1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
|
# Copyright 1999-2011 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Header: /var/cvsroot/gentoo-x86/www-apache/modsecurity-crs/modsecurity-crs-2.1.2.ebuild,v 1.6 2011/12/18 17:28:54 armin76 Exp $
EAPI=4
DESCRIPTION="Core Rule Set for ModSecurity"
HOMEPAGE="http://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project"
SRC_URI="mirror://sourceforge/mod-security/${PN}_${PV}.tar.gz"
LICENSE="GPL-2"
SLOT="0"
KEYWORDS="amd64 ~ppc sparc x86"
IUSE=""
RDEPEND=">=www-apache/mod_security-2.5.13-r1"
DEPEND=""
S="${WORKDIR}/${PN}_${PV}"
RULESDIR=/etc/modsecurity
src_install() {
insinto "${RULESDIR}"/base_rules
doins base_rules/*
insinto "${RULESDIR}"/optional_rules
doins optional_rules/*
insinto "${RULESDIR}"/experimental_rules
doins experimental_rules/*
dodoc CHANGELOG README
(
cat - <<EOF
<IfDefine SECURITY>
EOF
cat modsecurity_crs_10_config.conf.example
cat - <<EOF
Include /etc/modsecurity/base_rules/*.conf
# Optionally use the other rules as well
# Include /etc/modsecurity/optional_rules/*.conf
# Include /etc/modsecurity/experimental_rules/*.conf
</IfDefine>
# -*- apache -*-
# vim: ts=4 filetype=apache
EOF
) > "${T}"/"80_${PN}.conf"
insinto /etc/apache2/modules.d/
doins "${T}"/"80_${PN}.conf"
}
pkg_postinst() {
elog
elog "If you want to enable further rules, check the following directories:"
elog " ${RULESDIR}/optional_rules"
elog " ${RULESDIR}/experimental_rules"
elog ""
elog "Starting from version 2.0.9, the default for the Core Rule Set is again to block"
elog "when rules hit. If you wish to go back to the 2.0.8 method of anomaly scoring, you"
elog "should change 80_${PN}.conf so that you have these settings enabled:"
elog ""
elog " #SecDefaultAction \"phase:2,deny,log\""
elog " SecAction \"phase:1,t:none,nolog,pass,setvar:tx.anomaly_score_blocking=on\""
elog ""
elog "Starting from version 2.1.2 rules are installed, for consistency, under"
elog "/etc/modsecurity, and can be configured with the following file:"
elog " /etc/apache2/modules.d/80_${PN}.conf"
elog ""
}
|
GitWeb