|
 |
472fdf |
Name: gssproxy
|
|
|
472fdf |
Version: 0.7.0
|
|
|
45f3a6 |
Release: 29%{?dist}
|
|
|
472fdf |
Summary: GSSAPI Proxy
|
|
|
472fdf |
|
|
|
472fdf |
Group: System Environment/Libraries
|
|
|
472fdf |
License: MIT
|
|
|
472fdf |
URL: https://pagure.io/gssproxy
|
|
|
472fdf |
Source0: https://releases.pagure.org/gssproxy/gssproxy-%{version}.tar.gz
|
|
|
472fdf |
Source1: rwtab
|
|
|
472fdf |
BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
|
|
|
472fdf |
|
|
|
472fdf |
%global servicename gssproxy
|
|
|
472fdf |
%global pubconfpath %{_sysconfdir}/gssproxy
|
|
|
472fdf |
%global gpstatedir %{_localstatedir}/lib/gssproxy
|
|
|
472fdf |
|
|
|
472fdf |
### Patches ###
|
|
|
472fdf |
Patch0: Properly-renew-expired-credentials.patch
|
|
|
472fdf |
Patch1: Change-impersonator-check-code.patch
|
|
|
472fdf |
Patch2: Allow-connection-to-self-when-impersonator-set.patch
|
|
|
472fdf |
Patch3: Make-proc-file-failure-loud-but-nonfatal.patch
|
|
|
472fdf |
Patch4: Turn-on-Wextra.patch
|
|
|
472fdf |
Patch5: Fix-unused-variables.patch
|
|
|
472fdf |
Patch6: Fix-mismatched-sign-comparisons.patch
|
|
|
472fdf |
Patch7: Fix-error-checking-on-get_impersonator_fallback.patch
|
|
|
472fdf |
Patch8: Remove-gpm_release_ctx-to-fix-double-unlock.patch
|
|
|
472fdf |
Patch9: Appease-gcc-7-s-fallthrough-detection.patch
|
|
|
472fdf |
Patch10: Fix-memory-leak.patch
|
|
|
472fdf |
Patch11: Fix-most-memory-leaks.patch
|
|
|
472fdf |
Patch12: Fix-segfault-when-no-config-files-are-present.patch
|
|
|
472fdf |
Patch13: Update-systemd-file.patch
|
|
|
472fdf |
Patch14: Fix-error-handling-in-gp_config_from_dir.patch
|
|
|
472fdf |
Patch15: Fix-silent-crash-with-duplicate-config-sections.patch
|
|
|
472fdf |
Patch16: Do-not-call-gpm_grab_sock-twice.patch
|
|
|
472fdf |
Patch18: Only-empty-FILE-ccaches-when-storing-remote-creds.patch
|
|
|
472fdf |
Patch19: Handle-outdated-encrypted-ccaches.patch
|
|
|
472fdf |
Patch20: Separate-cred-and-ccache-manipulation-in-gpp_store_r.patch
|
|
|
472fdf |
Patch21: Properly-locate-credentials-in-collection-caches-in-.patch
|
|
|
472fdf |
Patch22: Properly-initialize-ccaches-before-storing-into-them.patch
|
|
|
472fdf |
Patch23: Include-header-for-writev.patch
|
|
|
472fdf |
Patch24: Tolerate-NULL-pointers-in-gp_same.patch
|
|
|
472fdf |
Patch25: Add-Client-ID-to-debug-messages.patch
|
|
|
472fdf |
Patch26: client-Switch-to-non-blocking-sockets.patch
|
|
|
472fdf |
Patch27: server-Add-detailed-request-logging.patch
|
|
|
472fdf |
Patch28: Fix-potential-free-of-non-heap-address.patch
|
|
|
472fdf |
Patch29: Prevent-uninitialized-read-in-error-path-of-XDR-cont.patch
|
|
|
472fdf |
Patch30: Simplify-setting-NONBLOCK-on-socket.patch
|
|
|
472fdf |
Patch31: Fix-handling-of-non-EPOLLIN-EPOLLOUT-events.patch
|
|
|
472fdf |
Patch32: Fix-error-handling-in-gpm_send_buffer-gpm_recv_buffe.patch
|
|
|
472fdf |
Patch33: Emit-debug-on-queue-errors.patch
|
|
|
472fdf |
Patch34: Conditionally-reload-kernel-interface-on-SIGHUP.patch
|
|
|
472fdf |
Patch35: Don-t-leak-mech_type-when-CONTINUE_NEEDED-from-init_.patch
|
|
|
472fdf |
Patch36: Always-use-the-encype-we-selected.patch
|
|
|
472fdf |
Patch37: Clarify-debug-and-debug_level-in-man-pages.patch
|
|
|
472fdf |
Patch38: Always-choose-highest-requested-debug-level.patch
|
|
|
472fdf |
Patch39: Use-pthread-keys-for-thread-local-storage.patch
|
|
|
472fdf |
Patch40: Close-epoll-fd-within-the-lock.patch
|
|
|
472fdf |
Patch41: Add-a-safety-timeout-to-epoll.patch
|
|
|
472fdf |
