20 2021 Guido Aulisi - 4.4.6-1 - Update to 4.4.6 - Fix for CVE-2020-13977 #BZ1849087 From 294e23595ac0212c1e259f648d98818876fc923e Mon Sep 17 00:00:00 2001 From: Guido Aulisi Date: Sat, 27 Feb 2021 18:54:56 +0100 Subject: [PATCH 19/52] Require plugins needed for localhost monitoring (#1932297) Remove mistakenly readded patch for conf.d --- nagios.spec | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/nagios.spec b/nagios.spec index a0a14e1..97f13b4 100644 --- a/nagios.spec +++ b/nagios.spec @@ -1,9 +1,12 @@ +# Set bootstrap = 1 to build without depending on plugins for localhost monitoring +%global bootstrap 0 + %global with_selinux 1 %global selinuxtype targeted Name: nagios Version: 4.4.6 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Host/service/network monitoring program @@ -26,9 +29,6 @@ Source14: nagios.te Source15: nagios.fc Source16: nagios.if -# Patch 0 should be a patch that we get from the maint git tree in -# order to fix any items upstream wanted. -#Patch0: nagios-0000-git201706.patch Patch1: nagios-0001-default-init.patch # Sent upstream Patch2: nagios-0002-Fix-installation-of-httpd-conf.d-config-file.patch @@ -36,8 +36,6 @@ Patch3: nagios-0003-Install-config-files-too.patch Patch4: nagios-0004-Fix-path-to-CGI-executables.patch Patch5: nagios-0005-Fixed-path-to-passwd-file-in-Apache-s-config-file.patch Patch6: nagios-0006-Added-several-images-to-the-sample-config-revb.patch -#Patch7: nagios-0007-Apache-2.4-configuration-fix-for-Fedora-18.patch -Patch8: nagios-0008-Add-cfg_dir-etc-nagios-conf.d-to-the-main-nagios-con.patch Patch9: nagios-0009-fix-localstatedir-for-linux.patch ## This has been requested for security groups not wanting to leak ## their nagios location. @@ -87,6 +85,17 @@ Requires: nagios-common Requires: user(nagios) Requires: group(nagios) +# This plugins are required for localhost monitoring +%if ! 0%{?bootstrap} +Requires: nagios-plugins-load +Requires: nagios-plugins-users +Requires: nagios-plugins-http +Requires: nagios-plugins-disk +Requires: nagios-plugins-ssh +Requires: nagios-plugins-swap +Requires: nagios-plugins-procs +%endif + %if 0%{?with_selinux} # This ensures that the *-selinux package and all it’s dependencies are not pulled # into containers and other systems that do not use SELinux @@ -462,6 +471,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Sat Feb 27 2021 Guido Aulisi - 4.4.6-3 +- Require plugins needed for localhost monitoring (#1932297) + * Tue Feb 23 2021 Guido Aulisi - 4.4.6-2 - Fix systemd unit file permissions #1676334 From c5207d1ef278696b82667159d000889c225aa01d Mon Sep 17 00:00:00 2001 From: Guido Aulisi Date: Sun, 28 Feb 2021 11:13:59 +0100 Subject: [PATCH 20/52] Add missing require for nagios-plugins-ping --- nagios.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/nagios.spec b/nagios.spec index 97f13b4..000165a 100644 --- a/nagios.spec +++ b/nagios.spec @@ -87,6 +87,7 @@ Requires: group(nagios) # This plugins are required for localhost monitoring %if ! 0%{?bootstrap} +Requires: nagios-plugins-ping Requires: nagios-plugins-load Requires: nagios-plugins-users Requires: nagios-plugins-http From 8fcbae50dd4be881bcbb416a9b81083da1aa77a9 Mon Sep 17 00:00:00 2001 From: Guido Aulisi Date: Sun, 28 Feb 2021 11:14:49 +0100 Subject: [PATCH 21/52] Fix run path --- nagios.tmpfiles.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nagios.tmpfiles.conf b/nagios.tmpfiles.conf index 907ca68..4bb5bc3 100644 --- a/nagios.tmpfiles.conf +++ b/nagios.tmpfiles.conf @@ -1 +1 @@ -D /var/run/nagios 0755 nagios nagios - +D /run/nagios 0755 nagios nagios - From 212673ea1e7cb685f28bf8aa8e1f76d5e4f5c4f6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 2 Mar 2021 16:13:25 +0100 Subject: [PATCH 22/52] Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. --- nagios.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/nagios.spec b/nagios.spec index 000165a..bdd068b 100644 --- a/nagios.spec +++ b/nagios.spec @@ -6,7 +6,7 @@ Name: nagios Version: 4.4.6 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Host/service/network monitoring program @@ -472,6 +472,10 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 4.4.6-4 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + * Sat Feb 27 2021 Guido Aulisi - 4.4.6-3 - Require plugins needed for localhost monitoring (#1932297) From 198c2b0aebb9fff8bf46116ca5d2027e66686499 Mon Sep 17 00:00:00 2001 From: Nikola Knazekova Date: Tue, 16 Mar 2021 15:22:36 +0100 Subject: [PATCH 23/52] Remove circular dependency Remove 'Requires: %{name} = %{version}-%{release}' from SELinux subpackage. Nagios-SELinux can be required by other packages without base Nagios package. This can happen, when other policy modules are using interfaces defined in Nagios SELinux policy. --- nagios.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/nagios.spec b/nagios.spec index bdd068b..6f974d2 100644 --- a/nagios.spec +++ b/nagios.spec @@ -161,7 +161,6 @@ may compile against. # SELinux subpackage %package selinux Summary: SELinux context for %{name} -Requires: %{name} = %{version}-%{release} BuildArch: noarch Requires: selinux-policy-%{selinuxtype} Requires(post): selinux-policy-%{selinuxtype} From 5a42318ffb55ed303666e161347ec03323ecb3de Mon Sep 17 00:00:00 2001 From: nknazeko Date: Tue, 12 May 2020 10:10:56 +0200 Subject: [PATCH 24/52] ifndef sssd_signull block Add interface sssd_signull from sssd policy module into an ifndef block because it is not present in epel distribution policy. --- nagios.if | 31 +++++++++++++++++++++++++++++++ nagios.te | 1 - 2 files changed, 31 insertions(+), 1 deletion(-) diff --git a/nagios.if b/nagios.if index d012e9b..13a034d 100644 --- a/nagios.if +++ b/nagios.if @@ -334,3 +334,34 @@ interface(`nagios_unconfined_signull',` allow $1 nagios_unconfined_plugin_t:process signull; ') + +######################################## +# +# Nagios interface compatibility blocks +# +# The following definitions ensure compatibility with distribution policy +# versions that do not contain given interfaces (epel, or older