From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: <gentoo-commits+bounces-889668-garchives=archives.gentoo.org@lists.gentoo.org> Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id A503E1382DE for <garchives@archives.gentoo.org>; Thu, 30 Jun 2016 23:53:13 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id AEFB6E0B49; Thu, 30 Jun 2016 23:53:11 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 40E1DE0B49 for <gentoo-commits@lists.gentoo.org>; Thu, 30 Jun 2016 23:53:11 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 08E02340EDF for <gentoo-commits@lists.gentoo.org>; Thu, 30 Jun 2016 23:53:10 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id AE68F97B for <gentoo-commits@lists.gentoo.org>; Thu, 30 Jun 2016 23:53:06 +0000 (UTC) From: "Patrick McLean" <chutzpah@gentoo.org> To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Patrick McLean" <chutzpah@gentoo.org> Message-ID: <1467330770.4c6618086e16e704df31113b279e7ea4395bd41a.chutzpah@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: sys-cluster/ceph/, sys-cluster/ceph/files/ X-VCS-Repository: repo/gentoo X-VCS-Files: sys-cluster/ceph/ceph-10.2.2-r1.ebuild sys-cluster/ceph/ceph-9.2.1-r2.ebuild sys-cluster/ceph/files/ceph-CVE-2016-5009.patch X-VCS-Directories: sys-cluster/ceph/files/ sys-cluster/ceph/ X-VCS-Committer: chutzpah X-VCS-Committer-Name: Patrick McLean X-VCS-Revision: 4c6618086e16e704df31113b279e7ea4395bd41a X-VCS-Branch: master Date: Thu, 30 Jun 2016 23:53:06 +0000 (UTC) Precedence: bulk List-Post: <mailto:gentoo-commits@lists.gentoo.org> List-Help: <mailto:gentoo-commits+help@lists.gentoo.org> List-Unsubscribe: <mailto:gentoo-commits+unsubscribe@lists.gentoo.org> List-Subscribe: <mailto:gentoo-commits+subscribe@lists.gentoo.org> List-Id: Gentoo Linux mail <gentoo-commits.gentoo.org> X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: faca9783-c0b1-4712-af57-51d4bdeb740d X-Archives-Hash: 0339876ec8664e09a5243b77e7011a85 commit: 4c6618086e16e704df31113b279e7ea4395bd41a Author: Patrick McLean <chutzpah <AT> gentoo <DOT> org> AuthorDate: Thu Jun 30 23:52:50 2016 +0000 Commit: Patrick McLean <chutzpah <AT> gentoo <DOT> org> CommitDate: Thu Jun 30 23:52:50 2016 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4c661808 sys-cluster/ceph: Revision bump to 9.2.1-r2 and 10.2.2-r1 for CVE-2016-5009 (bug #587568) Package-Manager: portage-2.3.0 sys-cluster/ceph/ceph-10.2.2-r1.ebuild | 263 ++++++++++++++++++++++++ sys-cluster/ceph/ceph-9.2.1-r2.ebuild | 193 +++++++++++++++++ sys-cluster/ceph/files/ceph-CVE-2016-5009.patch | 87 ++++++++ 3 files changed, 543 insertions(+) diff --git a/sys-cluster/ceph/ceph-10.2.2-r1.ebuild b/sys-cluster/ceph/ceph-10.2.2-r1.ebuild new file mode 100644 index 0000000..276f496 --- /dev/null +++ b/sys-cluster/ceph/ceph-10.2.2-r1.ebuild @@ -0,0 +1,263 @@ +# Copyright 1999-2016 