Patch42: Always-initialize-out-cred-in-gp_import_gssx_cred.patch
|
|
|
472fdf |
Patch43: Handle-gss_import_cred-failure-when-importing-gssx-c.patch
|
|
|
472fdf |
Patch44: Include-length-when-using-krb5_c_decrypt.patch
|
|
|
472fdf |
Patch45: Change-the-way-we-handle-encrypted-buffers.patch
|
|
|
472fdf |
Patch46: Avoid-uninitialized-free-when-allocating-buffers.patch
|
|
|
472fdf |
Patch47: Update-docs-to-reflect-actual-behavior-of-krb5_princ.patch
|
|
|
472fdf |
Patch48: Fix-double-free-of-popt-context-when-querying-versio.patch
|
|
|
45f3a6 |
Patch49: Make-syslog-of-call-status-configurable.patch
|
|
|
472fdf |
|
|
|
472fdf |
### Dependencies ###
|
|
|
472fdf |
|
|
|
472fdf |
# From rhbz#1458913 and rhbz#1507607 (and friends)
|
|
|
472fdf |
Requires: libini_config >= 1.3.1-31
|
|
|
472fdf |
|
|
|
472fdf |
Requires: krb5-libs >= 1.15
|
|
|
472fdf |
Requires: keyutils-libs
|
|
|
472fdf |
Requires: libverto-module-base
|
|
|
472fdf |
Requires(post): systemd-units
|
|
|
472fdf |
Requires(preun): systemd-units
|
|
|
472fdf |
Requires(postun): systemd-units
|
|
|
472fdf |
|
|
|
472fdf |
# Currently from rhbz#1458850 and friends
|
|
|
472fdf |
Conflicts: selinux-policy < 3.13.1-166.el7.noarch
|
|
|
472fdf |
|
|
|
472fdf |
### Build Dependencies ###
|
|
|
472fdf |
|
|
|
472fdf |
BuildRequires: autoconf
|
|
|
472fdf |
BuildRequires: automake
|
|
|
472fdf |
BuildRequires: coreutils
|
|
|
472fdf |
BuildRequires: docbook-style-xsl
|
|
|
472fdf |
BuildRequires: doxygen
|
|
|
472fdf |
BuildRequires: findutils
|
|
|
472fdf |
BuildRequires: gettext-devel
|
|
|
472fdf |
BuildRequires: keyutils-libs-devel
|
|
|
472fdf |
BuildRequires: krb5-devel >= 1.15
|
|
|
472fdf |
BuildRequires: libini_config-devel >= 1.3.1-28
|
|
|
472fdf |
BuildRequires: libselinux-devel
|
|
|
472fdf |
BuildRequires: libtool
|
|
|
472fdf |
BuildRequires: libverto-devel
|
|
|
472fdf |
BuildRequires: libxml2
|
|
|
472fdf |
BuildRequires: libxslt
|
|
|
472fdf |
BuildRequires: m4
|
|
|
472fdf |
BuildRequires: pkgconfig
|
|
|
472fdf |
BuildRequires: popt-devel
|
|
|
472fdf |
BuildRequires: sed
|
|
|
472fdf |
BuildRequires: systemd-units
|
|
|
472fdf |
|
|
|
472fdf |
|
|
|
472fdf |
%description
|
|
|
472fdf |
A proxy for GSSAPI credential handling
|
|
|
472fdf |
|
|
|
472fdf |
|
|
|
472fdf |
%prep
|
|
|
472fdf |
%setup -q
|
|
|
472fdf |
%patch0 -p2 -b .Properly-renew-expired-credentials
|
|
|
472fdf |
%patch1 -p2 -b .Change-impersonator-check-code
|
|
|
472fdf |
%patch2 -p2 -b .Allow-connection-to-self-when-impersonator-set
|
|
|
472fdf |
%patch3 -p2 -b .Make-proc-file-failure-loud-but-nonfatal
|
|
|
472fdf |
%patch4 -p2 -b .Turn-on-Wextra
|
|
|
472fdf |
%patch5 -p2 -b .Fix-unused-variables
|
|
|
472fdf |
%patch6 -p2 -b .Fix-mismatched-sign-comparisons
|
|
|
472fdf |
%patch7 -p2 -b .Fix-error-checking-on-get_impersonator_fallback
|
|
|
472fdf |
%patch8 -p2 -b .Remove-gpm_release_ctx-to-fix-double-unlock
|
|
|
472fdf |
%patch9 -p2 -b .Appease-gcc-7-s-fallthrough-detection
|
|
|
472fdf |
%patch10 -p2 -b .Fix-memory-leak
|
|
|
472fdf |
%patch11 -p2 -b .Fix-most-memory-leaks
|
|
|
472fdf |
%patch12 -p2 -b .Fix-segfault-when-no-config-files-are-present
|
|
|
472fdf |
%patch13 -p2 -b .Update-systemd-file
|
|
|
472fdf |
%patch14 -p2 -b .Fix-error-handling-in-gp_config_from_dir
|
|
|
472fdf |
%patch15 -p2 -b .Fix-silent-crash-with-duplicate-config-sections
|
|
|
472fdf |
%patch16 -p2 -b .Do-not-call-gpm_grab_sock-twice
|
|
|
472fdf |
%patch18 -p2 -b .Only-empty-FILE-ccaches-when-storing-remote-creds