Fedora +# releases). +# Each block tests for existence of given interface and defines it if needed. +# + +######################################## +## +## Allow caller to signull sssd. +## Backport from RHEL8 +## +## +## +## Domain allowed access. +## +## +# +ifndef(`sssd_signull',` + interface(`sssd_signull',` + gen_require(` + type sssd_t; + ') + + allow $1 sssd_t:process signull; + ') +') diff --git a/nagios.te b/nagios.te index 60c9803..46fcf5f 100644 --- a/nagios.te +++ b/nagios.te @@ -390,7 +390,6 @@ tunable_policy(`nagios_run_sudo',` systemd_write_inherited_logind_sessions_pipes(nrpe_t) systemd_dbus_chat_logind(nrpe_t) - systemd_logind_read_state(nrpe_t) logging_send_audit_msgs(nrpe_t) ') From 80f8acdcd966c1e0e05fa94a147b377cc3089ac7 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Wed, 21 Oct 2020 13:31:15 +0200 Subject: [PATCH 25/52] tests: Add decentralized SELinux policy test - Test for unsound/dangerous SELinux policy practices - Perform static policy code check using SELint For more details and debugging tips see https://fedoraproject.org/wiki/SELinux/IndependentPolicy#Testing --- tests/tests-DSP.yml | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 tests/tests-DSP.yml diff --git a/tests/tests-DSP.yml b/tests/tests-DSP.yml new file mode 100644 index 0000000..dd978d0 --- /dev/null +++ b/tests/tests-DSP.yml @@ -0,0 +1,41 @@ +- hosts: localhost + + roles: + - role: standard-test-beakerlib + tags: + - classic + repositories: + - repo: https://pagure.io/DSP_test.git + dest: DSP_test + version: master + + tests: + - DSP_test + environment: + # RPM package containing the policy module + TEST_RPM: nagios-selinux + # policy module name + TEST_POLICY: nagios + # policy sources will be extracted from corresponding .src.rpm + # policy tar filename regexp (e.g. "usbguard-selinux*.tar.gz") + # or empty string if policy sources are not inside a tar archive + POLICY_TAR: '' + # path to policy sources (in of the tar archive) -- //.(te|if|fc) + # or path in the src.rpm if there is no tar archive -- //.(te|if|fc) + # can contain wildcards (e.g. for versions etc.) + POLICY_PATH: . + # allow rules ignored by "Unsound/dangerous policy practices" test + IGNORE_RULES: >- + nagios_script_t:system_map_t:file + nagios_script_t:boot_t:dir + + required_packages: + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - libselinux-utils + - rpm + - tar + - git + - nagios-selinux From 78ac89991b60ea403da9df6d20d713f433be5b1b Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Wed, 21 Oct 2020 13:32:01 +0200 Subject: [PATCH 26/52] selinux: Fix issues reported by SELint - sort permissions alphabetically --- nagios.te | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/nagios.te b/nagios.te index 46fcf5f..b86a8dd 100644 --- a/nagios.te +++ b/nagios.te @@ -94,7 +94,7 @@ files_pid_file(nrpe_var_run_t) allow nagios_plugin_domain self:fifo_file rw_fifo_file_perms; -allow nrpe_t nagios_plugin_domain:process { signal sigkill }; +allow nrpe_t nagios_plugin_domain:process { sigkill signal }; allow nagios_t nagios_plugin_domain:process signal_perms; allow nagios_plugin_domain nagios_t:process signal_perms; @@ -127,7 +127,7 @@ allow nagios_t nagios_plugin_domain:process signal_perms; allow nagios_t nagios_eventhandler_plugin_exec_t:dir list_dir_perms; allow nagios_t nagios_etc_t:dir list_dir_perms; -allow nagios_t nagios_etc_t:file { read_file_perms map }; +allow nagios_t nagios_etc_t:file { map read_file_perms }; allow nagios_t nagios_etc_t:lnk_file read_lnk_file_perms; #allow nagios_t nagios_log_t:dir setattr_dir_perms; @@ -206,7 +206,7 @@ mta_kill_system_mail(nagios_t) systemd_exec_systemctl(nagios_t) tunable_policy(`nagios_run_sudo',` - allow nagios_t self:capability { chown setuid setgid sys_resource sys_ptrace }; + allow nagios_t self:capability { chown setgid setuid sys_ptrace sys_resource }; allow nagios_t self:process { setrlimit setsched }; allow nagios_t self:key write; @@ -316,13 +316,13 @@ optional_policy(` # Nrpe local policy # -allow nrpe_t self:capability { setuid setgid kill }; -dontaudit nrpe_t self:capability { sys_tty_config sys_resource }; -allow nrpe_t self:process { setpgid signal_perms setsched setrlimit }; +allow nrpe_t self:capability { kill setgid setuid }; +dontaudit nrpe_t self:capability { sys_resource sys_tty_config }; +allow nrpe_t self:process { setpgid setrlimit setsched signal_perms }; allow nrpe_t self:fifo_file rw_fifo_file_perms; allow nrpe_t self:tcp_socket { accept listen }; -allow nrpe_t nagios_plugin_domain:process { signal sigkill }; +allow nrpe_t nagios_plugin_domain:process { sigkill signal }; list_dirs_pattern(nrpe_t, nrpe_etc_t, nrpe_etc_t) read_files_pattern(nrpe_t, nagios_etc_t, nrpe_etc_t) @@ -372,7 +372,7 @@ logging_send_syslog_msg(nrpe_t) userdom_dontaudit_use_unpriv_user_fds(nrpe_t) tunable_policy(`nagios_run_sudo',` - allow nrpe_t self:capability { setuid setgid sys_resource sys_ptrace }; + allow nrpe_t self:capability { setgid setuid sys_ptrace sys_resource }; allow nrpe_t self:process { setrlimit setsched }; allow nrpe_t self:key write; @@ -467,7 +467,7 @@ files_getattr_all_file_type_fs(nagios_admin_plugin_t) # Mail local policy # -allow nagios_mail_plugin_t self:capability { setuid setgid dac_read_search }; +allow nagios_mail_plugin_t self:capability { dac_read_search setgid setuid }; allow nagios_mail_plugin_t self:netlink_route_socket r_netlink_socket_perms; allow nagios_mail_plugin_t self:tcp_socket create_stream_socket_perms; allow nagios_mail_plugin_t self:udp_socket create_socket_perms; @@ -520,8 +520,8 @@ storage_raw_read_fixed_disk(nagios_checkdisk_plugin_t) # Services local policy # -allow nagios_services_plugin_t self:capability { setuid net_bind_service net_raw }; -allow nagios_services_plugin_t self:process { signal sigkill }; +allow nagios_services_plugin_t self:capability { net_bind_service net_raw setuid }; +allow nagios_services_plugin_t self:process { sigkill signal }; allow nagios_services_plugin_t self:tcp_socket create_stream_socket_perms; allow nagios_services_plugin_t self:udp_socket create_socket_perms; allow nagios_services_plugin_t self:unix_dgram_socket create_socket_perms; @@ -575,7 +575,7 @@ optional_policy(` # allow nagios_system_plugin_t self:capability { dac_read_search }; -dontaudit nagios_system_plugin_t self:capability { setuid setgid }; +dontaudit nagios_system_plugin_t self:capability { setgid setuid }; allow nagios_system_plugin_t nrpe_exec_t:file read_file_perms; allow nagios_system_plugin_t nagios_exec_t:file read_file_perms; From e5f28a1e6d9cc121120fd7205bc7e4371cfff823 Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Fri, 21 May 2021 21:55:14 +0200 Subject: [PATCH 27/52] Perl 5.34 rebuild --- nagios.