diff --git a/.gitignore b/.gitignore index 9e2513d..3ac2d64 100644 --- a/.gitignore +++ b/.gitignore @@ -17,9 +17,3 @@ nagios-3.2.1.tar.gz /nagioscore-nagios-4.4.3.tar.gz /nagioscore-nagios-4.4.5.tar.gz /nagioscore-nagios-4.4.6.tar.gz -/nagioscore-nagios-4.4.7.tar.gz -/nagioscore-nagios-4.4.8.tar.gz -/nagioscore-nagios-4.4.9.tar.gz -/nagioscore-nagios-4.4.10.tar.gz -/nagioscore-nagios-4.4.14.tar.gz -/nagioscore-nagios-4.5.9.tar.gz diff --git a/nagios-0010-remove-information-leak.patch b/nagios-0010-remove-information-leak.patch index cd3b400..b417e5b 100644 --- a/nagios-0010-remove-information-leak.patch +++ b/nagios-0010-remove-information-leak.patch @@ -32,7 +32,7 @@ diff -up ./cgi/extinfo.c.remove_3rdparty_links ./cgi/extinfo.c diff -up ./cgi/status.c.remove_3rdparty_links ./cgi/status.c --- ./cgi/status.c.remove_3rdparty_links 2019-08-20 15:29:34.000000000 +0000 +++ ./cgi/status.c 2019-08-29 18:17:32.322544264 +0000 -@@ -556,31 +556,8 @@ void document_header(int use_stylesheet) +@@ -555,31 +555,8 @@ void document_header(int use_stylesheet) /* JS function to append content to elements on page */ printf(" + + +- +- +- +- + + > + diff --git a/nagios-0011-remove-rpmbuild.patch b/nagios-0011-remove-rpmbuild.patch index 4e4bc1d..401cad0 100644 --- a/nagios-0011-remove-rpmbuild.patch +++ b/nagios-0011-remove-rpmbuild.patch @@ -8,7 +8,7 @@ index 72e4d4a9..62415152 100644 $(CC) $(CFLAGS) $(LDFLAGS) $< $(CGI_O) -o $@ - -############################################################################## --# making similar EPEL rpm for Fedora/RHEL/CentOS +-# making similiar EPEL rpm for Fedora/RHEL/CentOS - -ifneq ("$(wildcard /etc/redhat-release)","") - diff --git a/nagios.if b/nagios.if index 13a034d..d012e9b 100644 --- a/nagios.if +++ b/nagios.if @@ -334,34 +334,3 @@ interface(`nagios_unconfined_signull',` allow $1 nagios_unconfined_plugin_t:process signull; ') - -######################################## -# -# Nagios interface compatibility blocks -# -# The following definitions ensure compatibility with distribution policy -# versions that do not contain given interfaces (epel, or older Fedora -# releases). -# Each block tests for existence of given interface and defines it if needed. -# - -######################################## -## -## Allow caller to signull sssd. -## Backport from RHEL8 -## -## -## -## Domain allowed access. -## -## -# -ifndef(`sssd_signull',` - interface(`sssd_signull',` - gen_require(` - type sssd_t; - ') - - allow $1 sssd_t:process signull; - ') -') diff --git a/nagios.spec b/nagios.spec index f945ac9..99e3834 100644 --- a/nagios.spec +++ b/nagios.spec @@ -1,17 +1,16 @@ -# Set %%bcond_without bootstrap to build without depending on plugins for localhost monitoring -%bcond_with bootstrap +# Set bootstrap = 1 to build without depending on plugins for localhost monitoring +%global bootstrap 0 %global with_selinux 1 %global selinuxtype targeted Name: nagios -Version: 4.5.9 -Release: 2%{?dist} +Version: 4.4.6 +Release: 4%{?dist} Summary: Host/service/network monitoring program -# Automatically converted from old format: GPLv2 - review is highly recommended. -License: GPL-2.0-only +License: GPLv2 URL: https://www.nagios.org/projects/nagios-core/ Source0: https://github.com/NagiosEnterprises/nagioscore/archive/nagios-%{version}.tar.gz#/nagioscore-nagios-%{version}.tar.gz