OpenPKG Specs: freeradius/freeradius.spec@0ba300bdf30a (annotated)

freeradius/freeradius.spec@0ba300bdf30a (annotated)

freeradius/freeradius.spec

Mon, 20 Apr 2009 19:22:00 +0200

author: Michael Schloh von Bennewitz <michael@schloh.com>
date: Mon, 20 Apr 2009 19:22:00 +0200
changeset 178: 0ba300bdf30a
parent 47: 120a0b206db9
child 306: cc6a45887422
permissions: -rw-r--r--

Change unfortunate but partly useful overreaching security tradeoff.
The principle of allocating each running process an individual system
user and group can have security benefits, however maintining a plethora
of users, groups, processes, file modes, file permissions, and even
nonportable file ACLs on a host serving from a hundred processes has
some security disadvantages. This tradeoff is even worse for systems
like OpenPKG which benefit from administration transparency through the
use of minimal system intrusion and only three usage privilege levels.

 ##
 ##  freeradius.spec -- OpenPKG RPM Package Specification
 ##  Copyright (c) 2000-2008 OpenPKG Foundation e.V. <http://openpkg.net/>
 ##
 ##  Permission to use, copy, modify, and distribute this software for
 ##  any purpose with or without fee is hereby granted, provided that
 ##  the above copyright notice and this permission notice appear in all
 ##  copies.
 ##
 ##  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
 ##  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
 ##  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 ##  IN NO EVENT SHALL THE AUTHORS AND COPYRIGHT HOLDERS AND THEIR
 ##  CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 ##  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 ##  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
 ##  USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
 ##  ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 ##  OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
 ##  OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 ##  SUCH DAMAGE.
 ##
 #   FIXME: rse: default configuration is a little bit fat
 #   FIXME: rse: still not run-time tested
 #   package information
 Name:         freeradius
 Summary:      FreeRADIUS Server
 URL:          http://www.freeradius.org/
 Vendor:       The FreeRADIUS Server Project
 Packager:     OpenPKG Foundation e.V.
 Distribution: OpenPKG Community
 Class:        EVAL
 Group:        RADIUS
 License:      GPL
 Version:      2.1.3
 Release:      20090106
 #   package options
 %option       with_mysql     no
 %option       with_openldap  no
 %option       with_pgsql     no
 %option       with_snmp      no
 #   list of sources
 Source0:      ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-%{version}.tar.gz
 Source1:      rc.freeradius
 Patch0:       freeradius.patch
 #   build information
 Prefix:       %{l_prefix}
 BuildRoot:    %{l_buildroot}
 BuildPreReq:  OpenPKG, openpkg >= 20060823, make, gcc, libtool
 PreReq:       OpenPKG, openpkg >= 20060823
 BuildPreReq:  perl, openssl, gdbm, readline
 PreReq:       perl, openssl, gdbm, readline
 %if "%{with_mysql}" == "yes"
 BuildPreReq:  mysql, zlib
 PreReq:       mysql, zlib
 %endif
 %if "%{with_openldap}" == "yes"
 BuildPreReq:  openldap
 PreReq:       openldap
 %endif
 %if "%{with_pgsql}" == "yes"
 BuildPreReq:  postgresql
 PreReq:       postgresql
 %endif
 %if "%{with_snmp}" == "yes"
 BuildPreReq:  snmp
 PreReq:       snmp
 %endif
 AutoReq:      no
 AutoReqProv:  no
 %description
     FreeRADIUS is one of the most modular and featureful RADIUS servers
     available today. It has been written by a team of developers who
     have more than a decade of collective experience in implementing
     and deploying RADIUS software, in software engineering, and in Unix
     package management.
 %track
     prog freeradius = {
         version   = %{version}
         url       = ftp://ftp.freeradius.org/pub/freeradius/
         regex     = freeradius-server-(\d+\.\d+(\.\d+)*)\.tar\.gz
     }
 %prep
     %setup -q -n freeradius-server-%{version}
     %patch -p0
 %if "%{with_openldap}" == "yes"
     %{l_shtool} subst \
         -e 's;\(LIBS *=.*  *-lldap\);\1 -llber -lssl -lcrypto;' \
