- sandbox macro is always defined

[packages/openssh.git] / openssh.spec

diff --git a/openssh.spec b/openssh.spec
index 57246dd26c3b850fbe39f09efd297fdd3142e9a6..8f80222b1239ad4ca0e00637b0f87a2295b1a46e 100644 (file)
--- a/openssh.spec
+++ b/openssh.spec
@@ -11,12 +11,17 @@
 %bcond_without libedit         # without libedit (editline/history support in sftp client)
 %bcond_without kerberos5       # without kerberos5 support
 %bcond_without selinux         # build without SELinux support
+%bcond_without libseccomp      # use libseccomp for seccomp privsep (requires 3.5 kernel)
 %bcond_with    hpn             # High Performance SSH/SCP - HPN-SSH including Cipher NONE (broken too often)
 %bcond_without tests
 
 # gtk2-based gnome-askpass means no gnome1-based
 %{?with_gtk:%undefine with_gnome}
 
+%if "%{pld_release}" != "ac"
+%define        sandbox %{?with_libseccomp:lib}seccomp_filter
+%endif
+
 %if "%{pld_release}" == "ac"
 %define                pam_ver 0.79.0
 %else
@@ -34,7 +39,7 @@ Summary(ru.UTF-8):    OpenSSH - свободная реализация прото
 Summary(uk.UTF-8):     OpenSSH - вільна реалізація протоколу Secure Shell (SSH)
 Name:          openssh
 Version:       6.8p1
-Release:       3
+Release:       6
 Epoch:         2
 License:       BSD
 Group:         Applications/Networking
@@ -48,7 +53,6 @@ Source4:      %{name}.sysconfig
 Source5:       ssh-agent.sh
 Source6:       ssh-agent.conf
 Source7:       %{name}-lpk.schema
-Source8:       %{name}d.upstart
 Source9:       sshd.service
 Source10:      sshd-keygen
 Source11:      sshd.socket
@@ -89,12 +93,14 @@ BuildRequires:      pam-devel
 BuildRequires: rpm >= 4.4.9-56
 BuildRequires: rpmbuild(macros) >= 1.627
 BuildRequires: sed >= 4.0
-# libseccomp based sandbox requires NO_NEW_PRIVS prctl flag
-%{?with_tests:BuildRequires:   uname(release) >= 3.5}
 BuildRequires: zlib-devel >= 1.2.3
 %if %{with tests} && 0%(id -u sshd >/dev/null 2>&1; echo $?)
 BuildRequires: %{name}-server
 %endif
+%if %{with tests} && %{with libseccomp}
+# libseccomp based sandbox requires NO_NEW_PRIVS prctl flag
+BuildRequires: uname(release) >= 3.5
+%endif
 Requires:      zlib >= 1.2.3
 %if "%{pld_release}" == "ac"
 Requires:      filesystem >= 2.0-1
@@ -104,6 +110,7 @@ Requires:   filesystem >= 3.0-11
 Requires:      pam >= %{pam_ver}
 Suggests:      xorg-app-xauth
 %endif
+%{?with_libseccomp:Requires:   uname(release) >= 3.5}
 Obsoletes:     ssh
 BuildRoot:     %{tmpdir}/%{name}-%{version}-root-%(id -u -n)
 
@@ -437,20 +444,6 @@ among the servers in the network.
 Backend LDAP dla OpenSSH to metoda rozprowadzania autoryzowanych
 tokenów między serwerami w sieci.
 
-%package server-upstart
-Summary:       Upstart job description for OpenSSH server
-Summary(pl.UTF-8):     Opis zadania Upstart dla serwera OpenSSH
-Group:         Daemons
-Requires:      %{name}-server = %{epoch}:%{version}-%{release}
-Requires:      upstart >= 0.6
-Conflicts:     syslog-ng < 3.2.4-1
-
-%description server-upstart
-Upstart job description for OpenSSH.
-
-%description server-upstart -l pl.UTF-8
-Opis zadania Upstart dla OpenSSH.
-
 %package gnome-askpass
 Summary:       OpenSSH GNOME passphrase dialog
 Summary(de.UTF-8):     OpenSSH GNOME Passwort-Dialog
@@ -545,7 +538,7 @@ openldap-a.
 