Source1: nagios.logrotate @@ -46,6 +45,7 @@ Patch11: nagios-0011-remove-rpmbuild.patch Patch12: nagios-0012-fix-spool.patch Patch13: nagios-0013-fix-plugin.patch Patch14: nagios-0014-fix-uidgid.patch +Patch15: %{name}-0015-Changelog.patch BuildRequires: make BuildRequires: doxygen @@ -65,7 +65,6 @@ BuildRequires: perl(Test::HTML::Lint) %endif BuildRequires: perl(Test::More) BuildRequires: perl(Test::Simple) -BuildRequires: openssl-devel # For up-to-date config.sub and config.guess BuildRequires: libtool @@ -73,15 +72,21 @@ BuildRequires: libtool # For selinux tools BuildRequires: checkpolicy, selinux-policy-devel +%if 0%{?rhel} > 6 || 0%{?fedora} > 20 +# For necessary macros +BuildRequires: systemd +%endif + Requires: httpd Requires: php -Requires: %{_bindir}/mail +Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) +Requires: mailx Requires: nagios-common Requires: user(nagios) Requires: group(nagios) # This plugins are required for localhost monitoring -%if %{without bootstrap} +%if ! 0%{?bootstrap} Requires: nagios-plugins-ping Requires: nagios-plugins-load Requires: nagios-plugins-users @@ -126,6 +131,7 @@ files for Nagios. Development files are built as a separate package. %package common Summary: Provides common directories, uid and gid among nagios-related packages +Requires(pre): shadow-utils Requires(post): shadow-utils Provides: user(nagios) Provides: group(nagios) @@ -155,6 +161,7 @@ may compile against. # SELinux subpackage %package selinux Summary: SELinux context for %{name} +Requires: %{name} = %{version}-%{release} BuildArch: noarch Requires: selinux-policy-%{selinuxtype} Requires(post): selinux-policy-%{selinuxtype} @@ -184,11 +191,6 @@ Various contributed items used by plugins and other tools. install -p -m 0644 %{SOURCE10} %{SOURCE11} %{SOURCE12} html/images/logos/ -# Create a sysusers.d config file -cat >nagios.sysusers.conf < 6 || 0%{?fedora} > 20 @@ -303,17 +302,15 @@ chmod -x %{buildroot}%{_unitdir}/%{name}.service %endif # Fix permissions - FIXME remove this when unneeded -chmod 755 %{buildroot}%{_sbindir}/nagios %{buildroot}%{_bindir}/nagiostats +chmod 755 %{buildroot}%{_sbindir}/nagios # Install documentation install -d -m 0755 %{buildroot}%{_datadir}/nagios/html/docs -%{__cp} -r Documentation/html/* %{buildroot}%{_datadir}/nagios/html/docs +%{__cp} -a Documentation/html/* %{buildroot}%{_datadir}/nagios/html/docs %if 0%{?with_selinux} install -pm 0644 %{SOURCE13} README.SELinux.rst install -D -m 0644 %{name}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2 -install -D -p -m 0644 selinux/%{name}.if %{buildroot}%{_datadir}/selinux/devel/include/distributed/%{name}.if - %endif ### CONTRIB ITEMS TAKEN FROM UPSTREAM NAGIOS SPEC @@ -331,11 +328,10 @@ install -p -m 644 contrib/eventhandlers/redundancy-scenario1/handle-master-proc- %{__mv} contrib/README contrib/README.contrib -# Fix permissions #2275532 -chmod -R g-w %{buildroot}%{_datadir}/%{name} %{buildroot}%{_libdir}/%{name} %{buildroot}%{_sysconfdir} %{buildroot}%{_sbindir} - -install -m0644 -D nagios.sysusers.conf %{buildroot}%{_sysusersdir}/nagios.conf - +%pre common +getent group nagios >/dev/null || groupadd -r nagios +getent passwd nagios >/dev/null || useradd -r -g nagios -d %{_localstatedir}/spool/%{name} -s /sbin/nologin nagios +exit 0 %post @@ -423,11 +419,9 @@ fi %license LICENSE %{_datadir}/%{name}/html/[^cd]* %{_datadir}/%{name}/html/contexthelp/ +%{_datadir}/%{name}/html/d3/ -%if 0%{?fedora} < 42 && 0%{?rhel} < 11 %{_sbindir}/* -%endif - %{_bindir}/* %{_libdir}/%{name}/cgi-bin/*cgi %if 0%{?rhel} > 6 || 0%{?fedora} > 20 @@ -446,11 +440,11 @@ fi %attr(0640,root,nagios) %config(noreplace) %{_sysconfdir}/%{name}/private/resource.cfg %attr(0640,root,apache) %config(noreplace) %{_sysconfdir}/%{name}/passwd %attr(0640,root,apache) %config(noreplace) %{_datadir}/%{name}/html/config.inc.php -%attr(2755,nagios,nagios) %dir %{_localstatedir}/spool/%{name}/cmd +%attr(2775,nagios,nagios) %dir %{_localstatedir}/spool/%{name}/cmd %attr(0750,nagios,nagios) %dir %{_localstatedir}/run/%{name} %attr(0750,nagios,nagios) %dir %{_localstatedir}/log/%{name} %attr(0750,nagios,nagios) %dir %{_localstatedir}/log/%{name}/archives -%attr(0750,nagios,nagios) %dir %{_localstatedir}/spool/%{name}/checkresults +%attr(0770,nagios,nagios) %dir %{_localstatedir}/spool/%{name}/checkresults %files common %dir %{_sysconfdir}/%{name} @@ -458,7 +452,6 @@ fi %attr(0755,root,root) %dir %{_libdir}/%{name}/plugins %attr(0755,root,root) %dir %{_libdir}/%{name}/plugins/eventhandlers/ %attr(0755,nagios,nagios) %dir %{_localstatedir}/spool/%{name} -%{_sysusersdir}/nagios.conf %files devel @@ -469,8 +462,7 @@ fi %files selinux %doc README.SELinux.rst %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.* -%{_datadir}/selinux/devel/include/distributed/%{name}.if -%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name} +%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name} %endif @@ -480,79 +472,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog -* Thu Jul 24 2025 Fedora Release Engineering - 4.5.9-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Tue May 13 2025 Guido Aulisi - 4.5.9-1 -- Update to 4.5.9 - -* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - 4.4.14-8 -- Add sysusers.d config file to allow rpm to create users/groups automatically - -* Fri Jan 17 2025 Fedora Release Engineering - 4.4.14-7 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Mon Jul 29 2024 Miroslav Suchý - 4.4.14-6 -- convert license to SPDX - -* Thu Jul 18 2024 Fedora Release Engineering - 4.4.14-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Sat Apr 27 2024 Guido Aulisi - 4.4.14-4 -- Fix permissions (#2275532) - -* Thu Jan 25 2024 Fedora Release Engineering - 4.4.14-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Sun Jan 21 2024 Fedora Release Engineering - 4.4.14-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Wed Aug 16 2023 Guido Aulisi - 4.4.14-1 -- Update to 4.4.14 - -* Thu Jul 20 2023 Fedora Release Engineering - 4.4.10-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Mon Feb 13 2023 Guido Aulisi - 4.4.10-1 -- Update to 4.4.10 -- Fix nagiostats permissions #2169033 - -* Thu Jan 19 2023 Fedora Release Engineering - 4.4.9-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Sat Dec 10 2022 Florian Weimer - 4.4.9-2 -- Port configure script to C99 - -* Thu Nov 17 2022 Guido Aulisi - 4.4.9-1 -- Update to 4.4.9 - -* Sun Oct 23 2022 Guido Aulisi - 4.4.8-1 -- Update to 4.4.8 - -* Sun Sep 25 2022 Guido Aulisi - 4.4.7-1 -- Update to 4.4.7 - -* Fri Jul 