rpms
/
libcap-ng
20
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

import libcap-ng-0.7.11-1.el8

Browse Source
c8 imports/c8/libcap-ng-0.7.11-1.el8
CentOS Sources 3 years ago committed by MSVSphere Packaging Team
commit 77b8065cae
7 changed files with 591 additions and 0 deletions
Show Stats Download Patch File Download Diff File

1
.gitignore vendored
Unescape View File

@ -0,0 +1 @@
SOURCES/libcap-ng-0.7.11.tar.gz

1
.libcap-ng.metadata
Unescape View File

@ -0,0 +1 @@
786cf60a922f55442d1aab1112faa6203b4d8aaf SOURCES/libcap-ng-0.7.11.tar.gz

13
SOURCES/libcap-ng-0.8-vararg-support.patch
Unescape View File

@ -0,0 +1,13 @@
diff -ru a/bindings/src/capng_swig.i b/bindings/src/capng_swig.i
--- a/bindings/src/capng_swig.i
+++ b/bindings/src/capng_swig.i
@@ -26,6 +26,9 @@
%}
#if defined(SWIGPYTHON)
+
+%varargs(16, unsigned capability = 0) capng_updatev;
+
%except(python) {
$action
if (result < 0) {

17
SOURCES/libcap-ng-0.8.1-procfs-lastcap.patch
Unescape View File

@ -0,0 +1,17 @@
diff -ru a/src/cap-ng.c b/src/cap-ng.c
--- a/src/cap-ng.c
+++ b/src/cap-ng.c
@@ -204,12 +204,7 @@
int fd;
fd = open("/proc/sys/kernel/cap_last_cap", O_RDONLY);
- if (fd == -1) {
- if (errno != ENOENT) {
- m.state = CAPNG_ERROR;
- return;
- }
- } else {
+ if (fd >= 0) {
char buf[8];
int num = read(fd, buf, sizeof(buf) - 1);
if (num > 0) {

