OpenPKG Specs: arpwatch/arpwatch.patch@0ba300bdf30a (annotated)

arpwatch/arpwatch.patch@0ba300bdf30a (annotated)

arpwatch/arpwatch.patch

Mon, 20 Apr 2009 19:22:00 +0200

author: Michael Schloh von Bennewitz <michael@schloh.com>
date: Mon, 20 Apr 2009 19:22:00 +0200
changeset 178: 0ba300bdf30a
permissions: -rw-r--r--

Change unfortunate but partly useful overreaching security tradeoff.
The principle of allocating each running process an individual system
user and group can have security benefits, however maintining a plethora
of users, groups, processes, file modes, file permissions, and even
nonportable file ACLs on a host serving from a hundred processes has
some security disadvantages. This tradeoff is even worse for systems
like OpenPKG which benefit from administration transparency through the
use of minimal system intrusion and only three usage privilege levels.

 Index: configure
 --- configure.orig	2006-06-21 22:32:38.000000000 +0200
 +++ configure	2006-10-20 15:30:45.862899000 +0200
@@ -5259,11 +5259,7 @@
      echo "$as_me:$LINENO: result: $ac_cv_lbl_have_" >&5
  echo "${ECHO_T}$ac_cv_lbl_have_" >&6
      if test $ac_cv_lbl_have_ = no ; then
 -
 -cat >>confdefs.h <<\_ACEOF
 -#define
 -_ACEOF
 -
 +        :
      fi
  rm -f os-proto.h
 Index: Makefile.in
 --- Makefile.in.orig	2000-06-15 02:39:55.000000000 +0200
 +++ Makefile.in	2006-10-20 17:41:03.246914000 +0200
@@ -31,7 +31,7 @@
  # Pathname of directory to install the man page
  MANDEST = @mandir@
  # Pathname of directory to install database file
 -ARPDIR = $(prefix)/arpwatch
 +ARPDIR = @localstatedir@
  # VPATH
  srcdir = @srcdir@
@@ -42,16 +42,17 @@
  #
  CC = @CC@
 +CFLAGS = @CFLAGS@
 +CPPFLAGS = @CPPFLAGS@
 +
  PROG = arpwatch
  CCOPT = @V_CCOPT@
  INCLS = -I. @V_INCLS@
  DEFS = -DDEBUG @DEFS@ -DARPDIR=\"$(ARPDIR)\" -DPATH_SENDMAIL=\"$(SENDMAIL)\"
 -# Standard CFLAGS
 -CFLAGS = $(CCOPT) $(DEFS) $(INCLS)
 -
  # Standard LIBS
  LIBS = @LIBS@
 +LDFLAGS = @LDFLAGS@
  # Standard LIBS without libpcap.a
  SLIBS = @LBL_LIBS@
@@ -63,7 +64,7 @@
  # problem if you don't own the file but can write to the directory.
  .c.o:
  	@rm -f $@
 -	$(CC) $(CFLAGS) -c $(srcdir)/$*.c
 +	$(CC) $(CFLAGS) $(CPPFLAGS) $(DEFS) -c $(srcdir)/$*.c
  CSRC =	db.c dns.c ec.c file.c intoa.c machdep.c util.c report.c setsignal.c
  WSRC =	arpwatch.c
@@ -95,11 +96,11 @@
  arpwatch: $(WOBJ) @V_PCAPDEP@
  	@rm -f $@
 -	$(CC) $(CFLAGS) -o $@ $(WOBJ) $(LIBS)
 +	$(CC) $(CFLAGS) $(CPPFLAGS) $(DEFS) -o $@ $(WOBJ) $(LDFLAGS) $(LIBS)
  arpsnmp: $(SOBJ)
  	@rm -f $@
 -	$(CC) $(CFLAGS) -o $@ $(SOBJ) $(SLIBS)
 +	$(CC) $(CFLAGS) $(CPPFLAGS) $(DEFS) -o $@ $(SOBJ) $(LDFLAGS) $(SLIBS)
  version.o: version.c
  version.c: $(srcdir)/VERSION
@@ -107,18 +108,22 @@
  	sed -e 's/.*/char version[] = "&";/' $(srcdir)/VERSION > $@
  zap: zap.o intoa.o
 -	$(CC) $(CFLAGS) -o $@ zap.o intoa.o -lutil
 +	$(CC) $(CFLAGS) $(CPPFLAGS) $(DEFS) -o $@ zap.o intoa.o $(LDFLAGS) -lutil
  install: force
 -	$(INSTALL) -m 555 -o bin -g bin arpwatch $(DESTDIR)$(BINDEST)
 -	$(INSTALL) -m 555 -o bin -g bin arpsnmp $(DESTDIR)$(BINDEST)
 +	$(INSTALL) -s -m 555 arpwatch $(DESTDIR)$(BINDEST)
 +	$(INSTALL) -s -m 555 arpsnmp $(DESTDIR)$(BINDEST)
  install-man: force
 -	$(INSTALL) -m 444 -o bin -g bin $(srcdir)/arpwatch.8 \
 +	$(INSTALL) -m 644 $(srcdir)/arpwatch.8 \
  	    $(DESTDIR)$(MANDEST)/man8
 -	$(INSTALL) -m 444 -o bin -g bin $(srcdir)/arpsnmp.8 \
