diff --git a/java-9-start-up-parameters.conf b/java-9-start-up-parameters.conf new file mode 100644 index 0000000..341e077 --- /dev/null +++ b/java-9-start-up-parameters.conf @@ -0,0 +1,7 @@ +# Add the JAVA 9 specific start-up parameters required by Tomcat +JDK_JAVA_OPTIONS="$JDK_JAVA_OPTIONS --add-opens=java.base/java.lang=ALL-UNNAMED" +JDK_JAVA_OPTIONS="$JDK_JAVA_OPTIONS --add-opens=java.base/java.io=ALL-UNNAMED" +JDK_JAVA_OPTIONS="$JDK_JAVA_OPTIONS --add-opens=java.base/java.util=ALL-UNNAMED" +JDK_JAVA_OPTIONS="$JDK_JAVA_OPTIONS --add-opens=java.base/java.util.concurrent=ALL-UNNAMED" +JDK_JAVA_OPTIONS="$JDK_JAVA_OPTIONS --add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED" +export JDK_JAVA_OPTIONS diff --git a/rhbz-1857043.patch b/rhbz-1857043.patch index 7d68c42..dd74c3b 100644 --- a/rhbz-1857043.patch +++ b/rhbz-1857043.patch @@ -1,7 +1,7 @@ diff -up ./build.xml.orig ./build.xml --- build.xml.orig 2021-07-07 10:53:55.493742841 +0800 +++ build.xml 2021-07-07 11:09:43.107968515 +0800 -@@ -1030,7 +1030,7 @@ +@@ -1020,7 +1020,7 @@ filesDir="${tomcat.classes}" filesId="files.annotations-api" manifest="${tomcat.manifests}/annotations-api.jar.manifest" @@ -10,7 +10,7 @@ diff -up ./build.xml.orig ./build.xml + + ++ + + + diff --git a/tomcat-9.0-catalina-policy.patch b/tomcat-9.0-catalina-policy.patch index 6614609..dd6a47d 100644 --- a/tomcat-9.0-catalina-policy.patch +++ b/tomcat-9.0-catalina-policy.patch @@ -1,6 +1,6 @@ ---- conf/catalina.policy.orig 2021-07-07 10:25:53.461393329 +0800 -+++ conf/catalina.policy 2021-07-07 10:27:47.688682404 +0800 -@@ -56,6 +56,16 @@ grant codeBase "file:${java.home}/lib/ex +--- conf/catalina.policy.orig 2022-11-04 16:17:41.227506990 +0800 ++++ conf/catalina.policy 2022-11-04 16:21:51.393351415 +0800 +@@ -56,6 +56,15 @@ grant codeBase "file:${java.home}/lib/ex // permission java.security.AllPermission; //}; @@ -13,11 +13,10 @@ +grant codeBase "file:/usr/share/java/ecj/ecj.jar" { + permission java.security.AllPermission; +}; -+ // ========== CATALINA CODE PERMISSIONS ======================================= -@@ -262,4 +272,4 @@ grant codeBase "file:${catalina.home}/we +@@ -261,4 +270,4 @@ grant codeBase "file:${catalina.home}/we // // The permissions granted to a specific JAR // grant codeBase "war:file:${catalina.base}/webapps/examples.war*/WEB-INF/lib/foo.jar" { diff --git a/tomcat-9.0-tomcat-users-webapp.patch b/tomcat-9.0-tomcat-users-webapp.patch index 860c4cf..85b8b9b 100644 --- a/tomcat-9.0-tomcat-users-webapp.patch +++ b/tomcat-9.0-tomcat-users-webapp.patch @@ -1,6 +1,6 @@ --- conf/tomcat-users.xml~ 2008-01-28 17:41:06.000000000 -0500 +++ conf/tomcat-users.xml 2008-03-07 19:40:07.000000000 -0500 -@@ -23,4 +23,14 @@ +@@ -53,4 +53,14 @@ --> diff --git a/tomcat-build.patch b/tomcat-build.patch index 97440f1..49c63ff 100644 --- a/tomcat-build.patch +++ b/tomcat-build.patch @@ -1,18 +1,3 @@ -diff -up ./build.xml.orig ./build.xml ---- ./build.xml.orig 2020-07-13 12:59:09.555368724 -0400 -+++ ./build.xml 2020-07-13 13:06:51.246135917 -0400 -@@ -3307,6 +3307,11 @@ Read the Building page on the Apache Tom - - - -+ -+ -+ -+ -+ - - - diff -up ./res/bnd/build-defaults.bnd.orig ./res/bnd/build-defaults.bnd --- ./res/bnd/build-defaults.bnd.orig 2020-07-13 13:47:01.229077747 -0400 +++ ./res/bnd/build-defaults.bnd 2020-07-13 13:47:12.923095618 -0400 diff --git a/tomcat.spec b/tomcat.spec index 31a5258..707e59c 100644 --- a/tomcat.spec +++ b/tomcat.spec @@ -31,7 +31,7 @@ %global jspspec 2.3 %global major_version 9 %global minor_version 0 -%global micro_version 56 +%global micro_version 71 %global packdname apache-tomcat-%{version}-src %global servletspec 4.0 %global elspec 3.0 @@ -56,7 +56,7 @@ Name: tomcat Epoch: 1 Version: %{major_version}.%{minor_version}.