|
|
|
472fdf |
%patch19 -p2 -b .Handle-outdated-encrypted-ccaches
|
|
|
472fdf |
%patch20 -p2 -b .Separate-cred-and-ccache-manipulation-in-gpp_store_r
|
|
|
472fdf |
%patch21 -p2 -b .Properly-locate-credentials-in-collection-caches-in-
|
|
|
472fdf |
%patch22 -p2 -b .Properly-initialize-ccaches-before-storing-into-them
|
|
|
472fdf |
%patch23 -p2 -b .Include-header-for-writev
|
|
|
472fdf |
%patch24 -p2 -b .Tolerate-NULL-pointers-in-gp_same
|
|
|
472fdf |
%patch25 -p2 -b .Add-Client-ID-to-debug-messages
|
|
|
472fdf |
%patch26 -p2 -b .client-Switch-to-non-blocking-sockets
|
|
|
472fdf |
%patch27 -p2 -b .server-Add-detailed-request-logging
|
|
|
472fdf |
%patch28 -p2 -b .Fix-potential-free-of-non-heap-address
|
|
|
472fdf |
%patch29 -p2 -b .Prevent-uninitialized-read-in-error-path-of-XDR-cont
|
|
|
472fdf |
%patch30 -p2 -b .Simplify-setting-NONBLOCK-on-socket
|
|
|
472fdf |
%patch31 -p2 -b .Fix-handling-of-non-EPOLLIN-EPOLLOUT-events
|
|
|
472fdf |
%patch32 -p2 -b .Fix-error-handling-in-gpm_send_buffer-gpm_recv_buffe
|
|
|
472fdf |
%patch33 -p2 -b .Emit-debug-on-queue-errors
|
|
|
472fdf |
%patch34 -p2 -b .Conditionally-reload-kernel-interface-on-SIGHUP
|
|
|
472fdf |
%patch35 -p2 -b .Don-t-leak-mech_type-when-CONTINUE_NEEDED-from-init_
|
|
|
472fdf |
%patch36 -p2 -b .Always-use-the-encype-we-selected
|
|
|
472fdf |
%patch37 -p2 -b .Clarify-debug-and-debug_level-in-man-pages
|
|
|
472fdf |
%patch38 -p2 -b .Always-choose-highest-requested-debug-level
|
|
|
472fdf |
%patch39 -p2 -b .Use-pthread-keys-for-thread-local-storage
|
|
|
472fdf |
%patch40 -p2 -b .Close-epoll-fd-within-the-lock
|
|
|
472fdf |
%patch41 -p2 -b .Add-a-safety-timeout-to-epoll
|
|
|
472fdf |
%patch42 -p2 -b .Always-initialize-out-cred-in-gp_import_gssx_cred
|
|
|
472fdf |
%patch43 -p2 -b .Handle-gss_import_cred-failure-when-importing-gssx-c
|
|
|
472fdf |
%patch44 -p2 -b .Include-length-when-using-krb5_c_decrypt
|
|
|
472fdf |
%patch45 -p2 -b .Change-the-way-we-handle-encrypted-buffers
|
|
|
472fdf |
%patch46 -p2 -b .Avoid-uninitialized-free-when-allocating-buffers
|
|
|
472fdf |
%patch47 -p2 -b .Update-docs-to-reflect-actual-behavior-of-krb5_princ
|
|
|
472fdf |
%patch48 -p2 -b .Fix-double-free-of-popt-context-when-querying-versio
|
|
|
45f3a6 |
%patch49 -p2 -b .Make-syslog-of-call-status-configurable
|
|
|
472fdf |
|
|
|
472fdf |
%build
|
|
|
472fdf |
autoreconf -f -i
|
|
|
472fdf |
%configure \
|
|
|
472fdf |
--with-pubconf-path=%{pubconfpath} \
|
|
|
472fdf |
--with-initscript=systemd \
|
|
|
472fdf |
--disable-static \
|
|
|
472fdf |
--disable-rpath \
|
|
|
472fdf |
--with-gpp-default-behavior=REMOTE_FIRST \
|
|
|
472fdf |
CFLAGS="$CFLAGS -fPIE -fstack-protector-all" \
|
|
|
472fdf |
LDFLAGS="$LDFLAGS -fPIE -pie -Wl,-z,now"
|
|
|
472fdf |
make %{?_smp_mflags} all
|
|
|
472fdf |
make test_proxymech
|
|
|
472fdf |
|
|
|
472fdf |
%install
|
|
|
472fdf |
rm -rf -- "%{buildroot}"
|
|
|
472fdf |
make install DESTDIR=%{buildroot}
|
|
|
472fdf |
rm -f -- %{buildroot}%{_libdir}/gssproxy/proxymech.la
|
|
|
472fdf |
install -d -m755 %{buildroot}%{_sysconfdir}/gssproxy
|
|
|
472fdf |
install -m644 examples/gssproxy.conf %{buildroot}%{_sysconfdir}/gssproxy/gssproxy.conf
|
|
|
472fdf |
install -m644 examples/99-nfs-client.conf %{buildroot}%{_sysconfdir}/gssproxy/99-nfs-client.conf
|
|
|
472fdf |
mkdir -p %{buildroot}%{_sysconfdir}/gss/mech.d
|
|
|
472fdf |
install -m644 examples/mech %{buildroot}%{_sysconfdir}/gss/mech.d/gssproxy.conf
|
|
|
472fdf |
