Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild

See https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers.

.gitignore

@@ -16,3 +16,10 @@ nagios-3.2.1.tar.gz
 /nagioscore-nagios-4.4.2.tar.gz
 /nagioscore-nagios-4.4.3.tar.gz
 /nagioscore-nagios-4.4.5.tar.gz
+/nagioscore-nagios-4.4.6.tar.gz
+/nagioscore-nagios-4.4.7.tar.gz
+/nagioscore-nagios-4.4.8.tar.gz
+/nagioscore-nagios-4.4.9.tar.gz
+/nagioscore-nagios-4.4.10.tar.gz
+/nagioscore-nagios-4.4.14.tar.gz
+/nagioscore-nagios-4.5.9.tar.gz

nagios-0003-Install-config-files-too.patch

@@ -1,7 +1,8 @@
-diff -up ./Makefile.in.install_config ./Makefile.in
---- ./Makefile.in.install_config	2017-04-19 19:11:47.783707415 -0400
-+++ ./Makefile.in	2017-04-19 19:11:47.785707384 -0400
-@@ -377,7 +377,7 @@ dox:
+diff --git a/Makefile.in b/Makefile.in
+index b992ab1e..ef2a797f 100644
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -439,7 +439,7 @@ dox:
  	doxygen doxy.conf
  
  

nagios-0009-fix-localstatedir-for-linux.patch

@@ -264,9 +264,9 @@ diff -up ./startup/default-service.in.fix_localstatedir ./startup/default-servic
  ExecStop=@BIN_KILL@ -s TERM ${MAINPID}
 -ExecStopPost=@BIN_RM@ -f @localstatedir@/rw/nagios.cmd
 +ExecStopPost=@BIN_RM@ -f @localstatedir@/spool/nagios/cmd/nagios.cmd
+ ExecReload=@bindir@/nagios -v @sysconfdir@/nagios.cfg
  ExecReload=@BIN_KILL@ -s HUP ${MAINPID}
  
- [Install]
 diff -up ./t-tap/Makefile.in.fix_localstatedir ./t-tap/Makefile.in
 --- ./t-tap/Makefile.in.fix_localstatedir	2019-01-16 14:24:14.944312569 -0600
 +++ ./t-tap/Makefile.in	2019-01-16 14:24:42.359858604 -0600

nagios-0010-remove-information-leak.patch

@@ -32,7 +32,7 @@ diff -up ./cgi/extinfo.c.remove_3rdparty_links ./cgi/extinfo.c
 diff -up ./cgi/status.c.remove_3rdparty_links ./cgi/status.c
 --- ./cgi/status.c.remove_3rdparty_links	2019-08-20 15:29:34.000000000 +0000
 +++ ./cgi/status.c	2019-08-29 18:17:32.322544264 +0000
-@@ -555,31 +555,8 @@ void document_header(int use_stylesheet)
+@@ -556,31 +556,8 @@ void document_header(int use_stylesheet)
  	/* JS function to append content to elements on page */
  	printf("<script type='text/javascript'>\n");
  	if (enable_page_tour == TRUE) {
@@ -86,10 +86,11 @@ diff -up ./cgi/tac.c.remove_3rdparty_links ./cgi/tac.c
  
  
  
-diff -up ./html/main.php.remove_3rdparty_links ./html/main.php
---- ./html/main.php.remove_3rdparty_links	2019-08-20 15:29:34.000000000 +0000
-+++ ./html/main.php	2019-08-29 18:20:16.216716704 +0000
-@@ -19,20 +19,7 @@ $this_year = '2019';
+diff --git a/html/main.php b/html/main.php
+index 15713f8d..91cb1266 100644
+--- a/html/main.php
++++ b/html/main.php
+@@ -23,21 +23,7 @@ if ($theme != 'dark' && $theme != 'light') {
  
