public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/ejabberd] f45: Switch to polkit
@ 2026-09-23 19:07 Peter Lemenkov
0 siblings, 0 replies; only message in thread
From: Peter Lemenkov @ 2026-09-23 19:07 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/ejabberd
Branch : f45
Commit : 2309409d064d8187f3cc3e02e4c6dce9ee1d47b4
Author : Peter Lemenkov <lemenkov@gmail.com>
Date : 2013-09-16T18:51:14+04:00
Stats : +614/-586 in 14 file(s)
URL : https://src.fedoraproject.org/rpms/ejabberd/c/2309409d064d8187f3cc3e02e4c6dce9ee1d47b4?branch=f45
Log:
Switch to polkit
Signed-off-by: Peter Lemenkov <lemenkov@gmail.com>
---
diff --git a/ejabberd-0001-Fix-PAM-service-example-name-to-match-actual-one.patch b/ejabberd-0001-Fix-PAM-service-example-name-to-match-actual-one.patch
index 16c21c9..b3f929f 100644
--- a/ejabberd-0001-Fix-PAM-service-example-name-to-match-actual-one.patch
+++ b/ejabberd-0001-Fix-PAM-service-example-name-to-match-actual-one.patch
@@ -22,5 +22,5 @@ index a4068ad..9b24a4a 100644
%%
%% Authentication using LDAP
--
-1.8.2.1
+1.8.3.1
diff --git a/ejabberd-0002-Fixed-delays-in-s2s-connections.patch b/ejabberd-0002-Fixed-delays-in-s2s-connections.patch
index 33787e7..4533041 100644
--- a/ejabberd-0002-Fixed-delays-in-s2s-connections.patch
+++ b/ejabberd-0002-Fixed-delays-in-s2s-connections.patch
@@ -49,5 +49,5 @@ index 0dedb4c..9376d16 100644
end;
open_socket(closed, StateData) ->
--
-1.8.2.1
+1.8.3.1
diff --git a/ejabberd-0003-Introducing-mod_admin_extra.patch b/ejabberd-0003-Introducing-mod_admin_extra.patch
index a5f63f6..cac9b0a 100644
--- a/ejabberd-0003-Introducing-mod_admin_extra.patch
+++ b/ejabberd-0003-Introducing-mod_admin_extra.patch
@@ -1603,5 +1603,5 @@ index 0000000..1cef25a
+is_glob_match(String, Glob) ->
+ is_regexp_match(String, ejabberd_regexp:sh_to_awk(Glob)).
--
-1.8.2.1
+1.8.3.1
diff --git a/ejabberd-0004-Fedora-specific-changes-to-ejabberdctl.patch b/ejabberd-0004-Fedora-specific-changes-to-ejabberdctl.patch
index 590b843..6a3e5d2 100644
--- a/ejabberd-0004-Fedora-specific-changes-to-ejabberdctl.patch
+++ b/ejabberd-0004-Fedora-specific-changes-to-ejabberdctl.patch
@@ -44,5 +44,5 @@ index 461ec1a..b298e01 100644
done
if [ "$ID" -eq "$EJID" ] ; then
--
-1.8.2.1
+1.8.3.1
diff --git a/ejabberd-0005-Install-.so-objects-with-0755-permissions.patch b/ejabberd-0005-Install-.so-objects-with-0755-permissions.patch
index a26b721..354b1d3 100644
--- a/ejabberd-0005-Install-.so-objects-with-0755-permissions.patch
+++ b/ejabberd-0005-Install-.so-objects-with-0755-permissions.patch
@@ -22,5 +22,5 @@ index 42af5b2..64ed856 100644
# Translated strings
install -d $(MSGSDIR)
--
-1.8.2.1
+1.8.3.1
diff --git a/ejabberd-0006-Support-SASL-GSSAPI-authentication-thanks-to-Mikael-.patch b/ejabberd-0006-Support-SASL-GSSAPI-authentication-thanks-to-Mikael-.patch
new file mode 100644
index 0000000..30c5df1
--- /dev/null
+++ b/ejabberd-0006-Support-SASL-GSSAPI-authentication-thanks-to-Mikael-.patch
@@ -0,0 +1,505 @@
+From e49dbaca001a3d311a2f8a8e878c5b8b6fc385c0 Mon Sep 17 00:00:00 2001
+From: Badlop <badlop@process-one.net>
+Date: Thu, 15 Apr 2010 17:20:16 +0200
+Subject: [PATCH 6/8] Support SASL GSSAPI authentication (thanks to Mikael
+ Magnusson)(EJAB-831)
+
+---
+ src/cyrsasl.erl | 71 +++++++++++++++-----
+ src/cyrsasl.hrl | 15 +++++
+ src/cyrsasl_anonymous.erl | 6 +-
+ src/cyrsasl_digest.erl | 6 +-
+ src/cyrsasl_gssapi.erl | 166 ++++++++++++++++++++++++++++++++++++++++++++++
+ src/cyrsasl_plain.erl | 6 +-
+ src/cyrsasl_scram.erl | 5 +-
+ src/ejabberd_c2s.erl | 12 +++-
+ src/ejabberd_socket.erl | 19 ++++++
+ 9 files changed, 281 insertions(+), 25 deletions(-)
+ create mode 100644 src/cyrsasl.hrl
+ create mode 100644 src/cyrsasl_gssapi.erl
+
+diff --git a/src/cyrsasl.erl b/src/cyrsasl.erl
+index 9d1377f..802c679 100644
+--- a/src/cyrsasl.erl
++++ b/src/cyrsasl.erl
+@@ -30,21 +30,36 @@
+ -export([start/0,
+ register_mechanism/3,
+ listmech/1,
+- server_new/7,
++ server_new/8,
+ server_start/3,
+ server_step/2]).
+
++-include("cyrsasl.hrl").
+ -include("ejabberd.hrl").
+
++%% @type saslmechanism() = {sasl_mechanism, Mechanism, Module, Require_Plain}
++%% Mechanism = string()
++%% Module = atom()
++%% Require_Plain = bool().
++%% Registry entry of a supported SASL mechanism.
++
+ -record(sasl_mechanism, {mechanism, module, password_type}).
+--record(sasl_state, {service, myname, realm,
+- get_password, check_password, check_password_digest,
+- mech_mod, mech_state}).
++
++%% @type saslstate() = {sasl_state, Service, Myname, Mech_Mod, Mech_State, Params}
++%% Service = string()
++%% Myname = string()
++%% Mech_Mod = atom()
++%% Mech_State = term().
++%% Params = term().
++%% State of this process.
++
++-record(sasl_state, {service, myname,
++ mech_mod, mech_state, params}).
+
+ -export([behaviour_info/1]).
+
+ behaviour_info(callbacks) ->
+- [{mech_new, 4}, {mech_step, 2}];
++ [{mech_new, 1}, {mech_step, 2}];
+ behaviour_info(_Other) ->
+ undefined.
+
+@@ -56,8 +71,30 @@ start() ->
+ cyrsasl_digest:start([]),
+ cyrsasl_scram:start([]),
+ cyrsasl_anonymous:start([]),
++ maybe_try_start_gssapi(),
+ ok.
+
++maybe_try_start_gssapi() ->
++ case os:getenv("KRB5_KTNAME") of
++ false ->
++ ok;
++ _String ->
++ try_start_gssapi()
++ end.