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ + +EAPI=6 +PYTHON_COMPAT=( python{2_7,3_{4,5}} ) + +inherit check-reqs autotools eutils python-r1 udev user \ + readme.gentoo-r1 systemd versionator flag-o-matic + +if [[ ${PV} == *9999* ]]; then + inherit git-r3 + EGIT_REPO_URI=" + git://github.com/ceph/ceph.git + https://github.com/ceph/ceph.git" + SRC_URI="" +else + SRC_URI="http://ceph.com/download/${P}.tar.gz" + KEYWORDS="~amd64 ~arm ~ppc ~ppc64 ~x86" +fi + +DESCRIPTION="Ceph distributed filesystem" +HOMEPAGE="http://ceph.com/" + +LICENSE="LGPL-2.1" +SLOT="0" + +IUSE="babeltrace cephfs cryptopp debug fuse gtk jemalloc ldap +libaio" +IUSE+=" libatomic lttng +nss +radosgw static-libs tcmalloc test xfs zfs" + +# unbundling code commented out pending bugs 584056 and 584058 +#>=dev-libs/jerasure-2.0.0-r1 +#>=dev-libs/gf-complete-2.0.0 +COMMON_DEPEND=" + app-arch/snappy + app-arch/lz4:= + app-arch/bzip2 + dev-libs/boost:=[threads] + dev-libs/libaio + dev-libs/leveldb[snappy] + nss? ( dev-libs/nss ) + libatomic? ( dev-libs/libatomic_ops ) + cryptopp? ( dev-libs/crypto++ ) + sys-apps/keyutils + sys-apps/util-linux + dev-libs/libxml2 + radosgw? ( dev-libs/fcgi ) + ldap? ( net-nds/openldap ) + babeltrace? ( dev-util/babeltrace ) + fuse? ( sys-fs/fuse ) + xfs? ( sys-fs/xfsprogs ) + zfs? ( sys-fs/zfs ) + gtk? ( + x11-libs/gtk+:2 + dev-cpp/gtkmm:2.4 + gnome-base/librsvg + ) + radosgw? ( + dev-libs/fcgi + dev-libs/expat + net-misc/curl + ) + jemalloc? ( dev-libs/jemalloc ) + !jemalloc? ( dev-util/google-perftools ) + lttng? ( dev-util/lttng-ust ) + ${PYTHON_DEPS} + " +DEPEND="${COMMON_DEPEND} + dev-python/cython[${PYTHON_USEDEP}] + app-arch/cpio + sys-apps/lsb-release + virtual/pkgconfig + dev-python/sphinx + test? ( + sys-fs/btrfs-progs + sys-apps/grep[pcre] + dev-python/tox[${PYTHON_USEDEP}] + dev-python/virtualenv[${PYTHON_USEDEP}] + )" +RDEPEND="${COMMON_DEPEND} + sys-apps/hdparm + sys-block/parted + sys-fs/cryptsetup + sys-apps/gptfdisk + dev-python/flask[${PYTHON_USEDEP}] + dev-python/requests[${PYTHON_USEDEP}] + " +REQUIRED_USE=" + $(python_gen_useflags 'python2*') + ${PYTHON_REQUIRED_USE} + ^^ ( nss cryptopp ) + ?? ( jemalloc tcmalloc ) + " + +# work around bug in ceph compilation (rgw/ceph_dencoder-rgw_dencoder.o... undefined reference to `vtable for RGWZoneGroup') +REQUIRED_USE+=" radosgw" + +RESTRICT="test? ( userpriv )" + +# distribution tarball does not include everything needed for tests +RESTRICT+=" test" + +STRIP_MASK="/usr/lib*/rados-classes/*" + +UNBUNDLE_LIBS=( + src/erasure-code/jerasure/jerasure + src/erasure-code/jerasure/gf-complete +) + +PATCHES=( + "${FILESDIR}/ceph-10.2.0-dont-use-virtualenvs.patch" + #"${FILESDIR}/ceph-10.2.1-unbundle-jerasure.patch" + "${FILESDIR}/${PN}-10.2.1-libzfs.patch" + "${FILESDIR}/${PN}-10.2.1-armv7l-doesnt-support-momit-leaf-frame-pointer.patch" + "${FILESDIR}/${PN}-CVE-2016-5009.patch" +) + +check-reqs_export_vars() { + if