         src/modules/rlm_ldap/configure
 %endif
 %build
     #   configure package
     CC="%{l_cc}" \
     CFLAGS="-I`pwd`/src/include %{l_cflags -O} %{l_cppflags}" \
     CPPFLAGS="%{l_cppflags}" \
     LDFLAGS="%{l_ldflags}" \
 %if "%{with_openldap}" == "yes"
     LIBS="-llber -lssl -lcrypto -lreadline" \
 %endif
     ./configure \
         --prefix=%{l_prefix} \
         --libdir=%{l_prefix}/lib/freeradius \
         --mandir=%{l_prefix}/man \
         --localstatedir=%{l_prefix}/var/freeradius \
         --datadir=%{l_prefix}/share/freeradius \
         --sysconfdir=%{l_prefix}/etc \
         --with-system-libtool \
         --disable-shared \
         --enable-static \
         --with-logdir=%{l_prefix}/var/freeradius \
         --with-radacctdir=%{l_prefix}/var/freeradius \
         --with-raddbdir=%{l_prefix}/etc/freeradius \
         --without-threads \
         --with-openssl-includes=%{l_prefix}/include/openssl \
         --with-openssl-libraries=%{l_prefix}/lib/ \
         --with-rlm_perl \
 %if "%{with_mysql}" == "yes" || "%{with_pgsql}" == "yes"
         --with-rlm_sql \
         --with-rlm_sqlippool \
 %else
         --without-rlm_sql \
         --without-rlm_sqlippool \
 %endif
 %if "%{with_mysql}" == "yes"
         --with-rlm_sql_mysql \
 %else
         --without-rlm_sql_mysql \
 %endif
 %if "%{with_pgsql}" == "yes"
         --with-rlm_sql_postgresql \
 %else
         --without-rlm_sql_postgresql \
 %endif
         --without-rlm_sql_db2 \
         --without-rlm_sql_firebird \
         --without-rlm_sql_freetds \
         --without-rlm_sql_iodbc \
         --without-rlm_sql_oracle \
         --without-rlm_sql_sybase \
         --without-rlm_sql_unixodbc \
 %if "%{with_openldap}" == "yes"
         --with-rlm-ldap-include-dir=%{l_prefix}/include/ \
         --with-rlm-ldap-lib-dir=%{l_prefix}/lib/ \
 %else
         --without-rlm-ldap \
 %endif
         --without-rlm_eap_ikev2 \
         --without-rlm_eap_sim \
         --without-rlm_eap_tls \
         --without-rlm_eap_peap \
         --without-rlm_eap_ttls \
         --without-rlm_eap_tnc \
         --without-rlm_krb5 \
         --without-rlm_dbm \
         --without-rlm_otp \
         --without-rlm_pam \
         --without-rlm_python \
 %if "%{with_snmp}" == "yes"
         --with-snmp \
 %else
         --without-snmp \
 %endif
         --enable-strict-dependencies \
         --with-ltdl-lib=%{l_prefix}/lib \
         --with-ltdl-include=%{l_prefix}/include \
         --disable-ltdl-install
     #   build package
     %{l_make} %{l_mflags}
 %install
     #   install package
     rm -rf $RPM_BUILD_ROOT
     %{l_shtool} mkdir -f -p -m 755 \
         $RPM_BUILD_ROOT%{l_prefix}/lib/freeradius
     %{l_make} %{l_mflags} install \
         R=$RPM_BUILD_ROOT
     #   strip down installation
     strip  $RPM_BUILD_ROOT%{l_prefix}/bin/* >/dev/null 2>&1 || true
     rm -rf $RPM_BUILD_ROOT%{l_prefix}/etc/freeradius/certs
     rm -f  $RPM_BUILD_ROOT%{l_prefix}/etc/freeradius/*.sample
     rm -rf $RPM_BUILD_ROOT%{l_prefix}/share/freeradius/doc
     rm -f  $RPM_BUILD_ROOT%{l_prefix}/sbin/rc.radiusd
     rm -f  $RPM_BUILD_ROOT%{l_prefix}/lib/freeradius/*%{version}*
     rm -f  $RPM_BUILD_ROOT%{l_prefix}/lib/freeradius/rlm_*
     #   adjust default configuration
     %{l_shtool} subst \
         -e 's;^#user = nobody;user = %{l_rusr};' \
         -e 's;^#group = nobody;group = %{l_rgrp};' \
         $RPM_BUILD_ROOT%{l_prefix}/etc/freeradius/radiusd.conf
     #   install run-command script
     %{l_shtool} mkdir -f -p -m 755 \
         $RPM_BUILD_ROOT%{l_prefix}/etc/rc.d
     %{l_shtool} install -c -m 755 %{l_value -s -a} \
         %{SOURCE rc.freeradius} $RPM_BUILD_ROOT%{l_prefix}/etc/rc.d/
     #   determine installation files
     %{l_rpmtool} files -v -ofiles -r$RPM_BUILD_ROOT \
         %{l_files_std} \
         '%config %{l_prefix}/etc/freeradius/*' \
         '%attr(755,%{l_rusr},%{l_rgrp}) %{l_prefix}/var/freeradius'
 %files -f files
 %clean
     rm -rf $RPM_BUILD_ROOT

OpenPKG Specs / annotate

freeradius/freeradius.spec@0ba300bdf30a (annotated)

freeradius/freeradius.spec