Adding several patches to fix lib64 path errors, supporting newer rbac grsec fixes in hardened-2.6.4-r6 and a silly little interface bug. This requires some additional attention from people with older versions of grsec + rbac for regression testing.

(Portage version: 2.1_pre6-r2)

6 files changed, 110 insertions, 1 deletions

diff --git a/sys-apps/gradm/ChangeLog b/sys-apps/gradm/ChangeLog
index 6f25b87bb044..a8067213fecc 100644
--- a/sys-apps/gradm/ChangeLog
+++ b/sys-apps/gradm/ChangeLog
@@ -1,6 +1,16 @@
 # ChangeLog for sys-apps/gradm
 # Copyright 2002-2006 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-apps/gradm/ChangeLog,v 1.70 2006/03/10 01:21:33 agriffis Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-apps/gradm/ChangeLog,v 1.71 2006/03/15 14:33:36 johnm Exp $
+
+*gradm-2.1.8.200601212342-r1 (15 Mar 2006)
+
+  15 Mar 2006; John Mylchreest <johnm@gentoo.org>
+  +files/gradm_2.1.8.200601212342-fix_gradm_pam_symlinks.patch,
+  +files/gradm_2.1.8.200601212342-increase_num_pointers.patch,
+  +files/gradm_2.1.8.200601212342-ip_state_interface_fix.patch,
+  +gradm-2.1.8.200601212342-r1.ebuild:
+  Bumping to support hardened-sources-2.6.14-r6, namely the inodev_entry grsec
+  fix
 
