summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta-networking/recipes-connectivity/freeradius/files/0001-rlm_python3-add-PY_INC_DIR-in-search-dir.patch58
-rw-r--r--meta-networking/recipes-connectivity/freeradius/files/0001-su-to-radiusd-user-group-when-rotating-logs.patch104
-rw-r--r--meta-networking/recipes-connectivity/freeradius/freeradius_3.0.20.bb (renamed from meta-networking/recipes-connectivity/freeradius/freeradius_3.0.19.bb)35
3 files changed, 77 insertions, 120 deletions
diff --git a/meta-networking/recipes-connectivity/freeradius/files/0001-rlm_python3-add-PY_INC_DIR-in-search-dir.patch b/meta-networking/recipes-connectivity/freeradius/files/0001-rlm_python3-add-PY_INC_DIR-in-search-dir.patch
new file mode 100644
index 0000000000..d63023162d
--- /dev/null
+++ b/meta-networking/recipes-connectivity/freeradius/files/0001-rlm_python3-add-PY_INC_DIR-in-search-dir.patch
@@ -0,0 +1,58 @@
1From 733330888fff49e4d2b6c2121a6050fdd9f11a87 Mon Sep 17 00:00:00 2001
2From: Yi Zhao <yi.zhao@windriver.com>
3Date: Thu, 6 Feb 2020 09:32:04 +0800
4Subject: [PATCH] rlm_python3: add PY_INC_DIR in search dir
5
6The configure option --with-rlm-python3-include-dir is used to set
7PY_INC_DIR which is never used and it fails to find Python.h,
8so add it into search dir to fix it.
9
10Also remove SMART_LIBS from mod_flags because it introduces rpath
11to LDFALGS which causes a do_package_qa error:
12
13ERROR: freeradius-3.0.20-r0 do_package_qa: QA Issue: package freeradius-python contains bad RPATH
14/buildarea/build/tmp/work/core2-64-poky-linux/freeradius/3.0.20-r0/recipe-sysroot-native/usr/lib/python3.8/config in file
15/buildarea/build/tmp/work/core2-64-poky-linux/freeradius/3.0.20-r0/packages-split/freeradius-python/usr/lib/rlm_python3.so.0.0.0
16package freeradius-python contains bad RPATH
17/buildarea/build/tmp/work/core2-64-poky-linux/freeradius/3.0.20-r0/recipe-sysroot-native/usr/lib/python3.8/config in file
18/buildarea/build/tmp/work/core2-64-poky-linux/freeradius/3.0.20-r0/packages-split/freeradius-python/usr/lib/rlm_python3.so.0.0.0 [rpaths]
19
20Upstream-Status: Inappropriate [OE specific]
21
22Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
23---
24 src/modules/rlm_python3/configure.ac | 6 +++---
25 1 file changed, 3 insertions(+), 3 deletions(-)
26
27diff --git a/src/modules/rlm_python3/configure.ac b/src/modules/rlm_python3/configure.ac
28index a00320f..adbdf19 100644
29--- a/src/modules/rlm_python3/configure.ac
30+++ b/src/modules/rlm_python3/configure.ac
31@@ -95,7 +95,7 @@ if test x$with_[]modname != xno; then
32
33 old_CFLAGS=$CFLAGS
34 CFLAGS="$CFLAGS $PY_CFLAGS"
35- smart_try_dir="$PY_PREFIX/include/python$PY_SYS_VERSION"
36+ smart_try_dir="$PY_PREFIX/include/python$PY_SYS_VERSION $PY_INC_DIR"
37 FR_SMART_CHECK_INCLUDE(Python.h)
38 CFLAGS=$old_CFLAGS
39
40@@ -114,13 +114,13 @@ if test x$with_[]modname != xno; then
41
42 eval t=\${ac_cv_lib_${sm_lib_safe}_${sm_func_safe}}
43 if test "x$t" = "xyes"; then
44- mod_ldflags="$PY_LIB_LOC $PY_EXTRA_LIBS $SMART_LIBS -lm"
45+ mod_ldflags="$PY_LIB_LOC $PY_EXTRA_LIBS -lm"
46 targetname=modname
47 else
48 FR_SMART_CHECK_LIB(python${PY_SYS_VERSION}m, Py_Initialize)
49 eval t=\${ac_cv_lib_${sm_lib_safe}_${sm_func_safe}}
50 if test "x$t" = "xyes"; then
51- mod_ldflags="$PY_LIB_LOC $PY_EXTRA_LIBS $SMART_LIBS -lm"
52+ mod_ldflags="$PY_LIB_LOC $PY_EXTRA_LIBS -lm"
53 targetname=modname
54 else
55 targetname=
56--
572.7.4
58
diff --git a/meta-networking/recipes-connectivity/freeradius/files/0001-su-to-radiusd-user-group-when-rotating-logs.patch b/meta-networking/recipes-connectivity/freeradius/files/0001-su-to-radiusd-user-group-when-rotating-logs.patch
deleted file mode 100644
index 5859dc7ed0..0000000000
--- a/meta-networking/recipes-connectivity/freeradius/files/0001-su-to-radiusd-user-group-when-rotating-logs.patch
+++ /dev/null
@@ -1,104 +0,0 @@
1From 1f233773962bf1a9c2d228a180eacddb9db2d574 Mon Sep 17 00:00:00 2001
2From: Alexander Scheel <ascheel@redhat.com>
3Date: Tue, 7 May 2019 16:04:29 -0400
4Subject: [PATCH] su to radiusd user/group when rotating logs
5
6The su directive to logrotate ensures that log rotation happens under the
7owner of the logs. Otherwise, logrotate runs as root:root, potentially
8enabling privilege escalation if a RCE is discovered against the
9FreeRADIUS daemon.