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nagios.spec b/nagios.spec index 6f974d2..b54c000 100644 --- a/nagios.spec +++ b/nagios.spec @@ -6,7 +6,7 @@ Name: nagios Version: 4.4.6 -Release: 4%{?dist} +Release: 5%{?dist} Summary: Host/service/network monitoring program @@ -471,6 +471,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Fri May 21 2021 Jitka Plesnikova - 4.4.6-5 +- Perl 5.34 rebuild + * Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 4.4.6-4 - Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. From 53d79d5a3e5bcaff793b3336fc76752776196623 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 22 Jul 2021 15:48:04 +0000 Subject: [PATCH 28/52] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- nagios.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nagios.spec b/nagios.spec index b54c000..7357e8f 100644 --- a/nagios.spec +++ b/nagios.spec @@ -6,7 +6,7 @@ Name: nagios Version: 4.4.6 -Release: 5%{?dist} +Release: 6%{?dist} Summary: Host/service/network monitoring program @@ -471,6 +471,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Thu Jul 22 2021 Fedora Release Engineering - 4.4.6-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Fri May 21 2021 Jitka Plesnikova - 4.4.6-5 - Perl 5.34 rebuild From 57ae9b0776dc019902b3e884207a503281e13074 Mon Sep 17 00:00:00 2001 From: Guido Aulisi Date: Tue, 4 Jan 2022 12:08:22 +0100 Subject: [PATCH 29/52] Require a generic mail program (#2036844) --- nagios.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/nagios.spec b/nagios.spec index 7357e8f..1ae7b2d 100644 --- a/nagios.spec +++ b/nagios.spec @@ -6,7 +6,7 @@ Name: nagios Version: 4.4.6 -Release: 6%{?dist} +Release: 7%{?dist} Summary: Host/service/network monitoring program @@ -80,7 +80,7 @@ BuildRequires: systemd Requires: httpd Requires: php Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) -Requires: mailx +Requires: %{_bindir}/mail Requires: nagios-common Requires: user(nagios) Requires: group(nagios) @@ -471,6 +471,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Tue Jan 04 2022 Guido Aulisi - 4.4.6-7 +- Require a generic mail program (#2036844) + * Thu Jul 22 2021 Fedora Release Engineering - 4.4.6-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild From a120f1b7334c9e414ada9a2e0a700a9421b1758e Mon Sep 17 00:00:00 2001 From: Guido Aulisi Date: Tue, 4 Jan 2022 12:25:57 +0100 Subject: [PATCH 30/52] Bootstrap package correctly --- nagios.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/nagios.spec b/nagios.spec index 1ae7b2d..c9eb084 100644 --- a/nagios.spec +++ b/nagios.spec @@ -1,5 +1,5 @@ -# Set bootstrap = 1 to build without depending on plugins for localhost monitoring -%global bootstrap 0 +# Set %%bcond_without bootstrap to build without depending on plugins for localhost monitoring +%bcond_with bootstrap %global with_selinux 1 %global selinuxtype targeted @@ -86,7 +86,7 @@ Requires: user(nagios) Requires: group(nagios) # This plugins are required for localhost monitoring -%if ! 0%{?bootstrap} +%if %{without bootstrap} Requires: nagios-plugins-ping Requires: nagios-plugins-load Requires: nagios-plugins-users From ec9b36653d0f698ee7048109dcd577e1fe8f87c9 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jan 2022 20:51:03 +0000 Subject: [PATCH 31/52] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- nagios.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nagios.spec b/nagios.spec index c9eb084..9933bd6 100644 --- a/nagios.spec +++ b/nagios.spec @@ -6,7 +6,7 @@ Name: nagios Version: 4.4.6 -Release: 7%{?dist} +Release: 8%{?dist} Summary: Host/service/network monitoring program @@ -471,6 +471,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Thu Jan 20 2022 Fedora Release Engineering - 4.4.6-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Tue Jan 04 2022 Guido Aulisi - 4.4.6-7 - Require a generic mail program (#2036844) From d8c8d224c6999f1d680dfc344885e1e268dfa694 Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Wed, 1 Jun 2022 10:34:01 +0200 Subject: [PATCH 32/52] Perl 5.36 rebuild --- nagios.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nagios.spec b/nagios.spec index 9933bd6..d06ecf3 100644 --- a/nagios.spec +++ b/nagios.spec @@ -6,7 +6,7 @@ Name: nagios Version: 4.4.6 -Release: 8%{?dist} +Release: 9%{?dist} Summary: Host/service/network monitoring program @@ -471,6 +471,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Wed Jun 01 2022 Jitka Plesnikova - 4.4.6-9 +- Perl 5.36 rebuild + * Thu Jan 20 2022 Fedora Release Engineering - 4.4.6-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From 0ca22398d8ca2981ece3339b925db45d17b21bd0 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 22 Jul 2022 00:11:38 +0000 Subject: [PATCH 33/52] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- nagios.