 +	$(INSTALL) -m 644 $(srcdir)/arpsnmp.8 \
  	    $(DESTDIR)$(MANDEST)/man8
 +install-data: force
 +	$(INSTALL) -m 444 $(srcdir)/ethercodes.dat \
 +	    $(DESTDIR)$(ARPDIR)
 +
  lint:	$(GENSRC) force
  	lint -hbxn $(SRC) | \
  	    grep -v 'struct/union .* never defined' | \
 Index: arpwatch.8
 --- arpwatch.8.orig	2006-10-20 16:13:53.268590000 +0200
 +++ arpwatch.8	2006-10-20 16:15:01.537612000 +0200
@@ -152,9 +152,8 @@
  .na
  .nh
  .nf
 -/usr/operator/arpwatch - default directory
 -arp.dat - ethernet/ip address database
 -ethercodes.dat - vendor ethernet block list
 +@l_prefix@/var/arpwatch/arp.dat - ethernet/ip address database
 +@l_prefix@/var/arpwatch/ethercodes.dat - vendor ethernet block list
  .ad
  .hy
  .fi
 Index: arpsnmp.8
 --- arpsnmp.8.orig	2006-10-20 16:14:50.412624000 +0200
 +++ arpsnmp.8	2006-10-20 16:14:59.301665000 +0200
@@ -69,9 +69,8 @@
  .na
  .nh
  .nf
 -/usr/operator/arpwatch - default directory
 -arp.dat - ethernet/ip address database
 -ethercodes.dat - vendor ethernet block list
 +@l_prefix@/var/arpwatch/arp.dat - ethernet/ip address database
 +@l_prefix@/var/arpwatch/ethercodes.dat - vendor ethernet block list
  .ad
  .hy
  .fi
 Index: arpwatch.h
 --- arpwatch.h.orig	2000-10-01 01:40:55.000000000 +0200
 +++ arpwatch.h	2006-10-21 07:41:55.629111000 +0200
@@ -8,6 +8,20 @@
  #define BCOPY(a, b, n) memmove((char *)b, (char *)a, n)
  #define MEMSET(s, c, n) memset((char *)s, c, n)
 +/* Repair unportable usage of u_int*_t declarations */
 +#ifndef u_int64_t
 +#define u_int64_t unsigned long long
 +#endif
 +#ifndef u_int32_t
 +#define u_int32_t unsigned int
 +#endif
 +#ifndef u_int16_t
 +#define u_int16_t unsigned short
 +#endif
 +#ifndef u_int6_t
 +#define u_int8_t unsigned char
 +#endif
 +
  char	*intoa(u_int32_t);
  #ifndef HAVE_BCOPY
 Index: arpwatch.c
 --- arpwatch.c.orig	2004-01-22 23:18:20.000000000 +0100
 +++ arpwatch.c	2006-10-20 19:28:25.417689000 +0200
@@ -234,8 +234,11 @@
  			if (pid < 0) {
  				syslog(LOG_ERR, "main fork(): %m");
  				exit(1);
 -			} else if (pid != 0)
 +			} else if (pid != 0) {
 +				printf("%d\n", pid);
 +				fflush(stdout);
  				exit(0);
 +			}
  			(void)close(fileno(stdin));
  			(void)close(fileno(stdout));
  			(void)close(fileno(stderr));
@@ -321,7 +324,6 @@
  	(void)setsignal(SIGINT, die);
  	(void)setsignal(SIGTERM, die);
 -	(void)setsignal(SIGHUP, die);
  	if (rfilename == NULL) {
  		(void)setsignal(SIGQUIT, checkpoint);
  		(void)setsignal(SIGALRM, checkpoint);
 Index: dns.c
 --- dns.c.orig	2006-10-20 19:06:40.704886000 +0200
 +++ dns.c	2006-10-20 19:20:09.611322000 +0200
@@ -137,7 +137,7 @@
  	return (0);
  }
 -/* Return the cannonical name of the host */
 +/* Return the canonical name of the host (NULL if not found) */
  char *
  gethname(u_int32_t a)
  {
@@ -150,18 +150,18 @@
  	hp = gethostbyaddr((char *)&a, sizeof(a), AF_INET);
  	_res.options = options;
  	if (hp == NULL)
 -		return (intoa(a));
 +		return NULL;
  	return (hp->h_name);
  }
 -/* Return the simple name of the host */
 +/* Return the simple name of the host (NULL if not found) */
  char *
  getsname(register u_int32_t a)
  {
  	register char *s, *cp;
  	s = gethname(a);
 -	if (!isdigit((int)*s)) {
 +	if (s != NULL) {
  		cp = strchr(s, '.');
  		if (cp != NULL)
  			*cp = '\0';

OpenPKG Specs / annotate

arpwatch/arpwatch.patch@0ba300bdf30a (annotated)

arpwatch/arpwatch.patch