From f49db37e3f77fea98362781493cfb198c7267845 Mon Sep 17 00:00:00 2001 From: Mathieu Tortuyaux Date: Fri, 21 Jan 2022 10:25:10 +0100 Subject: [PATCH 1/2] app-crypt/mit-krb5: sync with upstream Commit-Ref: 7b01b4e5c717e91eee103485209b12deb985adf3 Signed-off-by: Mathieu Tortuyaux --- .../app-crypt/mit-krb5/Manifest | 1 + .../app-crypt/mit-krb5/files/kpropd.xinetd | 11 ++ .../files/mit-krb5-1.12_warn_cflags.patch | 11 ++ .../files/mit-krb5-1.18.2-krb5-config.patch | 15 ++ .../files/mit-krb5-CVE-2021-37750.patch | 43 +++++ .../files/mit-krb5-config_LDFLAGS-r1.patch | 12 ++ .../files/mit-krb5_dont_create_rundir.patch | 10 ++ .../mit-krb5/files/mit-krb5kadmind.confd | 2 + .../mit-krb5/files/mit-krb5kadmind.initd-r2 | 25 +++ .../mit-krb5/files/mit-krb5kadmind.service | 8 + .../mit-krb5/files/mit-krb5kdc.confd | 2 + .../mit-krb5/files/mit-krb5kdc.initd-r2 | 24 +++ .../mit-krb5/files/mit-krb5kdc.service | 9 + .../mit-krb5/files/mit-krb5kpropd.confd | 2 + .../mit-krb5/files/mit-krb5kpropd.initd-r2 | 24 +++ .../mit-krb5/files/mit-krb5kpropd.service | 8 + .../mit-krb5/files/mit-krb5kpropd.socket | 9 + .../mit-krb5/files/mit-krb5kpropd_at.service | 8 + .../app-crypt/mit-krb5/metadata.xml | 22 +++ .../mit-krb5/mit-krb5-1.19.2-r2.ebuild | 165 ++++++++++++++++++ 20 files changed, 411 insertions(+) create mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/Manifest create mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/kpropd.xinetd create mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-1.12_warn_cflags.patch create mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-1.18.2-krb5-config.patch create mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-CVE-2021-37750.patch create mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-config_LDFLAGS-r1.patch create mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5_dont_create_rundir.patch create mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kadmind.confd create mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kadmind.initd-r2 create mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kadmind.service create mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kdc.confd create mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kdc.initd-r2 create mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kdc.service create mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kpropd.confd create mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kpropd.initd-r2 create mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kpropd.service create mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kpropd.socket create mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kpropd_at.service create mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/metadata.xml create mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.19.2-r2.ebuild diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/Manifest b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/Manifest new file mode 100644 index 0000000000..a5005ab76f --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/Manifest @@ -0,0 +1 @@ +DIST krb5-1.19.2.tar.gz 8741053 BLAKE2B 963722721201e75381c91a2af6e982f569a5b1602beb2d1ded83d35f6f914235a6ed91e5d54f56c97e94921a32ed27c49aded258327966ee13d39485208c38d8 SHA512 b90d6ed0e1e8a87eb5cb2c36d88b823a6a6caabf85e5d419adb8a930f7eea09a5f8491464e7e454cca7ba88be09d19415962fe0036ad2e31fc584f9fc0bbd470 diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/kpropd.xinetd b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/kpropd.xinetd new file mode 100644 index 0000000000..af542fcf8a --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/kpropd.xinetd @@ -0,0 +1,11 @@ +service tell +{ + disable = yes + socket_type = stream + user = root + wait = no + server = /usr/sbin/kpropd + only_from = 0.0.0.0 + log_on_success = PID HOST EXIT DURATION + log_on_failure = HOST +} diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-1.12_warn_cflags.patch b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-1.12_warn_cflags.patch new file mode 100644 