  <script type='text/javascript'>
  	var cookie;
@@ -100,67 +101,14 @@ diff -up ./html/main.php.remove_3rdparty_links ./html/main.php
 -						"Click here to watch the entire Nagios Core 4 Tour!</a>";
 -	<?php } ?>
  	$(document).ready(function() {
--		var user = "<?php echo htmlspecialchars($_SERVER['REMOTE_USER']); ?>";
+-		var user = "<?php echo htmlspecialchars($_SERVER['REMOTE_USER'] ?? ''); ?>";
 -
 -		<?php if ($cfg["enable_page_tour"]) { ?>
 -			vBoxId += ";" + user;
 -			vbox = new vidbox({pos:'lr',vidurl:'https://www.youtube.com/embed/2hVBAet-XpY',
 -								text:vboxText,vidid:vBoxId});
 -		<?php } ?>
- 		loadRemoteFeed( // Our top banner splash.
- 			'#splashbox0-contents', 'corebanner', 1,
- 			'', processBannerItem, ''
-@@ -59,7 +46,6 @@ $this_year = '2019';
- 			crossDomain: true,
- 			success: function(d, status, jqXHR) {
- 				// We should have Internet access, set the playlist HTML.
--				initializePlaylist();
- 
- 				var text = ''; // Start with empty text by default.
- 
-@@ -94,19 +80,6 @@ $this_year = '2019';
- 			: '';
- 	}
- 
 -
--	// Set our playlist HTML when we know we have Internet access.
--	var playlistInitialized = false;
--	function initializePlaylist() {
--		if (!playlistInitialized) {
--			playlistInitialized = true;
--			$('#splashbox3')
--				.addClass('splashbox3-full')
--				.removeClass('splashbox3-empty')
--				.html('<iframe width="100%" height="100%" src="//www.youtube.com/embed/videoseries?list=PLN-ryIrpC_mCUW1DFwZpxpAk00i60lSkE&iv_load_policy=3&rel=0" frameborder="0" allowfullscreen></iframe>');
--		}
--	}
--
- 	// Get the daemon status JSON.
- 	function getCoreStatus() {
- 		setCoreStatusHTML('passiveonly', 'Checking process status...');
-diff -up ./html/map.php.remove_3rdparty_links ./html/map.php
---- ./html/map.php.remove_3rdparty_links	2019-08-29 18:17:32.324544303 +0000
-+++ ./html/map.php	2019-08-29 18:20:48.488341376 +0000
-@@ -71,22 +71,6 @@
- 		<script type="text/javascript" src="js/jquery-1.12.4.min.js"></script>
- 		<script type="text/javascript" src="js/nag_funcs.js"></script>
+ 		getCoreStatus();
+ 	});
  
--		<?php if ($cfg["enable_page_tour"]) { ?>
--			<script type='text/javascript'>
--				var vbox;
--				var vBoxId = "map";
--				var vboxText = "<a href=https://www.nagios.com/tours target=_blank>" +
--							"Click here to watch the entire Nagios Core 4 Tour!</a>";
--				$(document).ready(function() {
--					var user = "<?php echo htmlspecialchars($_SERVER['REMOTE_USER']); ?>";
--
--					vBoxId += ";" + user;
--					vbox = new vidbox({pos:'lr',vidurl:'https://www.youtube.com/embed/leaRdb3BElI',
--										text:vboxText,vidid:vBoxId});
--				});
--			</script>
--		<?php } ?>
--
- 	</head>
- 	<body ng-controller="mapCtrl" <?php echo $img; ?>>
- 		<div id="image-cache" style="display: none;"></div>

nagios-0011-remove-rpmbuild.patch

@@ -1,12 +1,14 @@
-diff -up ./contrib/Makefile.in.remove_rpmbuild ./contrib/Makefile.in
---- ./contrib/Makefile.in.remove_rpmbuild	2019-08-29 18:23:14.113160181 +0000
-+++ ./contrib/Makefile.in	2019-08-29 18:24:20.509445391 +0000
-@@ -85,36 +85,3 @@ $(CGI_O): $(CGI_C)
+diff --git a/contrib/Makefile.in b/contrib/Makefile.in
+index 72e4d4a9..62415152 100644
+--- a/contrib/Makefile.in
++++ b/contrib/Makefile.in
+@@ -84,52 +84,3 @@ $(CGI_O): $(CGI_C)
+ 
  %.cgi : %.c
  	$(CC) $(CFLAGS) $(LDFLAGS) $< $(CGI_O) -o $@
- 
+-
 -##############################################################################
--# rpm making automation for CentOS/RHEL.
+-# making similar EPEL rpm for Fedora/RHEL/CentOS 
 -
 -ifneq ("$(wildcard /etc/redhat-release)","")
 -
@@ -25,16 +27,31 @@ diff -up ./contrib/Makefile.in.remove_rpmbuild ./contrib/Makefile.in
 -    endif
 -endif
 -
--rpm:
+-# Create our own tarball and put ino rpmbuild/SOURCES
+-localsrc-rpm:
 -	# create nagios tar ball.
 -	@(cd ..;rm -f nagios-@VERSION@)
 -	@(cd ..;ln -s . nagios-@VERSION@)
 -	@(cd ..;tar zhcf nagios-@VERSION@.tar.gz --exclude nagios-@VERSION@/nagios-@VERSION@.tar.gz --exclude nagios-@VERSION@/nagios-@VERSION@ --exclude RCS --exclude CVS --exclude build-* --exclude *~ --exclude .git* nagios-@VERSION@/)
 -	@(cd ..;rm -f nagios-@VERSION@)
 -	# build the rpm using rpmbuild from ./rmbuild as topdir
--	@rm -rf rpmbuild && mkdir -p rpmbuild/SOURCES
+-	@rm -rf rpmbuild && mkdir -p ./rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
 -	@cp  ../nagios-@VERSION@.tar.gz rpmbuild/SOURCES/nagios-@VERSION@.tar.gz
--	@rpmbuild -ba --define "_topdir ${PWD}/rpmbuild"   ../nagios.spec
+-	@cp epel-patches/* ./rpmbuild/SOURCES
+-	@rpmbuild -ba --define "_topdir ${PWD}/rpmbuild"   epel-nagios.spec
+-	@cp  rpmbuild/RPMS/$(RPM_ARCH)/*.rpm .
+-	@cp rpmbuild/SRPMS/*.src.rpm .
+-	@ls -l *.rpm
+-
+-# tarball from https://github.com/NagiosEnterprises/nagioscore/releases/download/nagios-%{version}/nagios-%{version}.tar.gz
+-rpm: init-epelrpm  build-epelrpm
 -	@mv rpmbuild/RPMS/$(RPM_ARCH)/*.rpm .
 -	@ls -l *.rpm
+-init-epelrpm: 
+-	# build the rpm using rpmbuild from ./rmbuild as topdir
+-	@rm -rf ./rpmbuild && mkdir -p ./rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
+-	@spectool -C ./rpmbuild/SOURCES -g epel-nagios.spec
+-	@cp epel-patches/* ./rpmbuild/SOURCES
+-build-epelrpm:
+-	@rpmbuild -ba --define "_topdir ${PWD}/rpmbuild"  epel-nagios.spec
 -endif

