summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMatthew Thode <prometheanfire@gentoo.org>2017-12-02 21:28:07 -0600
committerMatthew Thode <prometheanfire@gentoo.org>2017-12-02 21:29:06 -0600
commit3d8ca20a1484cffc1de9da7bbb0131122f32b95c (patch)
tree9731a31136d14dc414016f5871f0ee8ce3b68d33
parentdev-libs/botan: reduce constrains (diff)
downloadgentoo-3d8ca20a1484cffc1de9da7bbb0131122f32b95c.tar.gz
gentoo-3d8ca20a1484cffc1de9da7bbb0131122f32b95c.tar.bz2
gentoo-3d8ca20a1484cffc1de9da7bbb0131122f32b95c.zip
net-analyzer/icinga: fixing bug 638186 CVE-2017-16882
Package-Manager: Portage-2.3.14, Repoman-2.3.6
-rw-r--r--net-analyzer/icinga/Manifest2
-rw-r--r--net-analyzer/icinga/icinga-1.14.0-r1.ebuild274
2 files changed, 275 insertions, 1 deletions
diff --git a/net-analyzer/icinga/Manifest b/net-analyzer/icinga/Manifest
index 825510b0967a..fa3026138979 100644
--- a/net-analyzer/icinga/Manifest
+++ b/net-analyzer/icinga/Manifest
@@ -1,3 +1,3 @@
DIST CVE-2015-8010_1.13.3.patch 177807 BLAKE2B c3832442d2953f28793236cd29c537041fc68e976e593da4793cd55c240de784c5bb3996ff38464097b3af27bb276d21c7538c90d2470d5067a831b1800f2874 SHA512 bc82e588db33fbb955002cf51ae7b0e40109d4ec3fa6199b046ffbf23b649d74fbdd04c8fb4a5af4cd44301e26f30aa295a9574281c14bc45eec2b9149a6339a
-DIST icinga-1.13.4.tar.gz 18741576 SHA256 5690f6b3f3340d341a265fe61598ff3f64cb7d135a0059e791b51c77bcd4833b SHA512 245f94facfcbb125ed6be26a2544292b7ce6d59a6d38374b7ef1b24b2ca3deaaff56720542c3747d36ab4998b88b367ca40bbd061491e0770e21505bd7c0a1d6 WHIRLPOOL 92c444ae98139c570b420cef83182401ee7756328a4edd89b52187c1844526aea0e374839395df082fff4504e2ace14366488a2d1d0864998890add32cd08c40
+DIST icinga-1.13.4.tar.gz 18741576 BLAKE2B fccc88c8749d405e29961e5a1510bec7f920fc43910be757668392098f4ff19ed9f659de911f97e150eea8bd8cfd7a60b440704bdcd9aba450ba1ea29222d1cf SHA512 245f94facfcbb125ed6be26a2544292b7ce6d59a6d38374b7ef1b24b2ca3deaaff56720542c3747d36ab4998b88b367ca40bbd061491e0770e21505bd7c0a1d6
DIST icinga-1.14.0.tar.gz 20779347 BLAKE2B 65899e99fdc57563aa1dee6f19572c032c5ab6e2aa7093482bd6d6068b4d066d3630ce9bf1396efcb65592d4f25292149178dac81a2a0b775745f70b7409bcc0 SHA512 f02c60c2bd1d3dff4a5a42f9d3c3362ada421f2cd83362b3cdd05f59b0aafe4f61255b621afed1fbf959415545a94ce6b3124bf2ffac22f0f2bdb8a67e75ad7a
diff --git a/net-analyzer/icinga/icinga-1.14.0-r1.ebuild b/net-analyzer/icinga/icinga-1.14.0-r1.ebuild
new file mode 100644
index 000000000000..bf0de98f741b
--- /dev/null
+++ b/net-analyzer/icinga/icinga-1.14.0-r1.ebuild
@@ -0,0 +1,274 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit depend.apache eutils multilib pax-utils toolchain-funcs user versionator
+
+DESCRIPTION="Nagios Fork - Check daemon, CGIs, docs, IDOutils"
+HOMEPAGE="http://www.icinga.org/"
+#MY_PV=$(delete_version_separator 3)
+#SRC_URI="mirror://sourceforge/${PN}/${PN}-${MY_PV}.tar.gz"
+#S=${WORKDIR}/${PN}-${MY_PV}
+#SRC_URI="mirror://sourceforge/${PN}/${P}.tar.gz"
+SRC_URI="https://github.com/${PN}/${PN}-core/archive/v${PV}/${P}.tar.gz"
+S="${WORKDIR}/${PN}-core-${PV}"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~hppa ~ppc ~ppc64 ~x86"
+IUSE="+apache2 contrib eventhandler +idoutils lighttpd +mysql perl +plugins postgres ssl +vim-syntax +web"
+DEPEND="idoutils? ( dev-db/libdbi-drivers[mysql?,postgres?] )
+ perl? ( dev-lang/perl:= )