10
11Signed-off-by: Alexander Scheel <ascheel@redhat.com>
12
13Upstream-Status: Backport
14[https://github.com/FreeRADIUS/freeradius-server/commit/1f233773962bf1a9c2d228a180eacddb9db2d574]
15
16CVE: CVE-2019-10143
17
18Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
19---
20 debian/freeradius.logrotate | 3 +++
21 redhat/freeradius-logrotate | 1 +
22 scripts/logrotate/freeradius | 3 +++
23 suse/radiusd-logrotate | 1 +
24 4 files changed, 8 insertions(+)
25
26diff --git a/debian/freeradius.logrotate b/debian/freeradius.logrotate
27index 7d837d5..a8d29b7 100644
28--- a/debian/freeradius.logrotate
29+++ b/debian/freeradius.logrotate
30@@ -9,6 +9,7 @@
31 notifempty
32
33 copytruncate
34+ su freerad freerad
35 }
36
37 # (in order)
38@@ -26,6 +27,7 @@
39 notifempty
40
41 nocreate
42+ su freerad freerad
43 }
44
45 # There are different detail-rotating strategies you can use. One is
46@@ -45,4 +47,5 @@
47 notifempty
48
49 nocreate
50+ su freerad freerad
51 }
52diff --git a/redhat/freeradius-logrotate b/redhat/freeradius-logrotate
53index 360765d..bb97ca5 100644
54--- a/redhat/freeradius-logrotate
55+++ b/redhat/freeradius-logrotate
56@@ -9,6 +9,7 @@ rotate 4
57 missingok
58 compress
59 delaycompress
60+su radiusd radiusd
61
62 #
63 # The main server log
64diff --git a/scripts/logrotate/freeradius b/scripts/logrotate/freeradius
65index 3de435e..eecf631 100644
66--- a/scripts/logrotate/freeradius
67+++ b/scripts/logrotate/freeradius
68@@ -17,6 +17,7 @@
69 notifempty
70
71 copytruncate
72+ su radiusd radiusd
73 }
74
75 # (in order)
76@@ -34,6 +35,7 @@
77 notifempty
78
79 nocreate
80+ su radiusd radiusd
81 }
82
83 # There are different detail-rotating strategies you can use. One is
84@@ -53,4 +55,5 @@
85 notifempty
86
87 nocreate
88+ su radiusd radiusd
89 }
90diff --git a/suse/radiusd-logrotate b/suse/radiusd-logrotate
91index 24d56be..be5a797 100644
92--- a/suse/radiusd-logrotate
93+++ b/suse/radiusd-logrotate
94@@ -11,6 +11,7 @@ missingok
95 compress
96 delaycompress
97 notifempty
98+su radiusd radiusd
99
100 #
101 # The main server log
102--
1032.7.4
104
diff --git a/meta-networking/recipes-connectivity/freeradius/freeradius_3.0.19.bb b/meta-networking/recipes-connectivity/freeradius/freeradius_3.0.20.bb
index 8887433062..a9c2fad0fd 100644
--- a/meta-networking/recipes-connectivity/freeradius/freeradius_3.0.19.bb
+++ b/meta-networking/recipes-connectivity/freeradius/freeradius_3.0.20.bb
@@ -26,12 +26,12 @@ SRC_URI = "git://github.com/FreeRADIUS/freeradius-server.git;branch=v3.0.x; \
26 file://freeradius-fix-quoting-for-BUILT_WITH.patch \ 26 file://freeradius-fix-quoting-for-BUILT_WITH.patch \
27 file://freeradius-fix-error-for-expansion-of-macro.patch \ 27 file://freeradius-fix-error-for-expansion-of-macro.patch \
28 file://0001-rlm_mschap-Use-includedir-instead-of-hardcoding-usr-.patch \ 28 file://0001-rlm_mschap-Use-includedir-instead-of-hardcoding-usr-.patch \
