CVS commit: pkgsrc/sysutils/cdrtools

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Wed Apr 24 09:40:38 UTC 2013

Modified Files:
        pkgsrc/sysutils/cdrtools: Makefile distinfo
Removed Files:
        pkgsrc/sysutils/cdrtools/patches: patch-include_schily_stat.h

Log Message:
Update to 3.01a14:

All:

-       Fixed a typo in include/schily/stat.h related to nanosecond
        handling for NetBSD and OpenBSD

-       New autoconf tests for sys/capability.h and cap_*() functions
        from Linux -lcap

        WARNING: If you do not see this:

                checking for cap_get_proc in -lcap... yes
                checking for cap_get_proc... yes
                checking for cap_set_proc... yes
                checking for cap_set_flag... yes
                checking for cap_clear_flag... yes

        your Linux installation is insecure in case you ever use the
        command "setcap" to set up file capabilities for executable commands.

        Note that cdrtools (as any other command) need to be capabylity aware
        in order to avoid security leaks with enhanced privileges. In most
        cases, privileges are only needed for a very limited set of operations.
        If cdrtools (cdrecord, cdda2wav, readcd) are installed suid-root, the
        functions to control privileges are in the basic set of supported
        functions and thus there is no problem for any program to control it's
        privileges - if they have been obtained via suid root, you are on a
        secure system.

        If you are however on an incomplete installation, that supports to
        raise privileges via fcaps but that does not include developer support
        for caps, the programs get the privileges without being able to know
        about the additional privileges and thus keep them because they cannot
        control them.

        WARNING: If you are on a Linux system that includes support for
        fcaps (this is seems to be true for all newer systems with
        Linux >= 2.6.24) and there is no development support for capabilities
        in the base system, you are on an inherently insecure system that allows
        to compile and set up programs with enhanced privileges that cannot
        control them.

        In such a case, try to educate the security manager for the related
        Linux distribution. Note that you may turn your private installation
        into a secure installation by installing development support for libcap.

-       The autofconf tests for broken Linux kernel headers now avoid to
        warn for /usr/src/linux/include if this directory is missing.

-       include/schily/priv.h now includes sys/capabilitiy.h if available.

Libscg:

-       Trying to support suid-root-less installation of librscg users on Linux.
        librscg now understands that a non-root program may be able to
        create sockets for a privileged port.

Cdrecord:

-       Trying to support suid-root-less installation of cdrecord on Linux.
        NOTE: You need "file caps" support built into your Linux installation.

        Call:

                setcap 
cap_sys_resource,cap_dac_override,cap_sys_admin,cap_sys_nice,cap_net_bind_service,cap_ipc_lock,cap_sys_rawio+ep
 /opt/schily/bin/cdrecord
        To set up the capabilities on Linux.

Cdda2wav (Maintained/enhanced by J�rg Schilling, originated by Heiko Ei�feldt 
heiko%hexco.de@localhost):

-       Trying to support suid-root-less installation of cdda2wav on Linux.
        NOTE: You need "file caps" support built into your Linux installation.

        Call:

                setcap 
cap_dac_override,cap_sys_admin,cap_sys_nice,cap_net_bind_service,cap_sys_rawio+ep
 /opt/schily/bin/cdda2wav
        To set up the capabilities on Linux.

Readcd:

-       Trying to support suid-root-less installation of readcd on Linux.
        NOTE: You need "file caps" support built into your Linux installation.

        Call:

                setcap 
cap_dac_override,cap_sys_admin,cap_net_bind_service,cap_sys_rawio+ep 
/opt/schily/bin/readcd
        To set up the capabilities on Linux.

Scgcheck:

-       Link now against $(LIB_CAP) also as librscg needs it on Linux

Scgskeleton:

-       Link now against $(LIB_CAP) also as librscg needs it on Linux

Btcflash:

-       Link now against $(LIB_CAP) also as librscg needs it on Linux

Mkisofs (Maintained/enhanced by J�rg Schilling since 1997, originated by Eric 
Youngdale):

-       -new-dir-mode now just superseeds the effect of -dir-mode on
        directories that have been "invented" by mkisofs.
        This is a more intuitive behavior.

-       Link now against $(LIB_CAP) also as librscg needs it on Linux


To generate a diff of this commit:
cvs rdiff -u -r1.94 -r1.95 pkgsrc/sysutils/cdrtools/Makefile
cvs rdiff -u -r1.72 -r1.73 pkgsrc/sysutils/cdrtools/distinfo
cvs rdiff -u -r1.1 -r0 \
    pkgsrc/sysutils/cdrtools/patches/patch-include_schily_stat.h

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.