mkdir -p %{buildroot}/var/lib/gssproxy/rcache
|
|
|
472fdf |
mkdir -p $RPM_BUILD_ROOT/%{_sysconfdir}/rwtab.d
|
|
|
472fdf |
install -m644 %{SOURCE1} $RPM_BUILD_ROOT/%{_sysconfdir}/rwtab.d/gssproxy
|
|
|
472fdf |
|
|
|
472fdf |
%clean
|
|
|
472fdf |
rm -rf -- "%{buildroot}"
|
|
|
472fdf |
|
|
|
472fdf |
|
|
|
472fdf |
%files
|
|
|
472fdf |
%defattr(-,root,root,-)
|
|
|
472fdf |
%doc COPYING
|
|
|
472fdf |
%{_unitdir}/gssproxy.service
|
|
|
472fdf |
%{_sbindir}/gssproxy
|
|
|
472fdf |
%attr(755,root,root) %dir %{pubconfpath}
|
|
|
472fdf |
%attr(755,root,root) %dir %{gpstatedir}
|
|
|
472fdf |
%attr(700,root,root) %dir %{gpstatedir}/clients
|
|
|
472fdf |
%attr(0600,root,root) %config(noreplace) /%{_sysconfdir}/gssproxy/gssproxy.conf
|
|
|
472fdf |
%attr(0600,root,root) %config(noreplace) /%{_sysconfdir}/gssproxy/99-nfs-client.conf
|
|
|
472fdf |
%attr(0644,root,root) %config(noreplace) /%{_sysconfdir}/gss/mech.d/gssproxy.conf
|
|
|
472fdf |
%attr(700,root,root) %dir /var/lib/gssproxy/rcache
|
|
|
472fdf |
%{_libdir}/gssproxy/proxymech.so
|
|
|
472fdf |
%{_mandir}/man5/gssproxy.conf.5*
|
|
|
472fdf |
%{_mandir}/man8/gssproxy.8*
|
|
|
472fdf |
%{_mandir}/man8/gssproxy-mech.8*
|
|
|
472fdf |
%config(noreplace) %{_sysconfdir}/rwtab.d/gssproxy
|
|
|
472fdf |
|
|
|
472fdf |
%post
|
|
|
472fdf |
%systemd_post gssproxy.service
|
|
|
472fdf |
|
|
|
472fdf |
|
|
|
472fdf |
%preun
|
|
|
472fdf |
%systemd_preun gssproxy.service
|
|
|
472fdf |
|
|
|
472fdf |
|
|
|
472fdf |
%postun
|
|
|
472fdf |
%systemd_postun_with_restart gssproxy.service
|
|
|
472fdf |
|
|
|
472fdf |
|
|
|
472fdf |
%changelog
|
|
|
45f3a6 |
* Mon Apr 06 2020 Robbie Harwood <rharwood@redhat.com> 0.7.0-29
|
|
|
45f3a6 |
- Make syslog of call status configurable
|
|
|
45f3a6 |
- Resolves: #1373421
|
|
|
45f3a6 |
|
|
|
472fdf |
* Thu Sep 19 2019 Robbie Harwood <rharwood@redhat.com> 0.7.0-28
|
|
|
472fdf |
- Fix double free of popt context when querying version
|
|
|
472fdf |
- Resolves: #1752810
|
|
|
472fdf |
|
|
|
472fdf |
* Mon Jul 22 2019 Robbie Harwood <rharwood@redhat.com> 0.7.0-27
|
|
|
472fdf |
- Update docs to reflect actual behavior of krb5_principal
|
|
|
472fdf |
- Resolves: #1553094
|
|
|
472fdf |
|
|
|
472fdf |
* Wed May 01 2019 Robbie Harwood <rharwood@redhat.com> 0.7.0-26
|
|
|
472fdf |
- Avoid uninitialized free when allocating buffers
|
|
|
472fdf |
- Resolves: #1699331
|
|
|
472fdf |
|
|
|
472fdf |
* Tue Apr 30 2019 Robbie Harwood <rharwood@redhat.com> 0.7.0-25
|
|
|
472fdf |
- Fix explicit NULL deref on some enctypes
|
|
|
472fdf |
- Resolves: #1699331
|
|
|
472fdf |
|
|
|
472fdf |
* Mon Mar 18 2019 Robbie Harwood <rharwood@redhat.com> 0.7.0-24
|
|
|
472fdf |
- Add a safety timeout to epoll
|
|
|
472fdf |
- Resolves: #1687899
|
|
|
472fdf |
|
|
|
472fdf |
* Mon Dec 17 2018 Robbie Harwood <rharwood@redhat.com> 0.7.0-23
|
|
|
472fdf |
- Use pthread keys for thread local storage
|
|
|
472fdf |
- Resolves: #1618375
|
|
|
472fdf |
|
|
|
472fdf |
* Tue Dec 11 2018 Robbie Harwood <rharwood@redhat.com> 0.7.0-22
|
|
|
472fdf |
- Add hack to support read-only root
|
|
|
472fdf |
- Resolves: #1542567
|
|
|
472fdf |
|
|
|
472fdf |
* Fri Jun 08 2018 Robbie Harwood <rharwood@redhat.com> 0.7.0-21
|
|
|
472fdf |
- Always choose highest requested debug level
|
|
|
472fdf |
- Resolves: #1505741
|
|
|
472fdf |
|
|
|
472fdf |
* Fri Apr 27 2018 Robbie Harwood <rharwood@redhat.com> 0.7.0-20
|
|
|
472fdf |
- Clean up debug man page + behavior
|
|
|
472fdf |
- Resolves: #1554249
|
|
|
472fdf |
|
|
