From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 05575139695 for ; Sat, 25 Feb 2017 19:29:33 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 6F6F8E0C47; Sat, 25 Feb 2017 19:29:31 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 3BCD6E0C47 for ; Sat, 25 Feb 2017 19:29:31 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id D2160341026 for ; Sat, 25 Feb 2017 19:29:29 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id DA7E35468 for ; Sat, 25 Feb 2017 19:29:27 +0000 (UTC) From: "Michael Orlitzky" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Michael Orlitzky" Message-ID: <1488050915.f1bda9ba9782908be6a873c8f5df29a9506ea753.mjo@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: net-analyzer/nagios-core/ X-VCS-Repository: repo/gentoo X-VCS-Files: net-analyzer/nagios-core/Manifest net-analyzer/nagios-core/nagios-core-4.3.1.ebuild X-VCS-Directories: net-analyzer/nagios-core/ X-VCS-Committer: mjo X-VCS-Committer-Name: Michael Orlitzky X-VCS-Revision: f1bda9ba9782908be6a873c8f5df29a9506ea753 X-VCS-Branch: master Date: Sat, 25 Feb 2017 19:29:27 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 32abd1c7-cd54-4c6a-93d3-92eaf621017b X-Archives-Hash: adaf88bd4e9b4b23fececa5b38092065 commit: f1bda9ba9782908be6a873c8f5df29a9506ea753 Author: Michael Orlitzky gentoo org> AuthorDate: Sat Feb 25 19:07:34 2017 +0000 Commit: Michael Orlitzky gentoo org> CommitDate: Sat Feb 25 19:28:35 2017 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f1bda9ba net-analyzer/nagios-core: new version to fix CVE-2016-6209. Gentoo-Bug: 585914 Package-Manager: Portage-2.3.3, Repoman-2.3.1 net-analyzer/nagios-core/Manifest | 1 + net-analyzer/nagios-core/nagios-core-4.3.1.ebuild | 248 ++++++++++++++++++++++ 2 files changed, 249 insertions(+) diff --git a/net-analyzer/nagios-core/Manifest b/net-analyzer/nagios-core/Manifest index 60c9c97f7e..d5f0efb170 100644 --- a/net-analyzer/nagios-core/Manifest +++ b/net-analyzer/nagios-core/Manifest @@ -1,3 +1,4 @@ DIST nagios-3.5.1.tar.gz 1763584 SHA256 ca9dd68234fa090b3c35ecc8767b2c9eb743977eaf32612fa9b8341cc00a0f99 SHA512 48e2ecb91002b08203937b12a438c87c62cd3c5c401a0ed9e861cd6d79074c7017ed373e9379f013d87dea1fd7cb8e3d85112d55c87ac91aed96b256868c112d WHIRLPOOL 2c02584702c64dbb0e353e34b758fab079eee0dc7a401e7b5947a21733758d3596401e5519e2dd7f05c89ee4835c21965d2718157fd9d6d3d20af9c853d688ca DIST nagios-4.2.4.tar.gz 11088206 SHA256 b0055c475683ce50d77b1536ff0cec9abf89139adecf771601fa021ef9a20b70 SHA512 1f060f3139db6f77f7ca218bb4befb631c08b0ccb1b2b85e4c06cfc94328b5d09cef9b547eb54617089334a1e36b881347dfbb98bcc88b9b38e878214f97883a WHIRLPOOL a3d5454c72ab38388e8071dca8a319c717bb22915cfd06243727eb33f7b8a93cc323531be1535d14e283335b9964762a2729f4605f76d9a01ff78bbe924053a7 +DIST nagios-4.3.1.tar.gz 11095797 SHA256 dfc2f5f146eb508b2a28d28af7c338ef9eb604327efdc50142642026f7e79f82 SHA512 d5f1919e2b32b0b2f4c5766367f0992fcf9b1f6766f4d3386e15e318cc1f57cdae6bc07f09464fd8212bef1713948fcb25d233eab588438036f996b6c479c97e WHIRLPOOL 72032e93802fd28db71bb5a10bba703a9508c587de69ff24ce302ad4fbbd93996b4800ceb7dd4f5648e2717377409cd7a66591f177e775da1c69444d528be1a2 DIST nagios-core-gentoo-icons-20141125.tar 40960 SHA256 68b715f636eb291343cab3259862bbed8b6b898520b58df522438524de3d8761 SHA512 bf109879cddd6136b76baba55d0b60b2596e37431dcf5ce0905d34a9fa292ebf7e4bde82d9a084362c486e8fac344c76d88f9298b1b85541ed70ffd608493766 WHIRLPOOL 7ec3a944b2a659b456d3168818ca5b1af3a427436e6af2f3e5d6cba6fc7b1c7bad6f552301f064df31988865b3b32fd117d9e6f61c630d6d817a51cbbbcb331d diff --git a/net-analyzer/nagios-core/nagios-core-4.3.1.ebuild b/net-analyzer/nagios-core/nagios-core-4.3.1.ebuild new file mode 100644 index 0000000000..eb33c75c1a --- /dev/null +++ b/net-analyzer/nagios-core/nagios-core-4.3.1.ebuild @@ -0,0 +1,248 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ + +EAPI=6 + +inherit toolchain-funcs user + +MY_P=${PN/-core}-${PV} +DESCRIPTION="Nagios core - monitoring daemon, web GUI, and documentation" +HOMEPAGE="http://www.nagios.org/" + +# The name of the directory into which our Gentoo icons will be +# extracted, and also the basename of the archive containing it. +GENTOO_ICONS="${PN}-gentoo-icons-20141125" +SRC_URI="mirror://sourceforge/nagios/${MY_P}.tar.gz + web? ( https://dev.gentoo.org/~mjo/distfiles/${GENTOO_ICONS}.tar )" + +LICENSE="GPL-2" +SLOT="0" +KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~sparc ~x86" +IUSE="apache2 classicui lighttpd perl +web vim-syntax" + +# In pkg_postinst(), we change the group of the Nagios configuration +# directory to that of the web server user. It can't belong to both +# apache/lighttpd groups at the same time, so we block this combination +# for our own sanity. +# +# This could be made to work, but we would need a better way to allow +# the web user read-only access to Nagios's configuration directory. +# +REQUIRED_USE="apache2? ( !lighttpd )" + +# sys-devel/libtool dependency is bug #401237. +# +# Note, we require one of the apache2 CGI modules: +# +# * mod_cgi +# * mod_cgid +# * mod_fcgid +# +# We just don't care /which/ one. And of course PHP supports both CGI +# (USE=cgi) and FastCGI (USE=fpm). We're pretty lenient with the +# dependencies, and expect the user not to do anything /too/ +# stupid. (For example, installing Apache with only FastCGI support, and +# PHP with only CGI support.) +# +# Another annoyance is that the upstream Makefile uses app-arch/unzip to +# extract a snapshot of AngularJS, but that's only needed when USE=web. +# +MOD_ALIAS=apache2_modules_alias +DEPEND="sys-devel/libtool + virtual/mailx + perl? ( dev-lang/perl:= ) + web? ( + app-arch/unzip + media-libs/gd[jpeg,png] + lighttpd? ( www-servers/lighttpd[php] ) + apache2? ( + || ( + >=www-servers/apache-2.4[${MOD_ALIAS},apache2_modules_cgi] + >=www-servers/apache-2.4[${MOD_ALIAS},apache2_modules_cgid] + >=www-servers/apache-2.4[${MOD_ALIAS},apache2_modules_fcgid] ) + || ( + dev-lang/php:*[apache2] + dev-lang/php:*[cgi] + dev-lang/php:*[fpm] ) + ) + )" +RDEPEND="${DEPEND} + vim-syntax? ( app-vim/nagios-syntax )" + +S="${WORKDIR}/${MY_P}" + +pkg_setup() { + enewgroup nagios + enewuser nagios -1 /bin/bash /var/nagios/home nagios +} + +src_configure() { + local myconf + + if use perl; then + myconf="${myconf} --enable-embedded-perl --with-perlcache" + fi + + if use !apache2 && use !lighttpd ; then + myconf="${myconf} --with-command-group=nagios" + else + if use apache2 ; then + myconf="${myconf} --with-command-group=apache" + myconf="${myconf} --with-httpd-conf=/etc/apache2/conf.d" + elif use lighttpd ; then + myconf="${myconf} --with-command-group=lighttpd" + fi + fi + + econf ${myconf} \ + --prefix=/usr \ + --bindir=/usr/sbin \ + --sbindir=/usr/$(get_libdir)/nagios/cgi-bin \ + --datadir=/usr/share/nagios/htdocs \ + --localstatedir=/var/nagios \ + --sysconfdir=/etc/nagios \ + --libexecdir=/usr/$(get_libdir)/nagios/plugins +} + +src_compile() { + emake CC=$(tc-getCC) nagios + + if use web; then + # Only compile the CGIs/HTML when USE=web is set. + emake CC=$(tc-getCC) DESTDIR="${D}" cgis html + fi +} + +src_install() { + dodoc Changelog INSTALLING LEGAL README.asciidoc UPGRADING + + emake DESTDIR="${D}" install-base + emake DESTDIR="${D}" install-basic + emake DESTDIR="${D}" install-config + emake DESTDIR="${D}" install-commandmode + + if use web; then + emake DESTDIR="${D}" install-cgis + + # install-html installs the new exfoliation theme + emake DESTDIR="${D}" install-html + + if use classicui; then + # This overwrites the already-installed exfoliation theme + emake DESTDIR="${D}" install-classicui + fi + + # Install cute Gentoo icons (bug #388323), setting their + # owner, group, and mode to match those of the rest of Nagios's + # images. + insopts --group=nagios --owner=nagios --mode=0664 + insinto /usr/share/nagios/htdocs/images/logos + doins "${WORKDIR}/${GENTOO_ICONS}"/*.