++
++try_start_gssapi() ->
++ case code:load_file(esasl) of
++ {module, _Module} ->
++ cyrsasl_gssapi:start([]);
++ {error, What} ->
++ ?ERROR_MSG("Support for GSSAPI not started because esasl.beam was not found: ~p", [What])
++ end.
++
++%% @spec (Mechanism, Module, Require_Plain) -> true
++%% Mechanism = string()
++%% Module = atom()
++%% Require_Plain = bool()
++
+ register_mechanism(Mechanism, Module, PasswordType) ->
+ ets:insert(sasl_mechanism,
+ #sasl_mechanism{mechanism = Mechanism,
+@@ -119,24 +156,28 @@ listmech(Host) ->
+ filter_anonymous(Host, Mechs).
+
+ server_new(Service, ServerFQDN, UserRealm, _SecFlags,
+- GetPassword, CheckPassword, CheckPasswordDigest) ->
++ GetPassword, CheckPassword, CheckPasswordDigest, Socket) ->
++ Params = #sasl_params{
++ host = ServerFQDN,
++ realm = UserRealm,
++ get_password = GetPassword,
++ check_password = CheckPassword,
++ check_password_digest= CheckPasswordDigest,
++ socket = Socket
++ },
++
+ #sasl_state{service = Service,
+ myname = ServerFQDN,
+- realm = UserRealm,
+- get_password = GetPassword,
+- check_password = CheckPassword,
+- check_password_digest= CheckPasswordDigest}.
++ params = Params}.
++
+
+ server_start(State, Mech, ClientIn) ->
+ case lists:member(Mech, listmech(State#sasl_state.myname)) of
+ true ->
+ case ets:lookup(sasl_mechanism, Mech) of
+ [#sasl_mechanism{module = Module}] ->
+- {ok, MechState} = Module:mech_new(
+- State#sasl_state.myname,
+- State#sasl_state.get_password,
+- State#sasl_state.check_password,
+- State#sasl_state.check_password_digest),
++ {ok, MechState} =
++ Module:mech_new(State#sasl_state.params),
+ server_step(State#sasl_state{mech_mod = Module,
+ mech_state = MechState},
+ ClientIn);
+diff --git a/src/cyrsasl.hrl b/src/cyrsasl.hrl
+new file mode 100644
+index 0000000..b4cc3e3
+--- /dev/null
++++ b/src/cyrsasl.hrl
+@@ -0,0 +1,15 @@
++%% @type saslparams() = {sasl_params, Host, Realm, GetPassword, CheckPassword, CheckPasswordDigest}
++%% Host = string()
++%% Realm = string()
++%% GetPassword = function()
++%% CheckPassword = function()
++%% CheckPasswordDigest = any().
++%% Parameters for SASL.
++
++-record(sasl_params, {
++ host,
++ realm,
++ get_password,
++ check_password,
++ check_password_digest,
++ socket}).
+diff --git a/src/cyrsasl_anonymous.erl b/src/cyrsasl_anonymous.erl
+index cb0b1e3..085e98c 100644
+--- a/src/cyrsasl_anonymous.erl
++++ b/src/cyrsasl_anonymous.erl
+@@ -27,7 +27,9 @@
+
+ -module(cyrsasl_anonymous).
+
+--export([start/1, stop/0, mech_new/4, mech_step/2]).
++-export([start/1, stop/0, mech_new/1, mech_step/2]).
++
++-include("cyrsasl.hrl").
+
+ -behaviour(cyrsasl).
+
+@@ -40,7 +42,7 @@ start(_Opts) ->
+ stop() ->
+ ok.
+
+-mech_new(Host, _GetPassword, _CheckPassword, _CheckPasswordDigest) ->
++mech_new(#sasl_params{host=Host}) ->
+ {ok, #state{server = Host}}.
+
+ mech_step(State, _ClientIn) ->
+diff --git a/src/cyrsasl_digest.erl b/src/cyrsasl_digest.erl
+index 557e498..e4199f8 100644
+--- a/src/cyrsasl_digest.erl
++++ b/src/cyrsasl_digest.erl
+@@ -29,10 +29,11 @@
+
+ -export([start/1,
+ stop/0,
+- mech_new/4,
++ mech_new/1,
+ mech_step/2]).
+
+ -include("ejabberd.hrl").
++-include("cyrsasl.hrl").
+
+ -behaviour(cyrsasl).
+
+@@ -47,7 +48,8 @@ start(_Opts) ->
+ stop() ->
+ ok.
+
+-mech_new(Host, GetPassword, _CheckPassword, CheckPasswordDigest) ->
++mech_new(#sasl_params{host=Host, get_password=GetPassword,
++ check_password_digest=CheckPasswordDigest}) ->
+ {ok, #state{step = 1,
+ nonce = randoms:get_string(),
+ host = Host,
+diff --git a/src/cyrsasl_gssapi.erl b/src/cyrsasl_gssapi.erl
+new file mode 100644
+index 0000000..11d9955
+--- /dev/null
++++ b/src/cyrsasl_gssapi.erl
+@@ -0,0 +1,166 @@
++%%%----------------------------------------------------------------------
++%%% File : cyrsasl_gssapi.erl
++%%% Author : Mikael Magnusson <mikma@users.sourceforge.net>
++%%% Purpose : GSSAPI SASL mechanism
++%%% Created : 1 June 2007 by Mikael Magnusson <mikma@users.sourceforge.net>
++%%% Id : $Id: $
++%%%----------------------------------------------------------------------
++%%%
++%%% Copyright (C) 2007-2009 Mikael Magnusson <mikma@users.sourceforge.net>
++%%%
++%%% Permission is hereby granted, free of charge, to any person
++%%% obtaining a copy of this software and associated documentation
++%%% files (the "Software"), to deal in the Software without
++%%% restriction, including without limitation the rights to use, copy,
++%%% modify, merge, publish, distribute, sublicense, and/or sell copies
++%%% of the Software, and to permit persons to whom the Software is
++%%% furnished to do so, subject to the following conditions:
++%%%
++%%% The above copyright notice and this permission notice shall be
++%%% included in all copies or substantial portions of the Software.
++%%%
++%%% THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
++%%% EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
++%%% MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
++%%% NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
++%%% BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
++%%% ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
++%%% CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
++%%% SOFTWARE.
++%%%
++
++%%%
++%%% configuration options:
++%%% {sasl_realm, "<Kerberos realm>"}.
++%%%
++%%% environment variables:
++%%% KRB5_KTNAME
++%%%
++
++-module(cyrsasl_gssapi).
++-author('mikma@users.sourceforge.net').
++-vsn('$Revision: $ ').
++
++-export([start/1,
++ stop/0,
++ mech_new/1,
++ mech_step/2]).
++
++-include("ejabberd.hrl").
++-include("cyrsasl.hrl").
++
++-behaviour(cyrsasl).
++
++-define(SERVER, ?MODULE).
++-define(SERVICE, "xmpp").
++
++-record(state, {sasl,
++ needsmore=true,
++ step=0,
++ host,
++ realm,
++ authid,
++ authzid,
++ authrealm,
++ error}).