|
472fdf |
* Fri Apr 27 2018 Robbie Harwood <rharwood@redhat.com> 0.7.0-19
|
|
|
472fdf |
- Always use the encype we selected
|
|
|
472fdf |
- Resolves: #1549684
|
|
|
472fdf |
|
|
|
472fdf |
* Fri Apr 27 2018 Robbie Harwood <rharwood@redhat.com> 0.7.0-18
|
|
|
472fdf |
- Don't leak mech_type when CONTINUE_NEEDED from init_sec_context
|
|
|
472fdf |
- Resolves: #1553819
|
|
|
472fdf |
|
|
|
472fdf |
* Wed Dec 13 2017 Robbie Harwood <rharwood@redhat.com> 0.7.0-17
|
|
|
472fdf |
- Conditionally reload kernel interface on SIGHUP
|
|
|
472fdf |
- Resolves: #1507817
|
|
|
472fdf |
|
|
|
472fdf |
* Tue Dec 12 2017 Robbie Harwood <rharwood@redhat.com> 0.7.0-16
|
|
|
472fdf |
- Backport epoll() logic
|
|
|
472fdf |
- Resolves: #1507817
|
|
|
472fdf |
|
|
|
472fdf |
* Wed Dec 06 2017 Robbie Harwood <rharwood@redhat.com> 0.7.0-15
|
|
|
472fdf |
- Properly initialize ccaches before storing into them
|
|
|
472fdf |
- Resolves: #1488629
|
|
|
472fdf |
|
|
|
472fdf |
* Fri Dec 01 2017 Robbie Harwood <rharwood@redhat.com> 0.7.0-14
|
|
|
472fdf |
- Properly locate credentials in collection caches in mechglue
|
|
|
472fdf |
- Resolves: #1488629
|
|
|
472fdf |
|
|
|
472fdf |
* Tue Oct 31 2017 Robbie Harwood <rharwood@redhat.com> 0.7.0-13
|
|
|
472fdf |
- Handle outdated encrypted ccaches
|
|
|
472fdf |
- Resolves: #1488629
|
|
|
472fdf |
|
|
|
472fdf |
* Tue Oct 31 2017 Robbie Harwood <rharwood@redhat.com> 0.7.0-12
|
|
|
472fdf |
- Handle outdated encrypted ccaches
|
|
|
472fdf |
- Resolves: #1488629
|
|
|
472fdf |
|
|
|
472fdf |
* Mon Oct 30 2017 Robbie Harwood <rharwood@redhat.com> 0.7.0-11
|
|
|
472fdf |
- Fix error message handling in gp_config_from_dir()
|
|
|
472fdf |
- Resolves: #1458913
|
|
|
472fdf |
|
|
|
472fdf |
* Fri Oct 27 2017 Robbie Harwood <rharwood@redhat.com> 0.7.0-10
|
|
|
472fdf |
- Fix concurrency issue around server socket handling
|
|
|
472fdf |
- Resolves: #1462974
|
|
|
472fdf |
|
|
|
472fdf |
* Tue Oct 17 2017 Robbie Harwood <rharwood@redhat.com> 0.7.0-9
|
|
|
472fdf |
- Log useful warning and merge when config file has duplicate sections
|
|
|
472fdf |
- Resolves: #1458913
|
|
|
472fdf |
|
|
|
472fdf |
* Mon Oct 02 2017 Robbie Harwood <rharwood@redhat.com> 0.7.0-8
|
|
|
472fdf |
- Add Conflicts: line for old selinux-policy
|
|
|
472fdf |
- Resolves: #1458850
|
|
|
472fdf |
|
|
|
472fdf |
* Thu Sep 21 2017 Robbie Harwood <rharwood@redhat.com> 0.7.0-7
|
|
|
472fdf |
- Backport NFS-related gssproxy.service changes
|
|
|
472fdf |
- Resolves: #1326440
|
|
|
472fdf |
|
|
|
472fdf |
* Mon Sep 11 2017 Robbie Harwood <rharwood@redhat.com> 0.7.0-6
|
|
|
472fdf |
- Fix segfault when no config files are present
|
|
|
472fdf |
- Resolves: #1451255
|
|
|
472fdf |
|
|
|
472fdf |
* Thu Aug 17 2017 Robbie Harwood <rharwood@redhat.com> 0.7.0-5
|
|
|
472fdf |
- Backport hardening improvements
|
|
|
472fdf |
- Resolves: #1462974
|
|
|
472fdf |
|
|
|
472fdf |
* Wed May 31 2017 Robbie Harwood <rharwood@redhat.com> 0.7.0-4
|
|
|
472fdf |
- Make proc file failure loud but nonfatal
|
|
|
472fdf |
- Resolves: #1449238
|
|
|
472fdf |
|
|
|
472fdf |
* Tue Mar 28 2017 Robbie Harwood <rharwood@redhat.com> 0.7.0-3
|
|
|
472fdf |
- Stop shipping NFS server snippet (nfs-utils takes it instead)
|
|
|
472fdf |
- Resolves: #1379836
|
|
|
472fdf |
|
|
|
472fdf |
* Tue Mar 14 2017 Robbie Harwood <rharwood@redhat.com> 0.7.0-2
|
|
|
472fdf |
- Fix credential handling with mod_auth_gssapi that we broke
|
|
|
472fdf |
- Resolves: #1379836
|
|
|
472fdf |
|
|
|