   10 Mar 2006; Aron Griffis <agriffis@gentoo.org>
   gradm-2.1.8.200601212342.ebuild:
diff --git a/sys-apps/gradm/files/digest-gradm-2.1.8.200601212342-r1 b/sys-apps/gradm/files/digest-gradm-2.1.8.200601212342-r1
new file mode 100644
index 000000000000..2b014206f690
--- /dev/null
+++ b/sys-apps/gradm/files/digest-gradm-2.1.8.200601212342-r1
@@ -0,0 +1,3 @@
+MD5 c8e9670798cb224300aaf2a869b28b43 gradm-2.1.8-200601212342.tar.gz 61615
+RMD160 fec5ea79cffeca2ec202f3de4adebc8ed028b980 gradm-2.1.8-200601212342.tar.gz 61615
+SHA256 55d0e85265ba6237679a85e654b17fd50ec0af82016e24cf39cf449110f26e36 gradm-2.1.8-200601212342.tar.gz 61615
diff --git a/sys-apps/gradm/files/gradm_2.1.8.200601212342-fix_gradm_pam_symlinks.patch b/sys-apps/gradm/files/gradm_2.1.8.200601212342-fix_gradm_pam_symlinks.patch
new file mode 100644
index 000000000000..95a441aa8913
--- /dev/null
+++ b/sys-apps/gradm/files/gradm_2.1.8.200601212342-fix_gradm_pam_symlinks.patch
@@ -0,0 +1,13 @@
+--- gradm2/gradm_adm.c	2005/12/07 00:15:18	1.73
++++ gradm2/gradm_adm.c	2006/02/05 22:51:05	1.74
+@@ -158,8 +158,8 @@ add_gradm_pam_acl(struct role_acl *role)
+ 	add_proc_object_acl(current_subject, "/dev/null", proc_object_mode_conv("rw"), GR_FEXIST);
+ 	add_proc_object_acl(current_subject, "/lib", proc_object_mode_conv("rx"), GR_FEXIST);
+ 	add_proc_object_acl(current_subject, "/usr/lib", proc_object_mode_conv("rx"), GR_FEXIST);
+-	add_proc_object_acl(current_subject, "/lib64", proc_object_mode_conv("rx"), GR_FEXIST);
+-	add_proc_object_acl(current_subject, "/usr/lib64", proc_object_mode_conv("rx"), GR_FEXIST);
++	add_proc_object_acl(current_subject, "/lib64", proc_object_mode_conv("rx"), GR_FEXIST | GR_SYMLINK);
++	add_proc_object_acl(current_subject, "/usr/lib64", proc_object_mode_conv("rx"), GR_FEXIST | GR_SYMLINK);
+ 	add_proc_object_acl(current_subject, GRPAM_PATH, proc_object_mode_conv("x"), GR_FEXIST);
+ 
+ 	add_cap_acl(current_subject, "-CAP_ALL");
diff --git a/sys-apps/gradm/files/gradm_2.1.8.200601212342-increase_num_pointers.patch b/sys-apps/gradm/files/gradm_2.1.8.200601212342-increase_num_pointers.patch
new file mode 100644
index 000000000000..2613b09db4bc
--- /dev/null
+++ b/sys-apps/gradm/files/gradm_2.1.8.200601212342-increase_num_pointers.patch
@@ -0,0 +1,13 @@
+--- gradm2/gradm_parse.c	2006/01/22 04:40:42	1.105
++++ gradm2/gradm_parse.c	2006/02/08 00:42:51	1.106
+@@ -576,8 +576,8 @@ add_proc_object_acl(struct proc_acl *sub
+ 	file_len++;
+ 
+ 	num_objects++;
+-	/* one for the object, one for the filename, one for the name entry struct in the kernel*/
+-	num_pointers += 3;
++	/* one for the object, one for the filename, one for the name entry struct, and one for the inodev_entry struct in the kernel*/
++	num_pointers += 4;
+ 
+ 	if (lstat(filename, &fstat)) {
+ 		dfile = add_deleted_file(filename);
diff --git a/sys-apps/gradm/files/gradm_2.1.8.200601212342-ip_state_interface_fix.patch b/sys-apps/gradm/files/gradm_2.1.8.200601212342-ip_state_interface_fix.patch
new file mode 100644
index 000000000000..e048375ea20e
--- /dev/null
+++ b/sys-apps/gradm/files/gradm_2.1.8.200601212342-ip_state_interface_fix.patch
@@ -0,0 +1,10 @@
+--- gradm2/gradm.l	2006/01/02 01:44:39	1.90
++++ gradm2/gradm.l	2006/02/06 23:27:16	1.91
+@@ -125,6 +125,7 @@ IP [0-9]{1,3}"."[0-9]{1,3}"."[0-9]{1,3}"
+ 					  return NOT;
+ 					}
+ <IPIP_STATE>[-a-zA-Z0-9_]{1,7}("#"[0-9]{1,3})?	{
++					  BEGIN(IP_STATE);
+ 					  gr_line = yytext;
+ 					  gradmlval.string = gr_strdup(gr_line);
+ 					  gr_line = strchr(gradmlval.string, '#');
diff --git a/sys-apps/gradm/gradm-2.1.8.200601212342-r1.ebuild b/sys-apps/gradm/gradm-2.1.8.200601212342-r1.ebuild
new file mode 100644
index 000000000000..19c7f081b593
--- /dev/null
+++ b/sys-apps/gradm/gradm-2.1.8.200601212342-r1.ebuild
@@ -0,0 +1,60 @@
+# Copyright 1999-2006 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sys-apps/gradm/gradm-2.1.8.200601212342-r1.ebuild,v 1.1 2006/03/15 14:33:36 johnm Exp $
+
+inherit flag-o-matic toolchain-funcs eutils versionator
+
+myPV="$(replace_version_separator 3 -)"
+
+DESCRIPTION="Administrative interface for the grsecurity Role Based Access Control system"
+HOMEPAGE="http://www.grsecurity.net/"
+SRC_URI="http://www.grsecurity.net/gradm-${myPV}.tar.gz"
+#SRC_URI="mirror://gentoo/gradm-${myPV}.tar.gz"
+#RESTRICT=primaryuri
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~ia64 ~mips ~ppc ~ppc64 ~sparc ~x86"
+IUSE="pam"
+RDEPEND=""
+DEPEND="virtual/libc
+	sys-devel/bison
+	sys-devel/flex
+	pam? ( virtual/pam )
+	|| (
+		sys-apps/paxctl
+		sys-apps/chpax
+	)"
+
+S="${WORKDIR}/${PN}2"
+
+src_unpack() {
+	unpack ${A}
+	cd "${S}"
+	epatch "${FILESDIR}"/2.1.7.200511041858-non-lazy-bindings.patch
+
+	# All of these patches can be dropped in gradm-2.1.9
+	epatch "${FILESDIR}/${PN}_${PV}-fix_gradm_pam_symlinks.patch"
+	epatch "${FILESDIR}/${PN}_${PV}-increase_num_pointers.patch"
+	epatch "${FILESDIR}/${PN}_${PV}-ip_state_interface_fix.patch"
+}
+
+src_compile() {
+	local target=""
+	use pam || target="nopam"
+
+	emake ${target} CC="$(tc-getCC)" OPT_FLAGS="${CFLAGS}" || die "compile problem"
+}
+
+src_install() {
+	einstall DESTDIR="${D}" || die "einstall failed"
+	fperms 711 /sbin/gradm
+}
+
+pkg_postinst() {
+	if [ ! -e "${ROOT}"/dev/grsec ] ; then
+		einfo "Making character device for grsec2 learning mode"
+		mkdir -p -m 755 "${ROOT}"/dev/
+		mknod -m 0622 "${ROOT}"/dev/grsec c 1 12 || die "Cant mknod for grsec learning device"
+	fi
+	ewarn "Be sure to set a password with 'gradm -P' before enabling learning mode"
+}