scm-commits March 2023

scm-commits@lists.fedoraproject.org

1 participants
36223 discussions

orion pushed to rpms/fail2ban (epel8). "Add Requires for selinux subpackage for EL 9."
by notifications＠fedoraproject.org 31 Mar '23

31 Mar '23

Notification time stamped 2023-03-31 22:34:04 UTC From e0082e942bbd887e00f95d4399033ebfab7cfbe7 Mon Sep 17 00:00:00 2001 From: Richard Shaw <hobbes1069(a)gmail.com> Date: Nov 04 2022 12:17:37 +0000 Subject: Add Requires for selinux subpackage for EL 9. --- diff --git a/fail2ban.spec b/fail2ban.spec index 8bada15..74e8a11 100644 --- a/fail2ban.spec +++ b/fail2ban.spec @@ -89,7 +89,7 @@ Requires(post): systemd Requires(preun): systemd Requires(postun): systemd -%if 0%{?fedora} +%if 0%{?fedora} || 0%{?rhel} >= 9 Requires: (%{name}-selinux if selinux-policy-%{selinuxtype}) %endif https://src.fedoraproject.org/rpms/fail2ban/c/e0082e942bbd887e00f95d4399033…

1 0

orion pushed to rpms/fail2ban (epel8). "Rename rpmlint configuration file."
by notifications＠fedoraproject.org 31 Mar '23

31 Mar '23

Notification time stamped 2023-03-31 22:34:03 UTC From 7c6041466e555fb07a3e1da12fb95925e49f7d76 Mon Sep 17 00:00:00 2001 From: Richard Shaw <hobbes1069(a)gmail.com> Date: Jun 28 2021 12:53:55 +0000 Subject: Rename rpmlint configuration file. --- diff --git a/.rpmlint b/.rpmlint deleted file mode 100644 index 05ddcce..0000000 --- a/.rpmlint +++ /dev/null @@ -1,8 +0,0 @@ -from Config import * -addFilter("incoherent-logrotate-file /etc/logrotate.d/fail2ban"); -addFilter("macro-in-comment %{(name|version|release)}"); -addFilter("spelling-error .* (tcp|sendmail|shorewall|sshd)"); -# Tests -addFilter("hidden-file-or-dir .*fail2ban/tests/files/config/apache.*/\.htpasswd"); -addFilter("htaccess-file-error .*fail2ban/tests/files/config/apache.*/\.htaccess"); -addFilter("zero-length .*fail2ban/tests/files/files/"); diff --git a/fail2ban.rpmlintrc b/fail2ban.rpmlintrc new file mode 100644 index 0000000..05ddcce --- /dev/null +++ b/fail2ban.rpmlintrc @@ -0,0 +1,8 @@ +from Config import * +addFilter("incoherent-logrotate-file /etc/logrotate.d/fail2ban"); +addFilter("macro-in-comment %{(name|version|release)}"); +addFilter("spelling-error .* (tcp|sendmail|shorewall|sshd)"); +# Tests +addFilter("hidden-file-or-dir .*fail2ban/tests/files/config/apache.*/\.htpasswd"); +addFilter("htaccess-file-error .*fail2ban/tests/files/config/apache.*/\.htaccess"); +addFilter("zero-length .*fail2ban/tests/files/files/"); https://src.fedoraproject.org/rpms/fail2ban/c/7c6041466e555fb07a3e1da12fb95…

1 0

orion pushed to rpms/fail2ban (epel8). "Merge branch 'rawhide' of ssh://pkgs.fedoraproject.org/rpms/fail2ban into rawhide"
by notifications＠fedoraproject.org 31 Mar '23

31 Mar '23

Notification time stamped 2023-03-31 22:34:03 UTC From 35fd77cd4da2c2bb363512e0413ec55a0b4e2136 Mon Sep 17 00:00:00 2001 From: Richard Shaw <hobbes1069(a)gmail.com> Date: Feb 08 2021 23:57:36 +0000 Subject: Merge branch 'rawhide' of ssh://pkgs.fedoraproject.org/rpms/fail2ban into rawhide --- diff --git a/fail2ban.spec b/fail2ban.spec index bb9e1f6..08b0c61 100644 --- a/fail2ban.spec +++ b/fail2ban.spec @@ -1,6 +1,6 @@ Name: fail2ban Version: 0.11.2 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Daemon to ban hosts that cause multiple authentication errors License: GPLv2+ @@ -397,6 +397,9 @@ fi %changelog +* Tue Jan 26 2021 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.11.2-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Wed Jan 06 2021 Richard Shaw <hobbes1069(a)gmail.com> - 0.11.2-2 - Add patch to deal with a new century in tests (2021). https://src.fedoraproject.org/rpms/fail2ban/c/35fd77cd4da2c2bb363512e0413ec…