index 0000000000..53037d9702 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-1.12_warn_cflags.patch @@ -0,0 +1,11 @@ +gentoo bug #498794 +--- src/aclocal.m4 2014-01-16 00:44:15.000000000 +0000 ++++ src/aclocal.m4 2014-03-26 10:20:54.000000000 +0000 +@@ -501,6 +501,7 @@ + fi + if test "x$krb5_ac_warn_cflags_set" = xset ; then + AC_MSG_NOTICE(not adding extra gcc warning flags because WARN_CFLAGS was set) ++ WARN_CFLAGS="" + else + AC_MSG_NOTICE(adding extra warning flags for gcc) + WARN_CFLAGS="$WARN_CFLAGS $extra_gcc_warn_opts -Wmissing-prototypes" diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-1.18.2-krb5-config.patch b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-1.18.2-krb5-config.patch new file mode 100644 index 0000000000..ec901ce9c3 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-1.18.2-krb5-config.patch @@ -0,0 +1,15 @@ +--- a/build-tools/krb5-config.in ++++ b/build-tools/krb5-config.in +@@ -208,12 +208,6 @@ + + + if test -n "$do_libs"; then +- # Assumes /usr/lib is the standard library directory everywhere... +- if test "$libdir" = /usr/lib; then +- libdirarg= +- else +- libdirarg="-L$libdir" +- fi + # Ugly gross hack for our build tree + lib_flags=`echo $CC_LINK | sed -e 's/\$(CC)//' \ + -e 's/\$(PURE)//' \ diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-CVE-2021-37750.patch b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-CVE-2021-37750.patch new file mode 100644 index 0000000000..2f4c949e9f --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-CVE-2021-37750.patch @@ -0,0 +1,43 @@ +From d775c95af7606a51bf79547a94fa52ddd1cb7f49 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Tue, 3 Aug 2021 01:15:27 -0400 +Subject: [PATCH] Fix KDC null deref on TGS inner body null server + +After the KDC decodes a FAST inner body, it does not check for a null +server. Prior to commit 39548a5b17bbda9eeb63625a201cfd19b9de1c5b this +would typically result in an error from krb5_unparse_name(), but with +the addition of get_local_tgt() it results in a null dereference. Add +a null check. + +Reported by Joseph Sutton of Catalyst. + +CVE-2021-37750: + +In MIT krb5 releases 1.14 and later, an authenticated attacker can +cause a null dereference in the KDC by sending a FAST TGS request with +no server field. + +ticket: 9008 (new) +tags: pullup +target_version: 1.19-next +target_version: 1.18-next +--- + src/kdc/do_tgs_req.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c +index 582e497cc9..32dc65fa8e 100644 +--- a/kdc/do_tgs_req.c ++++ b/kdc/do_tgs_req.c +@@ -204,6 +204,11 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt, + status = "FIND_FAST"; + goto cleanup; + } ++ if (sprinc == NULL) { ++ status = "NULL_SERVER"; ++ errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN; ++ goto cleanup; ++ } + + errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server, + &local_tgt, &local_tgt_storage, &local_tgt_key); diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-config_LDFLAGS-r1.patch b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-config_LDFLAGS-r1.patch new file mode 100644 index 0000000000..39bac974af --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-config_LDFLAGS-r1.patch @@ -0,0 +1,12 @@ +Bug #448778 +--- a/build-tools/krb5-config.in 2012-12-18 02:47:04.000000000 +0000 ++++ b/build-tools/krb5-config.in 2012-12-28 07:13:16.582693363 +0000 +@@ -217,7 +217,7 @@ + -e 's#\$(PROG_RPATH)#'$libdir'#' \ + -e 's#\$(PROG_LIBPATH)#'$libdirarg'#' \ + -e 's#\$(RPATH_FLAG)#'"$RPATH_FLAG"'#' \ +- -e 's#\$(LDFLAGS)#'"$LDFLAGS"'#' \ ++ -e 's#\$(LDFLAGS)##' \ + -e 's#\$(PTHREAD_CFLAGS)#'"$PTHREAD_CFLAGS"'#' \ + -e 's#\$(CFLAGS)##'` + diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5_dont_create_rundir.patch b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5_dont_create_rundir.patch new file mode 100644 index 0000000000..4cc7d826ee --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5_dont_create_rundir.patch @@ -0,0 +1,10 @@ +--- src/Makefile.in 2019-12-12 10:15:51.674552983 +0300 ++++ src/Makefile.in 2019-12-12 10:16:33.205543490 +0300 +@@ -71,7 +71,6 @@ + $(KRB5_AD_MODULE_DIR) \ + $(KRB5_LIBKRB5_MODULE_DIR) $(KRB5_TLS_MODULE_DIR) \ + $(localstatedir) $(localstatedir)/krb5kdc \ +- $(runstatedir) $(runstatedir)/krb5kdc \ + $(KRB5_INCSUBDIRS) $(datadir) $(EXAMPLEDIR) \ + $(PKGCONFIG_DIR) + diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kadmind.confd b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kadmind.confd new file mode 100644 index 0000000000..f6029b6097 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kadmind.confd @@ -0,0 +1,2 @@ +# Define startup options for Kerberos administration server +KADMIND_OPTS="" diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kadmind.initd-r2 b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kadmind.initd-r2 new file mode 100644 index 0000000000..03e64f83e2 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kadmind.initd-r2 @@ -0,0 +1,25 @@ +#!/sbin/openrc-run + +#--------------------------------------------------------------------------- +# This script starts/stops the MIT Kerberos 5 Admin daemon +#--------------------------------------------------------------------------- + +daemon="MIT Kerberos 5 Admin daemon" +exec="/usr/sbin/kadmind" + +depend() { + need mit-krb5kdc + use net +} + +start() { + ebegin "Starting $daemon" + start-stop-daemon --start --quiet --exec ${exec} -- ${KADMIND_OPTS} 1>&2 + eend $? "Error starting $daemon" +} + +stop() { + ebegin "Stopping $daemon" + start-stop-daemon --stop --quiet --exec ${exec} 1>&2 + eend $? "Error stopping $daemon" +} diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kadmind.service b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kadmind.service new file mode 100644 index 0000000000..f3836c8986 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kadmind.service @@ -0,0 +1,8 @@ +[Unit] +Description=Kerberos 5 administration server + +[Service] +ExecStart=/usr/sbin/kadmind -nofork + +[Install] +WantedBy=multi-user.target diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kdc.confd b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kdc.confd new file mode 100644 index 0000000000..887d3d8c7b --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kdc.confd @@ -0,0 +1,2 @@ +# Define startup options for Kerberos KDC +KDC_OPTS="" diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kdc.initd-r2 b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kdc.initd-r2 new file mode 100644 index 0000000000..ecd47e4568 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kdc.initd-r2 @@ -0,0 +1,24 @@ +#!/sbin/openrc-run + +#--------------------------------------------------------------------------- +# This script starts/stops the MIT Kerberos 5 KDC +#--------------------------------------------------------------------------- + +daemon="MIT Kerberos 5 KDC" +exec="/usr/sbin/krb5kdc" + +depend() { + use net +} + +start() { + ebegin "Starting $daemon" + start-stop-daemon --start --quiet --exec ${exec} -- ${KDC_OPTS} 1>&2 + eend $? "Error starting $daemon" +} + +stop() { + ebegin "Stopping $daemon" + start-stop-daemon --stop --quiet --exec ${exec} 1>&2 + eend $? "Error stopping $daemon" +} diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kdc.service b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kdc.service new file mode 100644 index 0000000000..6ec93bb723 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kdc.service @@ -0,0 +1,9 @@ +[Unit] +Description=Kerberos 5 KDC + +[Service] +ExecStart=/usr/sbin/krb5kdc -n +Restart=always + +[Install] +WantedBy=multi-user.target diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kpropd.confd b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kpropd.confd new file mode 100644 index 0000000000..d75d41ab81 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kpropd.confd @@ -0,0 +1,2 @@ +# Define startup options for Kerberos incremental propagation server +KPROPD_OPTS="" diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kpropd.initd-r2 b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kpropd.initd-r2 new file mode 100644 index 0000000000..f6ab7872c9 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kpropd.initd-r2 @@ -0,0 +1,24 @@ +#!