Rebase to 8.2310.0

resolves: rhbz#2232275

.gitignore

@@ -85,3 +85,10 @@ rsyslog-4.6.3.tar.gz
 /rsyslog-doc-8.2204.0.tar.gz
 /rsyslog-8.2210.0.tar.gz
 /rsyslog-doc-8.2210.0.tar.gz
+/rsyslog-8.2306.0.tar.gz
+/rsyslog-doc-8.2306.0.tar.gz
+/rsyslog-8.2308.0.tar.gz
+/rsyslog-doc-8.2308.0.tar.gz
+/qpid-proton-0.39.0.tar.gz
+/rsyslog-8.2310.0.tar.gz
+/rsyslog-doc-8.2310.0.tar.gz

rsyslog-8.2210.0-rhbz2127403-drop-capabilities.patch

@@ -1,261 +0,0 @@
-diff --git a/configure.ac b/configure.ac
-index 9f73a708d0..958c26245e 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -377,6 +377,28 @@ AC_ARG_ENABLE(fmhash,
- 	[enable_fmhash=yes]
- )
- 
-+AC_ARG_ENABLE(libcap-ng,
-+        [AS_HELP_STRING([--enable-libcap-ng],[Enable dropping capabilities to only the necessary set @<:@default=no@:>@])],
-+        [case "${enableval}" in
-+         yes) enable_libcapng="yes" ;;
-+          no) enable_libcapng="no" ;;
-+           *) AC_MSG_ERROR(bad value ${enableval} for --enable_libcapng) ;;
-+         esac],
-+        [enable_libcapng=no]
-+)
-+
-+if test "$enable_libcapng" = "yes"; then
-+        PKG_CHECK_MODULES(
-+                [LIBCAPNG],
-+                [libcap-ng >= 0.8.2],
-+                [AC_DEFINE([ENABLE_LIBCAPNG], [1], [Indicator that libcap-ng is present])],
-+                [AC_MSG_ERROR(libcap-ng is not present.)]
-+        )
-+        CFLAGS="$CFLAGS $LIBCAPNG_CFLAGS"
-+        LIBS="$LIBS $LIBCAPNG_LIBS"
-+fi
-+
-+
- AC_ARG_ENABLE(fmhash-xxhash,
- 	[AS_HELP_STRING([--enable-fmhash-xxhash],[Enable xxhash in fmhash support @<:@default=no@:>@])],
-         [case "${enableval}" in
-@@ -2820,6 +2842,8 @@ echo "    liblogging-stdlog support enabled:        $enable_liblogging_stdlog"
- echo "    libsystemd enabled:                       $enable_libsystemd"
- echo "    kafka static linking enabled:             $enable_kafka_static"
- echo "    atomic operations enabled:                $enable_atomic_operations"
-+echo "    libcap-ng support enabled:                $enable_libcapng"
-+
- echo
- echo "---{ input plugins }---"
- if test "$unamestr" != "AIX"; then
-diff --git a/runtime/debug.c b/runtime/debug.c
-index a655bc2e4e..6e6c9fd38f 100644
---- a/runtime/debug.c
-+++ b/runtime/debug.c
-@@ -250,7 +250,7 @@ r_dbgoprint( const char *srcname, obj_t *pObj, const char *fmt, ...)
- 
- 	if(!(Debug && debugging_on))
- 		return;
--	
-+
- 	if(!checkDbgFile(srcname)) {
- 		return;
- 	}
-@@ -435,7 +435,7 @@ rsRetVal dbgClassInit(void)
- {
- 	rsRetVal iRet;	/* do not use DEFiRet, as this makes calls into the debug system! */
- 
--	
-+
- 	(void) pthread_key_create(&keyThrdName, dbgThrdNameDestruct);
- 
- 	/* while we try not to use any of the real rsyslog code (to avoid infinite loops), we
-diff --git a/runtime/modules.c b/runtime/modules.c
-index 810b2e9b52..b39bd9f066 100644
---- a/runtime/modules.c
-+++ b/runtime/modules.c
-@@ -595,7 +595,7 @@ doModInit(pModInit_t modInit, uchar *name, void *pModHdlr, modInfo_t **pNewModul
- 	CHKiRet((*pNew->modQueryEtryPt)((uchar*)"getKeepType", &modGetKeepType));
- 	CHKiRet((*modGetKeepType)(&pNew->eKeepType));