29 file://0001-su-to-radiusd-user-group-when-rotating-logs.patch \ 29 file://0001-rlm_python3-add-PY_INC_DIR-in-search-dir.patch \
30 file://radiusd.service \ 30 file://radiusd.service \
31 file://radiusd-volatiles.conf \ 31 file://radiusd-volatiles.conf \
32" 32"
33 33
34SRCREV = "ab4c767099f263a7cd4109bcdca80ee74210a769" 34SRCREV = "d94c953ab9602a238433ba18533111b845fd8e9e"
35 35
36PARALLEL_MAKE = "" 36PARALLEL_MAKE = ""
37 37
@@ -61,9 +61,11 @@ EXTRA_OECONF = " --enable-strict-dependencies \
61 --without-rlm_sql_iodbc \ 61 --without-rlm_sql_iodbc \
62 --without-rlm_sql_oracle \ 62 --without-rlm_sql_oracle \
63 --without-rlm_sql_sybase \ 63 --without-rlm_sql_sybase \
64 --without-rlm_sql_mongo \
64 --without-rlm_sqlhpwippool \ 65 --without-rlm_sqlhpwippool \
65 --without-rlm_securid \ 66 --without-rlm_securid \
66 --without-rlm_unbound \ 67 --without-rlm_unbound \
68 --without-rlm_python \
67 ac_cv_path_PERL=${bindir}/perl \ 69 ac_cv_path_PERL=${bindir}/perl \
68 ax_cv_cc_builtin_choose_expr=no \ 70 ax_cv_cc_builtin_choose_expr=no \
69 ax_cv_cc_builtin_types_compatible_p=no \ 71 ax_cv_cc_builtin_types_compatible_p=no \
@@ -86,7 +88,7 @@ PACKAGECONFIG[unixodbc] = "--with-rlm_sql_unixodbc,--without-rlm_sql_unixodbc,un
86PACKAGECONFIG[postgresql] = "--with-rlm_sql_postgresql,--without-rlm_sql_postgresql,postgresql" 88PACKAGECONFIG[postgresql] = "--with-rlm_sql_postgresql,--without-rlm_sql_postgresql,postgresql"
87PACKAGECONFIG[pcre] = "--with-pcre,--without-pcre,libpcre" 89PACKAGECONFIG[pcre] = "--with-pcre,--without-pcre,libpcre"
88PACKAGECONFIG[perl] = "--with-perl=${STAGING_BINDIR_NATIVE}/perl-native/perl --with-rlm_perl,--without-rlm_perl,perl-native perl,perl" 90PACKAGECONFIG[perl] = "--with-perl=${STAGING_BINDIR_NATIVE}/perl-native/perl --with-rlm_perl,--without-rlm_perl,perl-native perl,perl"
89PACKAGECONFIG[python] = "--with-rlm_python --with-rlm-python-bin=${STAGING_BINDIR_NATIVE}/python-native/python --with-rlm-python-include-dir=${STAGING_INCDIR}/${PYTHON_DIR},--without-rlm_python,python-native python" 91PACKAGECONFIG[python3] = "--with-rlm_python3 --with-rlm-python3-bin=${STAGING_BINDIR_NATIVE}/python3-native/python3 --with-rlm-python3-include-dir=${STAGING_INCDIR}/${PYTHON_DIR},--without-rlm_python3,python3-native python3"
90PACKAGECONFIG[rest] = "--with-rlm_rest,--without-rlm_rest,curl json-c" 92PACKAGECONFIG[rest] = "--with-rlm_rest,--without-rlm_rest,curl json-c"
91PACKAGECONFIG[ruby] = "--with-rlm_ruby,--without-rlm_ruby,ruby" 93PACKAGECONFIG[ruby] = "--with-rlm_ruby,--without-rlm_ruby,ruby"
92PACKAGECONFIG[openssl] = "--with-openssl, --without-openssl" 94PACKAGECONFIG[openssl] = "--with-openssl, --without-openssl"
@@ -145,23 +147,24 @@ do_install() {
145 rm -f ${D}/${sbindir}/rc.radiusd 147 rm -f ${D}/${sbindir}/rc.radiusd
146 chmod +x ${D}/${sysconfdir}/init.d/radiusd 148 chmod +x ${D}/${sysconfdir}/init.d/radiusd
147 rm -rf ${D}/${localstatedir}/run/ 149 rm -rf ${D}/${localstatedir}/run/
150 rm -rf ${D}/${localstatedir}/log/
