libqb/libqb.spec
yang_zhuang_zhuang a070a24bff Fix CVE-2019-12779
2021-02-08 15:25:35 +08:00

88 lines
2.5 KiB
RPMSpec

Name: libqb
Version: 1.0.3
Release: 7
Summary: High performance servers IPC library
Group: System Environment/Libraries
License: LGPLv2+
URL: https://github.com/ClusterLabs/libqb
Source0: https://github.com/ClusterLabs/libqb/releases/download/v%{version}/libqb-%{version}.tar.xz
Patch1: backport-ipc_shm-Don-t-truncate-SHM-files-of-an-active-server.patch
Patch2: backport-0001-CVE-2019-12779-ipc-use-O_EXCL-on-SHM-files-and-randomize-the-names.patch
Patch3: backport-0002-CVE-2019-12779-ipc-fixes.patch
Patch4: backport-0003-CVE-2019-12779-ipc-Use-mkdtemp-for-more-secure-IPC-files.patch
BuildRequires: autoconf automake libtool doxygen procps check-devel gcc
%description
The high-performance, reusable features of libqb are provided for client-server
architecture, such as logging, tracing, inter-process communication (IPC),
and polling.
%prep
%autosetup -n libqb-%{version} -p1
%build
./autogen.sh
%configure --disable-static
%make_build V=1
%if 0%{?with_check}
%check
make VERBOSE=1 check \
&& make -C tests/functional/log_internal VERBOSE=1 check
%endif
%install
%make_install
%delete_la
rm -rf $RPM_BUILD_ROOT/%{_docdir}/*
%post
/sbin/ldconfig
%postun
/sbin/ldconfig
%package devel
Summary: Development files for libqb
Requires: libqb = %{version}-%{release}
Requires: pkgconfig
%description devel
The libqb-devel package contains libraries and header files for
developing applications that use libqb.
%package help
Summary: help documents for libqb package
Buildarch: noarch
%description help
help documents for libqb package
%files
%doc README.markdown COPYING
%{_sbindir}/qb-blackbox
%{_libdir}/libqb.so.*
%files devel
%{_includedir}/qb/
%{_libdir}/libqb.so
%{_libdir}/pkgconfig/libqb.pc
%files help
%{_mandir}/man8/qb-blackbox.8*
%{_mandir}/man3/qb*3*
%changelog
* Tue Feb 8 2021 yangzhuangzhuang <yangzhuangzhuang1@huawei.com> - 1.0.3-7
- Fix CVE-2019-12779 libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack.
CVE Link: https://nvd.nist.gov/vuln/detail/CVE-2019-12779
Community Patch Link:
https://github.com/ClusterLabs/libqb/commit/e322e98dc264bc5911d6fe1d371e55ac9f95a71e
https://github.com/ClusterLabs/libqb/commit/7cd7b06d52ac80c343f362c7e39ef75495439dfc
https://github.com/ClusterLabs/libqb/commit/6a4067c1d1764d93d255eccecfd8bf9f43cb0b4d
* Tue Apr 27 2020 wangerfeng <wangerfeng5@huawei.com> - 1.0.3-6
- Package init