- 	dbgprintf("module %s of type %d being loaded (keepType=%d).\n", name, pNew->eType, pNew->eKeepType);
--	
-+
- 	/* OK, we know we can successfully work with the module. So we now fill the
- 	 * rest of the data elements. First we load the interfaces common to all
- 	 * module types.
-@@ -1242,7 +1242,7 @@ Load(uchar *const pModName, const sbool bConfLoad, struct nvlst *const lst)
- 		}
- 
- 		iLoadCnt++;
--	
-+
- 	} while(pModHdlr == NULL && *pModName != '/' && pModDirNext);
- 
- 	if(load_err_msg != NULL) {
-@@ -1323,7 +1323,7 @@ modulesProcessCnf(struct cnfobj *o)
- 
- 	cnfModName = (uchar*)es_str2cstr(pvals[typeIdx].val.d.estr, NULL);
- 	iRet = Load(cnfModName, 1, o->nvlst);
--	
-+
- finalize_it:
- 	free(cnfModName);
- 	cnfparamvalsDestruct(pvals, &pblk);
-diff --git a/runtime/rsconf.c b/runtime/rsconf.c
-index 4620ff8d13..de2a21b406 100644
---- a/runtime/rsconf.c
-+++ b/runtime/rsconf.c
-@@ -34,6 +34,10 @@
- #include <sys/types.h>
- #include <sys/stat.h>
- #include <sys/socket.h>
-+#ifdef ENABLE_LIBCAPNG
-+	#include <cap-ng.h>
-+#endif
-+
- 
- #include "rsyslog.h"
- #include "obj.h"
-@@ -656,6 +660,7 @@ rsRetVal doDropPrivGid(rsconf_t *cnf)
- 	uchar szBuf[1024];
- 	DEFiRet;
- 
-+#ifndef ENABLE_LIBCAPNG
- 	if(!cnf->globals.gidDropPrivKeepSupplemental) {
- 		res = setgroups(0, NULL); /* remove all supplemental group IDs */
- 		if(res) {
-@@ -668,9 +673,19 @@ rsRetVal doDropPrivGid(rsconf_t *cnf)
- 	res = setgid(cnf->globals.gidDropPriv);
- 	if(res) {
- 		LogError(errno, RS_RET_ERR_DROP_PRIV,
--				"could not set requested group id %d", cnf->globals.gidDropPriv);
-+				"could not set requested group id %d via setgid()", cnf->globals.gidDropPriv);
- 		ABORT_FINALIZE(RS_RET_ERR_DROP_PRIV);
- 	}
-+#else
-+	int capng_flags = cnf->globals.gidDropPrivKeepSupplemental ? CAPNG_NO_FLAG : CAPNG_DROP_SUPP_GRP;
-+	res = capng_change_id(-1, cnf->globals.gidDropPriv, capng_flags);
-+	if (res) {
-+		LogError(0, RS_RET_LIBCAPNG_ERR,
-+				"could not set requested group id %d via capng_change_id()", cnf->globals.gidDropPriv);
-+		ABORT_FINALIZE(RS_RET_LIBCAPNG_ERR);
-+	}
-+#endif
-+
- 	DBGPRINTF("setgid(%d): %d\n", cnf->globals.gidDropPriv, res);
- 	snprintf((char*)szBuf, sizeof(szBuf), "rsyslogd's groupid changed to %d",
- 		 cnf->globals.gidDropPriv);
-@@ -705,12 +720,18 @@ static void doDropPrivUid(rsconf_t *cnf)
- 			cnf->globals.uidDropPriv);
- 	}
- 
-+#ifndef ENABLE_LIBCAPNG
- 	res = setuid(cnf->globals.uidDropPriv);
-+#else
-+	int capng_flags = cnf->globals.gidDropPrivKeepSupplemental ? CAPNG_NO_FLAG : CAPNG_DROP_SUPP_GRP;
-+	res = capng_change_id(cnf->globals.uidDropPriv, -1, capng_flags);
-+#endif
- 	if(res) {
- 		/* if we can not set the userid, this is fatal, so let's unconditionally abort */
- 		perror("could not set requested userid");
- 		exit(1);
- 	}
-+
- 	DBGPRINTF("setuid(%d): %d\n", cnf->globals.uidDropPriv, res);
- 	snprintf((char*)szBuf, sizeof(szBuf), "rsyslogd's userid changed to %d", cnf->globals.uidDropPriv);
- 	logmsgInternal(NO_ERRCODE, LOG_SYSLOG|LOG_INFO, szBuf, 0);
-@@ -739,6 +760,29 @@ dropPrivileges(rsconf_t *cnf)
- 			  cnf->globals.uidDropPriv);
- 	}
- 