1 0

orion pushed to rpms/fail2ban (epel8). "Rebuilt for Python 3.10"
by notifications＠fedoraproject.org 31 Mar '23

31 Mar '23

Notification time stamped 2023-03-31 22:34:03 UTC From 27db463db8e4aee76fd7a3db97a0f3dac28e9c3b Mon Sep 17 00:00:00 2001 From: Python Maint <python-maint(a)redhat.com> Date: Jun 07 2021 09:13:15 +0000 Subject: Rebuilt for Python 3.10 --- diff --git a/fail2ban.spec b/fail2ban.spec index 7c15cc2..4b5127d 100644 --- a/fail2ban.spec +++ b/fail2ban.spec @@ -1,6 +1,6 @@ Name: fail2ban Version: 0.11.2 -Release: 6%{?dist} +Release: 7%{?dist} Summary: Daemon to ban hosts that cause multiple authentication errors License: GPLv2+ @@ -397,6 +397,9 @@ fi %changelog +* Mon Jun 07 2021 Python Maint <python-maint(a)redhat.com> - 0.11.2-7 +- Rebuilt for Python 3.10 + * Sun Jun 06 2021 Richard Shaw <hobbes1069(a)gmail.com> - 0.11.2-6 - Update selinux policy for Fedora 34+ https://src.fedoraproject.org/rpms/fail2ban/c/27db463db8e4aee76fd7a3db97a0f…

1 0

orion pushed to rpms/fail2ban (epel8). "Fix selinux requires for EPEL7/8"
by notifications＠fedoraproject.org 31 Mar '23

31 Mar '23

Notification time stamped 2023-03-31 22:34:04 UTC From d94388bb16212d9063fdb4fcfc0ec3e05cfd8f6b Mon Sep 17 00:00:00 2001 From: Orion Poplawski <orion(a)nwra.com> Date: Mar 30 2023 00:17:35 +0000 Subject: Fix selinux requires for EPEL7/8 --- diff --git a/fail2ban.spec b/fail2ban.spec index 108f1c9..4814fb2 100644 --- a/fail2ban.spec +++ b/fail2ban.spec @@ -89,9 +89,10 @@ Requires: nftables Requires(post): systemd Requires(preun): systemd Requires(postun): systemd - -%if 0%{?fedora} || 0%{?rhel} >= 9 +%if 0%{?fedora} || 0%{?rhel} >= 8 Requires: (%{name}-selinux if selinux-policy-%{selinuxtype}) +%else +Requires: %{name}-selinux %endif %description server https://src.fedoraproject.org/rpms/fail2ban/c/d94388bb16212d9063fdb4fcfc0ec…

1 0

orion pushed to rpms/fail2ban (epel8). "Add bash completion file"
by notifications＠fedoraproject.org 31 Mar '23

31 Mar '23

Notification time stamped 2023-03-31 22:34:04 UTC From b4bdb39ec1b76bf18826d82d3a6fe86b1707a96f Mon Sep 17 00:00:00 2001 From: Paweł Marciniak <sunwire+git(a)gmail.com> Date: Aug 15 2022 11:58:10 +0000 Subject: Add bash completion file --- diff --git a/fail2ban.spec b/fail2ban.spec index d03608d..15154d5 100644 --- a/fail2ban.spec +++ b/fail2ban.spec @@ -48,6 +48,7 @@ BuildRequires: sqlite BuildRequires: systemd BuildRequires: selinux-policy-devel BuildRequires: make +BuildRequires: bash-completion # Default components Requires: %{name}-firewalld = %{version}-%{release} @@ -294,6 +295,10 @@ rm -r %{buildroot}%{_docdir}/%{name} install -d %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype} install -m 0644 %{modulename}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype} +#BASH completion +COMPLETIONDIR=%{buildroot}$(pkg-config --variable=completionsdir bash-completion) +%__mkdir_p $COMPLETIONDIR +%__install -p -m 644 files/bash-completion $COMPLETIONDIR/fail2ban %check %if 0%{?rhel} && 0%{?rhel} < 8 @@ -348,6 +353,7 @@ fi %exclude %{python3_sitelib}/fail2ban/tests %endif %{_unitdir}/fail2ban.service +%{_datadir}/bash-completion/ %{_mandir}/man1/fail2ban.1* %{_mandir}/man1/fail2ban-client.1* %{_mandir}/man1/fail2ban-python.1* https://src.fedoraproject.org/rpms/fail2ban/c/b4bdb39ec1b76bf18826d82d3a6fe…

