!33 [sync] PR-32: update patching mode

From: @openeuler-sync-bot 
Reviewed-by: @gebidelidaye 
Signed-off-by: @gebidelidaye

0001-main-create-new-file-when-writing-pidfile.patch

@@ -0,0 +1,207 @@
+From f00fed20092b6a42283f29c6ee1f58244d74b545 Mon Sep 17 00:00:00 2001
+From: Miroslav Lichvar <mlichvar@redhat.com>
+Date: Thu, 6 Aug 2020 09:31:11 +0200
+Subject: [PATCH] main: create new file when writing pidfile
+
+When writing the pidfile, open the file with the O_CREAT|O_EXCL flags
+to avoid following a symlink and writing the PID to an unexpected file,
+when chronyd still has the root privileges.
+
+The Linux open(2) man page warns about O_EXCL not working as expected on
+NFS versions before 3 and Linux versions before 2.6. Saving pidfiles on
+a distributed filesystem like NFS is not generally expected, but if
+there is a reason to do that, these old kernel and NFS versions are not
+considered to be supported for saving files by chronyd.
+
+This is a minimal backport specific to this issue of the following
+commits:
+- commit 2fc8edacb810 ("use PATH_MAX")
+- commit f4c6a00b2a11 ("logging: call exit() in LOG_Message()")
+- commit 7a4c396bba8f ("util: add functions for common file operations")
+- commit e18903a6b563 ("switch to new util file functions")
+
+Reported-by: Matthias Gerstner <mgerstner@suse.de>
+---
+ logging.c |  1 +
+ main.c    | 10 ++-----
+ sysincl.h |  1 +
+ util.c    | 95 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ util.h    | 11 ++++++++
+ 5 files changed, 111 insertions(+), 7 deletions(-)
+
+diff --git a/logging.c b/logging.c
+index d2296e0..fd7f900 100644
+--- a/logging.c
++++ b/logging.c
+@@ -171,6 +171,7 @@ void LOG_Message(LOG_Severity severity,
+         system_log = 0;
+         log_message(1, severity, buf);
+       }
++      exit(1);
+       break;
+     default:
+       assert(0);
+diff --git a/main.c b/main.c
+index 6ccf32e..8edb2e1 100644
+--- a/main.c
++++ b/main.c
+@@ -281,13 +281,9 @@ write_pidfile(void)
+   if (!pidfile[0])
+     return;
+ 
+-  out = fopen(pidfile, "w");
+-  if (!out) {
+-    LOG_FATAL("Could not open %s : %s", pidfile, strerror(errno));
+-  } else {
+-    fprintf(out, "%d\n", (int)getpid());
+-    fclose(out);
+-  }
++  out = UTI_OpenFile(NULL, pidfile, NULL, 'W', 0644);
++  fprintf(out, "%d\n", (int)getpid());
++  fclose(out);
+ }
+ 
+ /* ================================================== */
+diff --git a/sysincl.h b/sysincl.h
+index 296c5e6..873a3bd 100644
+--- a/sysincl.h
++++ b/sysincl.h
+@@ -37,6 +37,7 @@
+ #include <glob.h>
+ #include <grp.h>
+ #include <inttypes.h>
++#include <limits.h>
+ #include <math.h>
+ #include <netinet/in.h>
+ #include <pwd.h>
+diff --git a/util.c b/util.c
+index e7e3442..83b3b20 100644
+--- a/util.c
++++ b/util.c
+@@ -1179,6 +1179,101 @@ UTI_CheckDirPermissions(const char *path, mode_t perm, uid_t uid, gid_t gid)
+ 
+ /* ================================================== */
+ 
++static int
++join_path(const char *basedir, const char *name, const char *suffix,
++          char *buffer, size_t length, LOG_Severity severity)
++{
++  const char *sep;
++
++  if (!basedir) {
++    basedir = "";
++    sep = "";
++  } else {
++    sep = "/";
++  }
++
++  if (!suffix)
++    suffix = "";
++
++  if (snprintf(buffer, length, "%s%s%s%s", basedir, sep, name, suffix) >= length) {
++    LOG(severity, "File path %s%s%s%s too long", basedir, sep, name, suffix);
++    return 0;
++  }
++
++  return 1;
++}
++
++/* ================================================== */
++
++FILE *
++UTI_OpenFile(const char *basedir, const char *name, const char *suffix,
++             char mode, mode_t perm)
++{
++  const char *file_mode;
++  char path[PATH_MAX];
++  LOG_Severity severity;
++  int fd, flags;
++  FILE *file;
++
++  severity = mode >= 'A' && mode <= 'Z' ? LOGS_FATAL : LOGS_ERR;
++
++  if (!join_path(basedir, name, suffix, path, sizeof (path), severity))
++    return NULL;
++
++  switch (mode) {
++    case 'r':
++    case 'R':
++      flags = O_RDONLY;
++      file_mode = "r";
++      if (severity != LOGS_FATAL)
++        severity = LOGS_DEBUG;
++      break;
++    case 'w':
++    case 'W':
++      flags = O_WRONLY | O_CREAT | O_EXCL;
++      file_mode = "w";
++      break;
++    case 'a':
++    case 'A':
++      flags = O_WRONLY | O_CREAT | O_APPEND;
++      file_mode = "a";
++      break;
++    default:
++      assert(0);
++      return NULL;
++  }
++
++try_again:
++  fd = open(path, flags, perm);
++  if (fd < 0) {
++    if (errno == EEXIST) {
++      if (unlink(path) < 0) {
++        LOG(severity, "Could not remove %s : %s", path, strerror(errno));
++        return NULL;
++      }
++      DEBUG_LOG("Removed %s", path);
++      goto try_again;
++    }
++    LOG(severity, "Could not open %s : %s", path, strerror(errno));
++    return NULL;
++  }
++
++  UTI_FdSetCloexec(fd);
++
++  file = fdopen(fd, file_mode);
++  if (!file) {
++    LOG(severity, "Could not open %s : %s", path, strerror(errno));
++    close(fd);
++    return NULL;
++  }
++
++  DEBUG_LOG("Opened %s fd=%d mode=%c", path, fd, mode);
++
++  return file;
++}
++
++/* ================================================== */
++
+ void
+ UTI_DropRoot(uid_t uid, gid_t gid)
+ {
+diff --git a/util.h b/util.h
+index e3d6767..a2481cc 100644
+--- a/util.h
++++ b/util.h
+@@ -176,6 +176,17 @@ extern int UTI_CreateDirAndParents(const char *path, mode_t mode, uid_t uid, gid
+    permissions and its uid/gid must match the specified values. */
+ extern int UTI_CheckDirPermissions(const char *path, mode_t perm, uid_t uid, gid_t gid);
+ 
++/* Open a file.  The full path of the file is constructed from the basedir
++   (may be NULL), '/' (if basedir is not NULL), name, and suffix (may be NULL).
++   Created files have specified permissions (umasked).  Returns NULL on error.
++   The following modes are supported (if the mode is an uppercase character,
++   errors are fatal):
++   r/R - open an existing file for reading
++   w/W - open a new file for writing (remove existing file)
++   a/A - open an existing file for appending (create if does not exist) */
++extern FILE *UTI_OpenFile(const char *basedir, const char *name, const char *suffix,
++                          char mode, mode_t perm);
++
+ /* Set process user/group IDs and drop supplementary groups */
+ extern void UTI_DropRoot(uid_t uid, gid_t gid);
+ 
+-- 
+1.8.3.1
+