nagios-0015-Changelog.patch

@@ -0,0 +1,13 @@
+diff --git a/Changelog b/Changelog
+index a5fd04c6..51394645 100644
+--- a/Changelog
++++ b/Changelog
+@@ -9,7 +9,7 @@ FIXES
+ * Fixed duplicate properties appearing in statusjson.cgi (#718) (Sebastian Wolf)
+ * Fixed NERD not building when enabled in ./configure (#723) (Sebastian Wolf)
+ * Fixed build process when using GCC 10 (#721) (Michael Orlitzky)
+-* Fixed postauth vulnerabilities in histogram.js, map.js, trends.js (CVE-2020-1408) (Thanks UraSec Team) (Sebastian Wolf)
++* Fixed postauth vulnerabilities in histogram.js, map.js, trends.js (CVE-2020-13977) (Thanks UraSec Team) (Sebastian Wolf)
+ * When using systemd, configuration will be verified before reloading (#715) (tatref)
+ * Fixed HARD OK states triggering on the maximum check attempt (#757) (Sebastian Wolf)
+ 

nagios.if

@@ -334,3 +334,34 @@ interface(`nagios_unconfined_signull',`
 
 	allow $1 nagios_unconfined_plugin_t:process signull;
 ')
+
+########################################
+# 
+# Nagios interface compatibility blocks
+#
+# The following definitions ensure compatibility with distribution policy
+# versions that do not contain given interfaces (epel, or older Fedora
+# releases).
+# Each block tests for existence of given interface and defines it if needed.
+#
+
+########################################
+## <summary>
+##	Allow caller to signull sssd.
+##	Backport from RHEL8
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+ifndef(`sssd_signull',`
+	interface(`sssd_signull',`
+		gen_require(`
+			type sssd_t;
+		')
+
+		allow $1 sssd_t:process signull;
+	')
+')

nagios.spec

@@ -1,18 +1,17 @@
-%global _hardened_build 1
+# Set %%bcond_without bootstrap to build without depending on plugins for localhost monitoring
+%bcond_with bootstrap
+
 %global with_selinux 1
 %global selinuxtype targeted
 
-# https://gcc.gnu.org/gcc-10/porting_to.html#common
-# attempt to fix bugzilla 1793909
-%define _legacy_common_support 1
-
 Name:           nagios
-Version:        4.4.5
-Release:        9%{?dist}
+Version:        4.5.9
+Release:        2%{?dist}
 
 Summary: Host/service/network monitoring program
 
-License:        GPLv2
+# Automatically converted from old format: GPLv2 - review is highly recommended.
+License:        GPL-2.0-only
 URL:            https://www.nagios.org/projects/nagios-core/
 Source0:        https://github.com/NagiosEnterprises/nagioscore/archive/nagios-%{version}.tar.gz#/nagioscore-nagios-%{version}.tar.gz
 Source1: nagios.logrotate
@@ -31,9 +30,6 @@ Source14: nagios.te
 Source15: nagios.fc
 Source16: nagios.if
 