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nagios.spec b/nagios.spec index d06ecf3..e87ef6b 100644 --- a/nagios.spec +++ b/nagios.spec @@ -6,7 +6,7 @@ Name: nagios Version: 4.4.6 -Release: 9%{?dist} +Release: 10%{?dist} Summary: Host/service/network monitoring program @@ -471,6 +471,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Fri Jul 22 2022 Fedora Release Engineering - 4.4.6-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Wed Jun 01 2022 Jitka Plesnikova - 4.4.6-9 - Perl 5.36 rebuild From db9c91f4b27424a0d793379389654e01efe4f4c0 Mon Sep 17 00:00:00 2001 From: Guido Aulisi Date: Sun, 25 Sep 2022 12:28:07 +0200 Subject: [PATCH 34/52] Update to 4.4.7 --- .gitignore | 1 + nagios.spec | 14 ++++++-------- sources | 2 +- 3 files changed, 8 insertions(+), 9 deletions(-) diff --git a/.gitignore b/.gitignore index 3ac2d64..c6c707e 100644 --- a/.gitignore +++ b/.gitignore @@ -17,3 +17,4 @@ nagios-3.2.1.tar.gz /nagioscore-nagios-4.4.3.tar.gz /nagioscore-nagios-4.4.5.tar.gz /nagioscore-nagios-4.4.6.tar.gz +/nagioscore-nagios-4.4.7.tar.gz diff --git a/nagios.spec b/nagios.spec index e87ef6b..083cf4f 100644 --- a/nagios.spec +++ b/nagios.spec @@ -5,8 +5,8 @@ %global selinuxtype targeted Name: nagios -Version: 4.4.6 -Release: 10%{?dist} +Version: 4.4.7 +Release: 1%{?dist} Summary: Host/service/network monitoring program @@ -45,7 +45,6 @@ Patch11: nagios-0011-remove-rpmbuild.patch Patch12: nagios-0012-fix-spool.patch Patch13: nagios-0013-fix-plugin.patch Patch14: nagios-0014-fix-uidgid.patch -Patch15: %{name}-0015-Changelog.patch BuildRequires: make BuildRequires: doxygen @@ -65,6 +64,7 @@ BuildRequires: perl(Test::HTML::Lint) %endif BuildRequires: perl(Test::More) BuildRequires: perl(Test::Simple) +BuildRequires: openssl-devel # For up-to-date config.sub and config.guess BuildRequires: libtool @@ -72,11 +72,6 @@ BuildRequires: libtool # For selinux tools BuildRequires: checkpolicy, selinux-policy-devel -%if 0%{?rhel} > 6 || 0%{?fedora} > 20 -# For necessary macros -BuildRequires: systemd -%endif - Requires: httpd Requires: php Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) @@ -471,6 +466,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Sun Sep 25 2022 Guido Aulisi - 4.4.7-1 +- Update to 4.4.7 + * Fri Jul 22 2022 Fedora Release Engineering - 4.4.6-10 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild diff --git a/sources b/sources index 8d9f3c3..c3f4aa6 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (nagioscore-nagios-4.4.6.tar.gz) = db3a205f1675693301c059b0ecdc767cdc423923cff0729c5584a48e04fb18d6c119d51991dd24290a539eb8578b2cb82316275039b36827871bb028883b495f +SHA512 (nagioscore-nagios-4.4.7.tar.gz) = cc4efef0db591406953ecef6c42356494df152d97deb4f430fb866313b48e4bf8d83c4587a67bfc9c90f9b6292c8aee28e3c1c39255128f5f0872df0c0869b02 From e510354fc178bbbce9c1f0267920dd8d4c2ebf76 Mon Sep 17 00:00:00 2001 From: Guido Aulisi Date: Sun, 23 Oct 2022 11:53:21 +0200 Subject: [PATCH 35/52] Update to 4.4.8 --- .gitignore | 1 + nagios.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index c6c707e..d35a1cb 100644 --- a/.gitignore +++ b/.gitignore @@ -18,3 +18,4 @@ nagios-3.2.1.tar.gz /nagioscore-nagios-4.4.5.tar.gz /nagioscore-nagios-4.4.6.tar.gz /nagioscore-nagios-4.4.7.tar.gz +/nagioscore-nagios-4.4.8.tar.gz diff --git a/nagios.spec b/nagios.spec index 083cf4f..e2b7bc8 100644 --- a/nagios.spec +++ b/nagios.spec @@ -5,7 +5,7 @@ %global selinuxtype targeted Name: nagios -Version: 4.4.7 +Version: 4.4.8 Release: 1%{?dist} Summary: Host/service/network monitoring program @@ -466,6 +466,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Sun Oct 23 2022 Guido Aulisi - 4.4.8-1 +- Update to 4.4.8 + * Sun Sep 25 2022 Guido Aulisi - 4.4.7-1 - Update to 4.4.7 diff --git a/sources b/sources index c3f4aa6..2e00318 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (nagioscore-nagios-4.4.7.tar.gz) = cc4efef0db591406953ecef6c42356494df152d97deb4f430fb866313b48e4bf8d83c4587a67bfc9c90f9b6292c8aee28e3c1c39255128f5f0872df0c0869b02 +SHA512 (nagioscore-nagios-4.4.8.tar.gz) = a0616b5e9faa041f6c414f41bffee29b37dcc90d6777d8c8bbe0ceefd50a858d6c1eee4c33cd88c872c2ff7ecfeb64ce072a87bb9482a5eca7edb4fbdbf5c262 From 2be4ff8478ca7e778d3b27135431369e1aab8bfa Mon Sep 17 00:00:00 2001 From: Nikola Knazekova Date: Mon, 26 Sep 2022 18:14:25 +0200 Subject: [PATCH 36/52] selinux: Update based on latest packaging guide https://fedoraproject.org/wiki/SELinux/IndependentPolicy Start shipping nagios interface file Exclude installed policy module file from RPM verification Signed-off-by: Nikola Knazekova --- nagios.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nagios.spec b/nagios.spec index e2b7bc8..13a365a 100644 --- a/nagios.spec +++ b/nagios.spec @@ -305,6 +305,8 @@ install -d -m 0755 %{buildroot}%{_datadir}/nagios/html/docs %if 0%{?with_selinux} install -pm 0644 %{SOURCE13} README.SELinux.rst install -D -m 0644 %{name}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2 +install -D -p -m 0644 selinux/%{name}.if %{buildroot}%{_datadir}/selinux/devel/include/distributed/%{name}.if + %endif ### CONTRIB ITEMS TAKEN FROM UPSTREAM NAGIOS SPEC @@ -456,7 +458,8 @@ fi %files selinux %doc README.SELinux.rst %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.* -%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name} +%{_datadir}/selinux/devel/include/distributed/%{name}.if +%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name} %endif From 1eceb3fafa5fff8db2d335f3fd9e7310ce94bb82 Mon Sep 17 00:00:00 2001 From: Guido Aulisi Date: Thu, 17 Nov 2022 12:10:04 +0100 Subject: [PATCH 37/52] Update to 4.4.9 --- .gitignore | 1 + nagios.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index d35a1cb..90d2d7d 100644 --- a/.gitignore +++ b/.gitignore @@ -19,3 +19,4 @@ nagios-3.2.1.tar.gz /nagioscore-nagios-4.4.6.tar.gz /nagioscore-nagios-4.4.7.tar.gz /nagioscore-nagios-4.4.8.tar.gz +/nagioscore-nagios-4.4.9.tar.gz diff --git a/nagios.spec b/nagios.spec index 13a365a..c60b2c5 100644 --- a/nagios.spec +++ b/nagios.spec @@ -5,7 +5,7 @@ %global selinuxtype targeted Name: nagios -Version: 4.4.8 +Version: 4.4.9 Release: 1%{?dist} Summary: Host/service/network monitoring program @@ -469,6 +469,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Thu Nov 17 2022 Guido Aulisi - 4.4.9-1 +- Update to 4.4.9 + * Sun Oct 23 2022 Guido Aulisi - 4.4.8-1 - Update to 4.4.8 diff --git a/sources b/sources index 2e00318..c1b318a 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (nagioscore-nagios-4.4.8.tar.gz) = a0616b5e9faa041f6c414f41bffee29b37dcc90d6777d8c8bbe0ceefd50a858d6c1eee4c33cd88c872c2ff7ecfeb64ce072a87bb9482a5eca7edb4fbdbf5c262 +SHA512 (nagioscore-nagios-4.4.9.tar.gz) = bf9a18bc0fd51c037eb37cd98507df39514b0c8a956ea1d9ec6cc2d633696ed10b58395c36e23cc729ea1337c08d6b6e7a88900f249efdac2b25c9de6ad7001c From ecad3c5b17a3f6238a58dfb380076c7ce702917f Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Sat, 10 Dec 2022 09:34:26 +0100 Subject: [PATCH 38/52] Port configure script to C99 Related to: --- nagios-configure-c99.patch | 52 ++++++++++++++++++++++++++++++++++++++ nagios.spec | 6 ++++- 2 files changed, 57 insertions(+), 1 deletion(-) create mode 100644 nagios-configure-c99.patch diff --git a/nagios-configure-c99.patch b/nagios-configure-c99.patch new file mode 100644 index 0000000..4360eac --- /dev/null +++ b/nagios-configure-c99.patch @@ -0,0 +1,52 @@ +Avoid implicit function declarations and implicit ints. These will +cause the check to fail with future compilers even if the environment +supports a proper C99 vsnprintf. + +Submitted upstream: + +diff --git a/configure b/configure +index dddc31e96dc9f2e4..48d397ead46f0559 100755 +--- a/configure ++++ b/configure +@@ -5920,6 +5920,9 @@ else + + #include + #include ++#include ++#include ++#include + void foo(const char *format, ...) { + va_list ap; + int len; +@@ -5939,7 +5942,7 @@ void foo(const char *format, ...) { + + exit(0); + } +-main() { foo("hello"); } ++int main() { foo("hello"); } + + _ACEOF + if ac_fn_c_try_run "$LINENO"; then : +diff --git a/configure.ac b/configure.ac +index d2e69ce86408c7f1..d9814d8a75cf06b1 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -125,6 +125,9 @@ AC_CACHE_CHECK([for C99 vsnprintf],ac_cv_HAVE_C99_VSNPRINTF,[ + AC_TRY_RUN([ + #include + #include ++#include ++#include ++#include + void foo(const char *format, ...) { + va_list ap; + int len; +@@ -144,7 +147,7 @@ void foo(const char *format, ...) { + + exit(0); + } +-main() { foo("hello"); } ++int main() { foo("hello"); } + ], + ac_cv_HAVE_C99_VSNPRINTF=yes,ac_cv_HAVE_C99_VSNPRINTF=no,ac_cv_HAVE_C99_VSNPRINTF=cross)]) + if test "x$ac_cv_HAVE_C99_VSNPRINTF" = "xyes"; then diff --git a/nagios.spec b/nagios.spec index c60b2c5..230c9e7 100644 --- a/nagios.spec +++ b/nagios.spec @@ -6,7 +6,7 @@ Name: nagios Version: 4.4.9 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Host/service/network monitoring program @@ -45,6 +45,7 @@ Patch11: nagios-0011-remove-rpmbuild.patch Patch12: nagios-0012-fix-spool.patch Patch13: nagios-0013-fix-plugin.patch Patch14: nagios-0014-fix-uidgid.patch +Patch15: nagios-configure-c99.patch BuildRequires: make BuildRequires: doxygen @@ -469,6 +470,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Sat Dec 10 2022 Florian Weimer - 4.4.9-2 +- Port configure script to C99 + * Thu Nov 17 2022 Guido Aulisi - 4.4.9-1 - Update to 4.4.9 From 4bc39f64dbc1c74a7211e30b282ca96fb3fd80b9 Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Fri, 13 Jan 2023 09:49:58 +0100 Subject: [PATCH 39/52] Remove perl(MODULE_COMPAT), it will be replaced by generators --- nagios.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/nagios.spec b/nagios.spec index 230c9e7..370723f 100644 --- a/nagios.spec +++ b/nagios.spec @@ -75,7 +75,6 @@ BuildRequires: checkpolicy, selinux-policy-devel Requires: httpd Requires: php -Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) Requires: %{_bindir}/mail Requires: nagios-common Requires: user(nagios) From 7b7fe58113707f98f9c2e4c98927fd528801b2dc Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 19 Jan 2023 21:11:55 +0000 Subject: [PATCH 40/52] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- nagios.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nagios.spec b/nagios.spec index 370723f..e65f4ca 100644 --- a/nagios.spec +++ b/nagios.spec @@ -6,7 +6,7 @@ Name: nagios Version: 4.4.9 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Host/service/network monitoring program @@ -469,6 +469,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Thu Jan 19 2023 Fedora Release Engineering - 4.4.9-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Sat Dec 10 2022 Florian Weimer - 4.4.9-2 - Port configure script to C99 From 0d310e03a8e79caf9ff8494338b81e854be75af8 Mon Sep 17 00:00:00 2001 From: Guido Aulisi Date: Mon, 13 Feb 2023 16:10:54 +0100 Subject: [PATCH 41/52] Update to 4.4.10 Fix nagiostats permissions #2169033 --- .gitignore | 1 + nagios-configure-c99.patch | 52 -------------------------------------- nagios.spec | 11 +++++--- sources | 2 +- 4 files changed, 9 insertions(+), 57 deletions(-) delete mode 100644 nagios-configure-c99.patch diff --git a/.gitignore b/.gitignore index 90d2d7d..555ba84 100644 --- a/.gitignore +++ b/.gitignore @@ -20,3 +20,4 @@ nagios-3.2.1.tar.gz /nagioscore-nagios-4.4.7.tar.gz /nagioscore-nagios-4.4.8.tar.gz /nagioscore-nagios-4.4.9.tar.gz +/nagioscore-nagios-4.4.10.tar.gz diff --git a/nagios-configure-c99.patch b/nagios-configure-c99.patch deleted file mode 100644 index 4360eac..0000000 --- a/nagios-configure-c99.patch +++ /dev/null @@ -1,52 +0,0 @@ -Avoid implicit function declarations and implicit ints. These will -cause the check to fail with future compilers even if the environment -supports a proper C99 vsnprintf. - -Submitted upstream: - -diff --git a/configure b/configure -index dddc31e96dc9f2e4..48d397ead46f0559 100755 ---- a/configure -+++ b/configure -@@ -5920,6 +5920,9 @@ else - - #include - #include -+#include -+#include -+#include - void foo(const char *format, ...) { - va_list ap; - int len; -@@ -5939,7 +5942,7 @@ void foo(const char *format, ...) { - - exit(0); - } --main() { foo("hello"); } -+int main() { foo("hello"); } - - _ACEOF - if ac_fn_c_try_run "$LINENO"; then : -diff --git a/configure.ac b/configure.ac -index d2e69ce86408c7f1..d9814d8a75cf06b1 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -125,6 +125,9 @@ AC_CACHE_CHECK([for C99 vsnprintf],ac_cv_HAVE_C99_VSNPRINTF,[ - AC_TRY_RUN([ - #include - #include -+#include -+#include -+#include - void foo(const char *format, ...) { - va_list ap; - int len; -@@ -144,7 +147,7 @@ void foo(const char *format, ...) { - - exit(0); - } --main() { foo("hello"); } -+int main() { foo("hello"); } - ], - ac_cv_HAVE_C99_VSNPRINTF=yes,ac_cv_HAVE_C99_VSNPRINTF=no,ac_cv_HAVE_C99_VSNPRINTF=cross)]) - if test "x$ac_cv_HAVE_C99_VSNPRINTF" = "xyes"; then diff --git a/nagios.spec b/nagios.spec index e65f4ca..35f4553 100644 --- a/nagios.spec +++ b/nagios.spec @@ -5,8 +5,8 @@ %global selinuxtype targeted Name: nagios -Version: 4.4.9 -Release: 3%{?dist} +Version: 4.4.10 +Release: 1%{?dist} Summary: Host/service/network monitoring program @@ -45,7 +45,6 @@ Patch11: nagios-0011-remove-rpmbuild.patch Patch12: nagios-0012-fix-spool.patch Patch13: nagios-0013-fix-plugin.patch Patch14: nagios-0014-fix-uidgid.patch -Patch15: nagios-configure-c99.patch BuildRequires: make BuildRequires: doxygen @@ -296,7 +295,7 @@ chmod -x %{buildroot}%{_unitdir}/%{name}.service %endif # Fix permissions - FIXME remove this when unneeded -chmod 755 %{buildroot}%{_sbindir}/nagios +chmod 755 %{buildroot}%{_sbindir}/nagios %{buildroot}%{_bindir}/nagiostats # Install documentation install -d -m 0755 %{buildroot}%{_datadir}/nagios/html/docs @@ -469,6 +468,10 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Mon Feb 13 2023 Guido Aulisi - 4.4.10-1 +- Update to 4.4.10 +- Fix nagiostats permissions #2169033 + * Thu Jan 19 2023 Fedora Release Engineering - 4.4.9-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild diff --git a/sources b/sources index c1b318a..020a1f2 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (nagioscore-nagios-4.4.9.tar.gz) = bf9a18bc0fd51c037eb37cd98507df39514b0c8a956ea1d9ec6cc2d633696ed10b58395c36e23cc729ea1337c08d6b6e7a88900f249efdac2b25c9de6ad7001c +SHA512 (nagioscore-nagios-4.4.10.tar.gz) = 64fa2ab4500bf853ba53f44e6eb0b4569d826e264c12a1614bf8efae2d7f1c82587bb0f72510c90b7a53097b14530df1c5c05b79fc390bc9648fa2414b748a4e From 01bd89cf420c04ec7755ea04cf7b7e1f9b2c2823 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jul 2023 16:15:48 +0000 Subject: [PATCH 42/52] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- nagios.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nagios.spec b/nagios.spec index 35f4553..5b21e37 100644 --- a/nagios.spec +++ b/nagios.spec @@ -6,7 +6,7 @@ Name: nagios Version: 4.4.10 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Host/service/network monitoring program @@ -468,6 +468,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Thu Jul 20 2023 Fedora Release Engineering - 4.4.10-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Mon Feb 13 2023 Guido Aulisi - 4.4.10-1 - Update to 4.4.10 - Fix nagiostats permissions #2169033 From 17bb18eadb37449d466e59497981ce848ea52dd6 Mon Sep 17 00:00:00 2001 From: Guido Aulisi Date: Wed, 16 Aug 2023 13:16:04 +0200 Subject: [PATCH 43/52] Update to 4.4.14 --- .gitignore | 1 + nagios-0011-remove-rpmbuild.patch | 2 +- nagios.spec | 7 +++++-- sources | 2 +- 4 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 555ba84..d9f3385 100644 --- a/.gitignore +++ b/.gitignore @@ -21,3 +21,4 @@ nagios-3.2.1.tar.gz /nagioscore-nagios-4.4.8.tar.gz /nagioscore-nagios-4.4.9.tar.gz /nagioscore-nagios-4.4.10.tar.gz +/nagioscore-nagios-4.4.14.tar.gz diff --git a/nagios-0011-remove-rpmbuild.patch b/nagios-0011-remove-rpmbuild.patch index 401cad0..4e4bc1d 100644 --- a/nagios-0011-remove-rpmbuild.patch +++ b/nagios-0011-remove-rpmbuild.patch @@ -8,7 +8,7 @@ index 72e4d4a9..62415152 100644 $(CC) $(CFLAGS) $(LDFLAGS) $< $(CGI_O) -o $@ - -############################################################################## --# making similiar EPEL rpm for Fedora/RHEL/CentOS +-# making similar EPEL rpm for Fedora/RHEL/CentOS - -ifneq ("$(wildcard /etc/redhat-release)","") - diff --git a/nagios.spec b/nagios.spec index 5b21e37..8cf03dc 100644 --- a/nagios.spec +++ b/nagios.spec @@ -5,8 +5,8 @@ %global selinuxtype targeted Name: nagios -Version: 4.4.10 -Release: 2%{?dist} +Version: 4.4.14 +Release: 1%{?dist} Summary: Host/service/network monitoring program @@ -468,6 +468,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Wed Aug 16 2023 Guido Aulisi - 4.4.14-1 +- Update to 4.4.14 + * Thu Jul 20 2023 Fedora Release Engineering - 4.4.10-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild diff --git a/sources b/sources index 020a1f2..83ce37d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (nagioscore-nagios-4.4.10.tar.gz) = 64fa2ab4500bf853ba53f44e6eb0b4569d826e264c12a1614bf8efae2d7f1c82587bb0f72510c90b7a53097b14530df1c5c05b79fc390bc9648fa2414b748a4e +SHA512 (nagioscore-nagios-4.4.14.tar.gz) = 6dfe19887f035f3a3f6774a0f1c515902608934a75b08835fe9a5163812657547c97a20f3df42b89a34cad949eb4b587853b4131718c30703490b11fbee0d0ee From b884bb7c4b96a1323077acd8356f9307c4f643f8 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 21 Jan 2024 09:09:57 +0000 Subject: [PATCH 44/52] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- nagios.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nagios.spec b/nagios.spec index 8cf03dc..ca9816a 100644 --- a/nagios.spec +++ b/nagios.spec @@ -6,7 +6,7 @@ Name: nagios Version: 4.4.14 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Host/service/network monitoring program @@ -468,6 +468,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Sun Jan 21 2024 Fedora Release Engineering - 4.4.14-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Wed Aug 16 2023 Guido Aulisi - 4.4.14-1 - Update to 4.4.14 From 258ce4a8a71ed773c825698e9cb9d75a9d2b7437 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 25 Jan 2024 08:34:52 +0000 Subject: [PATCH 45/52] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- nagios.