use debug; then + CHECKREQS_DISK_BUILD="23G" + CHECKREQS_DISK_USR="7G" + elif use amd64; then + CHECKREQS_DISK_BUILD="12G" + CHECKREQS_DISK_USR="450M" + else + CHECKREQS_DISK_BUILD="1400M" + CHECKREQS_DISK_USR="450M" + fi + + export CHECKREQS_DISK_BUILD CHECKREQS_DISK_USR +} + +user_setup() { + enewgroup ceph + enewuser ceph -1 -1 /var/lib/ceph ceph +} + +emake_python_bindings() { + local action="${1}" params binding + shift + params=("${@}") + + __emake_python_bindings_do_impl() { + emake "${params[@]}" PYTHON="${EPYTHON}" "${binding}-pybind-${action}" + + # these don't work and aren't needed on python3 + if [[ ${EBUILD_PHASE} == install ]] && python_is_python3; then + rm -f "${ED}/$(python_get_sitedir)"/ceph_{argparse,volume_client}.py + fi + } + + pushd "${S}/src" + for binding in rados rbd $(use cephfs && echo cephfs); do + python_foreach_impl __emake_python_bindings_do_impl + done + popd + + unset __emake_python_bindings_do_impl +} + +pkg_pretend() { + check-reqs_export_vars + check-reqs_pkg_pretend +} + +pkg_setup() { + python_setup + check-reqs_export_vars + check-reqs_pkg_setup + user_setup +} + +src_prepare() { + default + + # remove tests that need root access + rm src/test/cli/ceph-authtool/cap*.t + + #rm -rf "${UNBUNDLE_LIBS[@]}" + + append-flags -fPIC + eautoreconf +} + +src_configure() { + local myeconfargs=( + --without-hadoop + --includedir=/usr/include + $(use_with cephfs) + $(use_with debug) + $(use_with fuse) + $(use_with libaio) + $(use_with libatomic libatomic-ops) + $(use_with nss) + $(use_with cryptopp) + $(use_with radosgw) + $(use_with gtk gtk2) + $(use_enable static-libs static) + $(use_with jemalloc) + $(use_with xfs libxfs) + $(use_with zfs libzfs) + $(use_with lttng ) + $(use_with babeltrace) + $(use_with ldap openldap) + $(use jemalloc || usex tcmalloc " --with-tcmalloc" " --with-tcmalloc-minimal") + --with-mon + --with-eventfd + --with-cython + --without-kinetic + --without-librocksdb + --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" + ) + + # we can only use python2.7 for building at the moment + python_export python2.7 PYTHON EPYTHON + econf "${myeconfargs[@]}" +} + +src_compile() { + emake + emake_python_bindings all + + use test && emake check-local +} + +src_test() { + make check || die "make check failed" +} + +src_install() { + default + emake_python_bindings install-exec "DESTDIR=\"${D}\"" + + prune_libtool_files --all + + exeinto /usr/$(get_libdir)/ceph + newexe src/init-ceph ceph_init.sh + + insinto /etc/logrotate.d/ + newins "${FILESDIR}"/ceph.logrotate ${PN} + + keepdir /var/lib/${PN}{,/tmp} /var/log/${PN}/stat + + fowners ceph:ceph /var/lib/ceph + + newinitd "${FILESDIR}/rbdmap.initd" rbdmap + newinitd "${FILESDIR}/${PN}.initd-r2" ${PN} + newconfd "${FILESDIR}/${PN}.confd-r1" ${PN} + + systemd_install_serviced "${FILESDIR}/ceph-mds_at.service.conf" "ceph-mds@.service" + systemd_install_serviced "${FILESDIR}/ceph-osd_at.service.conf" "ceph-osd@.service" + systemd_install_serviced "${FILESDIR}/ceph-mon_at.service.conf" "ceph-mon@.service" + + python_fix_shebang "${ED}"/usr/{,s}bin/ + + udev_dorules udev/*.rules + + readme.gentoo_create_doc +} + +pkg_postinst() { + readme.gentoo_print_elog +} diff --git a/sys-cluster/ceph/ceph-9.2.1-r2.ebuild b/sys-cluster/ceph/ceph-9.2.1-r2.ebuild new file mode 100644 index 0000000..494094e --- /dev/null +++ b/sys-cluster/ceph/ceph-9.2.1-r2.ebuild @@ -0,0 +1,193 @@ +# Copyright 1999-2016 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ + +EAPI=5 +PYTHON_COMPAT=( python2_7 ) + +if [[ $PV = *9999* ]]; then + scm_eclass=git-r3 + EGIT_REPO_URI=" + git://github.com/ceph/ceph.git + https://github.com/ceph/ceph.git" + SRC_URI="" +else + SRC_URI="http://ceph.com/download/${P}.tar.gz" +fi +KEYWORDS="~amd64 ~arm ~ppc ~ppc64 ~x86" + +inherit check-reqs autotools eutils multilib python-single-r1 udev user readme.gentoo systemd versionator ${scm_eclass} + +DESCRIPTION="Ceph distributed filesystem" +HOMEPAGE="http://ceph.com/" + +LICENSE="LGPL-2.1" +SLOT="0" +IUSE="babeltrace cryptopp debug fuse gtk libatomic +libaio lttng +nss radosgw static-libs jemalloc tcmalloc xfs zfs" + +COMMON_DEPEND=" + app-arch/snappy + dev-libs/boost:=[threads] + dev-libs/fcgi + dev-libs/libaio + dev-libs/libedit + dev-libs/leveldb[snappy] + nss? ( dev-libs/nss ) + cryptopp? ( dev-libs/crypto++ ) + sys-apps/keyutils + sys-apps/util-linux + dev-libs/libxml2 + babeltrace? ( dev-util/babeltrace ) + fuse? ( sys-fs/fuse ) + libatomic? ( dev-libs/libatomic_ops ) + xfs? ( sys-fs/xfsprogs ) + zfs? ( sys-fs/zfs ) + gtk? ( + x11-libs/gtk+:2 + dev-cpp/gtkmm:2.4 + gnome-base/librsvg + ) + radosgw? ( + dev-libs/fcgi + dev-libs/expat + net-misc/curl + ) + jemalloc? ( dev-libs/jemalloc ) + !jemalloc? ( dev-util/google-perftools ) + lttng? ( dev-util/lttng-ust ) + ${PYTHON_DEPS} + " +DEPEND="${COMMON_DEPEND} + virtual/pkgconfig" +RDEPEND="${COMMON_DEPEND} + sys-apps/hdparm + dev-python/flask[${PYTHON_USEDEP}] + dev-python/requests[${PYTHON_USEDEP}] + " +REQUIRED_USE=" + ${PYTHON_REQUIRED_USE} + ^^ ( nss cryptopp ) + ?? ( jemalloc tcmalloc ) + " + +STRIP_MASK="/usr/lib*/rados-classes/*" + +PATCHES=( + "${FILESDIR}"/${PN}-0.79-libzfs.patch + "${FILESDIR}"/${P}-libxfs.patch +) + +check-reqs_export_vars() { + # check-reqs does not support use flags, and there is a lot of variability + # in Ceph. + # 16G /var/tmp/portage/sys-cluster/ceph-9999-r1/work/ceph-9999 + # 6.7G /var/tmp/portage/sys-cluster/ceph-9999-r1/image/usr + # 23G /var/tmp/portage/sys-cluster/ceph-9999-r1 + # Size requirements tested for Hammer & Jewel releases + if use debug; then + export CHECKREQS_DISK_BUILD="23G" + export CHECKREQS_DISK_USR="7G" + else + export CHECKREQS_DISK_BUILD="9G" + export CHECKREQS_DISK_USR="450M" + fi + + export CHECKREQS_MEMORY="7G" +} + +user_setup() { + enewgroup ceph + enewuser ceph -1 -1 /var/lib/ceph ceph +} + +pkg_setup() { + python_setup + check-reqs_export_vars + check-reqs_pkg_setup + user_setup +} + +src_prepare() { + [[ ${PATCHES[@]} ]] && epatch "${PATCHES[@]}" + + epatch_user + eautoreconf +} + +pkg_pretend() { + check-reqs_export_vars + check-reqs_pkg_pretend +} + +src_configure() { + local myeconfargs=( + --without-hadoop + --docdir="${EPREFIX}/usr/share/doc/${PF}" + --includedir=/usr/include + $(use_with debug) + $(use_with fuse) + $(use_with libaio) + $(use_with libatomic libatomic-ops) + $(use_with nss) + $(use_with cryptopp) + $(use_with radosgw) + $(use_with gtk gtk2) + $(use_enable static-libs static) + $(use_with jemalloc) + $(use_with xfs libxfs) + $(use_with zfs libzfs) + $(use_with lttng ) + $(use_with babeltrace) + --without-kinetic + --without-librocksdb + --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" + ) + + use jemalloc || \ + myeconfargs+=( $(usex tcmalloc " --with-tcmalloc" " --with-tcmalloc-minimal") ) + + PYTHON="${EPYTHON}" \ + econf "${myeconfargs[@]}" +} + +src_install() { + default + + prune_libtool_files --all + + exeinto /usr/$(get_libdir)/ceph + newexe src/init-ceph ceph_init.sh + + insinto /etc/logrotate.d/ + newins "${FILESDIR}"/ceph.logrotate ${PN} + + chmod 644 "${ED}"/usr/share/doc/${PF}/sample.* + + keepdir /var/lib/${PN} + keepdir /var/lib/${PN}/tmp + keepdir /var/log/${PN}/stat + + fowners ceph:ceph /var/lib/ceph + + newinitd "${FILESDIR}/rbdmap.initd" rbdmap + newinitd "${FILESDIR}/${PN}.initd-r2" ${PN} + newconfd "${FILESDIR}/${PN}.confd-r1" ${PN} + + systemd_install_serviced "${FILESDIR}/ceph-mds_at.service.conf" "ceph-mds@.service" + systemd_install_serviced "${FILESDIR}/ceph-osd_at.service.conf" "ceph-osd@.service" + systemd_install_serviced "${FILESDIR}/ceph-mon_at.service.conf" "ceph-mon@.service" + + python_fix_shebang \ + "${ED}"/usr/sbin/{ceph-disk,ceph-create-keys} \ + "${ED}"/usr/bin/{ceph,ceph-rest-api,ceph-detect-init,ceph-brag} + + #install udev rules + udev_dorules udev/50-rbd.rules + udev_dorules udev/95-ceph-osd.rules + + readme.gentoo_create_doc +} + +pkg_postinst() { + readme.gentoo_print_elog +} diff --git a/sys-cluster/ceph/files/ceph-CVE-2016-5009.patch b/sys-cluster/ceph/files/ceph-CVE-2016-5009.patch new file mode 100644 index 0000000..1528dad --- /dev/null +++ b/sys-cluster/ceph/files/ceph-CVE-2016-5009.patch @@ -0,0 +1,87 @@ +diff --git a/src/mon/Monitor.cc b/src/mon/Monitor.cc +index 10c8bfc..98843d7 100644 +--- a/src/mon/Monitor.cc ++++ b/src/mon/Monitor.cc +@@ -2631,7 +2631,19 @@ void Monitor::handle_command(MonOpRequestRef op) + return; + } + +- cmd_getval(g_ceph_context, cmdmap, "prefix", prefix); ++ // check return