-# Patch 0 should be a patch that we get from the maint git tree in
-# order to fix any items upstream wanted.
-#Patch0: nagios-0000-git201706.patch
 Patch1: nagios-0001-default-init.patch
 # Sent upstream
 Patch2: nagios-0002-Fix-installation-of-httpd-conf.d-config-file.patch
@@ -41,8 +37,6 @@ Patch3: nagios-0003-Install-config-files-too.patch
 Patch4: nagios-0004-Fix-path-to-CGI-executables.patch
 Patch5: nagios-0005-Fixed-path-to-passwd-file-in-Apache-s-config-file.patch
 Patch6: nagios-0006-Added-several-images-to-the-sample-config-revb.patch
-#Patch7: nagios-0007-Apache-2.4-configuration-fix-for-Fedora-18.patch
-Patch8: nagios-0008-Add-cfg_dir-etc-nagios-conf.d-to-the-main-nagios-con.patch
 Patch9: nagios-0009-fix-localstatedir-for-linux.patch
 ## This has been requested for security groups not wanting to leak
 ## their nagios location.
@@ -53,7 +47,7 @@ Patch12: nagios-0012-fix-spool.patch
 Patch13: nagios-0013-fix-plugin.patch
 Patch14: nagios-0014-fix-uidgid.patch
 
-BuildRequires: make
+BuildRequires:  make
 BuildRequires:  doxygen
 BuildRequires:  gcc
 BuildRequires:  gd-devel > 1.8
@@ -71,6 +65,7 @@ BuildRequires:  perl(Test::HTML::Lint)
 %endif
 BuildRequires:  perl(Test::More)
 BuildRequires:  perl(Test::Simple)
+BuildRequires:  openssl-devel
 
 # For up-to-date config.sub and config.guess
 BuildRequires:  libtool
@@ -78,19 +73,25 @@ BuildRequires:  libtool
 # For selinux tools
 BuildRequires: checkpolicy, selinux-policy-devel
 
-%if 0%{?rhel} > 6 || 0%{?fedora} > 20
-# For necessary macros
-BuildRequires:  systemd
-%endif
-
 Requires:       httpd
 Requires:       php
-Requires:       perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
-Requires:       mailx
+Requires:       %{_bindir}/mail
 Requires:       nagios-common
 Requires:       user(nagios)
 Requires:       group(nagios)
 
+# This plugins are required for localhost monitoring
+%if %{without bootstrap}
+Requires:       nagios-plugins-ping
+Requires:       nagios-plugins-load
+Requires:       nagios-plugins-users
+Requires:       nagios-plugins-http
+Requires:       nagios-plugins-disk
+Requires:       nagios-plugins-ssh
+Requires:       nagios-plugins-swap
+Requires:       nagios-plugins-procs
+%endif
+
 %if 0%{?with_selinux}
 # This ensures that the *-selinux package and all it’s dependencies are not pulled
 # into containers and other systems that do not use SELinux
@@ -125,7 +126,6 @@ files for Nagios. Development files are built as a separate package.
 
 %package common
 Summary:        Provides common directories, uid and gid among nagios-related packages
-Requires(pre):  shadow-utils
 Requires(post): shadow-utils
 Provides:       user(nagios)
 Provides:       group(nagios)
@@ -155,7 +155,6 @@ may compile against.
 # SELinux subpackage
 %package selinux
 Summary:          SELinux context for %{name}
-Requires:         %{name} = %{version}-%{release}
 BuildArch:        noarch
 Requires:         selinux-policy-%{selinuxtype}
 Requires(post):   selinux-policy-%{selinuxtype}
@@ -181,26 +180,15 @@ Various contributed items used by plugins and other tools.
 %endif
 
 %prep
-%setup -q -n nagioscore-nagios-%{version}
-
-# patch0 would go here
-%patch1 -p1 -b .fix_el6_init
-%patch2 -p1 -b .fix_httpd_conf_d
-%patch3 -p0 -b .install_config
-%patch4 -p1 -b .fix_path_to_cgi
-%patch5 -p1 -b .fix_path_to_passwd
-%patch6 -p1 -b .more_images
-
-#%patch8 -p1 -b .conf_d
-%patch9 -p1 -b .fix_localstatedir
-%patch10 -p1 -b .remove_3rdparty_links
-%patch11 -p1 -b .remove_rpmbuild
-%patch12 -p1 -b .fix_spool
-%patch13 -p1 -b .fix_plugin
-%patch14 -p1 -b .fix_uidgid
+%autosetup -p1 -n nagioscore-nagios-%{version}
 
 install -p -m 0644 %{SOURCE10} %{SOURCE11} %{SOURCE12} html/images/logos/
 
+# Create a sysusers.d config file
+cat >nagios.sysusers.conf <<EOF
+u nagios - - %{_localstatedir}/spool/%{name} -
+EOF
+
 
 %build
 %configure \
@@ -235,14 +223,16 @@ install -p -m 0644 %{SOURCE10} %{SOURCE11} %{SOURCE12} html/images/logos/
     --with-template-objects \
     --with-template-extinfo \
     --enable-event-broker \
+    --disable-static \
     STRIP=/bin/true
-make %{?_smp_mflags} all
+
+%make_build all
 