++
++start(_Opts) ->
++ ChildSpec =
++ {?SERVER,
++ {esasl, start_link, [{local, ?SERVER}]},
++ transient,
++ 1000,
++ worker,
++ [esasl]},
++
++ case supervisor:start_child(ejabberd_sup, ChildSpec) of
++ {ok, _Pid} ->
++ cyrsasl:register_mechanism("GSSAPI", ?MODULE, false);
++ {error, Error} = E ->
++ ?ERROR_MSG("esasl failed: ~p", [Error]),
++ E
++ end.
++
++
++stop() ->
++ catch esasl:stop(?SERVER),
++ supervisor:terminate_child(ejabberd_sup, ?SERVER),
++ supervisor:delete_child(ejabberd_sup, ?SERVER).
++
++mech_new(#sasl_params{host=Host, realm=Realm, socket=Socket}) ->
++ case ejabberd_socket:gethostname(Socket) of
++ {ok, FQDN} ->
++ ?DEBUG("mech_new ~p ~p ~p~n", [Host, Realm, FQDN]),
++ case esasl:server_start(?SERVER, "GSSAPI", ?SERVICE, FQDN) of
++ {ok, Sasl} ->
++ {ok, #state{sasl=Sasl,host=Host,realm=Realm}};
++ {error, {gsasl_error, Error}} ->
++ {ok, Str} = esasl:str_error(?SERVER, Error),
++ ?DEBUG("esasl error: ~p", [Str]),
++ {ok, #state{needsmore=error,error="internal-server-error"}};
++ {error, Error} ->
++ ?DEBUG("esasl error: ~p", [Error]),
++ {ok, #state{needsmore=error,error="internal-server-error"}}
++ end;
++ {error, Error} ->
++ ?DEBUG("gethostname error: ~p", [Error]),
++ {ok, #state{needsmore=error,error="internal-server-error"}}
++ end.
++
++mech_step(State, ClientIn) when is_list(ClientIn) ->
++ catch do_step(State, ClientIn).
++
++do_step(#state{needsmore=error,error=Error}=_State, _) ->
++ {error, Error};
++do_step(#state{needsmore=false}=State, _) ->
++ check_user(State);
++do_step(#state{needsmore=true,sasl=Sasl,step=Step}=State, ClientIn) ->
++ ?DEBUG("mech_step~n", []),
++ case esasl:step(Sasl, list_to_binary(ClientIn)) of
++ {ok, RspAuth} ->
++ ?DEBUG("ok~n", []),
++ {ok, Display_name} = esasl:property_get(Sasl, gssapi_display_name),
++ {ok, Authzid} = esasl:property_get(Sasl, authzid),
++ {Authid, [$@ | Auth_realm]} =
++ lists:splitwith(fun(E)->E =/= $@ end, Display_name),
++ State1 = State#state{authid=Authid,
++ authzid=Authzid,
++ authrealm=Auth_realm},
++ handle_step_ok(State1, binary_to_list(RspAuth));
++ {needsmore, RspAuth} ->
++ ?DEBUG("needsmore~n", []),
++ if (Step > 0) and (ClientIn =:= []) and (RspAuth =:= <<>>) ->
++ {error, "not-authorized"};
++ true ->
++ {continue, binary_to_list(RspAuth),
++ State#state{step=Step+1}}
++ end;
++ {error, _} ->
++ {error, "not-authorized"}
++ end.
++
++handle_step_ok(State, []) ->
++ check_user(State);
++handle_step_ok(#state{step=Step}=State, RspAuth) ->
++ ?DEBUG("continue~n", []),
++ {continue, RspAuth, State#state{needsmore=false,step=Step+1}}.
++
++check_user(#state{authid=Authid,authzid=Authzid,
++ authrealm=Auth_realm,host=Host,realm=Realm}) ->
++ if Realm =/= Auth_realm ->
++ ?DEBUG("bad realm ~p (expected ~p)~n",[Auth_realm, Realm]),
++ throw({error, "not-authorized"});
++ true ->
++ ok
++ end,
++
++ case ejabberd_auth:is_user_exists(Authid, Host) of
++ false ->
++ ?DEBUG("bad user ~p~n",[Authid]),
++ throw({error, "not-authorized"});
++ true ->
++ ok
++ end,
++
++ ?DEBUG("GSSAPI authenticated ~p ~p~n", [Authid, Authzid]),
++ {ok, [{username, Authid}, {authzid, Authzid}]}.
+diff --git a/src/cyrsasl_plain.erl b/src/cyrsasl_plain.erl
+index 7192cd1..7bf41b3 100644
+--- a/src/cyrsasl_plain.erl
++++ b/src/cyrsasl_plain.erl
+@@ -27,7 +27,9 @@
+ -module(cyrsasl_plain).
+ -author('alexey@process-one.net').
+
+--export([start/1, stop/0, mech_new/4, mech_step/2, parse/1]).
++-export([start/1, stop/0, mech_new/1, mech_step/2, parse/1]).
++
++-include("cyrsasl.hrl").
+
+ -behaviour(cyrsasl).
+
+@@ -40,7 +42,7 @@ start(_Opts) ->
+ stop() ->
+ ok.
+
+-mech_new(_Host, _GetPassword, CheckPassword, _CheckPasswordDigest) ->
++mech_new(#sasl_params{check_password = CheckPassword}) ->
+ {ok, #state{check_password = CheckPassword}}.
+
+ mech_step(State, ClientIn) ->
+diff --git a/src/cyrsasl_scram.erl b/src/cyrsasl_scram.erl
+index dc671b2..d65cc6f 100644
+--- a/src/cyrsasl_scram.erl
++++ b/src/cyrsasl_scram.erl
+@@ -29,10 +29,11 @@
+
+ -export([start/1,
+ stop/0,
+- mech_new/4,
++ mech_new/1,
+ mech_step/2]).
+
+ -include("ejabberd.hrl").
++-include("cyrsasl.hrl").
+
+ -behaviour(cyrsasl).
+
+@@ -48,7 +49,7 @@ start(_Opts) ->
+ stop() ->
+ ok.
+
+-mech_new(_Host, GetPassword, _CheckPassword, _CheckPasswordDigest) ->
++mech_new(#sasl_params{get_password=GetPassword}) ->
+ {ok, #state{step = 2, get_password = GetPassword}}.
+
+ mech_step(#state{step = 2} = State, ClientIn) ->
+diff --git a/src/ejabberd_c2s.erl b/src/ejabberd_c2s.erl
+index ed26400..11ae5dd 100644
+--- a/src/ejabberd_c2s.erl
++++ b/src/ejabberd_c2s.erl
+@@ -305,9 +305,16 @@ wait_for_stream({xmlstreamstart, _Name, Attrs}, StateData) ->
+ send_header(StateData, Server, "1.0", DefaultLang),
+ case StateData#state.authenticated of
+ false ->
++ Realm =
++ case ejabberd_config:get_local_option({sasl_realm, Server}) of
++ undefined ->
++ "";
++ Realm0 ->
++ Realm0
++ end,
+ SASLState =
+ cyrsasl:server_new(
+- "jabber", Server, "", [],
++ "jabber", Server, Realm, [],
+ fun(U) ->
+ ejabberd_auth:get_password_with_authmodule(
+ U, Server)
+@@ -319,7 +326,8 @@ wait_for_stream({xmlstreamstart, _Name, Attrs}, StateData) ->
+ fun(U, P, D, DG) ->
+ ejabberd_auth:check_password_with_authmodule(
+ U, Server, P, D, DG)
+- end),
++ end,
++ StateData#state.socket),
+ Mechs = lists:map(
+ fun(S) ->
+ {xmlelement, "mechanism", [],
+diff --git a/src/ejabberd_socket.erl b/src/ejabberd_socket.erl
+index 836e7d9..59e4034 100644
+--- a/src/ejabberd_socket.erl
++++ b/src/ejabberd_socket.erl
+@@ -44,9 +44,11 @@
+ get_peer_certificate/1,
+ get_verify_result/1,
+ close/1,
++ gethostname/1,
+ sockname/1, peername/1]).