179
SOURCES/libcap-ng-0.8.1-signed-unsigned-fix.patch
Unescape View File

@ -0,0 +1,179 @@
diff -ru a/src/cap-ng.c b/src/cap-ng.c
--- a/src/cap-ng.c
+++ b/src/cap-ng.c
@@ -46,7 +46,7 @@
#endif
# define hidden __attribute__ ((visibility ("hidden")))
-int last_cap hidden = -1;
+unsigned int last_cap hidden = 0;
/*
* Some milestones of when things became available:
* 2.6.24 kernel XATTR_NAME_CAPS
@@ -65,7 +65,7 @@
// Local defines
#define MASK(x) (1U << (x))
#ifdef PR_CAPBSET_DROP
-#define UPPER_MASK ~(unsigned)((~0U)<<(last_cap-31))
+#define UPPER_MASK ~((~0U)<<(last_cap-31))
#else
// For v1 systems UPPER_MASK will never be used
#define UPPER_MASK (unsigned)(~0U)
@@ -73,7 +73,7 @@
// Re-define cap_valid so its uniform between V1 and V3
#undef cap_valid
-#define cap_valid(x) ((x) <= (unsigned int)last_cap)
+#define cap_valid(x) ((x) <= last_cap)
// If we don't have the xattr library, then we can't
// compile-in file system capabilities
@@ -174,6 +174,26 @@
#ifdef HAVE_PTHREAD_H
pthread_atfork(NULL, NULL, deinit);
#endif
+ // Detect last cap
+ if (last_cap == 0) {
+ int fd;
+
+ fd = open("/proc/sys/kernel/cap_last_cap", O_RDONLY);
+ if (fd >= 0) {
+ char buf[8];
+ int num = read(fd, buf, sizeof(buf) - 1);
+ if (num > 0) {
+ buf[num] = 0;
+ errno = 0;
+ unsigned int val = strtoul(buf, NULL, 10);
+ if (errno == 0)
+ last_cap = val;
+ }
+ close(fd);
+ }
+ if (last_cap == 0)
+ last_cap = CAP_LAST_CAP;
+ }
}
static void init(void)
@@ -199,26 +219,6 @@
#else
m.hdr.pid = (unsigned)getpid();
#endif
- // Detect last cap
- if (last_cap == -1) {
- int fd;
-
- fd = open("/proc/sys/kernel/cap_last_cap", O_RDONLY);
- if (fd >= 0) {
- char buf[8];
- int num = read(fd, buf, sizeof(buf) - 1);
- if (num > 0) {
- buf[num] = 0;
- errno = 0;
- int val = strtoul(buf, NULL, 10);
- if (errno == 0)
- last_cap = val;
- }
- close(fd);
- }
- if (last_cap == -1)
- last_cap = CAP_LAST_CAP;
- }
m.state = CAPNG_ALLOCATED;
}
@@ -478,7 +478,7 @@
if (CAPNG_INHERITABLE & type)
v1_update(action, capability, &m.data.v1.inheritable);
} else {
- int idx;
+ unsigned int idx;
if (capability > 31) {
idx = capability>>5;
@@ -545,7 +545,7 @@
memcpy(&state, &m, sizeof(state)); /* save state */
capng_get_caps_process();
if (capng_have_capability(CAPNG_EFFECTIVE, CAP_SETPCAP)) {
- int i;
+ unsigned int i;
memcpy(&m, &state, sizeof(m)); /* restore state */
rc = 0;
for (i=0; i <= last_cap && rc == 0; i++)
@@ -602,7 +602,7 @@
#ifndef VFS_CAP_U32
return -1;
#else
- int rc, size;
+ int rc, size = 0;
struct vfs_cap_data filedata;
struct stat buf;
@@ -1010,7 +1010,7 @@
char *capng_print_caps_text(capng_print_t where, capng_type_t which)
{
- int i, once = 0, cnt = 0;
+ unsigned int i, once = 0, cnt = 0;
char *ptr = NULL;
if (m.state < CAPNG_INIT)
diff -ru a/src/lookup_table.c b/src/lookup_table.c
--- a/src/lookup_table.c
+++ b/src/lookup_table.c
@@ -29,10 +29,10 @@
#define hidden __attribute__ ((visibility ("hidden")))
-extern int last_cap hidden;
+extern unsigned int last_cap hidden;
#undef cap_valid
-#define cap_valid(x) ((x) <= (unsigned int)last_cap)
+#define cap_valid(x) ((x) <= last_cap)
struct transtab {
diff -ru a/src/test/lib_test.c b/src/test/lib_test.c
--- a/src/test/lib_test.c
+++ b/src/test/lib_test.c
@@ -29,7 +29,7 @@
#include <fcntl.h>
#include <sys/stat.h>
-int get_last_cap(void)
+static unsigned int get_last_cap(void)
{
int fd;
@@ -41,17 +41,19 @@
int num = read(fd, buf, sizeof(buf));
if (num > 0) {
errno = 0;
- int val = strtoul(buf, NULL, 10);
+ unsigned int val = strtoul(buf, NULL, 10);
if (errno == 0)
return val;
}
+ close(fd);
}
return CAP_LAST_CAP;
}
int main(void)
{
- int rc, i, len, last = get_last_cap();
+ int rc;
+ unsigned int i, len, last = get_last_cap();
char *text;
void *saved;
@@ -127,7 +129,7 @@
abort();
}
name = capng_capability_to_name(i);
- if (name == NULL) {
+ if (name == NULL) {
printf("Failed converting capability %d to name\n", i);
abort();
}