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nagios.spec b/nagios.spec index ca9816a..ee3c140 100644 --- a/nagios.spec +++ b/nagios.spec @@ -6,7 +6,7 @@ Name: nagios Version: 4.4.14 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Host/service/network monitoring program @@ -468,6 +468,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Thu Jan 25 2024 Fedora Release Engineering - 4.4.14-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Sun Jan 21 2024 Fedora Release Engineering - 4.4.14-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 8182a4d5ba61fd13401d0dabc0fed15e594a2915 Mon Sep 17 00:00:00 2001 From: Guido Aulisi Date: Sat, 27 Apr 2024 22:46:12 +0200 Subject: [PATCH 46/52] Fix permissions (#2275532) --- nagios.spec | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-) diff --git a/nagios.spec b/nagios.spec index ee3c140..6b58166 100644 --- a/nagios.spec +++ b/nagios.spec @@ -6,7 +6,7 @@ Name: nagios Version: 4.4.14 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Host/service/network monitoring program @@ -271,16 +271,16 @@ install -d -m 0755 %{buildroot}%{_libdir}/%{name}/plugins/eventhandlers install -d -m 0755 %{buildroot}%{_libdir}/%{name}/plugins/eventhandlers/distributed-monitoring/ install -d -m 0755 %{buildroot}%{_libdir}/%{name}/plugins/eventhandlers/redundancy-scenario1/ -install -d -m 0775 %{buildroot}%{_localstatedir}/spool/%{name}/cmd -install -d -m 0775 %{buildroot}%{_localstatedir}/run/%{name} +install -d -m 0755 %{buildroot}%{_localstatedir}/spool/%{name}/cmd +install -d -m 0755 %{buildroot}%{_localstatedir}/run/%{name} # Make a run directory -install -d -m 0775 %{buildroot}%{_localstatedir}/run/%{name} +install -d -m 0755 %{buildroot}%{_localstatedir}/run/%{name} # Make logdirs -install -d -m 0775 %{buildroot}/%{_localstatedir}/log/ -install -d -m 0775 %{buildroot}/%{_localstatedir}/log/%{name}/ -install -d -m 0775 %{buildroot}/%{_localstatedir}/log/%{name}/archives +install -d -m 0755 %{buildroot}/%{_localstatedir}/log/ +install -d -m 0755 %{buildroot}/%{_localstatedir}/log/%{name}/ +install -d -m 0755 %{buildroot}/%{_localstatedir}/log/%{name}/archives # Use systemd unit on rhel7 or any supported Fedora %if 0%{?rhel} > 6 || 0%{?fedora} > 20 @@ -299,7 +299,7 @@ chmod 755 %{buildroot}%{_sbindir}/nagios %{buildroot}%{_bindir}/nagiostats # Install documentation install -d -m 0755 %{buildroot}%{_datadir}/nagios/html/docs -%{__cp} -a Documentation/html/* %{buildroot}%{_datadir}/nagios/html/docs +%{__cp} -r Documentation/html/* %{buildroot}%{_datadir}/nagios/html/docs %if 0%{?with_selinux} install -pm 0644 %{SOURCE13} README.SELinux.rst @@ -323,6 +323,9 @@ install -p -m 644 contrib/eventhandlers/redundancy-scenario1/handle-master-proc- %{__mv} contrib/README contrib/README.contrib +# Fix permissions #2275532 +chmod -R g-w %{buildroot}%{_datadir}/%{name} %{buildroot}%{_libdir}/%{name} %{buildroot}%{_sysconfdir} %{buildroot}%{_sbindir} + %pre common getent group nagios >/dev/null || groupadd -r nagios getent passwd nagios >/dev/null || useradd -r -g nagios -d %{_localstatedir}/spool/%{name} -s /sbin/nologin nagios @@ -435,11 +438,11 @@ fi %attr(0640,root,nagios) %config(noreplace) %{_sysconfdir}/%{name}/private/resource.cfg %attr(0640,root,apache) %config(noreplace) %{_sysconfdir}/%{name}/passwd %attr(0640,root,apache) %config(noreplace) %{_datadir}/%{name}/html/config.inc.php -%attr(2775,nagios,nagios) %dir %{_localstatedir}/spool/%{name}/cmd +%attr(2755,nagios,nagios) %dir %{_localstatedir}/spool/%{name}/cmd %attr(0750,nagios,nagios) %dir %{_localstatedir}/run/%{name} %attr(0750,nagios,nagios) %dir %{_localstatedir}/log/%{name} %attr(0750,nagios,nagios) %dir %{_localstatedir}/log/%{name}/archives -%attr(0770,nagios,nagios) %dir %{_localstatedir}/spool/%{name}/checkresults +%attr(0750,nagios,nagios) %dir %{_localstatedir}/spool/%{name}/checkresults %files common %dir %{_sysconfdir}/%{name} @@ -468,6 +471,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Sat Apr 27 2024 Guido Aulisi - 4.4.14-4 +- Fix permissions (#2275532) + * Thu Jan 25 2024 Fedora Release Engineering - 4.4.14-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 6a1fa55ad72c8fff4760ac60f3047f445a95d769 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 18 Jul 2024 19:07:16 +0000 Subject: [PATCH 47/52] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- nagios.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nagios.spec b/nagios.spec index 6b58166..7e1dc20 100644 --- a/nagios.spec +++ b/nagios.spec @@ -6,7 +6,7 @@ Name: nagios Version: 4.4.14 -Release: 4%{?dist} +Release: 5%{?dist} Summary: Host/service/network monitoring program @@ -471,6 +471,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Thu Jul 18 2024 Fedora Release Engineering - 4.4.14-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Sat Apr 27 2024 Guido Aulisi - 4.4.14-4 - Fix permissions (#2275532) From e0262c10ac8ab52ae3c4f26b502fe2a7e43ed55b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20Such=C3=BD?= Date: Mon, 29 Jul 2024 11:27:11 +0200 Subject: [PATCH 48/52] convert GPLv2 license to SPDX This is part of https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_4 --- nagios.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/nagios.spec b/nagios.spec index 7e1dc20..c66d91b 100644 --- a/nagios.spec +++ b/nagios.spec @@ -6,11 +6,12 @@ Name: nagios Version: 4.4.14 -Release: 5%{?dist} +Release: 6%{?dist} Summary: Host/service/network monitoring program -License: GPLv2 +# Automatically converted from old format: GPLv2 - review is highly recommended. +License: GPL-2.0-only URL: https://www.nagios.org/projects/nagios-core/ Source0: https://github.com/NagiosEnterprises/nagioscore/archive/nagios-%{version}.tar.gz#/nagioscore-nagios-%{version}.tar.gz Source1: nagios.logrotate @@ -471,6 +472,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Mon Jul 29 2024 Miroslav Suchý - 4.4.14-6 +- convert license to SPDX + * Thu Jul 18 2024 Fedora Release Engineering - 4.4.14-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From a7612acc8837a98d3408eff7739178f1e52fc354 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jan 2025 19:38:58 +0000 Subject: [PATCH 49/52] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- nagios.