 %patch14 -p1
 %{!?with_ldap:%patch15 -p1}
-%patch16 -p1
+%{?with_libseccomp:%patch16 -p1}
 
 %if "%{pld_release}" == "ac"
 # fix for missing x11.pc
@@ -558,6 +551,9 @@ sed -i -e 's#-lssh -lopenbsd-compat#-lssh -lopenbsd-compat -lssh#g' Makefile*
 grep -rl /usr/libexec/openssh/ssh-ldap-helper . | xargs \
 %{__sed} -i -e 's,/usr/libexec/openssh/ssh-ldap-helper,%{_libexecdir}/ssh-ldap-helper,'
 
+# prevent being ovewritten by aclocal calls
+mv aclocal.m4 acinclude.m4
+
 %build
 cp /usr/share/automake/config.sub .
 %{__aclocal}
@@ -581,9 +577,7 @@ CPPFLAGS="%{rpmcppflags} -DCHROOT -std=gnu99"
        --with-pid-dir=%{_localstatedir}/run \
        --with-privsep-path=%{_privsepdir} \
        --with-privsep-user=sshd \
-%if "%{pld_release}" != "ac"
-       --with-sandbox=libseccomp_filter \
-%endif
+       --with-sandbox=%{sandbox} \
        %{?with_selinux:--with-selinux} \
 %if "%{pld_release}" == "ac"
        --with-xauth=/usr/X11R6/bin/xauth
@@ -609,7 +603,7 @@ cd contrib
 
 %install
 rm -rf $RPM_BUILD_ROOT
-install -d $RPM_BUILD_ROOT{%{_sysconfdir},/etc/{init,pam.d,rc.d/init.d,sysconfig,security,env.d}} \
+install -d $RPM_BUILD_ROOT{%{_sysconfdir},/etc/{pam.d,rc.d/init.d,sysconfig,security,env.d}} \
        $RPM_BUILD_ROOT{%{_libexecdir}/ssh,%{schemadir},%{systemdunitdir}}
 install -d $RPM_BUILD_ROOT/etc/{profile.d,X11/xinit/xinitrc.d}
 
@@ -625,7 +619,6 @@ cp -p %{SOURCE5} $RPM_BUILD_ROOT/etc/profile.d
 ln -sf /etc/profile.d/ssh-agent.sh $RPM_BUILD_ROOT/etc/X11/xinit/xinitrc.d/ssh-agent.sh
 cp -p %{SOURCE6} $RPM_BUILD_ROOT%{_sysconfdir}
 cp -p %{SOURCE7} $RPM_BUILD_ROOT%{schemadir}
-cp -p %{SOURCE8} $RPM_BUILD_ROOT/etc/init/sshd.conf
 
 cp -p %{SOURCE9} %{SOURCE11} %{SOURCE12} $RPM_BUILD_ROOT%{systemdunitdir}
 install -p %{SOURCE10} $RPM_BUILD_ROOT%{_libexecdir}/sshd-keygen
@@ -748,12 +741,6 @@ if [ -x /bin/systemd_booted ] && /bin/systemd_booted; then
 EOF
 fi
 
-%post server-upstart
-%upstart_post sshd
-
-%postun server-upstart
-%upstart_postun sshd
-
 %post -n openldap-schema-openssh-lpk
 %openldap_schema_register %{schemadir}/openssh-lpk.schema
 %service -q ldap restart
@@ -858,9 +845,3 @@ fi
 %defattr(644,root,root,755)
 %{schemadir}/openssh-lpk.schema
 %endif
-
-%if "%{pld_release}" != "ti"
-%files server-upstart
-%defattr(644,root,root,755)
-%config(noreplace) %verify(not md5 mtime size) /etc/init/sshd.conf
-%endif