 ### Build our documentation
-%{__make} dox
+%make_build dox
 
 ### Apparently contrib does not obey configure !
-%{__make} %{?_smp_mflags} -C contrib
+%make_build -C contrib
 
 
 sed -e "s|/usr/lib/|%{_libdir}/|" %{SOURCE2} > %{name}.htaccess
@@ -259,19 +249,19 @@ cp -p %{SOURCE14} selinux/
 cp -p %{SOURCE15} selinux/
 cp -p %{SOURCE16} selinux/
 
-make -f %{_datadir}/selinux/devel/Makefile %{name}.pp
+%make_build -f %{_datadir}/selinux/devel/Makefile %{name}.pp
 bzip2 -9 %{name}.pp
 %endif
 
 
 %install
-rm -rf $RPM_BUILD_ROOT
-
-make DESTDIR=%{buildroot} INIT_OPTS="" INSTALL_OPTS="" COMMAND_OPTS="" CGIDIR="%{_libdir}/%{name}/cgi-bin" CFGDIR="%{_sysconfdir}/%{name}" fullinstall
+%make_install INIT_OPTS="" INSTALL_OPTS="" COMMAND_OPTS="" CGIDIR="%{_libdir}/%{name}/cgi-bin" CFGDIR="%{_sysconfdir}/%{name}" fullinstall
 
 # relocated to sbin (Fedora-specific)
 install -d -m 0755 %{buildroot}%{_bindir}
+%if 0%{?fedora} < 42 && 0%{?rhel} < 11
 mv %{buildroot}%{_sbindir}/nagiostats %{buildroot}%{_bindir}/nagiostats
+%endif
 
 install -d -m 0755 %{buildroot}%{_sysconfdir}/%{name}/private
 mv %{buildroot}%{_sysconfdir}/%{name}/resource.cfg %{buildroot}%{_sysconfdir}/%{name}/private/resource.cfg
@@ -289,16 +279,16 @@ install -d -m 0755 %{buildroot}%{_libdir}/%{name}/plugins/eventhandlers
 install -d -m 0755 %{buildroot}%{_libdir}/%{name}/plugins/eventhandlers/distributed-monitoring/
 install -d -m 0755 %{buildroot}%{_libdir}/%{name}/plugins/eventhandlers/redundancy-scenario1/
 
-install -d -m 0775 %{buildroot}%{_localstatedir}/spool/%{name}/cmd
-install -d -m 0775 %{buildroot}%{_localstatedir}/run/%{name}
+install -d -m 0755 %{buildroot}%{_localstatedir}/spool/%{name}/cmd
+install -d -m 0755 %{buildroot}%{_localstatedir}/run/%{name}
 
 # Make a run directory
-install -d -m 0775 %{buildroot}%{_localstatedir}/run/%{name}
+install -d -m 0755 %{buildroot}%{_localstatedir}/run/%{name}
 
 # Make logdirs
-install -d -m 0775 %{buildroot}/%{_localstatedir}/log/
-install -d -m 0775 %{buildroot}/%{_localstatedir}/log/%{name}/
-install -d -m 0775 %{buildroot}/%{_localstatedir}/log/%{name}/archives
+install -d -m 0755 %{buildroot}/%{_localstatedir}/log/
+install -d -m 0755 %{buildroot}/%{_localstatedir}/log/%{name}/
+install -d -m 0755 %{buildroot}/%{_localstatedir}/log/%{name}/archives
 
 # Use systemd unit on rhel7 or any supported Fedora
 %if 0%{?rhel} > 6 || 0%{?fedora} > 20
@@ -307,22 +297,27 @@ install -D -m 0644 -p %{SOURCE8} %{buildroot}%{_tmpfilesdir}/%{name}.conf
 
 # Remove SystemV init-script
 rm -f %{buildroot}%{_initrddir}/nagios
+
+# Fix systemd unit file permissions #1676334
+chmod -x %{buildroot}%{_unitdir}/%{name}.service
 %endif
 
 # Fix permissions - FIXME remove this when unneeded
-chmod 755 %{buildroot}%{_sbindir}/nagios
+chmod 755 %{buildroot}%{_sbindir}/nagios %{buildroot}%{_bindir}/nagiostats
 
 # Install documentation
 install -d -m 0755 %{buildroot}%{_datadir}/nagios/html/docs
-%{__cp} -a Documentation/html/* %{buildroot}%{_datadir}/nagios/html/docs
+%{__cp} -r Documentation/html/* %{buildroot}%{_datadir}/nagios/html/docs
 
 %if 0%{?with_selinux}
 install -pm 0644 %{SOURCE13} README.SELinux.rst
 install -D -m 0644 %{name}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
+install -D -p -m 0644 selinux/%{name}.if %{buildroot}%{_datadir}/selinux/devel/include/distributed/%{name}.if
+
 %endif
 