22 2022 Fedora Release Engineering - 4.4.6-10 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Wed Jun 01 2022 Jitka Plesnikova - 4.4.6-9 -- Perl 5.36 rebuild - -* Thu Jan 20 2022 Fedora Release Engineering - 4.4.6-8 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Tue Jan 04 2022 Guido Aulisi - 4.4.6-7 -- Require a generic mail program (#2036844) - -* Thu Jul 22 2021 Fedora Release Engineering - 4.4.6-6 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Fri May 21 2021 Jitka Plesnikova - 4.4.6-5 -- Perl 5.34 rebuild - -* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 4.4.6-4 -- Rebuilt for updated systemd-rpm-macros - See https://pagure.io/fesco/issue/2583. +* Wed Mar 03 2021 Guido Aulisi - 4.4.6-4 +- Add missing require for nagios-plugins-ping +- Fix run path * Sat Feb 27 2021 Guido Aulisi - 4.4.6-3 - Require plugins needed for localhost monitoring (#1932297) diff --git a/nagios.te b/nagios.te index b86a8dd..60c9803 100644 --- a/nagios.te +++ b/nagios.te @@ -94,7 +94,7 @@ files_pid_file(nrpe_var_run_t) allow nagios_plugin_domain self:fifo_file rw_fifo_file_perms; -allow nrpe_t nagios_plugin_domain:process { sigkill signal }; +allow nrpe_t nagios_plugin_domain:process { signal sigkill }; allow nagios_t nagios_plugin_domain:process signal_perms; allow nagios_plugin_domain nagios_t:process signal_perms; @@ -127,7 +127,7 @@ allow nagios_t nagios_plugin_domain:process signal_perms; allow nagios_t nagios_eventhandler_plugin_exec_t:dir list_dir_perms; allow nagios_t nagios_etc_t:dir list_dir_perms; -allow nagios_t nagios_etc_t:file { map read_file_perms }; +allow nagios_t nagios_etc_t:file { read_file_perms map }; allow nagios_t nagios_etc_t:lnk_file read_lnk_file_perms; #allow nagios_t nagios_log_t:dir setattr_dir_perms; @@ -206,7 +206,7 @@ mta_kill_system_mail(nagios_t) systemd_exec_systemctl(nagios_t) tunable_policy(`nagios_run_sudo',` - allow nagios_t self:capability { chown setgid setuid sys_ptrace sys_resource }; + allow nagios_t self:capability { chown setuid setgid sys_resource sys_ptrace }; allow nagios_t self:process { setrlimit setsched }; allow nagios_t self:key write; @@ -316,13 +316,13 @@ optional_policy(` # Nrpe local policy # -allow nrpe_t self:capability { kill setgid setuid }; -dontaudit nrpe_t self:capability { sys_resource sys_tty_config }; -allow nrpe_t self:process { setpgid setrlimit setsched signal_perms }; +allow nrpe_t self:capability { setuid setgid kill }; +dontaudit nrpe_t self:capability { sys_tty_config sys_resource }; +allow nrpe_t self:process { setpgid signal_perms setsched setrlimit }; allow nrpe_t self:fifo_file rw_fifo_file_perms; allow nrpe_t self:tcp_socket { accept listen }; -allow nrpe_t nagios_plugin_domain:process { sigkill signal }; +allow nrpe_t nagios_plugin_domain:process { signal sigkill }; list_dirs_pattern(nrpe_t, nrpe_etc_t, nrpe_etc_t) read_files_pattern(nrpe_t, nagios_etc_t, nrpe_etc_t) @@ -372,7 +372,7 @@ logging_send_syslog_msg(nrpe_t) userdom_dontaudit_use_unpriv_user_fds(nrpe_t) tunable_policy(`nagios_run_sudo',` - allow nrpe_t self:capability { setgid setuid sys_ptrace sys_resource }; + allow nrpe_t self:capability { setuid setgid sys_resource sys_ptrace }; allow nrpe_t self:process { setrlimit setsched }; allow nrpe_t self:key write; @@ -390,6 +390,7 @@ tunable_policy(`nagios_run_sudo',` systemd_write_inherited_logind_sessions_pipes(nrpe_t) systemd_dbus_chat_logind(nrpe_t) + systemd_logind_read_state(nrpe_t) logging_send_audit_msgs(nrpe_t) ') @@ -467,7 +468,7 @@ files_getattr_all_file_type_fs(nagios_admin_plugin_t) # Mail local policy # -allow nagios_mail_plugin_t self:capability { dac_read_search setgid setuid }; +allow nagios_mail_plugin_t self:capability { setuid setgid dac_read_search }; allow nagios_mail_plugin_t self:netlink_route_socket r_netlink_socket_perms; allow nagios_mail_plugin_t self:tcp_socket create_stream_socket_perms; allow nagios_mail_plugin_t self:udp_socket create_socket_perms; @@ -520,8 +521,8 @@ storage_raw_read_fixed_disk(nagios_checkdisk_plugin_t) # Services local policy # -allow nagios_services_plugin_t self:capability { net_bind_service net_raw setuid }; -allow nagios_services_plugin_t self:process { sigkill signal }; +allow nagios_services_plugin_t self:capability { setuid net_bind_service net_raw }; +allow nagios_services_plugin_t self:process { signal sigkill }; allow nagios_services_plugin_t self:tcp_socket create_stream_socket_perms; allow nagios_services_plugin_t self:udp_socket create_socket_perms; allow nagios_services_plugin_t self:unix_dgram_socket create_socket_perms; @@ -575,7 +576,7 @@ optional_policy(` # allow nagios_system_plugin_t self:capability { dac_read_search }; -dontaudit nagios_system_plugin_t self:capability { setgid setuid }; +dontaudit nagios_system_plugin_t self:capability { setuid setgid }; allow nagios_system_plugin_t nrpe_exec_t:file read_file_perms; allow nagios_system_plugin_t nagios_exec_t:file read_file_perms; diff --git a/sources b/sources index a618899..8d9f3c3 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (nagioscore-nagios-4.5.9.tar.gz) = 90bd71f772b6686b32fbe5f543468938f0dfc9c5bade1d41c27d63b1971d5000d16d6ca843b3eccab5550daa1bc649f16e8d68890052149126601a060ac9230d +SHA512 (nagioscore-nagios-4.4.6.tar.gz) = db3a205f1675693301c059b0ecdc767cdc423923cff0729c5584a48e04fb18d6c119d51991dd24290a539eb8578b2cb82316275039b36827871bb028883b495f diff --git a/tests/tests-DSP.yml b/tests/tests-DSP.yml deleted file mode 100644 index dd978d0..0000000 --- a/tests/tests-DSP.yml +++ /dev/null @@ -1,41 +0,0 @@ -- hosts: localhost - - roles: - - role: standard-test-beakerlib - tags: - - classic - repositories: - - repo: https://pagure.io/DSP_test.git - dest: DSP_test - version: master - - tests: - - DSP_test - environment: - # RPM package containing the policy module - TEST_RPM: nagios-selinux - # policy module name - TEST_POLICY: nagios - # policy sources will be extracted from corresponding .src.rpm - # policy tar filename regexp (e.g. "usbguard-selinux*.tar.gz") - # or empty string if policy sources are not inside a tar archive - POLICY_TAR: '' - # path to policy sources (in of the tar archive) -- //.(te|if|fc) - # or path in the src.rpm if there is no tar archive -- //.(te|if|fc) - # can contain wildcards (e.g. for versions etc.) - POLICY_PATH: . - # allow rules ignored by "Unsound/dangerous policy practices" test - IGNORE_RULES: >- - nagios_script_t:system_map_t:file - nagios_script_t:boot_t:dir - - required_packages: - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console - - libselinux-utils - - rpm - - tar - - git - - nagios-selinux