chrony-packettest.patch

@@ -0,0 +1,25 @@
+commit 62d6aed6a64b887c9e3b7f03d9e0db1deaa2696a
+Author: Miroslav Lichvar <mlichvar@redhat.com>
+Date:   Tue Jun 18 15:41:50 2019 +0200
+
+    test: update processing of packet log
+    
+    Two new fields have been added to the packet log, which broke some
+    of the simulation tests.
+
+diff --git a/test/simulation/test.common b/test/simulation/test.common
+index 951a794b..8ed6ad9e 100644
+--- a/test/simulation/test.common
++++ b/test/simulation/test.common
+@@ -391,9 +391,9 @@ check_packet_port() {
+ 	for i in $(seq 1 $(get_chronyd_nodes)); do
+ 		test_message 3 0 "node $i:"
+ 
+-		grep -E -q "	$port	[0-9]+\$" tmp/log.packets && \
++		grep -E -q "^([0-9e.+-]+	){5}$port	" tmp/log.packets && \
+ 			! grep -E "^[0-9e.+-]+	$i	" tmp/log.packets | \
+-			grep -E -q -v "	$port	[0-9]+\$" && \
++			grep -E -q -v "^([0-9e.+-]+	){5}$port	" && \
+ 			test_ok || test_bad
+ 		[ $? -eq 0 ] || ret=1
+ 	done