87
SOURCES/libcap-ng-0.8.2-improve-lastcap-check.patch
Unescape View File

@ -0,0 +1,87 @@
diff -ru a/configure.ac b/configure.ac
--- a/configure.ac
+++ b/configure.ac
@@ -59,6 +59,9 @@
AC_CHECK_HEADERS(pthread.h,
[AC_SEARCH_LIBS(pthread_atfork, pthread)],
[AC_MSG_WARN(pthread.h not found, disabling pthread_atfork.)])
+AC_CHECK_HEADERS(sys/vfs.h, [
+ AC_CHECK_HEADERS(linux/magic.h, [] [AC_MSG_WARN(linux/magic.h is required in order to verify procfs.)])
+ ], [AC_MSG_WARN(sys/vfs.h is required in order to verify procfs.)])
AC_C_CONST
AC_C_INLINE
diff -ru a/src/cap-ng.c b/src/cap-ng.c
--- a/src/cap-ng.c
+++ b/src/cap-ng.c
@@ -44,6 +44,10 @@
#ifdef HAVE_LINUX_SECUREBITS_H
#include <linux/securebits.h>
#endif
+#ifdef HAVE_LINUX_MAGIC_H
+#include <sys/vfs.h>
+#include <linux/magic.h>
+#endif
# define hidden __attribute__ ((visibility ("hidden")))
unsigned int last_cap hidden = 0;
@@ -168,6 +172,15 @@
m.state = CAPNG_NEW;
}
+static inline int test_cap(unsigned int cap)
+{
+ // prctl returns 0 or 1 for valid caps, -1 otherwise
+ return prctl(PR_CAPBSET_READ, cap) >= 0;
+}
+
+// The maximum cap value is determined by VFS_CAP_U32
+#define MAX_CAP_VALUE (VFS_CAP_U32 * sizeof(__le32) * 8)
+
static void init_lib(void) __attribute__ ((constructor));
static void init_lib(void)
{
@@ -178,8 +191,15 @@
if (last_cap == 0) {
int fd;
+ // Try to read last cap from procfs
fd = open("/proc/sys/kernel/cap_last_cap", O_RDONLY);
if (fd >= 0) {
+#ifdef HAVE_LINUX_MAGIC_H
+ struct statfs st;
+ // Bail out if procfs is invalid or fstatfs fails
+ if (fstatfs(fd, &st) || st.f_type != PROC_SUPER_MAGIC)
+ goto fail;
+#endif
char buf[8];
int num = read(fd, buf, sizeof(buf) - 1);
if (num > 0) {
@@ -189,10 +209,25 @@
if (errno == 0)
last_cap = val;
}
+fail:
close(fd);
}
- if (last_cap == 0)
- last_cap = CAP_LAST_CAP;
+ // Run a binary search over capabilities
+ if (last_cap == 0) {
+ // starting with last_cap=MAX_CAP_VALUE means we always know
+ // that cap1 is invalid after the first iteration
+ last_cap = MAX_CAP_VALUE;
+ unsigned int cap0 = 0, cap1 = MAX_CAP_VALUE;
+
+ while (cap0 < last_cap) {
+ if (test_cap(last_cap))
+ cap0 = last_cap;
+ else
+ cap1 = last_cap;
+
+ last_cap = (cap0 + cap1) / 2U;
+ }
+ }
}
}

