commit: 52949343c8c1ca3d53c9b595f3c549ec08b38a1e Author: Sam James <sam <AT> gentoo <DOT> org> AuthorDate: Sat Sep 18 23:36:24 2021 +0000 Commit: Sam James <sam <AT> gentoo <DOT> org> CommitDate: Sat Sep 18 23:44:21 2021 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=52949343
sys-auth/sssd: add patch for CVE-2021-3621 for 2.5.2 Bug: https://bugs.gentoo.org/808911 Signed-off-by: Sam James <sam <AT> gentoo.org> sys-auth/sssd/Manifest | 1 + sys-auth/sssd/sssd-2.3.1-r3.ebuild | 2 +- .../{sssd-2.3.1-r3.ebuild => sssd-2.5.2-r1.ebuild} | 100 ++++++++++++--------- 3 files changed, 58 insertions(+), 45 deletions(-) diff --git a/sys-auth/sssd/Manifest b/sys-auth/sssd/Manifest index cb3f830192c..949f7b2f62e 100644 --- a/sys-auth/sssd/Manifest +++ b/sys-auth/sssd/Manifest @@ -1,3 +1,4 @@ DIST sssd-2.3.1-CVE-2021-3621.patch.bz2 3174 BLAKE2B 201c51fff92dd17d9517834e59a12422850ee3c5aab1efff51bcdc5b82521516589271222b6be36d12da2a388d122d37e9f455d593f22551ba9ea58ead694b49 SHA512 faffe46b710e3f8b2db54fc4f637b176b72f6bc31a2d5d1cae7a5ffc81609c4faa5decee1d6db4b2bf87451677c8eda068e153e38755f013afbce982daf58f65 DIST sssd-2.3.1.tar.gz 7186526 BLAKE2B 6d630fe75b9b426ef54adbe1704fde8e01fc34df7861028c07ce2985db8a151ce743d633061386fea6460fe8eabb89242b816d4bac87975bb9b7b2064ad1d547 SHA512 6aeb52d5222c5992d581296996749327bcaf276e4eb4413a6a32ea6529343432cfe413006aca4245c19b38b515be1c4c2ef88a157c617d889274179253355bc6 +DIST sssd-2.5.2-CVE-2021-3621.patch.bz2 3155 BLAKE2B c50e331f0f1acbb9ef8e6d54a63219da44df5e565608c24635d85a110fcc024f7d5293c4412bca64831a9a3a14e2c1188be1a802c76575ad6d7a83243d3d89c2 SHA512 650af7c67b3a807935c0875ee877d366facdf818492fb4244757448ad351454a279968ea5414e6b3cd116e873abe4f1aef2ccdaf790a4df0cf7f2a0078a41860 DIST sssd-2.5.2.tar.gz 7579208 BLAKE2B ec5d9aeaf5b5e05b56c01f9137f6f24db05544dbd48458d742285b60e7beb6d48af865f3415e11ce89e187f4643bbecf15bbb321859ec80cfe458eb781cea6c9 SHA512 a9bac7b2cc23022dce3bcda314c9c26a0a0914c448f6d5a51c5ba18670f04c1fd1a94cb20173235b6285df1dcc9251cb6b3f3e71a220037b4eb66668e6f33c48 diff --git a/sys-auth/sssd/sssd-2.3.1-r3.ebuild b/sys-auth/sssd/sssd-2.3.1-r3.ebuild index 4df7454beca..cd2099011aa 100644 --- a/sys-auth/sssd/sssd-2.3.1-r3.ebuild +++ b/sys-auth/sssd/sssd-2.3.1-r3.ebuild @@ -14,7 +14,7 @@ SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}-CVE-2021 LICENSE="GPL-3" SLOT="0" -KEYWORDS="amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc x86" +KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86" IUSE="acl doc +locator +netlink nfsv4 nls +man pac python samba selinux sudo systemd test valgrind" RESTRICT="!test? ( test )" diff --git a/sys-auth/sssd/sssd-2.3.1-r3.ebuild b/sys-auth/sssd/sssd-2.5.2-r1.ebuild similarity index 88% copy from sys-auth/sssd/sssd-2.3.1-r3.ebuild copy to sys-auth/sssd/sssd-2.5.2-r1.ebuild index 4df7454beca..b00af4ba567 100644 --- a/sys-auth/sssd/sssd-2.3.1-r3.ebuild +++ b/sys-auth/sssd/sssd-2.5.2-r1.ebuild @@ -3,26 +3,48 @@ EAPI=7 -PYTHON_COMPAT=( python3_{7,8,9} ) +PYTHON_COMPAT=( python3_{8..10} ) inherit autotools flag-o-matic linux-info multilib-minimal python-single-r1 pam systemd toolchain-funcs DESCRIPTION="System Security Services Daemon provides access to identity and authentication" HOMEPAGE="https://github.com/SSSD/sssd"; -SRC_URI="https://github.com/SSSD/sssd/releases/download/${PN}-${PV//./_}/${P}.tar.gz"; +SRC_URI="https://github.com/SSSD/sssd/releases/download/${PV}/${P}.tar.gz"; SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}-CVE-2021-3621.patch.bz2"; LICENSE="GPL-3" SLOT="0" -KEYWORDS="amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc x86" -IUSE="acl doc +locator +netlink nfsv4 nls +man pac python samba selinux sudo systemd test valgrind" +KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86" +IUSE="acl doc +locator +netlink nfsv4 nls +man pac python samba selinux sudo systemd systemtap test valgrind" RESTRICT="!test? ( test )" -REQUIRED_USE="pac? ( samba ) - python? ( ${PYTHON_REQUIRED_USE} )" +REQUIRED_USE="${PYTHON_REQUIRED_USE} + pac? ( samba ) + test? ( sudo ) + valgrind? ( test )" -DEPEND=" - >=app-crypt/mit-krb5-1.10.3 +BDEPEND=">=sys-devel/autoconf-2.69-r5 + virtual/pkgconfig + ${PYTHON_DEPS} + doc? ( app-doc/doxygen ) + test? ( + dev-libs/check + dev-libs/softhsm:2 + dev-util/cmocka + net-libs/gnutls[pkcs11,tools] + sys-libs/libfaketime + sys-libs/nss_wrapper + sys-libs/pam_wrapper + sys-libs/uid_wrapper + valgrind? ( dev-util/valgrind ) + ) + man? ( + app-text/docbook-xml-dtd:4.4 + >=dev-libs/libxslt-1.1.26 + nls? ( app-text/po4a ) + )" + +DEPEND=">=app-crypt/mit-krb5-1.19.1[${MULTILIB_USEDEP}] app-crypt/p11-kit >=dev-libs/ding-libs-0.2 dev-libs/glib:2 @@ -42,7 +64,6 @@ DEPEND=" >=sys-libs/ldb-1.1.17-r1:= virtual/libintl locator? ( - >=app-crypt/mit-krb5-1.12.2[${MULTILIB_USEDEP}] >=net-dns/c-ares-1.10.0-r1[${MULTILIB_USEDEP}] ) acl? ( net-fs/cifs-utils[acl] ) @@ -50,7 +71,6 @@ DEPEND=" nfsv4? ( || ( >=net-fs/nfs-utils-2.3.1-r2 net-libs/libnfsidmap ) ) nls? ( >=sys-devel/gettext-0.18 ) pac? ( - app-crypt/mit-krb5[${MULTILIB_USEDEP}] net-fs/samba ) python? ( ${PYTHON_DEPS} ) @@ -63,29 +83,11 @@ DEPEND=" dev-libs/jansson:0= net-libs/http-parser:0= net-misc/curl:0= - )" + ) + systemtap? ( dev-util/systemtap )" RDEPEND="${DEPEND} >=sys-libs/glibc-2.17[nscd] selinux? ( >=sec-policy/selinux-sssd-2.20120725-r9 )" -BDEPEND=">=sys-devel/autoconf-2.69-r5 - virtual/pkgconfig - doc? ( app-doc/doxygen ) - test? ( - dev-libs/check - dev-libs/softhsm:2 - dev-util/cmocka - net-libs/gnutls[pkcs11,tools] - sys-libs/libfaketime - sys-libs/nss_wrapper - sys-libs/pam_wrapper - sys-libs/uid_wrapper - valgrind? ( dev-util/valgrind ) - ) - man? ( - app-text/docbook-xml-dtd:4.4 - >=dev-libs/libxslt-1.1.26 - nls? ( app-text/po4a ) - )" CONFIG_CHECK="~KEYS" @@ -101,24 +103,31 @@ MULTILIB_WRAPPED_HEADERS=( ) PATCHES=( - "${FILESDIR}"/${P}-test_ca-Look-for-libsofthsm2.so-in-usr-libdir-sofths.patch "${WORKDIR}"/${P}-CVE-2021-3621.patch ) pkg_setup() { linux-info_pkg_setup + python-single-r1_pkg_setup } src_prepare() { - sed -i 's:/var/run:/run:' \ - "${S}"/src/examples/logrotate || die - default + + sed -i \ + -e 's:/var/run:/run:' \ + "${S}"/src/examples/logrotate \ + || die + + # disable flaky test, see https://github.com/SSSD/sssd/issues/5631 + sed -i \ + -e '/^\s*pam-srv-tests[ \\]*$/d' \ + "${S}"/Makefile.am \ + || die + eautoreconf + multilib_copy_sources - if use python && multilib_is_native_abi; then - python_setup - fi } src_configure() { @@ -148,8 +157,8 @@ multilib_src_configure() { --with-nscd="${EPREFIX}"/usr/sbin/nscd --with-unicode-lib="glib2" --disable-rpath + --disable-static --sbindir=/usr/sbin - --with-crypto="libcrypto" --enable-local-provider $(multilib_native_use_with systemd kcm) $(multilib_native_use_with systemd secrets) @@ -167,6 +176,7 @@ multilib_src_configure() { $(multilib_native_use_with sudo) $(multilib_native_with autofs) $(multilib_native_with ssh) + $(use_enable systemtap) $(use_enable valgrind) --without-python2-bindings $(multilib_native_use_with python python3-bindings) @@ -219,6 +229,13 @@ multilib_src_compile() { fi } +multilib_src_test() { + if multilib_is_native_abi; then + local -x CK_TIMEOUT_MULTIPLIER=10 + emake check VERBOSE=yes + fi +} + multilib_src_install() { if multilib_is_native_abi; then emake -j1 DESTDIR="${D}" "${_at_args[@]}" install @@ -226,7 +243,6 @@ multilib_src_install() { python_optimize python_fix_shebang "${ED}" fi - else # easier than playing with automake... dopammod .libs/pam_sss.so @@ -271,7 +287,7 @@ multilib_src_install_all() { keepdir /var/log/sssd # strip empty dirs - if ! use doc ; then + if ! use doc; then rm -r "${ED}"/usr/share/doc/"${PF}"/doc || die rm -r "${ED}"/usr/share/doc/"${PF}"/{hbac,idmap,nss_idmap,sss_simpleifp}_doc || die fi @@ -279,10 +295,6 @@ multilib_src_install_all() { rm -r "${ED}"/run || die } -multilib_src_test() { - multilib_is_native_abi && emake check -} - pkg_postinst() { elog "You must set up sssd.conf (default installed into /etc/sssd)" elog "and (optionally) configuration in /etc/pam.d in order to use SSSD"