/sbin/openrc-run + +#--------------------------------------------------------------------------- +# This script starts/stops the MIT Kerberos 5 kpropd +#--------------------------------------------------------------------------- + +daemon="MIT Kerberos 5 kpropd" +exec="/usr/sbin/kpropd" + +depend() { + use net mit-krb5kdc mit-krb5kadmind +} + +start() { + ebegin "Starting $daemon" + start-stop-daemon --start --quiet --exec ${exec} -- ${KPROPD_OPTS} 1>&2 + eend $? "Error starting $daemon" +} + +stop() { + ebegin "Stopping $daemon" + start-stop-daemon --stop --quiet --exec ${exec} 1>&2 + eend $? "Error stopping $daemon" +} diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kpropd.service b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kpropd.service new file mode 100644 index 0000000000..a7c5b579d2 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kpropd.service @@ -0,0 +1,8 @@ +[Unit] +Description=Kerberos 5 propagation server + +[Service] +ExecStart=/usr/sbin/kpropd -S + +[Install] +WantedBy=multi-user.target diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kpropd.socket b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kpropd.socket new file mode 100644 index 0000000000..4389290c0b --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kpropd.socket @@ -0,0 +1,9 @@ +[Unit] +Description=Kerberos 5 propagation server + +[Socket] +ListenStream=754 +Accept=yes + +[Install] +WantedBy=sockets.target diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kpropd_at.service b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kpropd_at.service new file mode 100644 index 0000000000..f826eb33cb --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5kpropd_at.service @@ -0,0 +1,8 @@ +[Unit] +Description=Kerberos 5 propagation server +Conflicts=mit-krb5kpropd.service + +[Service] +ExecStart=/usr/sbin/kpropd +StandardInput=socket +StandardError=syslog diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/metadata.xml b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/metadata.xml new file mode 100644 index 0000000000..af3905a6da --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/metadata.xml @@ -0,0 +1,22 @@ + + + + + kerberos@gentoo.org + Kerberos + + + + Creates and installs the API and implementation + documentation. This is only useful if you want to develop software + which depends on kerberos + + Enable for the keyring ccache using keyutils + Add support for using dev-db/lmdb for lookup tables + Enable pkinit support for the initial ticket + Enable support for ldap as a database backend + + + cpe:/a:mit:kerberos + + diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.19.2-r2.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.19.2-r2.ebuild new file mode 100644 index 0000000000..5598ad9bed --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.19.2-r2.ebuild @@ -0,0 +1,165 @@ +# Copyright 1999-2022 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +PYTHON_COMPAT=( python3_{8..10} ) +inherit autotools flag-o-matic multilib-minimal python-any-r1 systemd toolchain-funcs + +MY_P="${P/mit-}" +P_DIR=$(ver_cut 1-2) +DESCRIPTION="MIT Kerberos V" +HOMEPAGE="https://web.mit.edu/kerberos/www/" +SRC_URI="https://web.mit.edu/kerberos/dist/krb5/${P_DIR}/${MY_P}.tar.gz" + +LICENSE="openafs-krb5-a BSD MIT OPENLDAP BSD-2 HPND BSD-4 ISC RSA CC-BY-SA-3.0 || ( BSD-2 GPL-2+ )" +SLOT="0" +KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~mips ppc ppc64 ~riscv ~s390 sparc x86" +IUSE="cpu_flags_x86_aes doc +keyutils lmdb nls openldap +pkinit selinux +threads test xinetd" + +# some tests requires network access +RESTRICT="test" + +DEPEND=" + !!app-crypt/heimdal + || ( + >=sys-fs/e2fsprogs-1.46.4-r51[${MULTILIB_USEDEP}] + sys-libs/e2fsprogs-libs[${MULTILIB_USEDEP}] + ) + || ( + >=dev-libs/libverto-0.2.5[libev,${MULTILIB_USEDEP}] + >=dev-libs/libverto-0.2.5[libevent,${MULTILIB_USEDEP}] + ) + keyutils? ( >=sys-apps/keyutils-1.5.8:=[${MULTILIB_USEDEP}] ) + lmdb? ( dev-db/lmdb ) + nls? ( sys-devel/gettext[${MULTILIB_USEDEP}] ) + openldap? ( >=net-nds/openldap-2.4.38-r1[${MULTILIB_USEDEP}] ) + pkinit? ( >=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}] ) + xinetd? ( sys-apps/xinetd ) + " +BDEPEND=" + ${PYTHON_DEPS} + virtual/yacc + cpu_flags_x86_aes? ( + amd64? ( dev-lang/yasm ) + x86? ( dev-lang/yasm ) + ) + doc? ( virtual/latex-base ) + test? ( + ${PYTHON_DEPS} + dev-lang/tcl:0 + dev-util/dejagnu + dev-util/cmocka + )" +RDEPEND="${DEPEND} + selinux? ( sec-policy/selinux-kerberos )" + +S=${WORKDIR}/${MY_P}/src + +PATCHES=( + "${FILESDIR}/${PN}-1.12_warn_cflags.patch" + "${FILESDIR}/${PN}-config_LDFLAGS-r1.patch" + "${FILESDIR}/${PN}_dont_create_rundir.patch" + "${FILESDIR}/${PN}-1.18.2-krb5-config.patch" + "${FILESDIR}/${PN}-CVE-2021-37750.patch" +) + +MULTILIB_CHOST_TOOLS=( + /usr/bin/krb5-config +) + +src_prepare() { + default + # Make sure we always use the system copies. + rm -rf util/{et,ss,verto} + sed -i 's:^[[:space:]]*util/verto$::' configure.ac || die + + eautoreconf +} + +src_configure() { + # QA + append-flags -fno-strict-aliasing + append-flags -fno-strict-overflow + + multilib-minimal_src_configure +} + +multilib_src_configure() { + ECONF_SOURCE=${S} \ + AR="$(tc-getAR)" \ + WARN_CFLAGS="set" \ + econf \ + $(use_with openldap ldap) \ + "$(multilib_native_use_with test tcl "${EPREFIX}/usr")" \ + $(use_enable nls) \ + $(use_enable pkinit) \ + $(use_enable threads thread-support) \ + $(use_with lmdb) \ + $(use_with keyutils) \ + --without-hesiod \ + --enable-shared \ + --with-system-et \ + --with-system-ss \ + --enable-dns-for-realm \ + --enable-kdc-lookaside-cache \ + --with-system-verto \ + --disable-rpath +} + +multilib_src_compile() { + emake -j1 +} + +multilib_src_test() { + multilib_is_native_abi && emake -j1 check +} + +multilib_src_install() { + emake \ + DESTDIR="${D}" \ + EXAMPLEDIR="${EPREFIX}/usr/share/doc/${PF}/examples" \ + install +} + +multilib_src_install_all() { + # default database dir + keepdir /var/lib/krb5kdc + + cd .. + dodoc README + + if use doc; then + dodoc -r doc/html + docinto pdf + dodoc doc/pdf/*.pdf + fi + + newinitd "${FILESDIR}"/mit-krb5kadmind.initd-r2 mit-krb5kadmind + newinitd "${FILESDIR}"/mit-krb5kdc.initd-r2 mit-krb5kdc + newinitd "${FILESDIR}"/mit-krb5kpropd.initd-r2 mit-krb5kpropd + newconfd "${FILESDIR}"/mit-krb5kadmind.confd mit-krb5kadmind + newconfd "${FILESDIR}"/mit-krb5kdc.confd mit-krb5kdc + newconfd "${FILESDIR}"/mit-krb5kpropd.confd mit-krb5kpropd + + systemd_newunit "${FILESDIR}"/mit-krb5kadmind.service mit-krb5kadmind.service + systemd_newunit "${FILESDIR}"/mit-krb5kdc.service mit-krb5kdc.service + systemd_newunit "${FILESDIR}"/mit-krb5kpropd.service mit-krb5kpropd.service + systemd_newunit "${FILESDIR}"/mit-krb5kpropd_at.service "mit-krb5kpropd@.service" + systemd_newunit "${FILESDIR}"/mit-krb5kpropd.socket mit-krb5kpropd.socket + + insinto /etc + newins "${ED}/usr/share/doc/${PF}/examples/krb5.conf" krb5.conf.example + insinto /var/lib/krb5kdc + newins "${ED}/usr/share/doc/${PF}/examples/kdc.conf" kdc.conf.example + + if use openldap ; then + insinto /etc/openldap/schema + doins "${S}/plugins/kdb/ldap/libkdb_ldap/kerberos.schema" + fi + + if use xinetd ; then + insinto /etc/xinetd.d + newins "${FILESDIR}/kpropd.xinetd" kpropd + fi +} From 3e78672cbd48e7603cfb3ebe3a0593a249209f8e Mon Sep 17 00:00:00 2001 From: Mathieu Tortuyaux Date: Fri, 21 Jan 2022 10:34:46 +0100 Subject: [PATCH 2/2] changelog: add security entry Signed-off-by: Mathieu Tortuyaux --- .../portage-stable/changelog/security/2022-01-21-krb5.md | 1 + 1 file changed, 1 insertion(+) create mode 100644 sdk_container/src/third_party/portage-stable/changelog/security/2022-01-21-krb5.md diff --git a/sdk_container/src/third_party/portage-stable/changelog/security/2022-01-21-krb5.md b/sdk_container/src/third_party/portage-stable/changelog/security/2022-01-21-krb5.md new file mode 100644 index 0000000000..d42f6192f1 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/changelog/security/2022-01-21-krb5.md @@ -0,0 +1 @@ +- krb5 ([CVE-2021-37750](https://nvd.nist.gov/vuln/detail/CVE-2021-37750))