148 install -m 0644 ${WORKDIR}/volatiles.58_radiusd ${D}${sysconfdir}/default/volatiles/58_radiusd 151 install -m 0644 ${WORKDIR}/volatiles.58_radiusd ${D}${sysconfdir}/default/volatiles/58_radiusd
149 152
150 chown -R radiusd:radiusd ${D}/${sysconfdir}/raddb/ 153 chown -R radiusd:radiusd ${D}/${sysconfdir}/raddb/
151 chown -R radiusd:radiusd ${D}/${localstatedir}/lib/radiusd 154 chown -R radiusd:radiusd ${D}/${localstatedir}/lib/radiusd
152 155
153 # For systemd 156 # For systemd
154 install -d ${D}${systemd_unitdir}/system
155 install -m 0644 ${WORKDIR}/radiusd.service ${D}${systemd_unitdir}/system
156 sed -i -e 's,@BASE_BINDIR@,${base_bindir},g' \
157 -e 's,@SBINDIR@,${sbindir},g' \
158 -e 's,@STATEDIR@,${localstatedir},g' \
159 -e 's,@SYSCONFDIR@,${sysconfdir},g' \
160 ${D}${systemd_unitdir}/system/radiusd.service
161
162 if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then 157 if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
158 install -d ${D}${systemd_unitdir}/system
159 install -m 0644 ${WORKDIR}/radiusd.service ${D}${systemd_unitdir}/system
160 sed -i -e 's,@BASE_BINDIR@,${base_bindir},g' \
161 -e 's,@SBINDIR@,${sbindir},g' \
162 -e 's,@STATEDIR@,${localstatedir},g' \
163 -e 's,@SYSCONFDIR@,${sysconfdir},g' \
164 ${D}${systemd_unitdir}/system/radiusd.service
165
163 install -d ${D}${sysconfdir}/tmpfiles.d/ 166 install -d ${D}${sysconfdir}/tmpfiles.d/
164 install -m 0644 ${WORKDIR}/radiusd-volatiles.conf ${D}${sysconfdir}/tmpfiles.d/ 167 install -m 0644 ${WORKDIR}/radiusd-volatiles.conf ${D}${sysconfdir}/tmpfiles.d/radiusd.conf
165 fi 168 fi
166} 169}
167 170
@@ -171,7 +174,7 @@ pkg_postinst_${PN} () {
171 if [ -z "$D" ]; then 174 if [ -z "$D" ]; then
172 if command -v systemd-tmpfiles >/dev/null; then 175 if command -v systemd-tmpfiles >/dev/null; then
173 # create /var/log/radius, /var/run/radiusd 176 # create /var/log/radius, /var/run/radiusd
174 systemd-tmpfiles --create ${sysconfdir}/tmpfiles.d/radiusd-volatiles.conf 177 systemd-tmpfiles --create ${sysconfdir}/tmpfiles.d/radiusd.conf
175 elif [ -e ${sysconfdir}/init.d/populate-volatile.sh ]; then 178 elif [ -e ${sysconfdir}/init.d/populate-volatile.sh ]; then
176 ${sysconfdir}/init.d/populate-volatile.sh update 179 ${sysconfdir}/init.d/populate-volatile.sh update
177 fi 180 fi
@@ -210,9 +213,9 @@ FILES_${PN}-perl = "${libdir}/rlm_perl.so* \
210 ${sysconfdir}/raddb/mods-available/perl \ 213 ${sysconfdir}/raddb/mods-available/perl \
211" 214"
212 215
213FILES_${PN}-python = "${libdir}/rlm_python.so* \ 216FILES_${PN}-python = "${libdir}/rlm_python3.so* \
214 ${sysconfdir}/raddb/mods-config/python \ 217 ${sysconfdir}/raddb/mods-config/python3 \
215 ${sysconfdir}/raddb/mods-available/python \ 218 ${sysconfdir}/raddb/mods-available/python3 \
216" 219"
217 220
218FILES_${PN}-mysql = "${libdir}/rlm_sql_mysql.so* \ 221FILES_${PN}-mysql = "${libdir}/rlm_sql_mysql.so* \
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-10-28 09:31:22 +0000