source: trunk/server/fedora/specs/httpd.spec.patch @ 2321

Last change on this file since 2321 was 2321, checked in by geofft, 12 years ago
Disable SSL compression to defend against rumored side-channel attack
File size: 2.5 KB
RevLine 
[2246]1--- httpd.spec.~1~      2012-04-30 05:52:31.000000000 -0400
2+++ httpd.spec  2012-05-22 23:31:12.397142763 -0400
3@@ -9,7 +9,7 @@
[926]4 Summary: Apache HTTP Server
5 Name: httpd
[2153]6 Version: 2.2.22
[2246]7-Release: 4%{?dist}
8+Release: 4%{?dist}.scripts.%{scriptsversion}
[926]9 URL: http://httpd.apache.org/
[1738]10 Source0: http://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
[926]11 Source1: index.html
[2321]12@@ -58,6 +58,15 @@
[2246]13 Requires(postun): systemd-units
14 Requires(post): systemd-units
[1]15 
[2066]16+Provides: scripts-httpd = %{version}-%{release}
[1]17+Patch1000: httpd-suexec-scripts.patch
[795]18+Patch1003: httpd-2.2.x-mod_status-security.patch
[1035]19+Patch1004: httpd-2.2.x-304.patch
[1348]20+Patch1005: httpd-2.2.x-mod_ssl-sessioncaching.patch
[1356]21+Patch1006: httpd-suexec-cloexec.patch
[1602]22+Patch1007: httpd-fixup-vhost.patch
[2321]23+Patch1008: httpd-SSLCompression.patch
[1]24+
25 %description
26 The Apache HTTP Server is a powerful, efficient, and extensible
27 web server.
[2321]28@@ -68,6 +78,7 @@
[1607]29 Obsoletes: secureweb-devel, apache-devel, stronghold-apache-devel
30 Requires: apr-devel, apr-util-devel, pkgconfig
31 Requires: httpd = %{version}-%{release}
[2066]32+Provides: scripts-httpd-devel = %{version}-%{release}
[1607]33 
34 %description devel
35 The httpd-devel package contains the APXS binary and other files
[2321]36@@ -106,6 +117,7 @@
[2066]37 Requires(post): openssl, /bin/cat
[1499]38 Requires(pre): httpd
[2066]39 Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
[925]40+Provides: scripts-mod_ssl
41 Obsoletes: stronghold-mod_ssl
42 
43 %description -n mod_ssl
[2321]44@@ -133,6 +150,14 @@
[1]45 # Patch in vendor/release string
46 sed "s/@RELEASE@/%{vstring}/" < %{PATCH20} | patch -p1
47 
48+%patch1000 -p1 -b .scripts
[795]49+%patch1003 -p1 -b .permitstatus
[1035]50+%patch1004 -p1 -b .scripts-304
[1348]51+%patch1005 -p1 -b .ssl-sessioncache
[1356]52+%patch1006 -p1 -b .cloexec
[1602]53+%patch1007 -p1 -b .fixup-vhost
[2321]54+%patch1008 -p1 -b .sslcompression
[1]55+
56 # Safety check: prevent build if defined MMN does not equal upstream MMN.
57 vmmn=`echo MODULE_MAGIC_NUMBER_MAJOR | cpp -include include/ap_mmn.h | sed -n '/^2/p'`
58 if test "x${vmmn}" != "x%{mmn}"; then
[2321]59@@ -193,10 +219,12 @@
[684]60         --with-apr=%{_prefix} --with-apr-util=%{_prefix} \
61        --enable-suexec --with-suexec \
62        --with-suexec-caller=%{suexec_caller} \
63-       --with-suexec-docroot=%{contentdir} \
[1288]64+       --with-suexec-docroot=/ \
[684]65+       --with-suexec-userdir=web_scripts \
[824]66+       --with-suexec-trusteddir=/usr/libexec/scripts-trusted \
[684]67        --with-suexec-logfile=%{_localstatedir}/log/httpd/suexec.log \
68        --with-suexec-bin=%{_sbindir}/suexec \
69-       --with-suexec-uidmin=500 --with-suexec-gidmin=100 \
70+       --with-suexec-uidmin=50 --with-suexec-gidmin=50 \
71         --enable-pie \
72         --with-pcre \
73        $*
Note: See TracBrowser for help on using the repository browser.