tcely authored 7 years ago and Ariadne Conill committed 7 years ago

Add patch for seccomp musl fixes.

it does not build on non-x86_64 due to:
https://github.com/memcached/memcached/issues/319

This fixes CVE-2017-9951

A. Klitzing authored 7 years ago and Ariadne Conill committed 7 years ago

Modernize abuild

Fixes #6445

Przemysław Pawełczyk authored 8 years ago and Natanael Copa committed 8 years ago

* main/dovecot: Properly set primary group in .pre-install.
main/dovecot/dovecot.pre-install

* main/{npre,postgrey}: Properly set primary group in .pre-install.
main/nrpe/nrpe.pre-install
main/postgrey/postgrey.pre-install

* main/ympd: Reorder arguments in .pre-install as in da4e96aa.
main/ympd/ympd.pre-install

* main/znc: Reorder arguments in .pre-install as in da4e96aa.
main/znc/znc.pre-install

* main/aports-build: Reorder arguments in .pre-install as in da4e96aa.
main/aports-build/aports-build.pre-install

* main/atheme-iris: Fix overlooked consistency issue as in a60b9f07.
main/atheme-iris/atheme-iris.pre-install

* main/[various]: Add group and use it as primary in .pre-* scripts.
main/apache2/apache2.pre-install
main/aports-build/aports-build.pre-install
main/atheme-iris/atheme-iris.pre-install
main/clamav/clamav-db.pre-install
main/clamsmtp/clamsmtp.pre-install
main/clamsmtp/clamsmtp.pre-upgrade
main/coova-chilli/coova-chilli.pre-install
main/dhcp/dhcp.pre-install
main/djbdns/dnscache.pre-install
main/djbdns/tinydns.pre-install
main/ez-ipupdate/ez-ipupdate.pre-install
main/fetchmail/fetchmail.pre-install
main/freeswitch/freeswitch.pre-install
main/gitolite/gitolite.pre-install
main/gnats/gnats.pre-install
main/gross/gross.pre-install
main/icecast/icecast.pre-install
main/memcached/memcached.pre-install
main/ngircd/ngircd.pre-install
main/openntpd/openntpd.pre-install
main/snort/snort.pre-install
main/squid/squid.pre-install
main/squid/squid.pre-upgrade
main/transmission/transmission-daemon.pre-install
main/znc/znc.pre-install

Przemysław Pawełczyk authored 8 years ago and Natanael Copa committed 8 years ago

Fixes the problem I unintentionally brought in commit ccc056db:
system user creation doesn't add same named group and uses nogroup as
primary group unless explicitly specified via -G.

Brings status quo regarding primary groups of users created in packages:
- main/apache2
- main/aports-build
- main/atheme-iris
- main/clamav
- main/clamsmtp
- main/coova-chilli
- main/dhcp
- main/djbdns
- main/ez-ipupdate
- main/fetchmail
- main/freeswitch
- main/gitolite
- main/gnats
- main/gross
- main/icecast
- main/memcached
- main/ngircd
- main/openntpd
- main/snort
- main/squid
- main/transmission
- main/znc

Przemysław Pawełczyk authored 8 years ago and Natanael Copa committed 8 years ago

Now all invocations have following order of arguments (if present):

    addgroup -S -g ... GROUP
    adduser -S -u ... -D -H -h ... -s ... -G ... -g ... USER

Przemysław Pawełczyk authored 8 years ago and Natanael Copa committed 8 years ago

Following rules have been applied:
- script starts with shebang !#/bin/sh followed by blank line,
- script ends with exit 0 prepended by blank line,
- only stderr of adduser, addgroup or passwd is redirected to /dev/null,
- getent passwd/group instances has been removed,
- manual checking of file and group existence has been removed,
- `|| true` instances has been removed.

Comments and line wrapping have been preserved.

Przemysław Pawełczyk authored 8 years ago and Natanael Copa committed 8 years ago

This way we can avoid ugly default:

    Linux user,,,

Przemysław Pawełczyk authored 8 years ago and Natanael Copa committed 8 years ago

Groups and users created by packages shouldn't use high ids by default
(unless explicitly requested), to distinguish them from groups and users
created by administrators for humans.