 ### CONTRIB ITEMS TAKEN FROM UPSTREAM NAGIOS SPEC
-make install -C contrib DESTDIR="%{buildroot}" INSTALL_OPTS=""
+%make_install -C contrib INSTALL_OPTS=""
 install -p -m 644 contrib/eventhandlers/disable_active_service_checks %{buildroot}%{_libdir}/nagios/plugins/eventhandlers/
 install -p -m 644 contrib/eventhandlers/disable_notifications %{buildroot}%{_libdir}/nagios/plugins/eventhandlers/
 install -p -m 644 contrib/eventhandlers/enable_active_service_checks %{buildroot}%{_libdir}/nagios/plugins/eventhandlers/
@@ -336,10 +331,11 @@ install -p -m 644 contrib/eventhandlers/redundancy-scenario1/handle-master-proc-
 
 %{__mv} contrib/README contrib/README.contrib
 
-%pre common
-getent group nagios >/dev/null || groupadd -r nagios
-getent passwd nagios >/dev/null || useradd -r -g nagios -d %{_localstatedir}/spool/%{name} -s /sbin/nologin nagios
-exit 0
+# Fix permissions #2275532
+chmod -R g-w %{buildroot}%{_datadir}/%{name} %{buildroot}%{_libdir}/%{name} %{buildroot}%{_sysconfdir} %{buildroot}%{_sbindir}
+
+install -m0644 -D nagios.sysusers.conf %{buildroot}%{_sysusersdir}/nagios.conf
+
 
 
 %post
@@ -422,13 +418,16 @@ fi
 %dir %{_datadir}/%{name}
 %dir %{_datadir}/%{name}/html
 %doc %{_datadir}/%{name}/html/docs
-%doc Changelog INSTALLING LICENSE README.md UPGRADING UpgradeToVersion4.ReadMe UpgradeToVersion4.sh
+%doc Changelog INSTALLING README.md UPGRADING UpgradeToVersion4.ReadMe UpgradeToVersion4.sh
 %doc internet.cfg
+%license LICENSE
 %{_datadir}/%{name}/html/[^cd]*
 %{_datadir}/%{name}/html/contexthelp/
-%{_datadir}/%{name}/html/d3/
 
+%if 0%{?fedora} < 42 && 0%{?rhel} < 11
 %{_sbindir}/*
+%endif
+
 %{_bindir}/*
 %{_libdir}/%{name}/cgi-bin/*cgi
 %if 0%{?rhel} > 6 || 0%{?fedora} > 20
@@ -447,11 +446,11 @@ fi
 %attr(0640,root,nagios) %config(noreplace) %{_sysconfdir}/%{name}/private/resource.cfg
 %attr(0640,root,apache) %config(noreplace) %{_sysconfdir}/%{name}/passwd
 %attr(0640,root,apache) %config(noreplace) %{_datadir}/%{name}/html/config.inc.php
-%attr(2775,nagios,nagios) %dir %{_localstatedir}/spool/%{name}/cmd
+%attr(2755,nagios,nagios) %dir %{_localstatedir}/spool/%{name}/cmd
 %attr(0750,nagios,nagios) %dir %{_localstatedir}/run/%{name}
 %attr(0750,nagios,nagios) %dir %{_localstatedir}/log/%{name}
 %attr(0750,nagios,nagios) %dir %{_localstatedir}/log/%{name}/archives
-%attr(0770,nagios,nagios) %dir %{_localstatedir}/spool/%{name}/checkresults
+%attr(0750,nagios,nagios) %dir %{_localstatedir}/spool/%{name}/checkresults
 
 %files common
 %dir %{_sysconfdir}/%{name}
@@ -459,6 +458,7 @@ fi
 %attr(0755,root,root) %dir %{_libdir}/%{name}/plugins
 %attr(0755,root,root) %dir %{_libdir}/%{name}/plugins/eventhandlers/
 %attr(0755,nagios,nagios) %dir %{_localstatedir}/spool/%{name}
+%{_sysusersdir}/nagios.conf
 
 
 %files devel
@@ -469,7 +469,8 @@ fi
 %files selinux
 %doc README.SELinux.rst
 %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.*
-%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name}
+%{_datadir}/selinux/devel/include/distributed/%{name}.if
+%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name}
 %endif
 