+
+ -include("ejabberd.hrl").
++-include_lib("kernel/include/inet.hrl").
+
+ -record(socket_state, {sockmod, socket, receiver}).
+
+@@ -228,6 +230,23 @@ peername(#socket_state{sockmod = SockMod, socket = Socket}) ->
+ SockMod:peername(Socket)
+ end.
+
++gethostname(#socket_state{socket = Socket} = State) ->
++ ?DEBUG("gethostname ~p~n", [Socket]),
++
++ case sockname(State) of
++ {ok, {Addr, _Port}} ->
++ case inet:gethostbyaddr(Addr) of
++ {ok, HostEnt} when is_record(HostEnt, hostent) ->
++ ?DEBUG("gethostname result ~p~n",
++ [HostEnt#hostent.h_name]),
++ {ok, HostEnt#hostent.h_name};
++ {error, _Reason} = E ->
++ E
++ end;
++ {error, _Reason} = E ->
++ E
++ end.
++
+ %%====================================================================
+ %% Internal functions
+ %%====================================================================
+--
+1.8.3.1
+
diff --git a/ejabberd-0006-Use-versioned-directory-for-storing-docs.patch b/ejabberd-0006-Use-versioned-directory-for-storing-docs.patch
deleted file mode 100644
index 0ef4a30..0000000
--- a/ejabberd-0006-Use-versioned-directory-for-storing-docs.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From ba733c94f5f1238dc73e624a842ebc47ecc1c605 Mon Sep 17 00:00:00 2001
-From: Peter Lemenkov <lemenkov@gmail.com>
-Date: Sat, 12 Jun 2010 16:12:11 +0400
-Subject: [PATCH 6/8] Use versioned directory for storing docs
-
-It's also a good idea to store doc-files under the versioned directory.
-This may greatly simplify parallel installation of different versions of
-ejabbed.
-
-Note that this may be done in the other way - by changing proper field
-in the AC_INIT macro, see the explanation of the field 'tarname':
-
-http://www.gnu.org/software/autoconf/manual/html_node/Initializing-configure.html
-
-Signed-off-by: Peter Lemenkov <lemenkov@gmail.com>
----
- src/Makefile.in | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/Makefile.in b/src/Makefile.in
-index 64ed856..43b5e1f 100644
---- a/src/Makefile.in
-+++ b/src/Makefile.in
-@@ -98,7 +98,7 @@ SBINDIR = $(DESTDIR)@sbindir@
- EJABBERDDIR = $(DESTDIR)@libdir@/ejabberd
-
- # /share/doc/ejabberd
--PACKAGE_TARNAME = @PACKAGE_TARNAME@
-+PACKAGE_TARNAME = @PACKAGE_TARNAME@-@PACKAGE_VERSION@
- datarootdir = @datarootdir@
- DOCDIR = $(DESTDIR)@docdir@
-
---
-1.8.2.1
-
diff --git a/ejabberd-0007-Disable-INET_DIST_INTERFACE-by-default.patch b/ejabberd-0007-Disable-INET_DIST_INTERFACE-by-default.patch
new file mode 100644
index 0000000..09f67fb
--- /dev/null
+++ b/ejabberd-0007-Disable-INET_DIST_INTERFACE-by-default.patch
@@ -0,0 +1,26 @@
+From a8910615b82e7af8cb32916792970de0b53e5872 Mon Sep 17 00:00:00 2001
+From: Peter Lemenkov <lemenkov@gmail.com>
+Date: Sat, 18 Jun 2011 23:24:28 +0400
+Subject: [PATCH 7/8] Disable INET_DIST_INTERFACE by default
+
+Signed-off-by: Peter Lemenkov <lemenkov@gmail.com>
+---
+ src/ejabberdctl.cfg.example | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/ejabberdctl.cfg.example b/src/ejabberdctl.cfg.example
+index b72058a..5ee43cf 100644
+--- a/src/ejabberdctl.cfg.example
++++ b/src/ejabberdctl.cfg.example
+@@ -59,7 +59,7 @@
+ #
+ # Default: {127,0,0,1}
+ #
+-INET_DIST_INTERFACE={127,0,0,1}
++#INET_DIST_INTERFACE={127,0,0,1}
+
+ #.
+ #' ERL_EPMD_ADDRESS: IP addresses where epmd listens for connections
+--
+1.8.3.1
+
diff --git a/ejabberd-0007-Support-SASL-GSSAPI-authentication-thanks-to-Mikael-.patch b/ejabberd-0007-Support-SASL-GSSAPI-authentication-thanks-to-Mikael-.patch
deleted file mode 100644
index d7132a5..0000000
--- a/ejabberd-0007-Support-SASL-GSSAPI-authentication-thanks-to-Mikael-.patch
+++ /dev/null
@@ -1,505 +0,0 @@
-From c00d31b20735b9a9d2bde1be7c4a70463bd1762e Mon Sep 17 00:00:00 2001
-From: Badlop <badlop@process-one.net>
-Date: Thu, 15 Apr 2010 17:20:16 +0200
-Subject: [PATCH 7/8] Support SASL GSSAPI authentication (thanks to Mikael
- Magnusson)(EJAB-831)
-
----
- src/cyrsasl.erl | 71 +++++++++++++++-----
- src/cyrsasl.hrl | 15 +++++
- src/cyrsasl_anonymous.erl | 6 +-
- src/cyrsasl_digest.erl | 6 +-
- src/cyrsasl_gssapi.erl | 166 ++++++++++++++++++++++++++++++++++++++++++++++
- src/cyrsasl_plain.erl | 6 +-
- src/cyrsasl_scram.erl | 5 +-
- src/ejabberd_c2s.erl | 12 +++-
- src/ejabberd_socket.erl | 19 ++++++
- 9 files changed, 281 insertions(+), 25 deletions(-)
- create mode 100644 src/cyrsasl.hrl
- create mode 100644 src/cyrsasl_gssapi.erl
-
-diff --git a/src/cyrsasl.erl b/src/cyrsasl.erl
-index 9d1377f..802c679 100644
---- a/src/cyrsasl.erl
-+++ b/src/cyrsasl.erl
-@@ -30,21 +30,36 @@
- -export([start/0,
- register_mechanism/3,
- listmech/1,
-- server_new/7,
-+ server_new/8,
- server_start/3,
- server_step/2]).
-
-+-include("cyrsasl.hrl").
- -include("ejabberd.hrl").