value. If no prefix parameter provided, ++ // return value will be false, then return error info. ++ if(!cmd_getval(g_ceph_context, cmdmap, "prefix", prefix)) { ++ reply_command(op, -EINVAL, "command prefix not found", 0); ++ return; ++ } ++ ++ // check prefix is empty ++ if (prefix.empty()) { ++ reply_command(op, -EINVAL, "command prefix must not be empty", 0); ++ return; ++ } ++ + if (prefix == "get_command_descriptions") { + bufferlist rdata; + Formatter *f = Formatter::create("json"); +@@ -2652,6 +2664,15 @@ void Monitor::handle_command(MonOpRequestRef op) + boost::scoped_ptr<Formatter> f(Formatter::create(format)); + + get_str_vec(prefix, fullcmd); ++ ++ // make sure fullcmd is not empty. ++ // invalid prefix will cause empty vector fullcmd. ++ // such as, prefix=";,,;" ++ if (fullcmd.empty()) { ++ reply_command(op, -EINVAL, "command requires a prefix to be valid", 0); ++ return; ++ } ++ + module = fullcmd[0]; + + // validate command is in leader map +diff --git a/src/test/librados/cmd.cc b/src/test/librados/cmd.cc +index 9261fb5..878a8af 100644 +--- a/src/test/librados/cmd.cc ++++ b/src/test/librados/cmd.cc +@@ -48,6 +48,41 @@ TEST(LibRadosCmd, MonDescribe) { + rados_buffer_free(buf); + rados_buffer_free(st); + ++ cmd[0] = (char *)""; ++ ASSERT_EQ(-EINVAL, rados_mon_command(cluster, (const char **)cmd, 1, "{}", 2, &buf, &buflen, &st, &stlen)); ++ rados_buffer_free(buf); ++ rados_buffer_free(st); ++ ++ cmd[0] = (char *)"{}"; ++ ASSERT_EQ(-EINVAL, rados_mon_command(cluster, (const char **)cmd, 1, "", 0, &buf, &buflen, &st, &stlen)); ++ rados_buffer_free(buf); ++ rados_buffer_free(st); ++ ++ cmd[0] = (char *)"{\"abc\":\"something\"}"; ++ ASSERT_EQ(-EINVAL, rados_mon_command(cluster, (const char **)cmd, 1, "", 0, &buf, &buflen, &st, &stlen)); ++ rados_buffer_free(buf); ++ rados_buffer_free(st); ++ ++ cmd[0] = (char *)"{\"prefix\":\"\"}"; ++ ASSERT_EQ(-EINVAL, rados_mon_command(cluster, (const char **)cmd, 1, "", 0, &buf, &buflen, &st, &stlen)); ++ rados_buffer_free(buf); ++ rados_buffer_free(st); ++ ++ cmd[0] = (char *)"{\"prefix\":\" \"}"; ++ ASSERT_EQ(-EINVAL, rados_mon_command(cluster, (const char **)cmd, 1, "", 0, &buf, &buflen, &st, &stlen)); ++ rados_buffer_free(buf); ++ rados_buffer_free(st); ++ ++ cmd[0] = (char *)"{\"prefix\":\";;;,,,;;,,\"}"; ++ ASSERT_EQ(-EINVAL, rados_mon_command(cluster, (const char **)cmd, 1, "", 0, &buf, &buflen, &st, &stlen)); ++ rados_buffer_free(buf); ++ rados_buffer_free(st); ++ ++ cmd[0] = (char *)"{\"prefix\":\"extra command\"}"; ++ ASSERT_EQ(-EINVAL, rados_mon_command(cluster, (const char **)cmd, 1, "", 0, &buf, &buflen, &st, &stlen)); ++ rados_buffer_free(buf); ++ rados_buffer_free(st); ++ + cmd[0] = (char *)"{\"prefix\":\"mon_status\"}"; + ASSERT_EQ(0, rados_mon_command(cluster, (const char **)cmd, 1, "", 0, &buf, &buflen, &st, &stlen)); + ASSERT_LT(0u, buflen);