293
SPECS/libcap-ng.spec
Unescape View File

@ -0,0 +1,293 @@
%{!?python_sitearch: %global python_sitearch %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib(1)")}
Summary: An alternate posix capabilities library
Name: libcap-ng
Version: 0.7.11
Release: 1%{?dist}
License: LGPLv2+
URL: http://people.redhat.com/sgrubb/libcap-ng
Source0: http://people.redhat.com/sgrubb/libcap-ng/%{name}-%{version}.tar.gz
Patch1: libcap-ng-0.8-vararg-support.patch
Patch2: libcap-ng-0.8.1-procfs-lastcap.patch
Patch3: libcap-ng-0.8.1-signed-unsigned-fix.patch
Patch4: libcap-ng-0.8.2-improve-lastcap-check.patch
BuildRequires: autoconf automake libtool
BuildRequires: gcc
BuildRequires: kernel-headers >= 2.6.11
BuildRequires: libattr-devel
%description
Libcap-ng is a library that makes using posix capabilities easier
%package devel
Summary: Header files for libcap-ng library
License: LGPLv2+
Requires: kernel-headers >= 2.6.11
Requires: %{name} = %{version}-%{release}
Requires: pkgconfig
%description devel
The libcap-ng-devel package contains the files needed for developing
applications that need to use the libcap-ng library.
%package python3
Summary: Python3 bindings for libcap-ng library
License: LGPLv2+
BuildRequires: python3-devel swig
Requires: %{name} = %{version}-%{release}
%description python3
The libcap-ng-python3 package contains the bindings so that libcap-ng
and can be used by python3 applications.
%package utils
Summary: Utilities for analyzing and setting file capabilities
License: GPLv2+
Requires: %{name} = %{version}-%{release}
%description utils
The libcap-ng-utils package contains applications to analyze the
posix capabilities of all the program running on a system. It also
lets you set the file system based capabilities.
%prep
%setup -q
%patch1 -p1 -b .vararg-support
%patch2 -p1 -b .procfs-lastcap
%patch3 -p1 -b .signed-unsigned-fix
%patch4 -p1 -b .improve-lastcap-check
%build
autoreconf -fiv
%configure --libdir=/%{_lib} --with-python=no --with-python3
make CFLAGS="%{optflags}" %{?_smp_mflags}
%install
make DESTDIR="${RPM_BUILD_ROOT}" INSTALL='install -p' install
# Move the symlink
rm -f $RPM_BUILD_ROOT/%{_lib}/%{name}.so
mkdir -p $RPM_BUILD_ROOT%{_libdir}
VLIBNAME=$(ls $RPM_BUILD_ROOT/%{_lib}/%{name}.so.*.*.*)
LIBNAME=$(basename $VLIBNAME)
ln -s ../../%{_lib}/$LIBNAME $RPM_BUILD_ROOT%{_libdir}/%{name}.so
# Move the pkgconfig file
mv $RPM_BUILD_ROOT/%{_lib}/pkgconfig $RPM_BUILD_ROOT%{_libdir}
# Remove a couple things so they don't get picked up
rm -f $RPM_BUILD_ROOT/%{_lib}/libcap-ng.la
rm -f $RPM_BUILD_ROOT/%{_lib}/libcap-ng.a
rm -f $RPM_BUILD_ROOT/%{_libdir}/python?.?/site-packages/_capng.a
rm -f $RPM_BUILD_ROOT/%{_libdir}/python?.?/site-packages/_capng.la
%check
make check
%ldconfig_scriptlets
%files
%{!?_licensedir:%global license %%doc}
%license COPYING.LIB
/%{_lib}/libcap-ng.so.*
%files devel
%attr(0644,root,root) %{_mandir}/man3/*
%attr(0644,root,root) %{_includedir}/cap-ng.h
%{_libdir}/libcap-ng.so
%attr(0644,root,root) %{_datadir}/aclocal/cap-ng.m4
%{_libdir}/pkgconfig/libcap-ng.pc
%files python3
%attr(755,root,root) %{python3_sitearch}/*
%{python3_sitearch}/capng.py*
%files utils
%{!?_licensedir:%global license %%doc}
%license COPYING
%attr(0755,root,root) %{_bindir}/*
%attr(0644,root,root) %{_mandir}/man8/*
%changelog
* Thu Mar 18 2021 Zoltan Fridrich <zfridric@redhat.com> 0.7.11-1
resolves: rhbz#1939386 - Rebase libcap-ng to version 0.7.11
* Tue Nov 05 2019 Marek Tamaskovic <mtamasko@redhat.com> 0.7.9-5
resolves: rhbz#1740775 - segfault after dlclose
* Tue Jan 08 2019 Steve Grubb <sgrubb@redhat.com> 0.7.9-4
resolves: rhbz#1599364 - filecap fails of files with no capabilities
* Thu Aug 09 2018 Steve Grubb <sgrubb@redhat.com> 0.7.9-3
resolves: rhbz#1599364 - filecap fails of files with no capabilities
* Thu Jun 07 2018 Steve Grubb <sgrubb@redhat.com> 0.7.9-2
- Drop python2 bindings (#1588449)
* Wed Feb 07 2018 Steve Grubb <sgrubb@redhat.com> 0.7.9-1
- New upstream bugfix release
* Sat Feb 03 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 0.7.8-9
- Switch to %%ldconfig_scriptlets
* Fri Jan 05 2018 Iryna Shcherbina <ishcherb@redhat.com> - 0.7.8-8
- Update Python 2 dependency declarations to new packaging standards
(See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)
* Sun Aug 20 2017 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.7.8-7
- Add Provides for the old name without %%_isa
* Sat Aug 19 2017 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.7.8-6
- Python 2 binary package renamed to python2-libcap-ng
See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3
* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.7.8-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.7.8-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.7.8-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
* Mon Dec 19 2016 Miro Hrončok <mhroncok@redhat.com> - 0.7.8-2