+ virtual/mailx
+ web? (
+ media-libs/gd[jpeg,png]
+ lighttpd? ( www-servers/lighttpd )
+ )
+ !net-analyzer/nagios-core"
+RDEPEND="${DEPEND}
+ plugins? ( || (
+ net-analyzer/monitoring-plugins
+ net-analyzer/nagios-plugins
+ ) )"
+RESTRICT="test"
+
+want_apache2
+
+pkg_setup() {
+ depend.apache_pkg_setup
+ enewgroup icinga
+ enewgroup nagios
+ enewuser icinga -1 -1 /var/lib/icinga "icinga,nagios"
+}
+
+src_prepare() {
+ epatch "${FILESDIR}/fix-prestripped-binaries-1.7.0.patch"
+ eapply_user
+}
+
+src_configure() {
+ local myconf
+
+ myconf="$(use_enable perl embedded-perl)
+ $(use_with perl perlcache)
+ $(use_enable idoutils)
+ $(use_enable ssl)
+ --with-cgiurl=/icinga/cgi-bin
+ --with-log-dir=/var/log/icinga
+ --libdir=/usr/$(get_libdir)
+ --bindir=/usr/sbin
+ --sbindir=/usr/$(get_libdir)/icinga/cgi-bin
+ --datarootdir=/usr/share/icinga/htdocs
+ --localstatedir=/var/lib/icinga
+ --sysconfdir=/etc/icinga
+ --with-lockfile=/var/run/icinga/icinga.lock
+ --with-temp-dir=/tmp/icinga
+ --with-temp-file=/tmp/icinga/icinga.tmp"
+
+ if use idoutils ; then
+ myconf+=" --with-ido2db-lockfile=/var/run/icinga/ido2db.lock
+ --with-icinga-chkfile=/var/lib/icinga/icinga.chk
+ --with-ido-sockfile=/var/lib/icinga/ido.sock
+ --with-idomod-tmpfile=/tmp/icinga/idomod.tmp"
+ fi
+
+ if use eventhandler ; then
+ myconfig+=" --with-eventhandler-dir=/etc/icinga/eventhandlers"
+ fi
+
+ if use plugins ; then
+ myconf+=" --with-plugin-dir=/usr/$(get_libdir)/nagios/plugins"
+ else
+ myconf+=" --with-plugin-dir=/usr/$(get_libdir)/nagios/plugins"
+ fi
+
+ if use !apache2 && use !lighttpd ; then
+ myconf+=" --with-command-group=icinga"
+ else
+ if use apache2 ; then
+ myconf+=" --with-httpd-conf=/etc/apache2/conf.d"
+ myconf+=" --with-command-group=apache"
+ elif use lighttpd ; then
+ myconf+=" --with-command-group=lighttpd"
+ fi
+ fi
+
+ econf ${myconf}
+}
+
+src_compile() {
+ tc-export CC
+
+ emake icinga
+
+ if use web ; then
+ emake DESTDIR="${D}" cgis
+ fi
+
+ if use contrib ; then
+ emake DESTDIR="${D}" -C contrib
+ fi
+
+ if use idoutils ; then
+ emake DESTDIR="${D}" idoutils
+ fi
+}
+
+src_install() {
+ dodoc Changelog README UPGRADING
+
+ if ! use web ; then
+ sed -i -e '/cd $(SRC_\(CGI\|HTM\))/d' Makefile
+ fi
+
+ emake DESTDIR="${D}" install{,-config,-commandmode}
+
+ if use idoutils ; then
+ emake DESTDIR="${D}" install-idoutils
+ fi
+
+ if use contrib ; then
+ emake DESTDIR="${D}" -C contrib install
+ fi
+
+ if use eventhandler ; then
+ emake DESTDIR="${D}" install-eventhandlers
+ fi
+
+ newinitd "${FILESDIR}"/icinga-init.d icinga
+ newconfd "${FILESDIR}"/icinga-conf.d icinga
+ if use idoutils ; then
+ newinitd "${FILESDIR}"/ido2db-init.d ido2db
+ newconfd "${FILESDIR}"/ido2db-conf.d ido2db
+ insinto /usr/share/icinga/contrib/db
+ doins -r module/idoutils/db/*
+ fi
+ # Apache Module
+ if use web ; then
+ if use apache2 ; then
+ insinto "${APACHE_MODULES_CONFDIR}"
+ newins "${FILESDIR}"/icinga-apache.conf 99_icinga.conf
+ elif use lighttpd ; then
+ insinto /etc/lighttpd
+ newins "${FILESDIR}"/icinga-lighty.conf lighttpd_icinga.conf
+ else
+ ewarn "${CATEGORY}/${PF} only supports Apache-2.x or Lighttpd webserver"
+ ewarn "out-of-the-box. Since you are not using one of them, you"
+ ewarn "have to configure your webserver accordingly yourself."