-+#ifdef ENABLE_LIBCAPNG
-+	/* In case privileges were dropped, do not allow bypassing
-+	 * file read, write, and execute permission checks
-+	 */
-+	if (cnf->globals.gidDropPriv != 0 || cnf->globals.uidDropPriv != 0) {
-+		int capng_rc;
-+		if ((capng_rc = capng_update(CAPNG_DROP, CAPNG_EFFECTIVE|CAPNG_PERMITTED, CAP_DAC_OVERRIDE)) != 0) {
-+			LogError(0, RS_RET_LIBCAPNG_ERR,
-+				"could not update the internal posix capabilities settings "
-+				"based on the options passed to it, capng_update=%d\n", capng_rc);
-+			exit(-1);
-+		}
-+
-+		if ((capng_rc = capng_apply(CAPNG_SELECT_BOTH)) != 0) {
-+			LogError(0, RS_RET_LIBCAPNG_ERR,
-+				"could not transfer  the  specified  internal posix  capabilities "
-+				"settings to the kernel, capng_apply=%d\n", capng_rc);
-+			exit(-1);
-+		}
-+	}
-+
-+#endif
-+
- finalize_it:
- 	RETiRet;
- }
-diff --git a/runtime/rsyslog.h b/runtime/rsyslog.h
-index 908e5e7b73..01616d8f7d 100644
---- a/runtime/rsyslog.h
-+++ b/runtime/rsyslog.h
-@@ -604,6 +604,7 @@ enum rsRetVal_				/** return value. All methods return this if not specified oth
- 	RS_RET_REDIS_ERROR = -2452, /**< redis-specific error. See message foe details. */
- 	RS_RET_REDIS_AUTH_FAILED = -2453, /**< redis authentication failure */
- 	RS_RET_FAUP_INIT_OPTIONS_FAILED = -2454, /**< could not initialize faup options */
-+	RS_RET_LIBCAPNG_ERR = -2455, /**< error during dropping the capabilities */
- 
- 	/* RainerScript error messages (range 1000.. 1999) */
- 	RS_RET_SYSVAR_NOT_FOUND = 1001, /**< system variable could not be found (maybe misspelled) */
-diff --git a/tools/rsyslogd.c b/tools/rsyslogd.c
-index 31b91a1bd1..77d814b482 100644
---- a/tools/rsyslogd.c
-+++ b/tools/rsyslogd.c
-@@ -37,6 +37,9 @@
- #ifdef HAVE_LIBSYSTEMD
- #	include <systemd/sd-daemon.h>
- #endif
-+#ifdef ENABLE_LIBCAPNG
-+	#include <cap-ng.h>
-+#endif
- 
- #include "rsyslog.h"
- #include "wti.h"
-@@ -2167,6 +2170,46 @@ main(int argc, char **argv)
- 	fjson_global_do_case_sensitive_comparison(0);
- 
- 	dbgClassInit();
-+
-+#ifdef ENABLE_LIBCAPNG
-+	/*
-+	 * Drop capabilities to the necessary set
-+	 */
-+	int capng_rc;
-+	capng_clear(CAPNG_SELECT_BOTH);
-+
-+	if ((capng_rc = capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED,
-+		CAP_BLOCK_SUSPEND,
-+		CAP_CHOWN,
-+		CAP_IPC_LOCK,
-+		CAP_LEASE,
-+		CAP_NET_ADMIN,
-+		CAP_NET_BIND_SERVICE,
-+		CAP_DAC_OVERRIDE,
-+		CAP_SETGID,
-+		CAP_SETUID,
-+		CAP_SETPCAP,
-+		CAP_SYS_ADMIN,
-+		CAP_SYS_CHROOT,
-+		CAP_SYS_RESOURCE,
-+		CAP_SYSLOG,
-+		-1
-+	)) != 0) {
-+		LogError(0, RS_RET_LIBCAPNG_ERR,
-+				"could not update the internal posix capabilities settings "
-+				"based on the options passed to it, capng_updatev=%d\n", capng_rc);
-+		exit(-1);
-+	}
-+
-+	if ((capng_rc = capng_apply(CAPNG_SELECT_BOTH)) != 0) {
-+		LogError(0, RS_RET_LIBCAPNG_ERR,
-+			"could not transfer  the  specified  internal posix  capabilities "
-+			"settings to the kernel, capng_apply=%d\n", capng_rc);
-+		exit(-1);
-+	}
-+	DBGPRINTF("Capabilities were dropped successfully\n");
-+#endif
-+
- 	initAll(argc, argv);
- #ifdef HAVE_LIBSYSTEMD
- 	sd_notify(0, "READY=1");