- Rebuild for Python 3.6
* Sun Jul 24 2016 Steve Grubb <sgrubb@redhat.com> 0.7.8-1
- New upstream bugfix release
* Tue Jul 19 2016 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.7.7-5
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
* Wed Feb 03 2016 Steve Grubb <sgrubb@redhat.com> 0.7.7-4
- use python site arch macros (#1303610)
* Tue Nov 10 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.7.7-3
- Rebuilt for https://fedoraproject.org/wiki/Changes/python3.5
* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.7.7-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
* Wed May 13 2015 Steve Grubb <sgrubb@redhat.com> 0.7.7-1
- New upstream bugfix release
* Fri May 08 2015 Steve Grubb <sgrubb@redhat.com> 0.7.6-1
- New upstream release adding python3 support
* Thu May 07 2015 Steve Grubb <sgrubb@redhat.com> 0.7.5-1
- New upstream release
* Sun Aug 17 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.7.4-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
* Thu Jul 17 2014 Tom Callaway <spot@fedoraproject.org> - 0.7.4-6
- fix license handling
* Mon Jun 23 2014 Kyle McMartin <kyle@redhat.com> 0.7.4-5
- Clamp CAP_LAST_CAP at /proc/sys/kernel/cap_last_cap's value in the
Python bindings test if possible, otherwise use the value from
<linux/capability.h> since the kernel now has 37 capabilities upstream,
but our builders are not that up to date.
* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.7.4-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
* Wed May 07 2014 Steve Grubb <sgrubb@redhat.com> 0.7.4-3
- Add PR_SET_NO_NEW_PRIVS call back to capng_lock
* Wed Apr 30 2014 Steve Grubb <sgrubb@redhat.com> 0.7.4-2
- Remove PR_SET_NO_NEW_PRIVS call in capng_lock
* Thu Apr 24 2014 Steve Grubb <sgrubb@redhat.com> 0.7.4-1
- New upstream release
* Thu Nov 14 2013 Steve Grubb <sgrubb@redhat.com> 0.7.3-6
- Rebuild to pickup current CAP_LAST_CAP
* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.7.3-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
* Tue Jul 02 2013 Karsten Hopp <karsten@redhat.com> 0.7.3-4
- bump release and rebuild to fix dependencies on PPC
* Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.7.3-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
* Wed Dec 19 2012 Steve Grubb <sgrubb@redhat.com> 0.7.3-2
- Remove useless code in pscap causing EBADFD
* Fri Nov 09 2012 Steve Grubb <sgrubb@redhat.com> 0.7.3-1
- New upstream release
* Wed Oct 24 2012 Steve Grubb <sgrubb@redhat.com> 0.7.1-1
- New upstream release
* Tue Jul 24 2012 Steve Grubb <sgrubb@redhat.com> 0.7-1
- New upstream release
* Thu Jul 19 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.6.6-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
* Fri Jan 13 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.6.6-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
* Fri Jun 24 2011 Steve Grubb <sgrubb@redhat.com> 0.6.6-1
- New upstream release
* Mon Feb 07 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.6.5-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
* Wed Nov 03 2010 Steve Grubb <sgrubb@redhat.com> 0.6.5-1
- New upstream release fixing 2.6.36 kernel header issue
* Wed Jul 21 2010 David Malcolm <dmalcolm@redhat.com> - 0.6.4-4
- Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild
* Thu Jun 17 2010 Steve Grubb <sgrubb@redhat.com> 0.6.4-3
- Only open regular files in filecap
* Mon May 24 2010 Steve Grubb <sgrubb@redhat.com> 0.6.4-2
- In utils subpackage added a requires statement.
* Thu May 06 2010 Steve Grubb <sgrubb@redhat.com> 0.6.4-1
- New upstream release fixing multi-threading issue
* Wed Apr 28 2010 Steve Grubb <sgrubb@redhat.com> 0.6.3-2
- filecap shows full capabilities if a file has any
* Thu Mar 11 2010 Steve Grubb <sgrubb@redhat.com> 0.6.3-1
- New upstream release
* Tue Feb 16 2010 Steve Grubb <sgrubb@redhat.com> 0.6.2-4
- Use global macro and require pkgconfig for devel subpackage
* Fri Oct 09 2009 Steve Grubb <sgrubb@redhat.com> 0.6.2-3
- Apply patch to retain setpcap only if clearing bounding set
* Sat Oct 03 2009 Steve Grubb <sgrubb@redhat.com> 0.6.2-2
- Apply patch correcting pscap and netcap acct detection
* Mon Sep 28 2009 Steve Grubb <sgrubb@redhat.com> 0.6.2-1
- New upstream release
* Sun Jul 26 2009 Steve Grubb <sgrubb@redhat.com> 0.6.1-1
- New upstream release
* Fri Jul 24 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.6-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
* Mon Jun 29 2009 Steve Grubb <sgrubb@redhat.com> 0.6-1
- New upstream release
* Sun Jun 21 2009 Steve Grubb <sgrubb@redhat.com> 0.5.1-1
- New upstream release
* Fri Jun 19 2009 Steve Grubb <sgrubb@redhat.com> 0.5-1
- New upstream release
* Fri Jun 12 2009 Steve Grubb <sgrubb@redhat.com> 0.4.2-1
- New upstream release
* Fri Jun 12 2009 Steve Grubb <sgrubb@redhat.com> 0.4.1-1
- Initial build.
Write Preview
Loading…
Cancel
Save