 
@@ -479,6 +480,94 @@ fi
 %{_libdir}/%{name}/cgi/
 
 %changelog
+* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 4.5.9-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Tue May 13 2025 Guido Aulisi <guido.aulisi@inps.it> - 4.5.9-1
+- Update to 4.5.9
+
+* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 4.4.14-8
+- Add sysusers.d config file to allow rpm to create users/groups automatically
+
+* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.14-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Mon Jul 29 2024 Miroslav Suchý <msuchy@redhat.com> - 4.4.14-6
+- convert license to SPDX
+
+* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.14-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Sat Apr 27 2024 Guido Aulisi <guido.aulisi@gmail.com> - 4.4.14-4
+- Fix permissions (#2275532)
+
+* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.14-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.14-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Wed Aug 16 2023 Guido Aulisi <guido.aulisi@gmail.com> - 4.4.14-1
+- Update to 4.4.14
+
+* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.10-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Mon Feb 13 2023 Guido Aulisi <guido.aulisi@gmail.com> - 4.4.10-1
+- Update to 4.4.10
+- Fix nagiostats permissions #2169033
+
+* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.9-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Sat Dec 10 2022 Florian Weimer <fweimer@redhat.com> - 4.4.9-2
+- Port configure script to C99
+
+* Thu Nov 17 2022 Guido Aulisi <guido.aulisi@gmail.com> - 4.4.9-1
+- Update to 4.4.9
+
+* Sun Oct 23 2022 Guido Aulisi <guido.aulisi@gmail.com> - 4.4.8-1
+- Update to 4.4.8
+
+* Sun Sep 25 2022 Guido Aulisi <guido.aulisi@gmail.com> - 4.4.7-1
+- Update to 4.4.7
+
+* Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.6-10
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Wed Jun 01 2022 Jitka Plesnikova <jplesnik@redhat.com> - 4.4.6-9
+- Perl 5.36 rebuild
+
+* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.6-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Tue Jan 04 2022 Guido Aulisi <guido.aulisi@gmail.com> - 4.4.6-7
+- Require a generic mail program (#2036844)
+
+* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.6-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Fri May 21 2021 Jitka Plesnikova <jplesnik@redhat.com> - 4.4.6-5
+- Perl 5.34 rebuild
+
+* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 4.4.6-4
+- Rebuilt for updated systemd-rpm-macros
+  See https://pagure.io/fesco/issue/2583.
+
+* Sat Feb 27 2021 Guido Aulisi <guido.aulisi@gmail.com> - 4.4.6-3
+- Require plugins needed for localhost monitoring (#1932297)
+
+* Tue Feb 23 2021 Guido Aulisi <guido.aulisi@gmail.com> - 4.4.6-2
+- Fix systemd unit file permissions #1676334
+
+* Sat Feb 20 2021 Guido Aulisi <guido.aulisi@gmail.com> - 4.4.6-1
+- Update to 4.4.6
+- Fix for CVE-2020-13977 #BZ1849087
+- Some spec cleanup
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.5-10
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
 * Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.5-9
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
 

nagios.te

@@ -94,7 +94,7 @@ files_pid_file(nrpe_var_run_t)
 
 allow nagios_plugin_domain self:fifo_file rw_fifo_file_perms;
 
-allow nrpe_t nagios_plugin_domain:process { signal sigkill };
+allow nrpe_t nagios_plugin_domain:process { sigkill signal };
    
 allow nagios_t nagios_plugin_domain:process signal_perms;
 allow nagios_plugin_domain nagios_t:process signal_perms;
@@ -127,7 +127,7 @@ allow nagios_t nagios_plugin_domain:process signal_perms;
 allow nagios_t nagios_eventhandler_plugin_exec_t:dir list_dir_perms;
 
 allow nagios_t nagios_etc_t:dir list_dir_perms;
-allow nagios_t nagios_etc_t:file { read_file_perms map };
+allow nagios_t nagios_etc_t:file { map read_file_perms };
 allow nagios_t nagios_etc_t:lnk_file read_lnk_file_perms;
 
 #allow nagios_t nagios_log_t:dir setattr_dir_perms;
@@ -206,7 +206,7 @@ mta_kill_system_mail(nagios_t)
 systemd_exec_systemctl(nagios_t)
 
 tunable_policy(`nagios_run_sudo',`
-    allow nagios_t self:capability { chown setuid setgid sys_resource sys_ptrace };
+    allow nagios_t self:capability { chown setgid setuid sys_ptrace sys_resource };
     allow nagios_t self:process { setrlimit setsched };
 
     allow nagios_t self:key write;
@@ -316,13 +316,13 @@ optional_policy(`
 # Nrpe local policy
 #
 
-allow nrpe_t self:capability { setuid setgid kill };
-dontaudit nrpe_t self:capability { sys_tty_config sys_resource };
-allow nrpe_t self:process { setpgid signal_perms setsched setrlimit };
+allow nrpe_t self:capability { kill setgid setuid };
+dontaudit nrpe_t self:capability { sys_resource sys_tty_config };
+allow nrpe_t self:process { setpgid setrlimit setsched signal_perms };
 allow nrpe_t self:fifo_file rw_fifo_file_perms;
 allow nrpe_t self:tcp_socket { accept listen };
 