+ fi
+ fowners -R root:root /usr/$(get_libdir)/icinga
+ cd "${D}"
+ find usr/$(get_libdir)/icinga -type d -exec fperms 755 {} +
+ find usr/$(get_libdir)/icinga/cgi-bin -type f -exec fperms 755 {} +
+ fi
+
+ if use eventhandler ; then
+ dodir /etc/icinga/eventhandlers
+ fowners icinga:icinga /etc/icinga/eventhandlers
+ fi
+
+ keepdir /etc/icinga
+ keepdir /var/lib/icinga
+ keepdir /var/lib/icinga/archives
+ keepdir /var/lib/icinga/rw
+ keepdir /var/lib/icinga/spool/checkresults
+
+ if use apache2 ; then
+ webserver=apache
+ elif use lighttpd ; then
+ webserver=lighttpd
+ else
+ webserver=icinga
+ fi
+
+ fowners icinga:icinga /var/lib/icinga
+ fowners -R icinga:${webserver} /var/lib/icinga/rw
+
+ fperms 6755 /var/lib/icinga/rw
+
+ # ensure ownership
+ fowners -R root:root /etc/icinga
+ fperms 0750 /etc/icinga
+ fowners -R root:root /usr/sbin
+ fowners -R root:root /usr/$(get_libdir)
+ fowners -R root:root /usr/share/icinga/htdocs
+
+ # paxmarks
+ if use idoutils ; then
+ pax-mark m usr/sbin/ido2db
+ fi
+}
+
+pkg_postinst() {
+ if use web ; then
+ elog "This does not include cgis that are perl-dependent"
+ elog "Currently traceroute.cgi is perl-dependent"
+ elog "Note that the user your webserver is running as needs"
+ elog "read-access to /etc/icinga."
+ elog
+ if use apache2 || use lighttpd ; then
+ elog "There are several possible solutions to accomplish this,"
+ elog "choose the one you are most comfortable with:"
+ elog
+ if use apache2 ; then
+ elog " usermod -G icinga apache"
+ elog "or"
+ elog " chown icinga:apache /etc/icinga"
+ elog
+ elog "Also edit /etc/conf.d/apache2 and add a line like"
+ elog "APACHE2_OPTS=\"\$APACHE2_OPTS -D ICINGA\""
+ elog
+ elog "Icinga web service needs user authentication. If you"
+ elog "use the base configuration, you need a password file"
+ elog "with a password for user \"icingaadmin\""
+ elog "You can create this file by executing:"
+ elog "htpasswd -c /etc/icinga/htpasswd.users icingaadmin"
+ elog
+ elog "you may want to also add apache to the icinga group"
+ elog "to allow it access to the AuthUserFile"
+ elog
+ elif use lighttpd ; then
+ elog " usermod -G icinga lighttpd "
+ elog "or"
+ elog " chown icinga:lighttpd /etc/icinga"
+ elog "Also edit /etc/lighttpd/lighttpd.conf and add 'include \"lighttpd_icinga.conf\"'"
+ fi
+ elog
+ elog "That will make icinga's web front end visable via"
+ elog "http://localhost/icinga/"
+ elog
+ else
+ elog "IMPORTANT: Do not forget to add the user your webserver"
+ elog "is running as to the icinga group!"
+ fi
+ else
+ ewarn "Please note that you have installed Icinga without web interface."
+ ewarn "Please don't file any bugs about having no web interface when you do this."
+ ewarn "Thank you!"
+ fi
+ elog
+ elog "If you want icinga to start at boot time"
+ elog "remember to execute:"
+ elog " rc-update add icinga default"
+ elog
+ elog "If your kernel has /proc protection, icinga"
+ elog "will not be happy as it relies on accessing the proc"
+ elog "filesystem. You can fix this by adding icinga into"
+ elog "the group wheel, but this is not recomended."
+ elog
+ if [ -d "${ROOT}"/var/icinga ] ; then
+ ewarn
+ ewarn "/var/icinga was moved to /var/lib/icinga"
+ ewarn "please move the files if this was an upgrade"
+ if use idoutils ; then
+ ewarn "and edit /etc/ido2db.cfg to change the location of the files"
+ ewarn "it accesses"
+ ewarn "update your db with the scripts under the directory"
+ ewarn "/usr/share/icinga/contrib/db/"
+ fi
+ ewarn
+ ewarn "The \"mv /var/icinga /var/lib/\" command works well to move the files"
+ ewarn "remove /var/icinga afterwards to make this warning disappear"
+ fi
+}