%{micro_version} -Release: 3%{?dist} +Release: 1%{?dist} Summary: Apache Servlet/JSP Engine, RI for Servlet %{servletspec}/JSP %{jspspec} API License: ASL 2.0 @@ -73,6 +73,7 @@ Source21: tomcat-functions Source30: tomcat-preamble Source31: tomcat-server Source32: tomcat-named.service +Source33: java-9-start-up-parameters.conf Patch0: %{name}-%{major_version}.%{minor_version}-bootstrap-MANIFEST.MF.patch Patch1: %{name}-%{major_version}.%{minor_version}-tomcat-users-webapp.patch @@ -80,6 +81,7 @@ Patch2: %{name}-build.patch Patch3: %{name}-%{major_version}.%{minor_version}-catalina-policy.patch Patch4: rhbz-1857043.patch Patch5: %{name}-%{major_version}.%{minor_version}-JDTCompiler.patch +Patch6: %{name}-%{major_version}.%{minor_version}-bnd-annotation.patch BuildArch: noarch @@ -90,12 +92,10 @@ BuildRequires: java-devel >= 1:1.8.0 BuildRequires: javapackages-local BuildRequires: aqute-bnd BuildRequires: aqute-bndlib -BuildRequires: wsdl4j BuildRequires: systemd Requires: java-headless >= 1:1.8.0 Requires: javapackages-tools -Requires: procps Requires: %{name}-lib = %{epoch}:%{version}-%{release} %if 0%{?fedora} || 0%{?rhel} > 7 Recommends: tomcat-native >= %{native_version} @@ -190,6 +190,7 @@ find . -type f \( -name "*.bat" -o -name "*.class" -o -name Thumbs.db -o -name " %patch3 -p0 %patch4 -p0 %patch5 -p0 +%patch6 -p0 # Remove webservices naming resources as it's generally unused %{__rm} -rf java/org/apache/naming/factory/webservices @@ -220,14 +221,9 @@ touch HACK -Dcommons-daemon.native.win.mgr.exe="HACK" \ -Dnsis.exe="HACK" \ -Djaxrpc-lib.jar="HACK" \ - -Dwsdl4j-lib.jar="$(build-classpath wsdl4j)" \ + -Dwsdl4j-lib.jar="HACK" \ -Dbnd.jar="$(build-classpath aqute-bnd/biz.aQute.bnd)" \ - -Dbndlib.jar="$(build-classpath aqute-bnd/biz.aQute.bndlib)" \ - -Dbndlibg.jar="$(build-classpath aqute-bnd/aQute.libg)" \ - -Dbndannotation.jar="$(build-classpath aqute-bnd/biz.aQute.bnd.annotation)" \ - -Dosgi-annotations.jar="$(build-classpath aqute-bnd/biz.aQute.bnd.annotation)" \ - -Dslf4j-api.jar="$(build-classpath slf4j/slf4j-api)" \ - -Dosgi-cmpn.jar="$(build-classpath osgi-compendium/osgi.cmpn)" \ + -Dbnd-annotation.jar="$(build-classpath aqute-bnd/biz.aQute.bnd.annotation)" \ -Dversion="%{version}" \ -Dversion.build="%{micro_version}" \ deploy @@ -302,6 +298,8 @@ popd %{__install} -m 0644 %{SOURCE32} \ ${RPM_BUILD_ROOT}%{_unitdir}/%{name}@.service +%{__install} -m 0644 %{SOURCE33} ${RPM_BUILD_ROOT}%{confdir}/conf.d/ + # Substitute libnames in catalina-tasks.xml sed -i \ "s,el-api.jar,%{name}-el-%{elspec}-api.jar,; @@ -441,6 +439,7 @@ fi %attr(0775,root,tomcat) %dir %{confdir}/Catalina/localhost %attr(0755,root,tomcat) %dir %{confdir}/conf.d %{confdir}/conf.d/README +%{confdir}/conf.d/java-9-start-up-parameters.conf %config(noreplace) %{confdir}/%{name}.conf %config(noreplace) %{confdir}/*.policy %config(noreplace) %{confdir}/*.properties @@ -496,6 +495,34 @@ fi %{appdir}/ROOT %changelog +* Sun Jan 29 2023 Hui Wang - 1:9.0.71-1 +- Update to 9.0.71 +- Remove osgi-annotations patch +- Add bnd-annotation dependency which is in bndlib package + +* Fri Jan 13 2023 Hui Wang - 1:9.0.70-1 +- Update to 9.0.70 + +* Thu Nov 03 2022 Hui Wang - 1:9.0.68-1 +- Update to 9.0.68 + +* Thu Jul 21 2022 Hui Wang - 1:9.0.65-1 +- Update to 9.0.65 + +* Tue Jun 21 2022 Hui Wang - 1:9.0.64-1 +- Update to 9.0.64 +- Add osgi-annotations dependency back + +* Thu Mar 10 2022 Coty Sutherland - 1:9.0.59-3 +- Related: rhbz#2061424 Adjust fix so that it uses the proper env var + +* Tue Mar 08 2022 Coty Sutherland - 1:9.0.59-2 +- Resolves: rhbz#2061424 Add Java 9 start-up parameters to allow reflection + +* Wed Mar 02 2022 Sonia Xu - 1:9.0.59-1 +- Update to 9.0.59 +- Resolves: rhbz#2047419 - CVE-2022-23181 tomcat: local privilege escalation vulnerability + * Sat Feb 05 2022 Jiri Vanek - 1:9.0.56-3 - Rebuilt for java-17-openjdk as system jdk