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nagios.spec b/nagios.spec index c66d91b..f1c871c 100644 --- a/nagios.spec +++ b/nagios.spec @@ -6,7 +6,7 @@ Name: nagios Version: 4.4.14 -Release: 6%{?dist} +Release: 7%{?dist} Summary: Host/service/network monitoring program @@ -472,6 +472,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Fri Jan 17 2025 Fedora Release Engineering - 4.4.14-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Mon Jul 29 2024 Miroslav Suchý - 4.4.14-6 - convert license to SPDX From ffcb5f8a4f480d060db53621a6f0fbb899de8c0a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 11 Feb 2025 15:53:23 +0100 Subject: [PATCH 50/52] Add sysusers.d config file to allow rpm to create users/groups automatically See https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers. --- nagios.spec | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/nagios.spec b/nagios.spec index f1c871c..d9fec9f 100644 --- a/nagios.spec +++ b/nagios.spec @@ -6,7 +6,7 @@ Name: nagios Version: 4.4.14 -Release: 7%{?dist} +Release: 8%{?dist} Summary: Host/service/network monitoring program @@ -126,7 +126,6 @@ files for Nagios. Development files are built as a separate package. %package common Summary: Provides common directories, uid and gid among nagios-related packages -Requires(pre): shadow-utils Requires(post): shadow-utils Provides: user(nagios) Provides: group(nagios) @@ -185,6 +184,11 @@ Various contributed items used by plugins and other tools. install -p -m 0644 %{SOURCE10} %{SOURCE11} %{SOURCE12} html/images/logos/ +# Create a sysusers.d config file +cat >nagios.sysusers.conf </dev/null || groupadd -r nagios -getent passwd nagios >/dev/null || useradd -r -g nagios -d %{_localstatedir}/spool/%{name} -s /sbin/nologin nagios -exit 0 +install -m0644 -D nagios.sysusers.conf %{buildroot}%{_sysusersdir}/nagios.conf + %post @@ -451,6 +453,7 @@ fi %attr(0755,root,root) %dir %{_libdir}/%{name}/plugins %attr(0755,root,root) %dir %{_libdir}/%{name}/plugins/eventhandlers/ %attr(0755,nagios,nagios) %dir %{_localstatedir}/spool/%{name} +%{_sysusersdir}/nagios.conf %files devel @@ -472,6 +475,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - 4.4.14-8 +- Add sysusers.d config file to allow rpm to create users/groups automatically + * Fri Jan 17 2025 Fedora Release Engineering - 4.4.14-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From fe349bea3ee2bed4b528a7fb453ec481eaeca192 Mon Sep 17 00:00:00 2001 From: Guido Aulisi Date: Tue, 13 May 2025 20:55:53 +0200 Subject: [PATCH 51/52] Update to 4.5.9 --- .gitignore | 1 + nagios-0010-remove-information-leak.patch | 70 +++-------------------- nagios.spec | 14 ++++- sources | 2 +- 4 files changed, 22 insertions(+), 65 deletions(-) diff --git a/.gitignore b/.gitignore index d9f3385..9e2513d 100644 --- a/.gitignore +++ b/.gitignore @@ -22,3 +22,4 @@ nagios-3.2.1.tar.gz /nagioscore-nagios-4.4.9.tar.gz /nagioscore-nagios-4.4.10.tar.gz /nagioscore-nagios-4.4.14.tar.gz +/nagioscore-nagios-4.5.9.tar.gz diff --git a/nagios-0010-remove-information-leak.patch b/nagios-0010-remove-information-leak.patch index b417e5b..cd3b400 100644 --- a/nagios-0010-remove-information-leak.patch +++ b/nagios-0010-remove-information-leak.patch @@ -32,7 +32,7 @@ diff -up ./cgi/extinfo.c.remove_3rdparty_links ./cgi/extinfo.c diff -up ./cgi/status.c.remove_3rdparty_links ./cgi/status.c --- ./cgi/status.c.remove_3rdparty_links 2019-08-20 15:29:34.000000000 +0000 +++ ./cgi/status.c 2019-08-29 18:17:32.322544264 +0000 -@@ -555,31 +555,8 @@ void document_header(int use_stylesheet) +@@ -556,31 +556,8 @@ void document_header(int use_stylesheet) /* JS function to append content to elements on page */ printf(" - + getCoreStatus(); + }); -- -- -- -- - - > - diff --git a/nagios.spec b/nagios.spec index d9fec9f..e366ec2 100644 --- a/nagios.spec +++ b/nagios.spec @@ -5,8 +5,8 @@ %global selinuxtype targeted Name: nagios -Version: 4.4.14 -Release: 8%{?dist} +Version: 4.5.9 +Release: 1%{?dist} Summary: Host/service/network monitoring program @@ -223,6 +223,7 @@ EOF --with-template-objects \ --with-template-extinfo \ --enable-event-broker \ + --disable-static \ STRIP=/bin/true %make_build all @@ -258,7 +259,9 @@ bzip2 -9 %{name}.pp # relocated to sbin (Fedora-specific) install -d -m 0755 %{buildroot}%{_bindir} +%if 0%{?fedora} < 42 && 0%{?rhel} < 11 mv %{buildroot}%{_sbindir}/nagiostats %{buildroot}%{_bindir}/nagiostats +%endif install -d -m 0755 %{buildroot}%{_sysconfdir}/%{name}/private mv %{buildroot}%{_sysconfdir}/%{name}/resource.cfg %{buildroot}%{_sysconfdir}/%{name}/private/resource.cfg @@ -420,9 +423,11 @@ fi %license LICENSE %{_datadir}/%{name}/html/[^cd]* %{_datadir}/%{name}/html/contexthelp/ -%{_datadir}/%{name}/html/d3/ +%if 0%{?fedora} < 42 && 0%{?rhel} < 11 %{_sbindir}/* +%endif + %{_bindir}/* %{_libdir}/%{name}/cgi-bin/*cgi %if 0%{?rhel} > 6 || 0%{?fedora} > 20 @@ -475,6 +480,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Tue May 13 2025 Guido Aulisi - 4.5.9-1 +- Update to 4.5.9 + * Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - 4.4.14-8 - Add sysusers.d config file to allow rpm to create users/groups automatically diff --git a/sources b/sources index 83ce37d..a618899 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (nagioscore-nagios-4.4.14.tar.gz) = 6dfe19887f035f3a3f6774a0f1c515902608934a75b08835fe9a5163812657547c97a20f3df42b89a34cad949eb4b587853b4131718c30703490b11fbee0d0ee +SHA512 (nagioscore-nagios-4.5.9.tar.gz) = 90bd71f772b6686b32fbe5f543468938f0dfc9c5bade1d41c27d63b1971d5000d16d6ca843b3eccab5550daa1bc649f16e8d68890052149126601a060ac9230d From 8d93daf3011ea49eb8923d9209a5ea3782839d6d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 24 Jul 2025 22:36:36 +0000 Subject: [PATCH 52/52] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- nagios.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nagios.spec b/nagios.spec index e366ec2..f945ac9 100644 --- a/nagios.spec +++ b/nagios.spec @@ -6,7 +6,7 @@ Name: nagios Version: 4.5.9 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Host/service/network monitoring program @@ -480,6 +480,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Thu Jul 24 2025 Fedora Release Engineering - 4.5.9-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Tue May 13 2025 Guido Aulisi - 4.5.9-1 - Update to 4.5.9