rsyslog.spec

@@ -1,6 +1,7 @@
 %define rsyslog_statedir %{_sharedstatedir}/rsyslog
 %define rsyslog_pkidir %{_sysconfdir}/pki/rsyslog
 %define rsyslog_docdir %{_docdir}/rsyslog
+%define qpid_proton_v 0.39.0
 # The following packages are not enabled on rhel:
 #   hiredis, libdbi, mongodb, rabbitmq
 # The omamqp1 plugin is built differently as qpid-proton is not available on rhel
@@ -34,9 +35,9 @@
 
 Summary: Enhanced system logging and kernel message trapping daemon
 Name: rsyslog
-Version: 8.2210.0
-Release: 4%{?dist}
-License: (GPLv3+ and ASL 2.0)
+Version: 8.2310.0
+Release: 1%{?dist}
+License: GPL-3.0-or-later AND Apache-2.0
 URL: http://www.rsyslog.com/
 Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz
 Source1: http://www.rsyslog.com/files/download/rsyslog/%{name}-doc-%{version}.tar.gz
@@ -46,10 +47,7 @@ Source4: rsyslog.log
 Source5: rsyslog.service
 # Add qpid-proton as another source, enable omamqp1 module in a
 # separatae sub-package with it statically linked(see rhbz#1713427)
-Source6: qpid-proton-0.34.0.tar.gz
-
-Patch0: openssl3-compatibility.patch
-Patch1: rsyslog-8.2210.0-rhbz2127403-drop-capabilities.patch
+Source6: https://archive.apache.org/dist/qpid/proton/%{qpid_proton_v}/qpid-proton-%{qpid_proton_v}.tar.gz
 
 BuildRequires: make
 BuildRequires: gcc
@@ -382,13 +380,8 @@ mv build doc
 %if %{with omamqp1}
 # Unpack qpid-proton
 %setup -q -D -T -b 6
-pushd ..
-%patch0 -p1 -b .openssl-compatibility
-popd
 %endif
 
