From d1d8adbfd346340c3784c72a9fa0868dde6ff736 Mon Sep 17 00:00:00 2001 From: V3n3RiX Date: Wed, 27 Jul 2022 15:01:59 +0100 Subject: gentoo auto-resync : 27:07:2022 - 15:01:59 --- www-servers/Manifest.gz | Bin 5030 -> 5026 bytes www-servers/apache/Manifest | 2 + www-servers/apache/apache-2.4.54-r6.ebuild | 259 +++++++++++++++++++++ .../apache/files/apache2.4-hardened.service | 25 ++ 4 files changed, 286 insertions(+) create mode 100644 www-servers/apache/apache-2.4.54-r6.ebuild create mode 100644 www-servers/apache/files/apache2.4-hardened.service (limited to 'www-servers') diff --git a/www-servers/Manifest.gz b/www-servers/Manifest.gz index a3a61da9e03e..0d2a660f4a11 100644 Binary files a/www-servers/Manifest.gz and b/www-servers/Manifest.gz differ diff --git a/www-servers/apache/Manifest b/www-servers/apache/Manifest index dd368b336f94..d06a6971fc09 100644 --- a/www-servers/apache/Manifest +++ b/www-servers/apache/Manifest @@ -3,10 +3,12 @@ AUX apache-2.4.54-libtool.patch 594 BLAKE2B b6bb19901e6eb69adebd8478af34abb544f4 AUX apache-2.4.54-no-which.patch 1807 BLAKE2B 27fbe5079f3844645c1e3fe237f47f5524ccb1c9a5532b8529091176ea0fc561c0888b74997acb98f4c86cacf8f138f065f248295c2a79779eb84f706173849a SHA512 830125dd90479972715a6b09bc0cef7bfe2c8ce7d198e52765e4284555cd60e400820a622530eb2bffa9b7aec9fd6bdb3f633b948075c68e9fd96a49a7eb41fd AUX apache.conf 94 BLAKE2B b0330849adfc5fc048622b3a256ecb727f3bfa339e6cc7f50843597d3e8d7b6d4463986d8f9a73f3580c93ce571d01f9ba571e0328356b62e5680ede913acc4b SHA512 e954c66da825fd6f84753cd7a50ae2da86daf5da27b37dba484019e8e1adaeb57122ba9a8fd1222e80edac04ca78d807265ef8b275278e4eeef12feb6043597b AUX apache2.2-hardened.service 970 BLAKE2B 77bf52cd0e5793aa81ad2b16267c1339e10fc4875704add053fd9ec67db60d2e175cb7a271c8d36b5e675a9cddd431062a6c31730510a921357b472383b502e4 SHA512 c206e7103d592dcf4f2d62979a20f7ab3cc7ce357ffe3c06ae8137064c812b9727e01a53fd602a0a55a64ed609664061de680ff42329381db787e2dae9310c48 +AUX apache2.4-hardened.service 933 BLAKE2B 60cbe1a55ded29299ba7fc453a6f13c456bc702ec77a31ede0904a52c9d726d57ec4d477df74d46e4edab157a2bf930750620c8d369a0b6900b049d9a4619a5c SHA512 711899777ea59995cecda007dca8d9ff6d0650b80990ea3b387f914e923df703e0c71ebaee5d967590c46fc5c588d35390d7c34023ef673c1791a60850efd0e8 DIST gentoo-apache-2.4.46-r6-20210212.tar.bz2 25854 BLAKE2B 001f16c1beac8c90fd407bb2f77417f886296baf02acf0f6d81dc0f10c209270db7005f58d845d309dec8332773556da88db41a57c6ecc86f24b8a5141ba07d0 SHA512 976dde952277542efca70831b67da32b8bf636a346adeeb6e0bc5a65b3543a7ca4fb182bc01204f747b583dd753607d184d91ef46a93d5e2f3ab55ed787860a2 DIST httpd-2.4.54.tar.bz2 7434530 BLAKE2B be2ba2d33368f9dd619e36e63dd3635fbcf55773a539ac2840251bda04311f3eb535c08a37ab58d8b184c71e75b90b92e2bdc4e59c722cfb146de516f6e1ed04 SHA512 228493b2ff32c4142c6e484d304f2ea12e467498605fe12adce2b61388d8efe7b2e96ae2fd0abd1dc88a5f12d625e007d8da0ae5628cff2a5272806754f41e18 EBUILD apache-2.4.54-r2.ebuild 7923 BLAKE2B 41b3e091d8b06f114aa9ccae5861b56a8d4b99f1a7077d8701fa9a31ccd76e266ab71aa7346789f78106590ab66e4ef92bd12c7b205da1e0216d38e14629d704 SHA512 e442300b4f4aa87045abecc13d4bbca90df27c75591e5d43a30df4135cdc2da2f4f756f6301f8d90a6556c5034e39c0cc1cefda7d4767029f9384b2c3ad9a02a EBUILD apache-2.4.54-r3.ebuild 8000 BLAKE2B 6c314bfffd06f463fb7920a7db83268a8709eb87bfe5fe11682d24de3ea7973538dd5b44e840a2cedd28971dc0abe57d03706dbb4b2d928d6ea25bc2d4d3d535 SHA512 9d1505706847510270b4a63b10b5ac90b8c61c626a7566a5d13f2bde18224c7784fe817cd0d2c90769c162011aaa91d40713a382b89b3a21384fd30df6504f99 EBUILD apache-2.4.54-r4.ebuild 8000 BLAKE2B 