Following 41 files lacked -S next to addgroup:
- community/sword/sword.pre-install
- main/amavisd-new/amavisd-new.pre-install
- main/chrony/chrony.pre-install
- main/cvechecker/cvechecker.pre-install
- main/dnsmasq/dnsmasq.pre-install
- main/freeradius/freeradius.pre-install
- main/gdnsd/gdnsd.pre-install
- main/haproxy/haproxy.pre-install
- main/haproxy/haproxy.pre-upgrade
- main/kamailio/kamailio.pre-install
- main/logcheck/logcheck.pre-install
- main/mlmmj/mlmmj.pre-install
- main/nrpe/nrpe.pre-install
- main/open-vm-tools/open-vm-tools.pre-install
- main/postgrey/postgrey.pre-install
- main/privoxy/privoxy.pre-install
- main/redis/redis.pre-install
- main/samba/winbind.pre-install
- main/sircbot/sircbot.pre-install
- main/smokeping/smokeping.pre-install
- main/squark/squark.post-install
- main/squid/squid.pre-install
- main/squid/squid.pre-upgrade
- main/subversion/subversion.pre-install
- main/trac/trac.pre-install
- main/vsftpd/vsftpd.pre-install
- main/zabbix/zabbix-agent.pre-install
- testing/3proxy/3proxy.pre-install
- testing/cluster-glue/cluster-glue.pre-install
- testing/elasticsearch/elasticsearch.pre-install
- testing/emby/emby.pre-install
- testing/gdnsd/gdnsd.pre-install
- testing/icinga2/icinga2.pre-install
- testing/lusca/lusca.pre-install
- testing/lusca/lusca.pre-upgrade
- testing/mongodb/mongodb.pre-install
- testing/openxcap/openxcap.pre-install
- testing/prosody/prosody.pre-install
- testing/rancid/rancid.pre-install
- testing/rutorrent/rutorrent.pre-install
- testing/zabbix/zabbix-agent.pre-install

Following 60 files lacked -S next to adduser:
- community/caddy/caddy.pre-install
- community/domoticz/domoticz.pre-install
- community/minetest/minetest-server.pre-install
- community/oscam/oscam.pre-install
- community/seafile/seafile-server.pre-install
- community/syncthing/syncthing.pre-install
- main/apache2/apache2.pre-install
- main/aports-build/aports-build.pre-install
- main/atheme-iris/atheme-iris.pre-install
- main/bind/bind.pre-install
- main/clamav/clamav-db.pre-install
- main/clamsmtp/clamsmtp.pre-install
- main/clamsmtp/clamsmtp.pre-upgrade
- main/coova-chilli/coova-chilli.pre-install
- main/cvechecker/cvechecker.pre-install
- main/dhcp/dhcp.pre-install
- main/distcc/distcc.pre-install
- main/djbdns/dnscache.pre-install
- main/djbdns/tinydns.pre-install
- main/dovecot/dovecot.pre-install
- main/ez-ipupdate/ez-ipupdate.pre-install
- main/fetchmail/fetchmail.pre-install
- main/freeswitch/freeswitch.pre-install
- main/gitolite/gitolite.pre-install
- main/gnats/gnats.pre-install
- main/gross/gross.pre-install
- main/icecast/icecast.pre-install
- main/kamailio/kamailio.pre-install
- main/lighttpd/lighttpd.pre-install
- main/mariadb/mariadb.pre-install
- main/memcached/memcached.pre-install
- main/ngircd/ngircd.pre-install
- main/nrpe/nrpe.pre-install
- main/openntpd/openntpd.pre-install
- main/postgrey/postgrey.pre-install
- main/snort/snort.pre-install
- main/squid/squid.pre-install
- main/squid/squid.pre-upgrade
- main/subversion/subversion.pre-install
- main/trac/trac.pre-install
- main/transmission/transmission-daemon.pre-install
- main/ympd/ympd.pre-install
- main/znc/znc.pre-install
- testing/at/at.pre-install
- testing/buildbot-slave/buildbot-slave.pre-install
- testing/buildbot/buildbot.pre-install
- testing/clapf/clapf.pre-install
- testing/cluster-glue/cluster-glue.pre-install
- testing/dbmail/dbmail.pre-install
- testing/dspam/dspam.pre-install
- testing/ejabberd/ejabberd.pre-install
- testing/emby/emby.pre-install
- testing/mongodb/mongodb.pre-install
- testing/opensips/opensips.pre-install
- testing/pdns/pdns.pre-install
- testing/prosody/prosody.pre-install
- testing/qpage/qpage.pre-install
- testing/rrdbot/rrdbot.pre-install
- testing/wt/wt.pre-install
- unmaintained/ejabberd-git/ejabberd-git.pre-install

Christian Kampka authored 9 years ago and Natanael Copa committed 9 years ago

Also remove CVE-2011-4971.patch as it has been fixed upstream in 1.4.16