diff options
Diffstat (limited to 'meta-networking/recipes-connectivity/freeradius/files')
2 files changed, 58 insertions, 104 deletions
diff --git a/meta-networking/recipes-connectivity/freeradius/files/0001-rlm_python3-add-PY_INC_DIR-in-search-dir.patch b/meta-networking/recipes-connectivity/freeradius/files/0001-rlm_python3-add-PY_INC_DIR-in-search-dir.patch new file mode 100644 index 0000000000..d63023162d --- /dev/null +++ b/meta-networking/recipes-connectivity/freeradius/files/0001-rlm_python3-add-PY_INC_DIR-in-search-dir.patch @@ -0,0 +1,58 @@ +From 733330888fff49e4d2b6c2121a6050fdd9f11a87 Mon Sep 17 00:00:00 2001 +From: Yi Zhao <yi.zhao@windriver.com> +Date: Thu, 6 Feb 2020 09:32:04 +0800 +Subject: [PATCH] rlm_python3: add PY_INC_DIR in search dir + +The configure option --with-rlm-python3-include-dir is used to set +PY_INC_DIR which is never used and it fails to find Python.h, +so add it into search dir to fix it. + +Also remove SMART_LIBS from mod_flags because it introduces rpath +to LDFALGS which causes a do_package_qa error: + +ERROR: freeradius-3.0.20-r0 do_package_qa: QA Issue: package freeradius-python contains bad RPATH +/buildarea/build/tmp/work/core2-64-poky-linux/freeradius/3.0.20-r0/recipe-sysroot-native/usr/lib/python3.8/config in file +/buildarea/build/tmp/work/core2-64-poky-linux/freeradius/3.0.20-r0/packages-split/freeradius-python/usr/lib/rlm_python3.so.0.0.0 +package freeradius-python contains bad RPATH +/buildarea/build/tmp/work/core2-64-poky-linux/freeradius/3.0.20-r0/recipe-sysroot-native/usr/lib/python3.8/config in file +/buildarea/build/tmp/work/core2-64-poky-linux/freeradius/3.0.20-r0/packages-split/freeradius-python/usr/lib/rlm_python3.so.0.0.0 [rpaths] + +Upstream-Status: Inappropriate [OE specific] + +Signed-off-by: Yi Zhao <yi.zhao@windriver.com> +--- + src/modules/rlm_python3/configure.ac | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/src/modules/rlm_python3/configure.ac b/src/modules/rlm_python3/configure.ac +index a00320f..adbdf19 100644 +--- a/src/modules/rlm_python3/configure.ac ++++ b/src/modules/rlm_python3/configure.ac +@@ -95,7 +95,7 @@ if test x$with_[]modname != xno; then + + old_CFLAGS=$CFLAGS + CFLAGS="$CFLAGS $PY_CFLAGS" +- smart_try_dir="$PY_PREFIX/include/python$PY_SYS_VERSION" ++ smart_try_dir="$PY_PREFIX/include/python$PY_SYS_VERSION $PY_INC_DIR" + FR_SMART_CHECK_INCLUDE(Python.h) + CFLAGS=$old_CFLAGS + +@@ -114,13 +114,13 @@ if test x$with_[]modname != xno; then + + eval t=\${ac_cv_lib_${sm_lib_safe}_${sm_func_safe}} + if test "x$t" = "xyes"; then +- mod_ldflags="$PY_LIB_LOC $PY_EXTRA_LIBS $SMART_LIBS -lm" ++ mod_ldflags="$PY_LIB_LOC $PY_EXTRA_LIBS -lm" + targetname=modname + else + FR_SMART_CHECK_LIB(python${PY_SYS_VERSION}m, Py_Initialize) + eval t=\${ac_cv_lib_${sm_lib_safe}_${sm_func_safe}} + if test "x$t" = "xyes"; then +- mod_ldflags="$PY_LIB_LOC $PY_EXTRA_LIBS $SMART_LIBS -lm" ++ mod_ldflags="$PY_LIB_LOC $PY_EXTRA_LIBS -lm" + targetname=modname + else + targetname= +-- +2.7.4 + diff --git a/meta-networking/recipes-connectivity/freeradius/files/0001-su-to-radiusd-user-group-when-rotating-logs.patch b/meta-networking/recipes-connectivity/freeradius/files/0001-su-to-radiusd-user-group-when-rotating-logs.patch deleted file mode 100644 index 5859dc7ed0..0000000000 --- a/meta-networking/recipes-connectivity/freeradius/files/0001-su-to-radiusd-user-group-when-rotating-logs.patch +++ /dev/null @@ -1,104 +0,0 @@ -From 1f233773962bf1a9c2d228a180eacddb9db2d574 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel <ascheel@redhat.com> -Date: Tue, 7 May 2019 16:04:29 -0400 -Subject: [PATCH] su to radiusd user/group when rotating logs - -The su directive to logrotate ensures that log rotation happens under the -owner of the logs. Otherwise, logrotate runs as root:root, potentially -enabling privilege escalation if a RCE is discovered against the -FreeRADIUS daemon. - -Signed-off-by: Alexander Scheel <ascheel@redhat.com> - -Upstream-Status: Backport -[https://github.com/FreeRADIUS/freeradius-server/commit/1f233773962bf1a9c2d228a180eacddb9db2d574] - -CVE: CVE-2019-10143 - -Signed-off-by: Yi Zhao <yi.zhao@windriver.com> ---- - debian/freeradius.logrotate | 3 +++ - redhat/freeradius-logrotate | 1 + - scripts/logrotate/freeradius | 3 +++ - suse/radiusd-logrotate | 1 + - 4 files changed, 8 insertions(+) - -diff --git a/debian/freeradius.logrotate b/debian/freeradius.logrotate -index 7d837d5..a8d29b7 100644 ---- a/debian/freeradius.logrotate -+++ b/debian/freeradius.logrotate -@@ -9,6 +9,7 @@ - notifempty - - copytruncate -+ su freerad freerad - } - - # (in order) -@@ -26,6 +27,7 @@ - notifempty - - nocreate -+ su freerad freerad - } - - # There are different detail-rotating strategies you can use. One is -@@ -45,4 +47,5 @@ - notifempty - - nocreate -+ su freerad freerad - } -diff --git a/redhat/freeradius-logrotate b/redhat/freeradius-logrotate -index 360765d..bb97ca5 100644 ---- a/redhat/freeradius-logrotate -+++ b/redhat/freeradius-logrotate -@@ -9,6 +9,7 @@ rotate 4 - missingok - compress - delaycompress -+su radiusd radiusd - - # - # The main server log -diff --git a/scripts/logrotate/freeradius b/scripts/logrotate/freeradius -index 3de435e..eecf631 100644 ---- a/scripts/logrotate/freeradius -+++ b/scripts/logrotate/freeradius -@@ -17,6 +17,7 @@ - notifempty - - copytruncate -+ su radiusd radiusd - } - - # (in order) -@@ -34,6 +35,7 @@ - notifempty - - nocreate -+ su radiusd radiusd - } - - # There are different detail-rotating strategies you can use. One is -@@ -53,4 +55,5 @@ - notifempty - - nocreate -+ su radiusd radiusd - } -diff --git a/suse/radiusd-logrotate b/suse/radiusd-logrotate -index 24d56be..be5a797 100644 ---- a/suse/radiusd-logrotate -+++ b/suse/radiusd-logrotate -@@ -11,6 +11,7 @@ missingok - compress - delaycompress - notifempty -+su radiusd radiusd - - # - # The main server log --- -2.7.4 - |