-
-+%% @type saslmechanism() = {sasl_mechanism, Mechanism, Module, Require_Plain}
-+%% Mechanism = string()
-+%% Module = atom()
-+%% Require_Plain = bool().
-+%% Registry entry of a supported SASL mechanism.
-+
- -record(sasl_mechanism, {mechanism, module, password_type}).
---record(sasl_state, {service, myname, realm,
-- get_password, check_password, check_password_digest,
-- mech_mod, mech_state}).
-+
-+%% @type saslstate() = {sasl_state, Service, Myname, Mech_Mod, Mech_State, Params}
-+%% Service = string()
-+%% Myname = string()
-+%% Mech_Mod = atom()
-+%% Mech_State = term().
-+%% Params = term().
-+%% State of this process.
-+
-+-record(sasl_state, {service, myname,
-+ mech_mod, mech_state, params}).
-
- -export([behaviour_info/1]).
-
- behaviour_info(callbacks) ->
-- [{mech_new, 4}, {mech_step, 2}];
-+ [{mech_new, 1}, {mech_step, 2}];
- behaviour_info(_Other) ->
- undefined.
-
-@@ -56,8 +71,30 @@ start() ->
- cyrsasl_digest:start([]),
- cyrsasl_scram:start([]),
- cyrsasl_anonymous:start([]),
-+ maybe_try_start_gssapi(),
- ok.
-
-+maybe_try_start_gssapi() ->
-+ case os:getenv("KRB5_KTNAME") of
-+ false ->
-+ ok;
-+ _String ->
-+ try_start_gssapi()
-+ end.
-+
-+try_start_gssapi() ->
-+ case code:load_file(esasl) of
-+ {module, _Module} ->
-+ cyrsasl_gssapi:start([]);
-+ {error, What} ->
-+ ?ERROR_MSG("Support for GSSAPI not started because esasl.beam was not found: ~p", [What])
-+ end.
-+
-+%% @spec (Mechanism, Module, Require_Plain) -> true
-+%% Mechanism = string()
-+%% Module = atom()
-+%% Require_Plain = bool()
-+
- register_mechanism(Mechanism, Module, PasswordType) ->
- ets:insert(sasl_mechanism,
- #sasl_mechanism{mechanism = Mechanism,
-@@ -119,24 +156,28 @@ listmech(Host) ->
- filter_anonymous(Host, Mechs).
-
- server_new(Service, ServerFQDN, UserRealm, _SecFlags,
-- GetPassword, CheckPassword, CheckPasswordDigest) ->
-+ GetPassword, CheckPassword, CheckPasswordDigest, Socket) ->
-+ Params = #sasl_params{
-+ host = ServerFQDN,
-+ realm = UserRealm,
-+ get_password = GetPassword,
-+ check_password = CheckPassword,
-+ check_password_digest= CheckPasswordDigest,
-+ socket = Socket
-+ },
-+
- #sasl_state{service = Service,
- myname = ServerFQDN,
-- realm = UserRealm,
-- get_password = GetPassword,
-- check_password = CheckPassword,
-- check_password_digest= CheckPasswordDigest}.
-+ params = Params}.
-+
-
- server_start(State, Mech, ClientIn) ->
- case lists:member(Mech, listmech(State#sasl_state.myname)) of
- true ->
- case ets:lookup(sasl_mechanism, Mech) of
- [#sasl_mechanism{module = Module}] ->
-- {ok, MechState} = Module:mech_new(
-- State#sasl_state.myname,
-- State#sasl_state.get_password,
-- State#sasl_state.check_password,
-- State#sasl_state.check_password_digest),
-+ {ok, MechState} =
-+ Module:mech_new(State#sasl_state.params),
- server_step(State#sasl_state{mech_mod = Module,
- mech_state = MechState},
- ClientIn);
-diff --git a/src/cyrsasl.hrl b/src/cyrsasl.hrl
-new file mode 100644
-index 0000000..b4cc3e3
---- /dev/null
-+++ b/src/cyrsasl.hrl
-@@ -0,0 +1,15 @@
-+%% @type saslparams() = {sasl_params, Host, Realm, GetPassword, CheckPassword, CheckPasswordDigest}
-+%% Host = string()
-+%% Realm = string()
-+%% GetPassword = function()
-+%% CheckPassword = function()
-+%% CheckPasswordDigest = any().
-+%% Parameters for SASL.
-+
-+-record(sasl_params, {
-+ host,
-+ realm,
-+ get_password,
-+ check_password,
-+ check_password_digest,
-+ socket}).
-diff --git a/src/cyrsasl_anonymous.erl b/src/cyrsasl_anonymous.erl
-index cb0b1e3..085e98c 100644
---- a/src/cyrsasl_anonymous.erl
-+++ b/src/cyrsasl_anonymous.erl
-@@ -27,7 +27,9 @@
-
- -module(cyrsasl_anonymous).
-
---export([start/1, stop/0, mech_new/4, mech_step/2]).
-+-export([start/1, stop/0, mech_new/1, mech_step/2]).
-+
-+-include("cyrsasl.hrl").
-
- -behaviour(cyrsasl).
-
-@@ -40,7 +42,7 @@ start(_Opts) ->
- stop() ->
- ok.
-
--mech_new(Host, _GetPassword, _CheckPassword, _CheckPasswordDigest) ->
-+mech_new(#sasl_params{host=Host}) ->
- {ok, #state{server = Host}}.
-
- mech_step(State, _ClientIn) ->
-diff --git a/src/cyrsasl_digest.erl b/src/cyrsasl_digest.erl
-index 557e498..e4199f8 100644
---- a/src/cyrsasl_digest.erl
-+++ b/src/cyrsasl_digest.erl
-@@ -29,10 +29,11 @@
-
- -export([start/1,
- stop/0,
-- mech_new/4,
-+ mech_new/1,
- mech_step/2]).
-
- -include("ejabberd.hrl").
-+-include("cyrsasl.hrl").
-
- -behaviour(cyrsasl).
-
-@@ -47,7 +48,8 @@ start(_Opts) ->
- stop() ->
- ok.
-
--mech_new(Host, GetPassword, _CheckPassword, CheckPasswordDigest) ->
-+mech_new(#sasl_params{host=Host, get_password=GetPassword,
-+ check_password_digest=CheckPasswordDigest}) ->
- {ok, #state{step = 1,
- nonce = randoms:get_string(),
- host = Host,
-diff --git a/src/cyrsasl_gssapi.erl b/src/cyrsasl_gssapi.erl
-new file mode 100644
-index 0000000..11d9955
---- /dev/null
-+++ b/src/cyrsasl_gssapi.erl
-@@ -0,0 +1,166 @@
-+%%%----------------------------------------------------------------------
-+%%% File : cyrsasl_gssapi.erl
-+%%% Author : Mikael Magnusson <mikma@users.sourceforge.net>
-+%%% Purpose : GSSAPI SASL mechanism
-+%%% Created : 1 June 2007 by Mikael Magnusson <mikma@users.sourceforge.net>
-+%%% Id : $Id: $
-+%%%----------------------------------------------------------------------
-+%%%
-+%%% Copyright (C) 2007-2009 Mikael Magnusson <mikma@users.sourceforge.net>
-+%%%
-+%%% Permission is hereby granted, free of charge, to any person
-+%%% obtaining a copy of this software and associated documentation
-+%%% files (the "Software"), to deal in the Software without
-+%%% restriction, including without limitation the rights to use, copy,
-+%%% modify, merge, publish, distribute, sublicense, and/or sell copies
-+%%% of the Software, and to permit persons to whom the Software is
-+%%% furnished to do so, subject to the following conditions:
-+%%%
-+%%% The above copyright notice and this permission notice shall be
-+%%% included in all copies or substantial portions of the Software.