* + insopts --mode=0644 # Back to the default... + fi + + newinitd "${FILESDIR}"/nagios4-r1 nagios + newconfd "${FILESDIR}"/conf.d nagios + + if use web ; then + if use apache2 ; then + # Install the Nagios configuration file for Apache. + insinto "/etc/apache2/modules.d" + doins "${FILESDIR}"/99_nagios4.conf + elif use lighttpd ; then + # Install the Nagios configuration file for Lighttpd. + insinto /etc/lighttpd + newins "${FILESDIR}/lighttpd_nagios4.conf" nagios.conf + else + ewarn "${CATEGORY}/${PF} only supports apache or lighttpd" + ewarn "out of the box. Since you are not using one of them, you" + ewarn "will have to configure your webserver yourself." + fi + fi + + for dir in etc/nagios var/nagios ; do + chown -R nagios:nagios "${D}/${dir}" \ + || die "failed chown of ${D}/${dir}" + done + + chown -R root:root "${D}/usr/$(get_libdir)/nagios" \ + || die "failed chown of ${D}/usr/$(get_libdir)/nagios" + + # The following two find...exec statements will die properly as long + # as chmod is only called once (that is, as long as the argument + # list is small enough). + find "${D}/usr/$(get_libdir)/nagios" -type d \ + -exec chmod 755 '{}' + || die 'failed to make nagios dirs traversable' + + if use web; then + find "${D}/usr/$(get_libdir)/nagios/cgi-bin" -type f \ + -exec chmod 755 '{}' + || die 'failed to make cgi-bins executable' + fi + + keepdir /etc/nagios + keepdir /var/nagios + keepdir /var/nagios/archives + keepdir /var/nagios/rw + keepdir /var/nagios/spool/checkresults + + if use !apache2 && use !lighttpd; then + chown -R nagios:nagios "${D}"/var/nagios/rw \ + || die "failed chown of ${D}/var/nagios/rw" + else + if use apache2 ; then + chown -R nagios:apache "${D}"/var/nagios/rw \ + || die "failed chown of ${D}/var/nagios/rw" + elif use lighttpd ; then + chown -R nagios:lighttpd "${D}"/var/nagios/rw \ + || die "failed chown of ${D}/var/nagios/rw" + fi + fi + + chmod ug+s "${D}"/var/nagios/rw || die "failed chmod of ${D}/var/nagios/rw" + chmod 0750 "${D}"/etc/nagios || die "failed chmod of ${D}/etc/nagios" +} + +pkg_postinst() { + + if use web; then + elog "Note that your web server user requires read-only access to" + elog "${ROOT}etc/nagios." + + if use apache2 || use lighttpd ; then + elog + elog "To that end, we have changed the group of ${ROOT}etc/nagios" + elog "to that of your web server user." + elog + if use apache2; then + chown nagios:apache "${ROOT}etc/nagios" \ + || die "failed to change group of ${ROOT}etc/nagios" + + elog "To enable the Nagios web front-end, please edit" + elog "${ROOT}etc/conf.d/apache2 and add \"-D NAGIOS -D PHP5\"" + elog "to APACHE2_OPTS. Then Nagios will be available at," + elog + elif use lighttpd; then + chown nagios:lighttpd "${ROOT}etc/nagios" \ + || die "failed to change group of ${ROOT}etc/nagios" + elog "To enable the Nagios web front-end, please add" + elog "'include \"nagios.conf\"' to the lighttpd configuration" + elog "file at ${ROOT}etc/lighttpd/lighttpd.conf. Then Nagios" + elog "will be available at," + elog + fi + + elog " http://localhost/nagios/" + else + elog "Since you're not using either Apache or Lighttpd, you" + elog "will have to grant the necessary permissions yourself." + fi + fi + + elog + elog "If your kernel has /proc protection, nagios" + elog "will not be happy as it relies on accessing the proc" + elog "filesystem. You can fix this by adding nagios into" + elog "the group wheel, but this is not recomended." + elog +}