1 0

orion pushed to rpms/fail2ban (epel8). "- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild (..more)"
by notifications＠fedoraproject.org 31 Mar '23

31 Mar '23

Notification time stamped 2023-03-31 22:34:03 UTC From 884fa781010739fe9e3098db5e1f2ad38d0d4fe4 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering <releng(a)fedoraproject.org> Date: Jan 26 2021 05:11:23 +0000 Subject: - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng(a)fedoraproject.org> --- diff --git a/fail2ban.spec b/fail2ban.spec index 1eb8397..082c6f3 100644 --- a/fail2ban.spec +++ b/fail2ban.spec @@ -1,6 +1,6 @@ Name: fail2ban Version: 0.11.2 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Daemon to ban hosts that cause multiple authentication errors License: GPLv2+ @@ -393,6 +393,9 @@ fi %changelog +* Tue Jan 26 2021 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.11.2-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Wed Jan 06 2021 Richard Shaw <hobbes1069(a)gmail.com> - 0.11.2-2 - Add patch to deal with a new century in tests (2021). https://src.fedoraproject.org/rpms/fail2ban/c/884fa781010739fe9e3098db5e1f2…

1 0

orion pushed to rpms/fail2ban (epel8). "Add patch for dovecot eating 100% CPU."
by notifications＠fedoraproject.org 31 Mar '23

31 Mar '23

Notification time stamped 2023-03-31 22:34:04 UTC From 97585e18cb8ac4eab074108bba221293ba3a2e9d Mon Sep 17 00:00:00 2001 From: Richard Shaw <hobbes1069(a)gmail.com> Date: Nov 02 2022 14:28:22 +0000 Subject: Add patch for dovecot eating 100% CPU. --- diff --git a/ca2b94c5229bd474f612b57b67d796252a4aab7a.patch b/ca2b94c5229bd474f612b57b67d796252a4aab7a.patch new file mode 100644 index 0000000..a00358f --- /dev/null +++ b/ca2b94c5229bd474f612b57b67d796252a4aab7a.patch @@ -0,0 +1,99 @@ +From ca2b94c5229bd474f612b57b67d796252a4aab7a Mon Sep 17 00:00:00 2001 +From: sebres <serg.brester(a)sebres.de> +Date: Tue, 4 Oct 2022 14:03:07 +0200 +Subject: [PATCH] fixes gh-3370: resolve extremely long search by repeated + apply of non-greedy RE `(?:: (?:[^$]+|\w+\([^$]*\))+)?` with following + branches (it may be extremely slow up to infinite search depending on + message); added new regression tests amend to gh-3210: fixes regression and + matches new format in aggressive mode too + +--- + ChangeLog | 4 ++++ + config/filter.d/dovecot.conf | 8 +++++--- + fail2ban/tests/files/logs/dovecot | 22 ++++++++++++++++++++++ + 3 files changed, 31 insertions(+), 3 deletions(-) + +diff --git a/ChangeLog b/ChangeLog +index fc4beade6e..04401ea866 100644 +--- a/ChangeLog ++++ b/ChangeLog +@@ -11,6 +11,10 @@ ver. 1.0.2-dev-1 (20??/??/??) - development nightly edition + ----------- + + ### Fixes ++* `filter.d/dovecot.conf`: ++ - fixes regression introduced in gh-3210: resolve extremely long search by repeated apply of non-greedy RE-part ++ with following branches (it may be extremely slow up to infinite search depending on message), gh-3370 ++ - fixes regression and matches new format in aggressive mode too (amend to gh-3210) + + ### New Features and Enhancements + +diff --git a/config/filter.d/dovecot.conf b/config/filter.d/dovecot.conf +index 0415ecb40a..dc3ebbcd42 100644 +--- a/config/filter.d/dovecot.conf ++++ b/config/filter.d/dovecot.conf +@@ -7,19 +7,21 @@ before = common.conf + + [Definition] + ++_daemon = (?:dovecot(?:-auth)?|auth) ++ + _auth_worker = (?:dovecot: )?auth(?:-worker)? + _auth_worker_info = (?:conn \w+:auth(?:-worker)? $[^$]+\): auth(?:-worker)?<\d+>: )? +-_daemon = (?:dovecot(?:-auth)?|auth) ++_bypass_reject_reason = (?:: (?:\w+$[^$:]*\) \w+|[^$]+))* + + prefregex = ^%(__prefix_line)s(?:%(_auth_worker)s(?:\([^$]+\))?: )?(?:%(__pam_auth)s(?:$dovecot:auth$)?: |(?:pop3|imap|managesieve|submission)-login: )?(?:Info: )?%(_auth_worker_info)s<F-CONTENT>.+</F-CONTENT>$ + + failregex = ^authentication failure; logname=<F-ALT_USER1>\S*</F-ALT_USER1> uid=\S* euid=\S* tty=dovecot ruser=<F-USER>\S*</F-USER> rhost=<HOST>(?:\s+user=<F-ALT_USER>\S*</F-ALT_USER>)?\s*$ +- ^(?:Aborted login|Disconnected|Remote closed connection|Client has quit the connection)(?:: (?:[^$]+|\w+\([^$]*\))+)? $(?:auth failed, \d+ attempts(?: in \d+ secs)?|tried to use (?:disabled|disallowed) \S+ auth|proxy dest auth failed)$:(?: user=<<F-USER>[^>]*</F-USER>>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$ ++ ^(?:Aborted login|Disconnected|Remote closed connection|Client has quit the connection)%(_bypass_reject_reason)s $(?:auth failed, \d+ attempts(?: in \d+ secs)?|tried to use (?:disabled|disallowed) \S+ auth|proxy dest auth failed)$:(?: user=<<F-USER>[^>]*</F-USER>>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$ + ^pam$\S+,<HOST>(?:,\S*)?$: pam_authenticate failed: (?:User not known to the underlying authentication module: \d+ Time$s$|Authentication failure $[Pp]assword mismatch\?$|Permission denied)\s*$ + ^[a-z\-]{3,15}$\S*,<HOST>(?:,\S*)?$: (?:[Uu]nknown user|[Ii]nvalid credentials|[Pp]assword mismatch) + <mdre-<mode>> + +-mdre-aggressive = ^(?:Aborted login|Disconnected|Remote closed connection|Client has quit the connection)(?::(?: [^ $]+)+)? \((?:no auth attempts|disconnected before auth was ready,|client didn't finish \S+ auth,)(?: (?:in|waited) \d+ secs)?$:(?: user=<[^>]*>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$ ++mdre-aggressive = ^(?:Aborted login|Disconnected|Remote closed connection|Client has quit the connection)%(_bypass_reject_reason)s $(?:no auth attempts|disconnected before auth was ready,|client didn't finish \S+ auth,)(?: (?:in|waited) \d+ secs)?$:(?: user=<[^>]*>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$ + + mdre-normal = + +diff --git a/fail2ban/tests/files/logs/dovecot b/fail2ban/tests/files/logs/dovecot +index 75934c37bb..0e33296129 100644 +--- a/fail2ban/tests/files/logs/dovecot ++++ b/fail2ban/tests/files/logs/dovecot +@@ -115,6 +115,17 @@ Aug 28 06:38:51 s166-62-100-187 dovecot: imap-login: Disconnected (auth failed, + # failJSON: { "time": "2004-08-28T06:38:52", "match": true , "host": "192.0.2.4", "desc": "open parenthesis in optional part between Disconnected and (auth failed ...), gh-3210" } + Aug 28 06:38:52 s166-62-100-187 dovecot: imap-login: Disconnected: Connection closed: read(size=1003) failed: Connection reset by peer (auth failed, 1 attempts in 0 secs): user=<test(a)example.com>, rip=192.0.2.4, lip=127.0.0.19, session=<Lsz0Oo7WXti3b7xe> + ++# failJSON: { "time": "2004-08-29T01:49:33", "match": false , "desc": "avoid slow RE, gh-3370" } ++Aug 29 01:49:33 server dovecot[459]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: read(size=1026) failed: Connection reset by peer ++# failJSON: { "time": "2004-08-29T01:49:33", "match": false , "desc": "avoid slow RE, gh-3370" } ++Aug 29 01:49:33 server dovecot[459]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number ++# failJSON: { "time": "2004-08-29T01:49:33", "match": false , "desc": "avoid slow RE, gh-3370" } ++Aug 29 01:49:33 server dovecot[459]: managesieve-login: Disconnected: Too many invalid commands. (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1 ++# failJSON: { "time": "2004-08-29T01:49:33", "match": false , "desc": "avoid slow RE, gh-3370" } ++Aug 29 01:49:33 server dovecot[459]: managesieve-login: Disconnected: Connection closed: read(size=1007) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1 ++# failJSON: { "time": "2004-08-29T01:49:33", "match": false , "desc": "avoid slow RE, gh-3370" } ++Aug 29 01:49:33 server dovecot[472]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol ++ + # failJSON: { "time": "2004-08-29T03:17:18", "match": true , "host": "192.0.2.133" } + Aug 29 03:17:18 server dovecot: submission-login: Client has quit the connection (auth failed, 1 attempts in 2 secs): user=<user1>, method=LOGIN, rip=192.0.2.133, lip=0.0.0.0 + # failJSON: { "time": "2004-08-29T03:53:52", "match": true , "host": "192.0.2.169" } +@@ -128,6 +139,17 @@ Aug 29 15:33:53 server dovecot: managesieve-login: Disconnected: Too many invali + + # filterOptions: [{"mode": "aggressive"}] + ++# failJSON: { "time": "2004-08-29T01:49:33", "match": true , "host": "192.0.2.5", "desc": "matches in aggressive mode, avoid slow RE, gh-3370" } ++Aug 29 01:49:33 server dovecot[459]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: read(size=1026) failed: Connection reset by peer ++# failJSON: { "time": "2004-08-29T01:49:33", "match": true , "host": "192.0.2.5", "desc": "matches in aggressive mode, avoid slow RE, gh-3370" } ++Aug 29 01:49:33 server dovecot[459]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number ++# failJSON: { "time": "2004-08-29T01:49:33", "match": true , "host": "192.0.2.5", "desc": "matches in aggressive mode, avoid slow RE, gh-3370" } ++Aug 29 01:49:33 server dovecot[459]: managesieve-login: Disconnected: Too many invalid commands. (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1 ++# failJSON: { "time": "2004-08-29T01:49:33", "match": true , "host": "192.0.2.5", "desc": "matches in aggressive mode, avoid slow RE, gh-3370" } ++Aug 29 01:49:33 server dovecot[459]: managesieve-login: Disconnected: Connection closed: read(size=1007) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1 ++# failJSON: { "time": "2004-08-29T01:49:33", "match": true , "host": "192.0.2.5", "desc": "matches in aggressive mode, avoid slow RE, gh-3370" } ++Aug 29 01:49:33 server dovecot[472]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol ++ + # failJSON: { "time": "2004-08-29T16:06:58", "match": true , "host": "192.0.2.5" } + Aug 29 16:06:58 s166-62-100-187 dovecot: imap-login: Disconnected (disconnected before auth was ready, waited 0 secs): user=<>, rip=192.0.2.5, lip=192.168.1.2, TLS handshaking: SSL_accept() syscall failed: Connection reset by peer + # failJSON: { "time": "2004-08-31T16:15:10", "match": true , "host": "192.0.2.6" } diff --git a/fail2ban.spec b/fail2ban.spec index ab21ecf..8bada15 100644 --- a/fail2ban.spec +++ b/fail2ban.spec @@ -1,6 +1,6 @@ Name: fail2ban Version: 1.0.1 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Daemon to ban hosts that cause multiple authentication errors License: GPLv2+ @@ -17,6 +17,8 @@ Source4: Makefile Patch0: fail2ban-partof.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2034205 Patch1: fail2ban-python311.patch +# Patch for dovecot jail eating 100% CPU +Patch2: https://github.com/fail2ban/fail2ban/commit/ca2b94c5229bd474f612b57b67d7962… BuildArch: noarch @@ -403,6 +405,9 @@ fi %changelog +* Wed Nov 02 2022 Richard Shaw <hobbes1069(a)gmail.com> - 1.0.1-2 +- Add patch for dovecot eating 100% CPU. + * Sun Oct 02 2022 Richard Shaw <hobbes1069(a)gmail.com> - 1.0.1-1 - Update to 1.0.1. https://src.fedoraproject.org/rpms/fail2ban/c/97585e18cb8ac4eab074108bba221…