-+%%%
-+%%% THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-+%%% EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-+%%% MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-+%%% NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
-+%%% BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
-+%%% ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
-+%%% CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-+%%% SOFTWARE.
-+%%%
-+
-+%%%
-+%%% configuration options:
-+%%% {sasl_realm, "<Kerberos realm>"}.
-+%%%
-+%%% environment variables:
-+%%% KRB5_KTNAME
-+%%%
-+
-+-module(cyrsasl_gssapi).
-+-author('mikma@users.sourceforge.net').
-+-vsn('$Revision: $ ').
-+
-+-export([start/1,
-+ stop/0,
-+ mech_new/1,
-+ mech_step/2]).
-+
-+-include("ejabberd.hrl").
-+-include("cyrsasl.hrl").
-+
-+-behaviour(cyrsasl).
-+
-+-define(SERVER, ?MODULE).
-+-define(SERVICE, "xmpp").
-+
-+-record(state, {sasl,
-+ needsmore=true,
-+ step=0,
-+ host,
-+ realm,
-+ authid,
-+ authzid,
-+ authrealm,
-+ error}).
-+
-+start(_Opts) ->
-+ ChildSpec =
-+ {?SERVER,
-+ {esasl, start_link, [{local, ?SERVER}]},
-+ transient,
-+ 1000,
-+ worker,
-+ [esasl]},
-+
-+ case supervisor:start_child(ejabberd_sup, ChildSpec) of
-+ {ok, _Pid} ->
-+ cyrsasl:register_mechanism("GSSAPI", ?MODULE, false);
-+ {error, Error} = E ->
-+ ?ERROR_MSG("esasl failed: ~p", [Error]),
-+ E
-+ end.
-+
-+
-+stop() ->
-+ catch esasl:stop(?SERVER),
-+ supervisor:terminate_child(ejabberd_sup, ?SERVER),
-+ supervisor:delete_child(ejabberd_sup, ?SERVER).
-+
-+mech_new(#sasl_params{host=Host, realm=Realm, socket=Socket}) ->
-+ case ejabberd_socket:gethostname(Socket) of
-+ {ok, FQDN} ->
-+ ?DEBUG("mech_new ~p ~p ~p~n", [Host, Realm, FQDN]),
-+ case esasl:server_start(?SERVER, "GSSAPI", ?SERVICE, FQDN) of
-+ {ok, Sasl} ->
-+ {ok, #state{sasl=Sasl,host=Host,realm=Realm}};
-+ {error, {gsasl_error, Error}} ->
-+ {ok, Str} = esasl:str_error(?SERVER, Error),
-+ ?DEBUG("esasl error: ~p", [Str]),
-+ {ok, #state{needsmore=error,error="internal-server-error"}};
-+ {error, Error} ->
-+ ?DEBUG("esasl error: ~p", [Error]),
-+ {ok, #state{needsmore=error,error="internal-server-error"}}
-+ end;
-+ {error, Error} ->
-+ ?DEBUG("gethostname error: ~p", [Error]),
-+ {ok, #state{needsmore=error,error="internal-server-error"}}
-+ end.
-+
-+mech_step(State, ClientIn) when is_list(ClientIn) ->
-+ catch do_step(State, ClientIn).
-+
-+do_step(#state{needsmore=error,error=Error}=_State, _) ->
-+ {error, Error};
-+do_step(#state{needsmore=false}=State, _) ->
-+ check_user(State);
-+do_step(#state{needsmore=true,sasl=Sasl,step=Step}=State, ClientIn) ->
-+ ?DEBUG("mech_step~n", []),
-+ case esasl:step(Sasl, list_to_binary(ClientIn)) of
-+ {ok, RspAuth} ->
-+ ?DEBUG("ok~n", []),
-+ {ok, Display_name} = esasl:property_get(Sasl, gssapi_display_name),
-+ {ok, Authzid} = esasl:property_get(Sasl, authzid),
-+ {Authid, [$@ | Auth_realm]} =
-+ lists:splitwith(fun(E)->E =/= $@ end, Display_name),
-+ State1 = State#state{authid=Authid,
-+ authzid=Authzid,
-+ authrealm=Auth_realm},
-+ handle_step_ok(State1, binary_to_list(RspAuth));
-+ {needsmore, RspAuth} ->
-+ ?DEBUG("needsmore~n", []),
-+ if (Step > 0) and (ClientIn =:= []) and (RspAuth =:= <<>>) ->
-+ {error, "not-authorized"};
-+ true ->
-+ {continue, binary_to_list(RspAuth),
-+ State#state{step=Step+1}}
-+ end;
-+ {error, _} ->
-+ {error, "not-authorized"}
-+ end.
-+
-+handle_step_ok(State, []) ->
-+ check_user(State);
-+handle_step_ok(#state{step=Step}=State, RspAuth) ->
-+ ?DEBUG("continue~n", []),
-+ {continue, RspAuth, State#state{needsmore=false,step=Step+1}}.
-+
-+check_user(#state{authid=Authid,authzid=Authzid,
-+ authrealm=Auth_realm,host=Host,realm=Realm}) ->
-+ if Realm =/= Auth_realm ->
-+ ?DEBUG("bad realm ~p (expected ~p)~n",[Auth_realm, Realm]),
-+ throw({error, "not-authorized"});
-+ true ->
-+ ok
-+ end,
-+
-+ case ejabberd_auth:is_user_exists(Authid, Host) of
-+ false ->
-+ ?DEBUG("bad user ~p~n",[Authid]),
-+ throw({error, "not-authorized"});
-+ true ->
-+ ok
-+ end,
-+
-+ ?DEBUG("GSSAPI authenticated ~p ~p~n", [Authid, Authzid]),
-+ {ok, [{username, Authid}, {authzid, Authzid}]}.
-diff --git a/src/cyrsasl_plain.erl b/src/cyrsasl_plain.erl
-index 7192cd1..7bf41b3 100644
---- a/src/cyrsasl_plain.erl
-+++ b/src/cyrsasl_plain.erl
-@@ -27,7 +27,9 @@
- -module(cyrsasl_plain).
- -author('alexey@process-one.net').
-
---export([start/1, stop/0, mech_new/4, mech_step/2, parse/1]).
-+-export([start/1, stop/0, mech_new/1, mech_step/2, parse/1]).
-+
-+-include("cyrsasl.hrl").
-
- -behaviour(cyrsasl).
-
-@@ -40,7 +42,7 @@ start(_Opts) ->
- stop() ->
- ok.
-
--mech_new(_Host, _GetPassword, CheckPassword, _CheckPasswordDigest) ->
-+mech_new(#sasl_params{check_password = CheckPassword}) ->
- {ok, #state{check_password = CheckPassword}}.