472fdf |
* Fri Mar 10 2017 Robbie Harwood <rharwood@redhat.com> 0.7.0-1
|
|
|
472fdf |
- New upstream version - 0.7.0
|
|
|
472fdf |
- Resolves: #1379836
|
|
|
472fdf |
|
|
|
472fdf |
* Tue Feb 28 2017 Robbie Harwood <rharwood@redhat.com> 0.6.2-4
|
|
|
472fdf |
- Include fixes for NULL-termination
|
|
|
472fdf |
- Resolves: #1379836
|
|
|
472fdf |
|
|
|
472fdf |
* Thu Feb 23 2017 Robbie Harwood <rharwod@redhat.com> 0.6.2-3
|
|
|
472fdf |
- Document debug_level option
|
|
|
472fdf |
- Resolves: #1379836
|
|
|
472fdf |
|
|
|
472fdf |
* Tue Feb 21 2017 Robbie Harwood <rharwood@redhat.com> 0.6.2-2
|
|
|
472fdf |
- Enable running the test suite
|
|
|
472fdf |
- Resolves: #1379836
|
|
|
472fdf |
|
|
|
472fdf |
* Thu Feb 16 2017 Robbie Harwood <rharwood@redhat.com> 0.6.2-1
|
|
|
472fdf |
- Rebase to latest version since we have krb5-1.15
|
|
|
472fdf |
- Resolves: #1379836
|
|
|
472fdf |
- Resolves: #1344518
|
|
|
472fdf |
- Resolves: #1366782
|
|
|
472fdf |
- Resolves: #1379005
|
|
|
472fdf |
- Resolves: #1379482
|
|
|
472fdf |
- Resolves: #1379616
|
|
|
472fdf |
- Resolves: #1380490
|
|
|
472fdf |
- Resolves: #1378600
|
|
|
472fdf |
- Resolves: #1285012
|
|
|
472fdf |
- Resolves: #1333813
|
|
|
472fdf |
|
|
|
472fdf |
* Tue Sep 06 2016 Robbie Harwood <rharwood@redhat.com> 0.4.1-13
|
|
|
472fdf |
- Third try is the charm
|
|
|
472fdf |
- Resolves: #1092515
|
|
|
472fdf |
|
|
|
472fdf |
* Tue Sep 06 2016 Robbie Harwood <rharwood@redhat.com> 0.4.1-12
|
|
|
472fdf |
- Restore _FORTIFY_SOURCE behavior
|
|
|
472fdf |
- Resolves: #1092515
|
|
|
472fdf |
|
|
|
472fdf |
* Tue Sep 06 2016 Robbie Harwood <rharwood@redhat.com> 0.4.1-11
|
|
|
472fdf |
- Actually harden build with PIE and RELRO
|
|
|
472fdf |
- Resolves: #1092515
|
|
|
472fdf |
|
|
|
472fdf |
* Fri Jun 10 2016 Robbie Harwood <rharwood@redhat.com> 0.4.1-10
|
|
|
472fdf |
- Fix behavior with multiple keys in a keytab
|
|
|
472fdf |
- Resolves: #1285012
|
|
|
472fdf |
|
|
|
472fdf |
* Tue Jun 07 2016 Robbie Harwood <rharwood@redhat.com> 0.4.1-9
|
|
|
472fdf |
- Re-open socket in mechglue if client forks/changes privilege
|
|
|
472fdf |
- Resolves: #1340259
|
|
|
472fdf |
|
|
|
472fdf |
* Wed Mar 30 2016 Robbie Harwood <rharwood@redhat.com> 0.4.1-8
|
|
|
472fdf |
- Make GSS-Proxy work with krb5-1.14
|
|
|
472fdf |
- resolves: #1292487
|
|
|
472fdf |
|
|
|
472fdf |
* Tue Sep 29 2015 Simo Sorce <simo@redhat.com> 0.4.1-7
|
|
|
472fdf |
- Fix loop cause by imporper EINTR handling
|
|
|
472fdf |
- resolves: #1266564
|
|
|
472fdf |
|
|
|
472fdf |
* Mon Aug 24 2015 Roland Mainz <rmainz@redhat.com> 0.4.1-6
|
|
|
472fdf |
- Remove extra whitespaces from #1208640/#1194299 patches
|
|
|
472fdf |
- spec file cleanup
|
|
|
472fdf |
related: #1208640 #1194299
|
|
|
472fdf |
|
|
|
472fdf |
* Wed Aug 19 2015 Robbie Harwood <rharwood@redhat.com> 0.4.1-5
|
|
|
472fdf |
- Carry service/HTTP default conf section
|
|
|
472fdf |
- resolves: #1208640
|
|
|
472fdf |
|
|
|
472fdf |
* Wed Aug 19 2015 Robbie Harwood <rharwood@redhat.com> 0.4.1-4
|
|
|
472fdf |
- Set default rcache location patch
|
|
|
472fdf |
- resolves: #1194299
|
|
|
472fdf |
|
|
|
472fdf |
* Mon Jul 13 2015 Roland Mainz <rmainz@redhat.com> 0.4.1-3
|
|
|
472fdf |
- Bug #1213852 ("[gssproxy] NFS clients cannot mount with
|
|
|
472fdf |
sec=krb5 if the NFS server is running gssproxy") was
|
|
|
472fdf |
fixed by the rebase to 0.4.1 in bug ("[RFE] Rebase
|
|
|
472fdf |
gssproxy to the latest to match expectations of other
|
|
|
472fdf |
projects").
