moved into main repo for pisi 2.0

2015-06-19 13:40:23 +03:00
parent 25736b05e8
commit 9378a7865f
18 changed files with 1468 additions and 0 deletions
@@ -0,0 +1,16 @@
+diff -up nss/coreconf/Linux.mk.relro nss/coreconf/Linux.mk
+--- nss/coreconf/Linux.mk.relro	2013-04-09 14:29:45.943228682 -0700
+++ nss/coreconf/Linux.mk	2013-04-09 14:31:26.194953927 -0700
+@@ -174,6 +174,12 @@ endif
+ endif
+ endif
+ 
+# harden DSOs/executables a bit against exploits
+ifeq (2.6,$(firstword $(sort 2.6 $(OS_RELEASE))))
+DSO_LDOPTS+=-Wl,-z,relro
+LDFLAGS	+= -Wl,-z,relro
+endif
+
+ USE_SYSTEM_ZLIB = 1
+ ZLIB_LIBS = -lz
+ 
@@ -0,0 +1,54 @@
+diff -up nss/cmd/httpserv/httpserv.c.539183 nss/cmd/httpserv/httpserv.c
+--- nss/cmd/httpserv/httpserv.c.539183	2013-05-28 14:43:24.000000000 -0700
+++ nss/cmd/httpserv/httpserv.c	2013-05-30 22:16:46.685373471 -0700
+@@ -661,14 +661,18 @@ getBoundListenSocket(unsigned short port
+     PRStatus	       prStatus;
+     PRNetAddr          addr;
+     PRSocketOptionData opt;
+    PRUint16           socketDomain = PR_AF_INET;
+ 
+-    addr.inet.family = PR_AF_INET;
+-    addr.inet.ip     = PR_INADDR_ANY;
+-    addr.inet.port   = PR_htons(port);
+    if (PR_SetNetAddr(PR_IpAddrAny, PR_AF_INET6, port, &addr) != PR_SUCCESS) {
+	errExit("PR_SetNetAddr");
+    }
+ 
+-    listen_sock = PR_NewTCPSocket();
+    if (PR_GetEnv("NSS_USE_SDP")) {
+        socketDomain = PR_AF_INET_SDP;
+    }
+    listen_sock = PR_OpenTCPSocket(PR_AF_INET6);
+     if (listen_sock == NULL) {
+-	errExit("PR_NewTCPSocket");
+	errExit("PR_OpenTCPSocket error");
+     }
+ 
+     opt.option = PR_SockOpt_Nonblocking;
+diff -up nss/cmd/selfserv/selfserv.c.539183 nss/cmd/selfserv/selfserv.c
+--- nss/cmd/selfserv/selfserv.c.539183	2013-05-28 14:43:24.000000000 -0700
+++ nss/cmd/selfserv/selfserv.c	2013-05-30 22:16:46.688373495 -0700
+@@ -1687,14 +1687,18 @@ getBoundListenSocket(unsigned short port
+     PRStatus	       prStatus;
+     PRNetAddr          addr;
+     PRSocketOptionData opt;
+    PRUint16           socketDomain = PR_AF_INET;
+ 
+-    addr.inet.family = PR_AF_INET;
+-    addr.inet.ip     = PR_INADDR_ANY;
+-    addr.inet.port   = PR_htons(port);
+    if (PR_SetNetAddr(PR_IpAddrAny, PR_AF_INET6, port, &addr) != PR_SUCCESS) {
+	errExit("PR_SetNetAddr");
+    }
+ 
+-    listen_sock = PR_NewTCPSocket();
+    if (PR_GetEnv("NSS_USE_SDP")) {
+        socketDomain = PR_AF_INET_SDP;
+    }
+    listen_sock = PR_OpenTCPSocket(PR_AF_INET6);
+     if (listen_sock == NULL) {
+-	errExit("PR_NewTCPSocket");
+        errExit("PR_OpenTCPSocket error");
+     }
+ 
+     opt.option = PR_SockOpt_Nonblocking;
@@ -0,0 +1,34 @@
+diff -up nss/tests/dbtests/dbtests.sh.646045 nss/tests/dbtests/dbtests.sh
+--- nss/tests/dbtests/dbtests.sh.646045	2013-04-04 13:31:55.000000000 -0700
+++ nss/tests/dbtests/dbtests.sh	2013-04-04 15:57:46.298127149 -0700
+@@ -168,6 +168,9 @@ dbtest_main()
+         cat $RONLY_DIR/* > /dev/null
+     fi
+ 
+    # skipping the next two tests when user is root,
+    # otherwise they would fail due to rooty powers
+    if [[ $EUID -ne 0 ]] then
+     ${BINDIR}/dbtest -d $RONLY_DIR
+     ret=$?
+     if [ $ret -ne 46 ]; then
+@@ -175,6 +178,10 @@ dbtest_main()
+     else
+       html_passed "Dbtest r/w didn't work in an readonly dir $ret" 
+     fi
+    else
+      html_passed "Skipping Dbtest r/w in a readonly dir because user is root" 
+    fi
+    if [[ $EUID -ne 0 ]] then
+     ${BINDIR}/certutil -D -n "TestUser" -d .
+     ret=$?
+     if [ $ret -ne 255 ]; then
+@@ -182,6 +189,9 @@ dbtest_main()
+     else
+         html_passed "Certutil didn't work in an readonly dir $ret"
+     fi
+    else
+      html_passed "Skipping Certutil delete cert in an readonly directory test because user is root" 
+    fi
+     
+     Echo "test opening the database ronly in a readonly directory"
+