-
- mech_step(State, ClientIn) ->
-diff --git a/src/cyrsasl_scram.erl b/src/cyrsasl_scram.erl
-index dc671b2..d65cc6f 100644
---- a/src/cyrsasl_scram.erl
-+++ b/src/cyrsasl_scram.erl
-@@ -29,10 +29,11 @@
-
- -export([start/1,
- stop/0,
-- mech_new/4,
-+ mech_new/1,
- mech_step/2]).
-
- -include("ejabberd.hrl").
-+-include("cyrsasl.hrl").
-
- -behaviour(cyrsasl).
-
-@@ -48,7 +49,7 @@ start(_Opts) ->
- stop() ->
- ok.
-
--mech_new(_Host, GetPassword, _CheckPassword, _CheckPasswordDigest) ->
-+mech_new(#sasl_params{get_password=GetPassword}) ->
- {ok, #state{step = 2, get_password = GetPassword}}.
-
- mech_step(#state{step = 2} = State, ClientIn) ->
-diff --git a/src/ejabberd_c2s.erl b/src/ejabberd_c2s.erl
-index ed26400..11ae5dd 100644
---- a/src/ejabberd_c2s.erl
-+++ b/src/ejabberd_c2s.erl
-@@ -305,9 +305,16 @@ wait_for_stream({xmlstreamstart, _Name, Attrs}, StateData) ->
- send_header(StateData, Server, "1.0", DefaultLang),
- case StateData#state.authenticated of
- false ->
-+ Realm =
-+ case ejabberd_config:get_local_option({sasl_realm, Server}) of
-+ undefined ->
-+ "";
-+ Realm0 ->
-+ Realm0
-+ end,
- SASLState =
- cyrsasl:server_new(
-- "jabber", Server, "", [],
-+ "jabber", Server, Realm, [],
- fun(U) ->
- ejabberd_auth:get_password_with_authmodule(
- U, Server)
-@@ -319,7 +326,8 @@ wait_for_stream({xmlstreamstart, _Name, Attrs}, StateData) ->
- fun(U, P, D, DG) ->
- ejabberd_auth:check_password_with_authmodule(
- U, Server, P, D, DG)
-- end),
-+ end,
-+ StateData#state.socket),
- Mechs = lists:map(
- fun(S) ->
- {xmlelement, "mechanism", [],
-diff --git a/src/ejabberd_socket.erl b/src/ejabberd_socket.erl
-index 836e7d9..59e4034 100644
---- a/src/ejabberd_socket.erl
-+++ b/src/ejabberd_socket.erl
-@@ -44,9 +44,11 @@
- get_peer_certificate/1,
- get_verify_result/1,
- close/1,
-+ gethostname/1,
- sockname/1, peername/1]).
-
- -include("ejabberd.hrl").
-+-include_lib("kernel/include/inet.hrl").
-
- -record(socket_state, {sockmod, socket, receiver}).
-
-@@ -228,6 +230,23 @@ peername(#socket_state{sockmod = SockMod, socket = Socket}) ->
- SockMod:peername(Socket)
- end.
-
-+gethostname(#socket_state{socket = Socket} = State) ->
-+ ?DEBUG("gethostname ~p~n", [Socket]),
-+
-+ case sockname(State) of
-+ {ok, {Addr, _Port}} ->
-+ case inet:gethostbyaddr(Addr) of
-+ {ok, HostEnt} when is_record(HostEnt, hostent) ->
-+ ?DEBUG("gethostname result ~p~n",
-+ [HostEnt#hostent.h_name]),
-+ {ok, HostEnt#hostent.h_name};
-+ {error, _Reason} = E ->
-+ E
-+ end;
-+ {error, _Reason} = E ->
-+ E
-+ end.
-+
- %%====================================================================
- %% Internal functions
- %%====================================================================
---
-1.8.2.1
-
diff --git a/ejabberd-0008-Clean-up-false-security-measure.patch b/ejabberd-0008-Clean-up-false-security-measure.patch
new file mode 100644
index 0000000..83fa98c
--- /dev/null
+++ b/ejabberd-0008-Clean-up-false-security-measure.patch
@@ -0,0 +1,26 @@
+From c827055ee650243c2af546753743f692ae0fe758 Mon Sep 17 00:00:00 2001
+From: Peter Lemenkov <lemenkov@gmail.com>
+Date: Wed, 17 Jul 2013 14:56:09 +0400
+Subject: [PATCH 8/8] Clean up false security measure
+
+Signed-off-by: Peter Lemenkov <lemenkov@gmail.com>
+---
+ src/Makefile.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/Makefile.in b/src/Makefile.in
+index 64ed856..1a1fa41 100644
+--- a/src/Makefile.in
++++ b/src/Makefile.in
+@@ -202,7 +202,7 @@ install: all
+ #
+ # Administration script
+ [ -d $(SBINDIR) ] || install -d -m 755 $(SBINDIR)
+- install -m 550 $(G_USER) ejabberdctl.example $(SBINDIR)/ejabberdctl
++ install -m 755 $(G_USER) ejabberdctl.example $(SBINDIR)/ejabberdctl
+ #
+ # Init script
+ sed -e "s*@ctlscriptpath@*$(SBINDIR)*" \
+--
+1.8.3.1
+
diff --git a/ejabberd-0008-Disable-INET_DIST_INTERFACE-by-default.patch b/ejabberd-0008-Disable-INET_DIST_INTERFACE-by-default.patch
deleted file mode 100644
index 8138522..0000000
--- a/ejabberd-0008-Disable-INET_DIST_INTERFACE-by-default.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From e17a26e31d6ddd1b9ab5bc0b00665f94cbdfa5b0 Mon Sep 17 00:00:00 2001
-From: Peter Lemenkov <lemenkov@gmail.com>
-Date: Sat, 18 Jun 2011 23:24:28 +0400
-Subject: [PATCH 8/8] Disable INET_DIST_INTERFACE by default
-
-Signed-off-by: Peter Lemenkov <lemenkov@gmail.com>
----
- src/ejabberdctl.cfg.example | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/ejabberdctl.cfg.example b/src/ejabberdctl.cfg.example
-index b72058a..5ee43cf 100644
---- a/src/ejabberdctl.cfg.example
-+++ b/src/ejabberdctl.cfg.example
-@@ -59,7 +59,7 @@
- #
- # Default: {127,0,0,1}
- #
--INET_DIST_INTERFACE={127,0,0,1}
-+#INET_DIST_INTERFACE={127,0,0,1}
-
- #.