1 0

orion pushed to rpms/fail2ban (epel8). "Back port selinux policy for EL8"
by notifications＠fedoraproject.org 31 Mar '23

31 Mar '23

Notification time stamped 2023-03-31 22:34:04 UTC From 5b326afa431c26d3ad384b9c02623bb8f69a0645 Mon Sep 17 00:00:00 2001 From: Orion Poplawski <orion(a)nwra.com> Date: Mar 30 2023 16:19:55 +0000 Subject: Back port selinux policy for EL8 --- diff --git a/fail2ban.te b/fail2ban.te index 6d36a70..c8009ad 100644 --- a/fail2ban.te +++ b/fail2ban.te @@ -99,18 +99,40 @@ logging_read_syslog_pid(fail2ban_t) logging_dontaudit_search_audit_logs(fail2ban_t) logging_mmap_generic_logs(fail2ban_t) logging_mmap_journal(fail2ban_t) +gen_require(` + type var_log_t, auditd_log_t; + class dir { watch }; + class file { watch }; +') allow fail2ban_t fail2ban_log_t:file watch; # Not in EL9 yet #logging_watch_audit_log_files(fail2ban_t) gen_require(` type var_log_t, auditd_log_t; ') -watch_files_pattern(fail2ban_t, auditd_log_t, auditd_log_t) +# Not in EL8 +#watch_files_pattern(fail2ban_t, auditd_log_t, auditd_log_t) +allow fail2ban_t auditd_log_t:dir search_dir_perms; +allow fail2ban_t auditd_log_t:file { getattr watch }; #logging_watch_audit_log_dirs(fail2ban_t) allow fail2ban_t var_log_t:dir search_dir_perms; -watch_dirs_pattern(fail2ban_t, auditd_log_t, auditd_log_t) -logging_watch_generic_log_dirs(fail2ban_t) -logging_watch_journal_dir(fail2ban_t) + +# Not in EL8 +#watch_dirs_pattern(fail2ban_t, auditd_log_t, auditd_log_t) +allow fail2ban_t auditd_log_t:dir search_dir_perms; +allow fail2ban_t auditd_log_t:dir { getattr watch }; + +# Not in EL8 +#logging_watch_generic_log_dirs(fail2ban_t) +files_search_var(fail2ban_t) +allow fail2ban_t var_log_t:dir { getattr watch }; + +# Not in EL8 +#logging_watch_journal_dir(fail2ban_t) +gen_require(` + type syslogd_var_run_t; +') +allow fail2ban_t syslogd_var_run_t:dir { getattr watch }; mta_send_mail(fail2ban_t) https://src.fedoraproject.org/rpms/fail2ban/c/5b326afa431c26d3ad384b9c02623…

1 0

orion pushed to rpms/fail2ban (epel8). "Rebuilt for updated systemd-rpm-macros (..more)"
by notifications＠fedoraproject.org 31 Mar '23

31 Mar '23

Notification time stamped 2023-03-31 22:34:03 UTC From 247ec56ab87626e43a79a6f56d20ff2f9bc3fd20 Mon Sep 17 00:00:00 2001 From: Zbigniew Jędrzejewski-Szmek <zbyszek(a)in.waw.pl> Date: Mar 02 2021 15:13:51 +0000 Subject: Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. --- diff --git a/fail2ban.spec b/fail2ban.spec index 08b0c61..5a069e4 100644 --- a/fail2ban.spec +++ b/fail2ban.spec @@ -1,6 +1,6 @@ Name: fail2ban Version: 0.11.2 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Daemon to ban hosts that cause multiple authentication errors License: GPLv2+ @@ -397,6 +397,10 @@ fi %changelog +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek(a)in.waw.pl> - 0.11.2-4 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + * Tue Jan 26 2021 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.11.2-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild https://src.fedoraproject.org/rpms/fail2ban/c/247ec56ab87626e43a79a6f56d20f…

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

scm-commits March 2023