source: trunk/server/fedora/specs/httpd.spec.patch @ 2134

--- httpd.spec.orig     2011-09-13 09:43:36.000000000 -0400
+++ httpd.spec  2011-11-05 20:57:13.910145847 -0400
@@ -8,7 +8,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.2.21
-Release: 1%{?dist}
+Release: 1%{?dist}.scripts.%{scriptsversion}
 URL: http://httpd.apache.org/
 Source0: http://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -54,6 +54,18 @@
 Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmnisa}
 Requires: httpd-tools = %{version}-%{release}, apr-util-ldap, systemd-units
 
+Provides: scripts-httpd = %{version}-%{release}
+Patch1000: httpd-suexec-scripts.patch
+Patch1003: httpd-2.2.x-mod_status-security.patch
+Patch1004: httpd-2.2.x-304.patch
+Patch1005: httpd-2.2.x-mod_ssl-sessioncaching.patch
+Patch1006: httpd-suexec-cloexec.patch
+Patch1007: httpd-fixup-vhost.patch
+Patch1008: httpd-sysv-deps.patch
+Patch1009: httpd-2.2.x-CVE-2011-3607.patch
+Patch1010: httpd-2.2.x-CVE-2012-0053.patch
+Patch1011: httpd-2.2.x-CVE-2012-0031.patch
+
 %description
 The Apache HTTP Server is a powerful, efficient, and extensible
 web server.
@@ -64,6 +73,7 @@
 Obsoletes: secureweb-devel, apache-devel, stronghold-apache-devel
 Requires: apr-devel, apr-util-devel, pkgconfig
 Requires: httpd = %{version}-%{release}
+Provides: scripts-httpd-devel = %{version}-%{release}
 
 %description devel
 The httpd-devel package contains the APXS binary and other files
@@ -102,6 +112,7 @@
 Requires(post): openssl, /bin/cat
 Requires(pre): httpd
 Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
+Provides: scripts-mod_ssl
 Obsoletes: stronghold-mod_ssl
 
 %description -n mod_ssl
@@ -110,6 +121,11 @@
 Security (TLS) protocols.
 
 %prep
+
+# Horrible hack to patch the httpd.init file
+cd $RPM_SOURCE_DIR
+%patch1008 -p1 -b .sysv-deps
+
 %setup -q
 %patch1 -p1 -b .apctl
 %patch2 -p1 -b .apxs
@@ -128,6 +144,17 @@
 # Patch in vendor/release string
 sed "s/@RELEASE@/%{vstring}/" < %{PATCH20} | patch -p1
 
+%patch1000 -p1 -b .scripts
+%patch1003 -p1 -b .permitstatus
+%patch1004 -p1 -b .scripts-304
+%patch1005 -p1 -b .ssl-sessioncache
+%patch1006 -p1 -b .cloexec
+%patch1007 -p1 -b .fixup-vhost
+# Note that patch1008 is not here, as it patches the initscript elsewhere in this .spec
+%patch1009 -p4 -b .cve-2011-3607
+%patch1010 -p4 -b .cve-2012-0053
+%patch1011 -p4 -b .cve-2012-0031
+
 # Safety check: prevent build if defined MMN does not equal upstream MMN.
 vmmn=`echo MODULE_MAGIC_NUMBER_MAJOR | cpp -include include/ap_mmn.h | sed -n '/^2/p'`
 if test "x${vmmn}" != "x%{mmn}"; then
@@ -175,10 +198,12 @@
         --with-apr=%{_prefix} --with-apr-util=%{_prefix} \
        --enable-suexec --with-suexec \
        --with-suexec-caller=%{suexec_caller} \
-       --with-suexec-docroot=%{contentdir} \
+       --with-suexec-docroot=/ \
+       --with-suexec-userdir=web_scripts \
+       --with-suexec-trusteddir=/usr/libexec/scripts-trusted \
        --with-suexec-logfile=%{_localstatedir}/log/httpd/suexec.log \
        --with-suexec-bin=%{_sbindir}/suexec \
-       --with-suexec-uidmin=500 --with-suexec-gidmin=100 \
+       --with-suexec-uidmin=50 --with-suexec-gidmin=50 \
         --enable-pie \
         --with-pcre \
        $*