From 4f7002163e46bc0d091eb6f2fae8d458c68feae9 Mon Sep 17 00:00:00 2001 From: Peter Vrabec Date: Tue, 2 Aug 2011 14:06:07 +0200 Subject: [PATCH 1/3] fixing semanage issue (#701355) --- shadow-4.1.4.3-semange.patch | 27 ++++++++++----------------- shadow-utils.spec | 5 ++++- 2 files changed, 14 insertions(+), 18 deletions(-) diff --git a/shadow-4.1.4.3-semange.patch b/shadow-4.1.4.3-semange.patch index 6a8a4f6..b10efd0 100644 --- a/shadow-4.1.4.3-semange.patch +++ b/shadow-4.1.4.3-semange.patch @@ -1,6 +1,6 @@ diff -up shadow-4.1.4.3/man/useradd.8.semange shadow-4.1.4.3/man/useradd.8 ---- shadow-4.1.4.3/man/useradd.8.semange 2011-06-28 16:17:06.385374734 +0200 -+++ shadow-4.1.4.3/man/useradd.8 2011-06-28 16:18:19.657899439 +0200 +--- shadow-4.1.4.3/man/useradd.8.semange 2011-08-02 12:57:47.971838218 +0200 ++++ shadow-4.1.4.3/man/useradd.8 2011-08-02 12:57:47.985838145 +0200 @@ -640,6 +640,11 @@ can\*(Aqt create home directory .RS 4 can\*(Aqt create mail spool @@ -15,7 +15,7 @@ diff -up shadow-4.1.4.3/man/useradd.8.semange shadow-4.1.4.3/man/useradd.8 diff -up shadow-4.1.4.3/man/userdel.8.semange shadow-4.1.4.3/man/userdel.8 --- shadow-4.1.4.3/man/userdel.8.semange 2011-02-16 00:14:13.000000000 +0100 -+++ shadow-4.1.4.3/man/userdel.8 2011-06-28 16:18:19.657899439 +0200 ++++ shadow-4.1.4.3/man/userdel.8 2011-08-02 12:57:47.985838145 +0200 @@ -76,6 +76,11 @@ variable in the login\&.defs file\&. @@ -23,14 +23,14 @@ diff -up shadow-4.1.4.3/man/userdel.8.semange shadow-4.1.4.3/man/userdel.8 +.PP +\fB\-Z\fR, \fB\-\-selinux-user\fR +.RS 4 -+Remove SELinux user assigned to the user´s login from SELinux login mapping. Use with caution, all the occurrences of the SELinux user will be removed. ++Remove SELinux user assigned to the user´s login from SELinux login mapping. +.RE .SH "CONFIGURATION" .PP The following configuration variables in diff -up shadow-4.1.4.3/src/useradd.c.semange shadow-4.1.4.3/src/useradd.c ---- shadow-4.1.4.3/src/useradd.c.semange 2011-06-28 16:17:06.381374760 +0200 -+++ shadow-4.1.4.3/src/useradd.c 2011-06-28 16:18:19.658899432 +0200 +--- shadow-4.1.4.3/src/useradd.c.semange 2011-08-02 12:57:47.968838234 +0200 ++++ shadow-4.1.4.3/src/useradd.c 2011-08-02 12:58:17.626684439 +0200 @@ -164,6 +164,7 @@ static bool home_added = false; #define E_GRP_UPDATE 10 /* can't update group file */ #define E_HOMEDIR 12 /* can't create home directory */ @@ -82,12 +82,9 @@ diff -up shadow-4.1.4.3/src/useradd.c.semange shadow-4.1.4.3/src/useradd.c /* * create_home - create the user's home directory * -@@ -2022,12 +1994,35 @@ int main (int argc, char **argv) - create_mail (); - } +@@ -2025,7 +1997,30 @@ int main (int argc, char **argv) + close_files (); -- close_files (); -- #ifdef WITH_SELINUX - selinux_update_mapping (); + if (Zflg && *user_selinux) { @@ -116,14 +113,10 @@ diff -up shadow-4.1.4.3/src/useradd.c.semange shadow-4.1.4.3/src/useradd.c + } #endif -+ close_files (); -+ nscd_flush_cache ("passwd"); - nscd_flush_cache ("group"); - diff -up shadow-4.1.4.3/src/userdel.c.semange shadow-4.1.4.3/src/userdel.c --- shadow-4.1.4.3/src/userdel.c.semange 2011-02-13 18:58:16.000000000 +0100 -+++ shadow-4.1.4.3/src/userdel.c 2011-06-28 16:18:19.659899426 +0200 ++++ shadow-4.1.4.3/src/userdel.c 2011-08-02 12:57:47.988838130 +0200 @@ -82,6 +82,7 @@ static char *user_home; static bool fflg = false; @@ -208,7 +201,7 @@ diff -up shadow-4.1.4.3/src/userdel.c.semange shadow-4.1.4.3/src/userdel.c diff -up shadow-4.1.4.3/src/usermod.c.semange shadow-4.1.4.3/src/usermod.c --- shadow-4.1.4.3/src/usermod.c.semange 2011-02-13 18:58:16.000000000 +0100 -+++ shadow-4.1.4.3/src/usermod.c 2011-06-28 16:18:19.661899414 +0200 ++++ shadow-4.1.4.3/src/usermod.c 2011-08-02 12:57:47.989838125 +0200 @@ -82,6 +82,9 @@ #define E_GRP_UPDATE 10 /* can't update group file */ /* #define E_NOSPACE 11 insufficient space to move home dir */ diff --git a/shadow-utils.spec b/shadow-utils.spec index d0a3c7f..4c87c96 100644 --- a/shadow-utils.spec +++ b/shadow-utils.spec @@ -1,7 +1,7 @@ Summary: Utilities for managing accounts and shadow password files Name: shadow-utils Version: 4.1.4.3 -Release: 7%{?dist} +Release: 8%{?dist} Epoch: 2 URL: http://pkg-shadow.alioth.debian.org/ Source0: http://pkg-shadow.alioth.debian.org/releases/shadow-%{version}.tar.bz2 @@ -221,6 +221,9 @@ rm -rf $RPM_BUILD_ROOT %{_mandir}/man8/vigr.8* %changelog +* Tue Aug 02 2011 Peter Vrabec - 2:4.1.4.3-8 +- fixing semanage issue (#701355) + * Fri Jul 22 2011 Miloslav Trmač - 2:4.1.4.3-7 - Make sure /etc/login.defs is not changed on upgrades from Fedora 1[345]. From 8d10c812854c400eec1cfde59cc73261e8c516a1 Mon Sep 17 00:00:00 2001 From: Peter Vrabec Date: Tue, 20 Dec 2011 13:53:56 +0100 Subject: [PATCH 2/3] fix leaks in .IDs patch (#734340) --- shadow-4.1.4.3-IDs.patch | 79 ++++++++++++++++++++++++++++++++++------ shadow-utils.spec | 5 ++- 2 files changed, 72 insertions(+), 12 deletions(-) diff --git a/shadow-4.1.4.3-IDs.patch b/shadow-4.1.4.3-IDs.patch index 3e5ea23..6d26f74 100644 --- a/shadow-4.1.4.3-IDs.patch +++ b/shadow-4.1.4.3-IDs.patch @@ -1,6 +1,6 @@ diff -up shadow-4.1.4.3/libmisc/find_new_gid.c.IDs shadow-4.1.4.3/libmisc/find_new_gid.c ---- shadow-4.1.4.3/libmisc/find_new_gid.c.IDs 2011-05-20 22:45:27.852146758 +0200 -+++ shadow-4.1.4.3/libmisc/find_new_gid.c 2011-05-20 22:47:45.977909798 +0200 +--- shadow-4.1.4.3/libmisc/find_new_gid.c.IDs 2011-12-20 13:28:13.042668305 +0100 ++++ shadow-4.1.4.3/libmisc/find_new_gid.c 2011-12-20 13:35:40.011817589 +0100 @@ -32,6 +32,7 @@ #include @@ -9,23 +9,56 @@ diff -up shadow-4.1.4.3/libmisc/find_new_gid.c.IDs shadow-4.1.4.3/libmisc/find_n #include "prototypes.h" #include "groupio.h" -@@ -65,7 +66,12 @@ int find_new_gid (bool sys_group, +@@ -65,8 +66,6 @@ int find_new_gid (bool sys_group, gid_max = (gid_t) getdef_ulong ("GID_MIN", 1000UL) - 1; gid_max = (gid_t) getdef_ulong ("SYS_GID_MAX", (unsigned long) gid_max); } - used_gids = alloca (sizeof (bool) * (gid_max +1)); +- memset (used_gids, false, sizeof (bool) * (gid_max + 1)); + + if ( (NULL != preferred_gid) + && (*preferred_gid >= gid_min) +@@ -80,6 +79,14 @@ int find_new_gid (bool sys_group, + return 0; + } + + used_gids = malloc (sizeof (bool) * (gid_max +1)); + if(used_gids==NULL) { + fprintf (stderr, + _("%s: failed to allocate memory. %s\n"), Prog, strerror (errno)); + return -1; + } - memset (used_gids, false, sizeof (bool) * (gid_max + 1)); ++ memset (used_gids, false, sizeof (bool) * (gid_max + 1)); ++ + /* if we did not find free preffered system gid, we start to look for + * one in the range assigned to dynamic system IDs */ + if (sys_group) +@@ -162,6 +169,7 @@ int find_new_gid (bool sys_group, + Prog); + SYSLOG ((LOG_WARN, + "no more available GID on the system")); ++ free(used_gids); + return -1; + } + } +@@ -177,12 +185,14 @@ int find_new_gid (bool sys_group, + _("%s: Can't get unique GID (no more available GIDs)\n"), + Prog); + SYSLOG ((LOG_WARN, "no more available GID on the system")); ++ free(used_gids); + return -1; + } + } + } + + *gid = group_id; ++ free(used_gids); + return 0; + } - if ( (NULL != preferred_gid) diff -up shadow-4.1.4.3/libmisc/find_new_uid.c.IDs shadow-4.1.4.3/libmisc/find_new_uid.c --- shadow-4.1.4.3/libmisc/find_new_uid.c.IDs 2011-02-13 18:58:11.000000000 +0100 -+++ shadow-4.1.4.3/libmisc/find_new_uid.c 2011-05-20 22:47:45.977909798 +0200 ++++ shadow-4.1.4.3/libmisc/find_new_uid.c 2011-12-20 13:37:27.415023688 +0100 @@ -32,6 +32,7 @@ #include @@ -34,25 +67,49 @@ diff -up shadow-4.1.4.3/libmisc/find_new_uid.c.IDs shadow-4.1.4.3/libmisc/find_n #include "prototypes.h" #include "pwio.h" -@@ -65,7 +66,12 @@ int find_new_uid (bool sys_user, +@@ -65,8 +66,6 @@ int find_new_uid (bool sys_user, uid_max = (uid_t) getdef_ulong ("UID_MIN", 1000UL) - 1; uid_max = (uid_t) getdef_ulong ("SYS_UID_MAX", (unsigned long) uid_max); } - used_uids = alloca (sizeof (bool) * (uid_max +1)); +- memset (used_uids, false, sizeof (bool) * (uid_max + 1)); + + if ( (NULL != preferred_uid) + && (*preferred_uid >= uid_min) +@@ -80,6 +79,13 @@ int find_new_uid (bool sys_user, + return 0; + } + + used_uids = malloc (sizeof (bool) * (uid_max +1)); + if(used_uids==NULL) { + fprintf (stderr, + _("%s: failed to allocate memory. %s\n"), Prog, strerror (errno)); + return -1; + } - memset (used_uids, false, sizeof (bool) * (uid_max + 1)); ++ memset (used_uids, false, sizeof (bool) * (uid_max + 1)); - if ( (NULL != preferred_uid) -@@ -178,6 +184,7 @@ int find_new_uid (bool sys_user, + /* + * Search the entire password file, +@@ -158,6 +164,7 @@ int find_new_uid (bool sys_user, + Prog); + SYSLOG ((LOG_WARN, + "no more available UID on the system")); ++ free(used_uids); + return -1; + } + } +@@ -173,12 +180,14 @@ int find_new_uid (bool sys_user, + _("%s: Can't get unique UID (no more available UIDs)\n"), + Prog); + SYSLOG ((LOG_WARN, "no more available UID on the system")); ++ free(used_uids); + return -1; + } } } -+ free(used_uids); *uid = user_id; ++ free(used_uids); return 0; } + diff --git a/shadow-utils.spec b/shadow-utils.spec index 18a1090..afe5104 100644 --- a/shadow-utils.spec +++ b/shadow-utils.spec @@ -1,7 +1,7 @@ Summary: Utilities for managing accounts and shadow password files Name: shadow-utils Version: 4.1.4.3 -Release: 11%{?dist} +Release: 12%{?dist} Epoch: 2 URL: http://pkg-shadow.alioth.debian.org/ Source0: http://pkg-shadow.alioth.debian.org/releases/shadow-%{version}.tar.bz2 @@ -228,6 +228,9 @@ rm -rf $RPM_BUILD_ROOT %{_mandir}/man8/vigr.8* %changelog +* Tue Dec 20 2011 Peter Vrabec - 2:4.1.4.3-12 +- fix leaks in .IDs patch (#734340) + * Wed Nov 16 2011 Peter Vrabec - 2:4.1.4.3-11 - free memory associated with SELinux security contexts From 91d35b9d663d220f2ef0c85810b08e975c84989e Mon Sep 17 00:00:00 2001 From: Peter Vrabec Date: Tue, 7 Feb 2012 18:04:27 +0100 Subject: [PATCH 3/3] compile with PIE and RELRO flags (#784349) Conflicts: shadow-utils.spec --- shadow-utils.spec | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/shadow-utils.spec b/shadow-utils.spec index afe5104..433ee84 100644 --- a/shadow-utils.spec +++ b/shadow-utils.spec @@ -1,7 +1,7 @@ Summary: Utilities for managing accounts and shadow password files Name: shadow-utils Version: 4.1.4.3 -Release: 12%{?dist} +Release: 13%{?dist} Epoch: 2 URL: http://pkg-shadow.alioth.debian.org/ Source0: http://pkg-shadow.alioth.debian.org/releases/shadow-%{version}.tar.bz2 @@ -79,6 +79,16 @@ cp -f doc/HOWTO.utf8 doc/HOWTO #autoconf %build + +%ifarch sparc64 +#sparc64 need big PIE +export CFLAGS="$RPM_OPT_FLAGS -fPIE" +export LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now" +%else +export CFLAGS="$RPM_OPT_FLAGS -fpie" +export LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now" +%endif + %configure \ --enable-shadowgrp \ --with-audit \ @@ -228,6 +238,9 @@ rm -rf $RPM_BUILD_ROOT %{_mandir}/man8/vigr.8* %changelog +* Tue Feb 07 2012 Peter Vrabec - 2:4.1.4.3-13 +- compile with PIE and RELRO flags (#784349) + * Tue Dec 20 2011 Peter Vrabec - 2:4.1.4.3-12 - fix leaks in .IDs patch (#734340)