-allow nrpe_t nagios_plugin_domain:process { signal sigkill };
+allow nrpe_t nagios_plugin_domain:process { sigkill signal };
 
 list_dirs_pattern(nrpe_t, nrpe_etc_t, nrpe_etc_t)
 read_files_pattern(nrpe_t, nagios_etc_t, nrpe_etc_t)
@@ -372,7 +372,7 @@ logging_send_syslog_msg(nrpe_t)
 userdom_dontaudit_use_unpriv_user_fds(nrpe_t)
 
 tunable_policy(`nagios_run_sudo',`
-    allow nrpe_t self:capability { setuid setgid sys_resource sys_ptrace };
+    allow nrpe_t self:capability { setgid setuid sys_ptrace sys_resource };
     allow nrpe_t self:process { setrlimit setsched };
 
     allow nrpe_t self:key write;
@@ -390,7 +390,6 @@ tunable_policy(`nagios_run_sudo',`
 
     systemd_write_inherited_logind_sessions_pipes(nrpe_t)
     systemd_dbus_chat_logind(nrpe_t)
-    systemd_logind_read_state(nrpe_t)
 
     logging_send_audit_msgs(nrpe_t)
 ')
@@ -468,7 +467,7 @@ files_getattr_all_file_type_fs(nagios_admin_plugin_t)
 # Mail local policy
 #
 
-allow nagios_mail_plugin_t self:capability { setuid setgid dac_read_search  };
+allow nagios_mail_plugin_t self:capability { dac_read_search setgid setuid };
 allow nagios_mail_plugin_t self:netlink_route_socket r_netlink_socket_perms;
 allow nagios_mail_plugin_t self:tcp_socket create_stream_socket_perms;
 allow nagios_mail_plugin_t self:udp_socket create_socket_perms;
@@ -521,8 +520,8 @@ storage_raw_read_fixed_disk(nagios_checkdisk_plugin_t)
 # Services local policy
 #
 
-allow nagios_services_plugin_t self:capability { setuid net_bind_service net_raw };
-allow nagios_services_plugin_t self:process { signal sigkill };
+allow nagios_services_plugin_t self:capability { net_bind_service net_raw setuid };
+allow nagios_services_plugin_t self:process { sigkill signal };
 allow nagios_services_plugin_t self:tcp_socket create_stream_socket_perms;
 allow nagios_services_plugin_t self:udp_socket create_socket_perms;
 allow nagios_services_plugin_t self:unix_dgram_socket create_socket_perms;
@@ -576,7 +575,7 @@ optional_policy(`
 #
 
 allow nagios_system_plugin_t self:capability { dac_read_search  };
-dontaudit nagios_system_plugin_t self:capability { setuid setgid };
+dontaudit nagios_system_plugin_t self:capability { setgid setuid };
 
 allow nagios_system_plugin_t nrpe_exec_t:file read_file_perms;
 allow nagios_system_plugin_t nagios_exec_t:file read_file_perms;

nagios.tmpfiles.conf

@@ -1 +1 @@
-D /var/run/nagios 0755 nagios nagios -
+D /run/nagios 0755 nagios nagios -

sources

@@ -1 +1 @@
-SHA512 (nagioscore-nagios-4.4.5.tar.gz) = b2b4213dc9087c49a96506f514ec672476763e1ca928bf5de8494a0509b612a4a357989e719820328095489138375c9db292ac3c8129925c323220860e17bc49
+SHA512 (nagioscore-nagios-4.5.9.tar.gz) = 90bd71f772b6686b32fbe5f543468938f0dfc9c5bade1d41c27d63b1971d5000d16d6ca843b3eccab5550daa1bc649f16e8d68890052149126601a060ac9230d

tests/tests-DSP.yml

@@ -0,0 +1,41 @@
+- hosts: localhost
+
+  roles:
+  - role: standard-test-beakerlib
+    tags:
+    - classic
+    repositories:
+      - repo: https://pagure.io/DSP_test.git
+        dest: DSP_test
+        version: master
+
+    tests:
+    - DSP_test
+    environment:
+      # RPM package containing the policy module
+      TEST_RPM: nagios-selinux
+      # policy module name
+      TEST_POLICY: nagios
+      # policy sources will be extracted from corresponding .src.rpm
+      # policy tar filename regexp (e.g. "usbguard-selinux*.tar.gz") 
+      # or empty string if policy sources are not inside a tar archive
+      POLICY_TAR: ''
+      # path to policy sources (in of the tar archive) -- <POLICY_TAR>/<POLICY_PATH>/<TEST_POLICY>.(te|if|fc)
+      # or path in the src.rpm if there is no tar archive -- <src.rpm>/<POLICY_PATH>/<TEST_POLICY>.(te|if|fc)
+      # can contain wildcards (e.g. for versions etc.)
+      POLICY_PATH: .
+      # allow rules ignored by "Unsound/dangerous policy practices" test
+      IGNORE_RULES: >-
+        nagios_script_t:system_map_t:file
+        nagios_script_t:boot_t:dir
+
+    required_packages:
+    - policycoreutils
+    - selinux-policy
+    - selinux-policy-targeted
+    - setools-console
+    - libselinux-utils
+    - rpm
+    - tar
+    - git
+    - nagios-selinux