6c314bfffd06f463fb7920a7db83268a8709eb87bfe5fe11682d24de3ea7973538dd5b44e840a2cedd28971dc0abe57d03706dbb4b2d928d6ea25bc2d4d3d535 SHA512 9d1505706847510270b4a63b10b5ac90b8c61c626a7566a5d13f2bde18224c7784fe817cd0d2c90769c162011aaa91d40713a382b89b3a21384fd30df6504f99 EBUILD apache-2.4.54-r5.ebuild 8056 BLAKE2B e02d3a3348ed919bb8778931b813d5fa84c7a67714cff4c8499d0b77927f9b55f25449ab091a95e52fb6f6a988bd6e446c97039bd9b440e2dbd6e1c48ac8db1e SHA512 e47001ac3cb50ad41a8a02745751956aa13c68fa074726d48bb1e1ec4083ac180b26ada81edb4cf4f66c3e72a62ac6256217cd5cff17d2461d2ed69e3bb3636f +EBUILD apache-2.4.54-r6.ebuild 8056 BLAKE2B bafc6ca46ee95f7d3a20824e1b81e8b1dd42ddb648340f370c62f3d944d56cd4cddc9ca626e5bdb496f190becfc49f16918c75be33fd68a31c6f574b637305c0 SHA512 d580c2a6997dcfbd763f9d9a8f8ba2641752280480599a1ec9766f0cc88b8b51a946f1c4080a5ef3c5d1ae91505b1ca4aaaadbc07c02f0ee97f5ff2f76526983 MISC metadata.xml 901 BLAKE2B 126de8b6d9c924dc1bfedecc23b0ea5b5b3881b13cda7dd35d1ba04c30dabef619b2a57ac83e65695ce5e6e51b0f17c69cf752d6505c0d146dca8e2b7d90cbc6 SHA512 453b98f9ee9af6ebfc11d55e2218d1877a5a3f45fd969f6b3708f97216776c41deb651116826b15d744ea54fdd283497bc4f14917a9b00ae8b6e7af126441263 diff --git a/www-servers/apache/apache-2.4.54-r6.ebuild b/www-servers/apache/apache-2.4.54-r6.ebuild new file mode 100644 index 000000000000..ce4943cba61e --- /dev/null +++ b/www-servers/apache/apache-2.4.54-r6.ebuild @@ -0,0 +1,259 @@ +# Copyright 1999-2022 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 + +# latest gentoo apache files +GENTOO_PATCHSTAMP="20210212" +GENTOO_DEVELOPER="polynomial-c" +GENTOO_PATCHNAME="gentoo-apache-2.4.46-r6" + +# IUSE/USE_EXPAND magic +IUSE_MPMS_FORK="prefork" +IUSE_MPMS_THREAD="event worker" + +# << obsolete modules: +# authn_default authz_default mem_cache +# mem_cache is replaced by cache_disk +# ?? buggy modules +# proxy_scgi: startup error: undefined symbol "ap_proxy_release_connection", no fix found +# >> added modules for reason: +# compat: compatibility with 2.2 access control +# authz_host: new module for access control +# authn_core: functionality provided by authn_alias in previous versions +# authz_core: new module, provides core authorization capabilities +# cache_disk: replacement for mem_cache +# lbmethod_byrequests: Split off from mod_proxy_balancer in 2.3 +# lbmethod_bytraffic: Split off from mod_proxy_balancer in 2.3 +# lbmethod_bybusyness: Split off from mod_proxy_balancer in 2.3 +# lbmethod_heartbeat: Split off from mod_proxy_balancer in 2.3 +# slotmem_shm: Slot-based shared memory provider (for lbmethod_byrequests). +# socache_shmcb: shared object cache provider. Default config with ssl needs it +# unixd: fixes startup error: Invalid command 'User' +IUSE_MODULES="access_compat actions alias asis auth_basic auth_digest auth_form +authn_anon authn_core authn_dbd authn_dbm authn_file authn_socache authz_core +authz_dbd authz_dbm authz_groupfile authz_host authz_owner authz_user autoindex +brotli cache cache_disk cache_socache cern_meta charset_lite cgi cgid dav dav_fs dav_lock +dbd deflate dir dumpio env expires ext_filter file_cache filter headers http2 +ident imagemap include info lbmethod_byrequests lbmethod_bytraffic lbmethod_bybusyness +lbmethod_heartbeat log_config log_forensic logio lua macro md mime mime_magic negotiation +proxy proxy_ajp proxy_balancer proxy_connect proxy_ftp proxy_hcheck proxy_html proxy_http proxy_scgi +proxy_http2 proxy_fcgi proxy_uwsgi proxy_wstunnel rewrite ratelimit remoteip reqtimeout +session session_cookie session_crypto session_dbd setenvif slotmem_shm socache_memcache +socache_shmcb speling status substitute systemd unique_id