|
|
|
472fdf |
Note that the same bug was also fixed in the kernel with
|
|
|
472fdf |
"9507271 svcrpc: fix potential GSSX_ACCEPT_SEC_CONTEXT
|
|
|
472fdf |
decoding failures" (see
|
|
|
472fdf |
https://bugzilla.redhat.com/show_bug.cgi?id=1213852#c2
|
|
|
472fdf |
and RH Bug #1120860 ("[NFS] NFS clients cannot mount with
|
|
|
472fdf |
sec=krb5 if the NFS server is running gssproxy")) to
|
|
|
472fdf |
handle various corner cases not covered by gssproxy,
|
|
|
472fdf |
for example individual krb5 ticket fields exceeding
|
|
|
472fdf |
the kernel's buffer size.
|
|
|
472fdf |
|
|
|
472fdf |
* Thu Jul 9 2015 Roland Mainz <rmainz@redhat.com> 0.4.1-2
|
|
|
472fdf |
- The following bugs have been fixed by the rebase to 0.4.1
|
|
|
472fdf |
in bug ("[RFE] Rebase gssproxy to the latest to match
|
|
|
472fdf |
expectations of other projects"):
|
|
|
472fdf |
- Bug #1196371 ("rpc.gssd segfaults in gssproxy (proxymech.so)")
|
|
|
472fdf |
Upstream tickets { #137, #144 }
|
|
|
472fdf |
- Bug #1053730 ("KrbLocalUserMapping does not work with
|
|
|
472fdf |
Apache & GSS-Proxy")
|
|
|
472fdf |
Upstream ticket #101
|
|
|
472fdf |
- Bug #1168962 ("gssproxy is not working with httpd on ppc64 and s390x")
|
|
|
472fdf |
Upstream ticket #146
|
|
|
472fdf |
|
|
|
472fdf |
* Thu Jul 9 2015 Roland Mainz <rmainz@redhat.com> 0.4.1-1
|
|
|
472fdf |
- Add patch to remove -fno-strict-aliasing (gssproxy ticket #140,
|
|
|
472fdf |
a dependicy for the fix for bug #1092515 (see below))
|
|
|
472fdf |
- Add patch to fix bug #1092515 ("gssproxy - PIE and RELRO check")
|
|
|
472fdf |
|
|
|
472fdf |
* Fri Jun 5 2015 Roland Mainz <rmainz@redhat.com> 0.4.1-0
|
|
|
472fdf |
- Rebase gssproxy to 0.4.1 per bug #1132389 ("[RFE] Rebase
|
|
|
472fdf |
gssproxy to the latest to match expectations of other
|
|
|
472fdf |
projects").
|
|
|
472fdf |
|
|
|
472fdf |
* Fri Jan 23 2015 Simo Sorce <ssorce@redhat.com> 0.3.0-10
|
|
|
472fdf |
- Fix crash bug affecting updated rpc.gssd
|
|
|
472fdf |
- resolves: #1184531
|
|
|
472fdf |
|
|
|
472fdf |
* Wed Mar 12 2014 Guenther Deschner <gdeschner@redhat.com> 0.3.0-9
|
|
|
472fdf |
- Fix potential mutex deadlock
|
|
|
472fdf |
- resolves: #1075268
|
|
|
472fdf |
|
|
|
472fdf |
* Fri Jan 24 2014 Daniel Mach <dmach@redhat.com> - 0.3.0-8
|
|
|
472fdf |
- Mass rebuild 2014-01-24
|
|
|
472fdf |
|
|
|
472fdf |
* Thu Jan 16 2014 Guenther Deschner <gdeschner@redhat.com> 0.3.0-7
|
|
|
472fdf |
- Fix nfsd startup
|
|
|
472fdf |
- resolves: https://fedorahosted.org/gss-proxy/ticket/114
|
|
|
472fdf |
- resolves: #1053710
|
|
|
472fdf |
|
|
|
472fdf |
* Fri Dec 27 2013 Daniel Mach <dmach@redhat.com> - 0.3.0-6
|
|
|
472fdf |
- Mass rebuild 2013-12-27
|
|
|
472fdf |
|
|
|
472fdf |
* Tue Dec 17 2013 Guenther Deschner <gdeschner@redhat.com> 0.3.0-5
|
|
|
472fdf |
- Fix flags handling.
|
|
|
472fdf |
- resolves: https://fedorahosted.org/gss-proxy/ticket/112
|
|
|
472fdf |
- related: #1031710
|
|
|
472fdf |
|
|
|
472fdf |
* Wed Nov 27 2013 Guenther Deschner <gdeschner@redhat.com> 0.3.0-4
|
|
|
472fdf |
- Use secure_getenv
|
|
|
472fdf |
- resolves: https://fedorahosted.org/gss-proxy/ticket/110
|
|
|
472fdf |
- resolves: #1032684
|
|
|
472fdf |
- Use strerror_r instead of strerror
|
|
|
472fdf |
- resolves: https://fedorahosted.org/gss-proxy/ticket/111
|
|
|
472fdf |
- resolves: #1033350
|
|
|
472fdf |
|
|
|
472fdf |
* Tue Nov 19 2013 Guenther Deschner <gdeschner@redhat.com> 0.3.0-3
|
|
|
472fdf |
- Fix flags handling in gss_init_sec_context()
|
|
|
472fdf |
- resolves: https://fedorahosted.org/gss-proxy/ticket/106
|
|
|
472fdf |
- resolves: #1031713
|
|
|
472fdf |
- Fix OID handling in gss_inquire_cred_by_mech()
|
|
|
472fdf |
- resolves: https://fedorahosted.org/gss-proxy/ticket/107
|
|
|
472fdf |
- resolves: #1031712
|
|
|
472fdf |
- Fix continuation processing for not yet fully established contexts.
|
|
|
472fdf |
- resolves: https://fedorahosted.org/gss-proxy/ticket/108
|
|
|
472fdf |
- resolves: #1031711
|
|
|
472fdf |
- Add flags filtering and flags enforcing.
|
|
|
472fdf |
- resolves: https://fedorahosted.org/gss-proxy/ticket/109
|
|
|
472fdf |
- resolves: #1031710
|
|
|
472fdf |
|
|
|
472fdf |
* Wed Oct 23 2013 Guenther Deschner <gdeschner@redhat.com> 0.3.0-0
|
|
|
472fdf |
- New upstream release 0.3.0:
|
|
|
472fdf |
* Add support for impersonation (depends on s4u2self/s4u2proxy on the KDC)
|
|
|
472fdf |
* Add support for new rpc.gssd mode of operation that forks and changes uid
|
|
|
472fdf |
* Add 2 new options allow_any_uid and cred_usage
|
|
|
472fdf |
|
|
|
472fdf |
* Fri Oct 18 2013 Guenther Deschner <gdeschner@redhat.com> 0.2.3-8
|
|
|
472fdf |
- Fix default proxymech documentation and fix LOCAL_FIRST implementation
|
|
|
472fdf |
- resolves: https://fedorahosted.org/gss-proxy/ticket/105
|
|
|
472fdf |
|
|
|
472fdf |
* Wed Jul 24 2013 Guenther Deschner <gdeschner@redhat.com> 0.2.3-6
|
|
|
472fdf |
- Add better default gssproxy.conf file for nfs client and server usage
|
|
|
472fdf |
|
|
|
472fdf |
* Thu Jun 06 2013 Guenther Deschner <gdeschner@redhat.com> 0.2.3-5
|
|
|
472fdf |
- New upstream release
|
|
|
472fdf |
|
|
|
472fdf |
* Fri May 31 2013 Guenther Deschner <gdeschner@redhat.com> 0.2.2-5
|
|
|
472fdf |
- Require libverto-tevent to make sure libverto initialization succeeds
|
|
|
472fdf |
|
|
|
472fdf |
* Wed May 29 2013 Guenther Deschner <gdeschner@redhat.com> 0.2.2-4
|
|
|
472fdf |
- Modify systemd unit files for nfs-secure services
|
|
|
472fdf |
|
|
|
472fdf |
* Wed May 22 2013 Guenther Deschner <gdeschner@redhat.com> 0.2.2-3
|
|
|
472fdf |
- Fix cred_store handling w/o client keytab
|
|
|
472fdf |
|
|
|
472fdf |
* Thu May 16 2013 Guenther Deschner <gdeschner@redhat.com> 0.2.2-2
|
|
|
472fdf |
- New upstream release
|
|
|
472fdf |
|
|
|
472fdf |
* Tue May 07 2013 Guenther Deschner <gdeschner@redhat.com> 0.2.1-2
|
|
|
472fdf |
- New upstream release
|
|
|
472fdf |
|
|
|
472fdf |
* Wed Apr 24 2013 Guenther Deschner <gdeschner@redhat.com> 0.2.0-1
|
|
|
472fdf |
- New upstream release
|
|
|
472fdf |
|
|
|
472fdf |
* Mon Apr 01 2013 Simo Sorce <simo@redhat.com> - 0.1.0-0
|
|
|
472fdf |
- New upstream release
|
|
|
472fdf |
|
|
|
472fdf |
* Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.0.3-8
|
|
|
472fdf |
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
|
|
|
472fdf |
|
|
|
472fdf |
* Tue Nov 06 2012 Guenther Deschner <gdeschner@redhat.com> 0.0.3-7
|
|
|
472fdf |
- Update to 0.0.3
|
|
|
472fdf |
|
|
|
472fdf |
* Wed Aug 22 2012 Guenther Deschner <gdeschner@redhat.com> 0.0.2-6
|
|
|
472fdf |
- Use new systemd-rpm macros
|
|
|
472fdf |
- resolves: #850139
|
|
|
472fdf |
|
|
|
472fdf |
* Wed Jul 18 2012 Guenther Deschner <gdeschner@redhat.com> 0.0.2-5
|
|
|
472fdf |
- More spec file fixes
|
|
|
472fdf |
|
|
|
472fdf |
* Mon Jul 16 2012 Guenther Deschner <gdeschner@redhat.com> 0.0.2-4
|
|
|
472fdf |
- Fix systemd service file
|
|
|
472fdf |
|
|
|
472fdf |
* Fri Jul 13 2012 Guenther Deschner <gdeschner@redhat.com> 0.0.2-3
|
|
|
472fdf |
- Fix various packaging issues
|
|
|
472fdf |
|
|
|
472fdf |
* Mon Jul 02 2012 Guenther Deschner <gdeschner@redhat.com> 0.0.1-2
|
|
|
472fdf |
- Add systemd packaging
|
|
|
472fdf |
|
|
|
472fdf |
* Wed Mar 28 2012 Guenther Deschner <gdeschner@redhat.com> 0.0.1-1
|
|
|
472fdf |
- Various fixes
|
|
|
472fdf |
|
|
|
472fdf |
* Mon Dec 12 2011 Simo Sorce <simo@redhat.com> - 0.0.2-0
|
|
|
472fdf |
- Automated build of the gssproxy daemon
|