-%patch1 -p1 -b .libcap-ng
-
 %build
 %ifarch sparc64
 #sparc64 need big PIC
@@ -400,7 +393,7 @@ export CFLAGS="$RPM_OPT_FLAGS -fpic"
 %if %{with omamqp1}
 # build the proton first
 (
-	cd %{_builddir}/qpid-proton-0.34.0
+	cd %{_builddir}/qpid-proton-%{qpid_proton_v}
 	mkdir bld
 	cd bld
 
@@ -462,7 +455,7 @@ autoreconf -if
 	--enable-omrabbitmq \
 %endif
 %if %{with omamqp1}
-	--enable-omamqp1 PROTON_LIBS="%{_builddir}/qpid-proton-0.34.0/bld/c/libqpid-proton-core-static.a %{_builddir}/qpid-proton-0.34.0/bld/c/libqpid-proton-proactor-static.a %{_builddir}/qpid-proton-0.34.0/bld/c/libqpid-proton-static.a -lssl -lsasl2 -lcrypto" PROTON_CFLAGS="-I%{_builddir}/qpid-proton-0.34.0/bld/c/include" \
+	--enable-omamqp1 PROTON_LIBS="%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-core-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-proactor-static.a %{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/libqpid-proton-static.a -lssl -lsasl2 -lcrypto" PROTON_CFLAGS="-I%{_builddir}/qpid-proton-%{qpid_proton_v}/bld/c/include" \
 %endif
 	--enable-elasticsearch \
 	--enable-generate-man-pages \
@@ -757,6 +750,18 @@ done
 
 
 %changelog
+* Fri Aug 25 2023 Attila Lakatos <alakatos@redhat.com> - 8.2310.0-1
+- Rebase to 8.2310.0
+  resolves: rhbz#2232275
+
+* Fri Aug 25 2023 Attila Lakatos <alakatos@redhat.com> - 8.2308.0-1
+- Rebase to 8.2308.0
+
+* Wed Jun 21 2023 Attila Lakatos <alakatos@redhat.com> - 8.2306.0-1
+- rebase to 8.2306.0
+  resolves: rhbz#2151339
+  resolves: rhbz#2151092
+
 * Fri Jan 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 8.2210.0-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
 

sources

@@ -1,3 +1,3 @@
-SHA512 (qpid-proton-0.34.0.tar.gz) = 0de6c3d11baeee1d69821a0f1879a61b314f14589e02ea7ed0de8814c741217fdcafdd978b4061f73bc75588886299f4ac6808021506545ec8a883f39ad54fb3
-SHA512 (rsyslog-8.2210.0.tar.gz) = c665b7f7a3c5ef31c9b62b50f815cfbb52db0cbe4a06934f4f1c3cd2a56fb49c319d33857ee92ab843aa5894cac16c16b8eccdf83714f31ab57a95049c4af231
-SHA512 (rsyslog-doc-8.2210.0.tar.gz) = e7847a9307a91fdf87d6cf91d2391eb75869679905b9598310c456fb3fe1864fc06dbdc649778f5b3788e47ffda0a6d89cb894258e55db441f7df7e74b0ae9f4
+SHA512 (qpid-proton-0.39.0.tar.gz) = df5c5469ee82ba02de62dce15b73b81aab2aae07c7db668182df690cea4ff7584111bd12143fe5e3569469a9ddf4950ac68d60b53d1a7815da4748052948cd1b
+SHA512 (rsyslog-8.2310.0.tar.gz) = f04e14ede8c35e1799eadc711a6e99dbe56d312c7909c7ebed4d4bd489d310a44a5c2d3ed23968fbf3ccff5b580870d0f3ceeb690deb1d1424420fc9d3220696
+SHA512 (rsyslog-doc-8.2310.0.tar.gz) = cf452f3705680fc81495e940ea7d5ae705a6dbfe0e2ce5a87865c3043f79daaec243df20e8aadd9fac6144a3df8f19d7c56fdf19ec68df78e2fdaffa45096143