userdir usertrack +unixd version vhost_alias watchdog xml2enc" +# The following are also in the source as of this version, but are not available +# for user selection: +# bucketeer case_filter case_filter_in echo http isapi optional_fn_export +# optional_fn_import optional_hook_export optional_hook_import + +# inter-module dependencies +# TODO: this may still be incomplete +MODULE_DEPENDS=" + auth_form:session + brotli:filter + dav_fs:dav + dav_lock:dav + deflate:filter + cache_disk:cache + ext_filter:filter + file_cache:cache + lbmethod_byrequests:proxy_balancer + lbmethod_byrequests:slotmem_shm + lbmethod_bytraffic:proxy_balancer + lbmethod_bybusyness:proxy_balancer + lbmethod_heartbeat:proxy_balancer + log_forensic:log_config + logio:log_config + cache_disk:cache + cache_socache:cache + md:watchdog + mime_magic:mime + proxy_ajp:proxy + proxy_balancer:proxy + proxy_balancer:slotmem_shm + proxy_connect:proxy + proxy_ftp:proxy + proxy_hcheck:proxy + proxy_hcheck:watchdog + proxy_html:proxy + proxy_html:xml2enc + proxy_http:proxy + proxy_http2:proxy + proxy_scgi:proxy + proxy_uwsgi:proxy + proxy_fcgi:proxy + proxy_wstunnel:proxy + session_cookie:session + session_dbd:dbd + session_dbd:session + socache_memcache:cache + substitute:filter +" + +# module<->define mappings +MODULE_DEFINES=" + auth_digest:AUTH_DIGEST + authnz_ldap:AUTHNZ_LDAP + cache:CACHE + cache_disk:CACHE + cache_socache:CACHE + dav:DAV + dav_fs:DAV + dav_lock:DAV + file_cache:CACHE + http2:HTTP2 + info:INFO + ldap:LDAP + lua:LUA + md:SSL + proxy:PROXY + proxy_ajp:PROXY + proxy_balancer:PROXY + proxy_connect:PROXY + proxy_ftp:PROXY + proxy_html:PROXY + proxy_http:PROXY + proxy_hcheck:PROXY + proxy_fcgi:PROXY + proxy_scgi:PROXY + proxy_wstunnel:PROXY + socache_shmcb:SSL + socache_memcache:CACHE + ssl:SSL + status:STATUS + suexec:SUEXEC + systemd:SYSTEMD + userdir:USERDIR +" + +# critical modules for the default config +MODULE_CRITICAL=" + authn_core + authz_core + authz_host + dir + mime + unixd +" +inherit apache-2 systemd tmpfiles toolchain-funcs + +DESCRIPTION="The Apache Web Server" +HOMEPAGE="https://httpd.apache.org/" + +# some helper scripts are Apache-1.1, thus both are here +LICENSE="Apache-2.0 Apache-1.1" +SLOT="2" +KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x64-macos ~sparc64-solaris ~x64-solaris" + +PATCHES=( + "${FILESDIR}"/${PN}-2.4.54-no-which.patch # bug #844868 + "${FILESDIR}"/${PN}-2.4.54-libtool.patch # bug #858836 +) + +pkg_setup() { + # dependend critical modules which are not allowed in global scope due + # to USE flag conditionals (bug #499260) + use ssl && MODULE_CRITICAL+=" socache_shmcb" + use doc && MODULE_CRITICAL+=" alias negotiation setenvif" + apache-2_pkg_setup +} + +src_configure() { + # Brain dead check. + tc-is-cross-compiler && export ap_cv_void_ptr_lt_long="no" + + apache-2_src_configure +} + +src_compile() { + if tc-is-cross-compiler ; then + # This header is the same across targets, so use the build compiler. + pushd server >/dev/null + emake gen_test_char + tc-export_build_env BUILD_CC + ${BUILD_CC} ${BUILD_CFLAGS} ${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} \ + gen_test_char.c -o gen_test_char $(apr-1-config --includes) || die + popd >/dev/null + fi + + default +} + +src_install() { + apache-2_src_install + local i + local apache_tools_prune_list=( + /usr/bin/{htdigest,logresolve,htpasswd,htdbm,ab,httxt2dbm} + /usr/sbin/{checkgid,fcgistarter,htcacheclean,rotatelogs} + /usr/share/man/man1/{logresolve.1,htdbm.1,htdigest.1,htpasswd.1,dbmmanage.1,ab.1} + /usr/share/man/man8/{rotatelogs.8,htcacheclean.8} + ) + for i in ${apache_tools_prune_list[@]} ; do + rm "${ED}"/${i} || die "Failed to prune apache-tools bits" + done + + # install apxs in /usr/bin (bug #502384) and put a symlink into the + # old location until all ebuilds and eclasses have been modified to + # use the new location. + dobin support/apxs + use split-usr && dosym ../bin/apxs /usr/sbin/apxs + + # Note: wait for mod_systemd to be included in some forthcoming release, + # Then apache2.4.service can be used and systemd support controlled + # through --enable-systemd + systemd_newunit "${FILESDIR}/apache2.4-hardened.service" "apache2.service" + dotmpfiles "${FILESDIR}/apache.conf" + #insinto /etc/apache2/modules.d + #doins "${FILESDIR}/00_systemd.conf" + + # Install http2 module config + insinto /etc/apache2/modules.d + doins "${FILESDIR}"/41_mod_http2.conf + + # Fix path to apache libdir + sed "s|@LIBDIR@|$(get_libdir)|" -i "${ED}"/usr/sbin/apache2ctl || die +} + +pkg_postinst() { + apache-2_pkg_postinst || die "apache-2_pkg_postinst failed" + + tmpfiles_process apache.conf #662544 + + # warnings that default config might not work out of the box + local mod cmod + for mod in ${MODULE_CRITICAL} ; do + if ! use "apache2_modules_${mod}"; then + echo + ewarn "Warning: Critical module not installed!" + ewarn "Modules 'authn_core', 'authz_core' and 'unixd'" + ewarn "are highly recomended but might not be in the base profile yet." + ewarn "Default config for ssl needs module 'socache_shmcb'." + ewarn "Enabling the following flags is highly recommended:" + for cmod in ${MODULE_CRITICAL} ; do + use "apache2_modules_${cmod}" || \ + ewarn "+ apache2_modules_${cmod}" + done + echo + break + fi + done + # warning for proxy_balancer and missing load balancing scheduler + if use apache2_modules_proxy_balancer; then + local lbset= + for mod in lbmethod_byrequests lbmethod_bytraffic lbmethod_bybusyness lbmethod_heartbeat; do + if use "apache2_modules_${mod}"; then + lbset=1 && break + fi + done + if [[ ! ${lbset} ]] ; then + echo + ewarn "Info: Missing load balancing scheduler algorithm module" + ewarn "(They were split off from proxy_balancer in 2.3)" + ewarn "In order to get the ability of load balancing, at least" + ewarn "one of these modules has to be present:" + ewarn "lbmethod_byrequests lbmethod_bytraffic lbmethod_bybusyness lbmethod_heartbeat" + echo + fi + fi +} diff --git a/www-servers/apache/files/apache2.4-hardened.service b/www-servers/apache/files/apache2.4-hardened.service new file mode 100644 index 000000000000..fe66567e1e80 --- /dev/null +++ b/www-servers/apache/files/apache2.4-hardened.service @@ -0,0 +1,25 @@ +[Unit] +Description=The Apache HTTP Server +After=network.target remote-fs.target nss-lookup.target + +[Service] +EnvironmentFile=/etc/conf.d/apache2 +ExecStart=/usr/sbin/apache2 $APACHE2_OPTS -DFOREGROUND +ExecReload=/usr/sbin/apache2 $APACHE2_OPTS -k graceful +ExecStop=/usr/sbin/apache2 $APACHE2_OPTS -k graceful-stop +# We want systemd to give httpd some time to finish gracefully, but still want +# it to kill httpd after TimeoutStopSec if something went wrong during the +# graceful stop. Normally, Systemd sends SIGTERM signal right after the +# ExecStop, which would kill httpd. We are sending useless SIGCONT here to give +# httpd time to finish. +KillSignal=SIGCONT +PrivateTmp=true +#Hardening +CapabilityBoundingSet=CAP_CHOWN CAP_SETGID CAP_SETUID CAP_DAC_OVERRIDE CAP_KILL CAP_NET_BIND_SERVICE CAP_IPC_LOCK +SecureBits=noroot-locked +ProtectSystem=full +PrivateDevices=true +MemoryDenyWriteExecute=true + +[Install] +WantedBy=multi-user.target -- cgit v1.2.3