chrony-service-helper.patch

@@ -1,8 +1,8 @@
-diff -up chrony-3.1/examples/chronyd.service.service-helper chrony-3.1/examples/chronyd.service
---- chrony-3.1/examples/chronyd.service.service-helper	2017-01-31 12:12:01.863772826 +0100
-+++ chrony-3.1/examples/chronyd.service	2017-01-31 12:12:30.371860064 +0100
-@@ -10,6 +10,7 @@ Type=forking
- PIDFile=/var/run/chrony/chronyd.pid
+diff -Nur chrony-3.5.bck/examples/chronyd.service chrony-3.5/examples/chronyd.service
+--- chrony-3.5.bck/examples/chronyd.service	2020-06-23 15:41:07.789042822 +0800
++++ chrony-3.5/examples/chronyd.service	2020-06-23 15:42:09.489819150 +0800
+@@ -10,6 +10,7 @@
+ PIDFile=/run/chrony/chronyd.pid
  EnvironmentFile=-/etc/sysconfig/chronyd
  ExecStart=/usr/sbin/chronyd $OPTIONS
 +ExecStartPost=/usr/libexec/chrony-helper update-daemon

chrony.spec

@@ -1,8 +1,8 @@
-%global clknetsim_ver 774308
+%global clknetsim_ver 79ffe4
 
 Name:      chrony
-Version:   3.4
-Release:   2
+Version:   3.5
+Release:   4
 Summary:   An NTP client/server
 License:   GPLv2
 URL:       https://chrony.tuxfamily.org
@@ -16,10 +16,11 @@ Source6:   https://github.com/mlichvar/clknetsim/archive/%{clknetsim_ver}/clknet
 
 #patch0 form fedora
 Patch0:    chrony-service-helper.patch
-
+Patch1:	   chrony-packettest.patch  
+Patch2:    0001-main-create-new-file-when-writing-pidfile.patch
 BuildRequires: gcc gcc-c++ bison systemd libcap-devel libedit-devel nettle-devel pps-tools-devel libseccomp-devel
 
-Requires:      shadow-utils systemd timedatex
+Requires:      shadow-utils systemd timedatex %{name}-help
 
 %description
 chrony is a versatile implementation of the Network Time Protocol (NTP).
@@ -28,20 +29,13 @@ It can synchronise the system clock with NTP servers, reference clocks
  also operate as an NTPv4 (RFC 5905) server and peer to provide a time
 service to other computers in the network.
 
-
-%package docs
-Summary:   Documentation files for chrony
-
-%description docs
-The chrony-docs package contains documentation files.
+%package_help
 
 %prep
-%autosetup -n %{name}-%{version} -p1
 
-%setup -q -n  %{name}-%{version} -a 6
+%autosetup -p1 -n  %{name}-%{version} -a 6
 mv clknetsim-%{clknetsim_ver}* test/simulation/clknetsim
 
-
 %build
 %configure \
         --enable-debug --enable-ntp-signd --enable-scfilter --docdir=%{_docdir} \
@@ -87,7 +81,7 @@ install -d $RPM_BUILD_ROOT%{_localstatedir}/log/chrony
 touch $RPM_BUILD_ROOT%{_localstatedir}/lib/chrony/{drift,rtc}
 
 %check
-%make_build -C test/simulation/clknetsim CLKNETSIM_RANDOM_SEED=16888
+%make_build -C test/simulation/clknetsim CLKNETSIM_RANDOM_SEED=24502
 make quickcheck
 
 
@@ -111,6 +105,7 @@ fi
 %systemd_postun_with_restart chronyd.service
 
 %files
+%defattr(-,root,root)
 %license COPYING
 
 %config(noreplace) %{_sysconfdir}/chrony.conf
@@ -133,11 +128,38 @@ fi
 %dir %attr(-,chrony,chrony) %{_localstatedir}/log/chrony
 
 
-%files docs
+%files help
 %defattr(644,root,root)
 %doc FAQ NEWS README
 %{_mandir}/man[158]/%{name}*.[158]*
 
 %changelog
-* Sat Sep 14 2019 hufeng <solar.hu@huawei.com> - 3.4.2
--Create chrony spec
+* Wed Dec 28 2022 chengyechun <chengyechun1@huawei.com> - 3.5-4
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC:update the patching mode
+
+* Mon Nov 09 2020 quanhongfei <quanhongfei@huawei.com> - 3.5-3
+- Type:requirement
+- ID:NA
+- SUG:NA
+- DESC:add chrony-help depenfency for chrony
+
+* Mon Sep 21 2020 yuboyun <yuboyun@huawei.com> - 3.5-2
+- Type:CVE
+- ID:CVE-2020-14367
+- SUG:NA
+- DESC:fix CVE-2020-14367
+
+* Thu Aug 13 2020 gaihuiying <gaihuiying1@huawei.com> - 3.5-1
+- Type:requirement
+- ID:NA
+- SUG:NA
+- DESC:update chrony to 3.5
+
+* Tue Dec 24 2019 openEuler Buildteam <buildteam@openeuler.org> - 3.4-3
+- rename docs subpackage as help subpackage
+
+* Sat Sep 14 2019 hufeng <solar.hu@huawei.com> - 3.4-2
+- Create chrony spec