- #' ERL_EPMD_ADDRESS: IP addresses where epmd listens for connections
---
-1.8.2.1
-
diff --git a/ejabberd.spec b/ejabberd.spec
index 0eed25f..2994ccb 100644
--- a/ejabberd.spec
+++ b/ejabberd.spec
@@ -22,7 +22,7 @@
Name: ejabberd
Version: 2.1.13
-Release: 3%{?dist}
+Release: 4%{?dist}
Summary: A distributed, fault-tolerant Jabber/XMPP server
Group: Applications/Internet
@@ -40,9 +40,14 @@ Source5: ejabberd.tmpfiles.conf
# PAM support
Source9: ejabberdctl.pam
-Source10: ejabberdctl.apps
Source11: ejabberd.pam
+# usermode support for old systems
+Source10: ejabberdctl.apps
+# polkit support
+Source12: ejabberdctl.polkit.rules
+Source13: ejabberdctl.sh
+
# Use ejabberd as an example for PAM service name (fedora/epel-specific)
Patch1: ejabberd-0001-Fix-PAM-service-example-name-to-match-actual-one.patch
# fixed delays in s2s connections
@@ -53,12 +58,12 @@ Patch3: ejabberd-0003-Introducing-mod_admin_extra.patch
Patch4: ejabberd-0004-Fedora-specific-changes-to-ejabberdctl.patch
# Fix so-lib permissions while installing (fedora/epel-specific)
Patch5: ejabberd-0005-Install-.so-objects-with-0755-permissions.patch
-# Will be proposed for inclusion into upstream
-Patch6: ejabberd-0006-Use-versioned-directory-for-storing-docs.patch
# Backported from upstream
-Patch7: ejabberd-0007-Support-SASL-GSSAPI-authentication-thanks-to-Mikael-.patch
+Patch6: ejabberd-0006-Support-SASL-GSSAPI-authentication-thanks-to-Mikael-.patch
# Disable IP restriction for ejabberdctl (seems that it doesn't work well)
-Patch8: ejabberd-0008-Disable-INET_DIST_INTERFACE-by-default.patch
+Patch7: ejabberd-0007-Disable-INET_DIST_INTERFACE-by-default.patch
+# Don't try to make system-wide scripts unreadable for users (fedora/epel-specific)
+Patch8: ejabberd-0008-Clean-up-false-security-measure.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -89,6 +94,9 @@ Requires(preun): systemd
Requires(postun): systemd
%endif
+Provides: user(%{name})
+Provides: group(%{name})
+
#Error:erlang(exmpp_jid:domain_as_list/1)
#Error:erlang(exmpp_jid:make/2)
#Error:erlang(exmpp_jid:node_as_list/1)
@@ -121,7 +129,12 @@ Requires(postun): systemd
Requires: erlang
#Error:erlang(esasl:str_error/2)
Requires: erlang-esasl
+%if 0%{?el5}%{?el6}
Requires: usermode
+%else
+# for /usr/bin/pkexec
+Requires: polkit
+%endif
# for flock in ejabberdctl
Requires: util-linux
@@ -153,9 +166,9 @@ Documentation for ejabberd.
%patch3 -p1 -b .mod_admin_extra
%patch4 -p1 -b .fedora_specific
%patch5 -p1 -b .fix_perms
-%patch6 -p1 -b .versioned_docdir
-%patch7 -p1 -b .gssapi
-%patch8 -p1 -b .disable_ip_restriction_for_ejabberdctl
+%patch6 -p1 -b .gssapi
+%patch7 -p1 -b .disable_ip_restriction_for_ejabberdctl
+%patch8 -p1 -b .dont_hide
%build
@@ -190,10 +203,7 @@ popd
mkdir -p %{buildroot}/var/log/ejabberd
mkdir -p %{buildroot}/var/lib/ejabberd/spool
-mkdir -p %{buildroot}%{_bindir}
-ln -s consolehelper %{buildroot}%{_bindir}/ejabberdctl
install -D -p -m 0644 %{S:9} %{buildroot}%{_sysconfdir}/pam.d/ejabberdctl
-install -D -p -m 0644 %{S:10} %{buildroot}%{_sysconfdir}/security/console.apps/ejabberdctl
install -D -p -m 0644 %{S:11} %{buildroot}%{_sysconfdir}/pam.d/ejabberd
%if 0%{?el5}
# No password-auth PAM scheme in EL5 - see rhbz #758601
@@ -223,15 +233,23 @@ install -p -m 0644 src/odbc/mssql2005.sql %{buildroot}%{_datadir}/%{name}
install -p -m 0644 src/odbc/mysql.sql %{buildroot}%{_datadir}/%{name}
install -p -m 0644 src/odbc/pg.sql %{buildroot}%{_datadir}/%{name}
-# Clean up false security measure
-chmod 755 %{buildroot}%{_sbindir}/ejabberdctl
-
# Fix permissions for captcha script
# In fact, we can also chown root:ejabberd here, but I'm not sure
# that we should care about the possibility of reading by someone
# for this *default* sript, which is not intended to be changed
chmod 755 %{buildroot}%{_libdir}/%{name}/priv/bin/captcha.sh
+%if 0%{?el5}%{?el6}
+# Use usermode on old systems
+mkdir -p %{buildroot}%{_bindir}
+ln -s consolehelper %{buildroot}%{_bindir}/ejabberdctl
+install -D -p -m 0644 %{S:10} %{buildroot}%{_sysconfdir}/security/console.apps/ejabberdctl
+%else
+# Install polkit file
+install -D -p -m 0644 %{S:12} %{buildroot}%{_datadir}/polkit-1/rules.d/51-ejabberdctl.rules
+install -D -p -m 0755 %{S:13} %{buildroot}%{_bindir}/ejabberdctl
+%endif
+
# Remove installed doc-files
rm -rf %{buildroot}%{_defaultdocdir}
@@ -351,7 +369,11 @@ rm -rf %{buildroot}
%config(noreplace) %{_sysconfdir}/logrotate.d/%{name}
%config(noreplace) %{_sysconfdir}/pam.d/%{name}
%config(noreplace) %{_sysconfdir}/pam.d/ejabberdctl
+%if 0%{?el5}%{?el6}
%config(noreplace) %{_sysconfdir}/security/console.apps/ejabberdctl
+%else
+%{_datadir}/polkit-1/rules.d/51-ejabberdctl.rules
+%endif
%{_bindir}/ejabberdctl
%{_sbindir}/ejabberdctl
@@ -419,6 +441,10 @@ rm -rf %{buildroot}
%changelog
+* Sun Sep 15 2013 Peter Lemenkov <lemenkov@gmail.com> - 2.1.13-4
+- Use polkit instead of usermode on modern systems
+- Restore user/group provides
+
* Thu Sep 05 2013 Peter Lemenkov <lemenkov@gmail.com> - 2.1.13-3
- TEMPORARY disable hevea - it's broken in F19+
- Fix building with unversioned docdir
diff --git a/ejabberdctl.polkit.rules b/ejabberdctl.polkit.rules
new file mode 100644
index 0000000..1037d3a
--- /dev/null
+++ b/ejabberdctl.polkit.rules
@@ -0,0 +1,9 @@
+polkit.addRule(function(action, subject) {
+ var CommandLine = action.lookup("command_line").split(" ");
+ if (action.id == "org.freedesktop.policykit.exec" && (CommandLine[0] == "/sbin/ejabberdctl" || CommandLine[0] == "/usr/sbin/ejabberdctl")){
+ if(subject.isInGroup("ejabberd"))
+ return polkit.Result.YES;
+ else
+ return polkit.Result.NO;
+ }
+});
diff --git a/ejabberdctl.sh b/ejabberdctl.sh
new file mode 100644
index 0000000..92a0519
--- /dev/null
+++ b/ejabberdctl.sh
@@ -0,0 +1,2 @@
+#!/bin/sh
+/usr/bin/pkexec /usr/sbin/ejabberdctl "$@"
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-09-23 19:07 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-23 19:07 [rpms/ejabberd] f45: Switch to polkit Peter Lemenkov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox