[rpms/ejabberd] f45: Update to 17.07 (#1427123).

[rpms/ejabberd] f45: Update to 17.07 (#1427123).

[Randy Barlow]

            A new commit has been pushed.

            Repo   : rpms/ejabberd
            Branch : f45
            Commit : e9cdddd835473981e90316f35ac24247215d6313
            Author : Randy Barlow <randy@electronsweatshop.com>
            Date   : 2017-10-22T13:46:41-04:00
            Stats  : +243/-79 in 9 file(s)
            URL    : https://src.fedoraproject.org/rpms/ejabberd/c/e9cdddd835473981e90316f35ac24247215d6313?branch=f45

            Log:
            Update to 17.07 (#1427123).

Also, add a currently-unused SELinux policy package.

Signed-off-by: Randy Barlow <randy@electronsweatshop.com>

---
diff --git a/.gitignore b/.gitignore
index 5da5abb..4d09921 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,4 @@
 /16.09.tar.gz
 /16.12.tar.gz
 /17.01.tar.gz
+/ejabberd-17.07.tar.gz

diff --git a/ejabberd-0002-Drop-post_hook_configure-from-rebar.config.patch b/ejabberd-0002-Drop-post_hook_configure-from-rebar.config.patch
new file mode 100644
index 0000000..62b280b
--- /dev/null
+++ b/ejabberd-0002-Drop-post_hook_configure-from-rebar.config.patch
@@ -0,0 +1,33 @@
+From 38ad990f72bdaf94cb2fb821154861b11167cabd Mon Sep 17 00:00:00 2001
+From: Randy Barlow <randy@electronsweatshop.com>
+Date: Sun, 22 Oct 2017 12:55:16 -0400
+Subject: [PATCH] Drop post_hook_configure from rebar.config.
+
+Signed-off-by: Randy Barlow <randy@electronsweatshop.com>
+---
+ rebar.config | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/rebar.config b/rebar.config
+index 240e2b6a..465e1aab 100644
+--- a/rebar.config
++++ b/rebar.config
+@@ -145,15 +145,6 @@
+ {if_version_above, "17", {cover_enabled, true}}.
+ {cover_export_enabled, true}.
+ 
+-{post_hook_configure, [{"fast_tls", []},
+-                       {"stringprep", []},
+-                       {"fast_yaml", []},
+-                       {if_var_true, sip, {"esip", []}},
+-                       {"fast_xml", [{if_var_true, full_xml, "--enable-full-xml"}]},
+-                       {if_var_true, pam, {"epam", []}},
+-                       {if_var_true, zlib, {"ezlib", []}},
+-                       {if_var_true, iconv, {"iconv", []}}]}.
+-
+ {port_env, [{"CFLAGS", "-g -O2 -Wall"}]}.
+ 
+ {port_specs, [{"priv/lib/jid.so", ["c_src/jid.c"]}]}.
+-- 
+2.14.2
+

diff --git a/ejabberd-0004-Enable-systemd-notification-if-available.patch b/ejabberd-0004-Enable-systemd-notification-if-available.patch
index 35b8a51..816e442 100644
--- a/ejabberd-0004-Enable-systemd-notification-if-available.patch
+++ b/ejabberd-0004-Enable-systemd-notification-if-available.patch
@@ -1,26 +1,28 @@
-From 21a36b3b32ce384b686236a0193f0fb3440a8243 Mon Sep 17 00:00:00 2001
+From 7792016b3ec67a7feb97ec374cecfb70bc632f39 Mon Sep 17 00:00:00 2001
 From: Randy Barlow <randy@electronsweatshop.com>
-Date: Mon, 2 Jan 2017 22:40:27 -0500
+Date: Sun, 22 Oct 2017 12:17:34 -0400
 Subject: [PATCH] Enable systemd notification if available.
 
 This patch was originally written by Peter Lemenkov, and was
-adapted for ejabberd 16.12.
+adapted for ejabberd 17.07.
+
+Signed-off-by: Randy Barlow <randy@electronsweatshop.com>
 ---
  src/ejabberd_app.erl | 1 +
  1 file changed, 1 insertion(+)
 
 diff --git a/src/ejabberd_app.erl b/src/ejabberd_app.erl
-index e4333c81..3ab6d4ba 100644
+index b52450d2..0cd449cb 100644
 --- a/src/ejabberd_app.erl
 +++ b/src/ejabberd_app.erl
-@@ -77,6 +77,7 @@ start(normal, _Args) ->
-     gen_mod:start_modules(),
-     ejabberd_listener:start_listeners(),
-     register_elixir_config_hooks(),
-+    {module, sd_notify} == code:load_file(sd_notify) andalso sd_notify:sd_notify(0, "READY=1\nSTATUS=Initialized\nMAINPID=" ++ os:getpid() ++ "\n"),
-     ?INFO_MSG("ejabberd ~s is started in the node ~p", [?VERSION, node()]),
-     Sup;
- start(_, _) ->
+@@ -56,6 +56,7 @@ start(normal, _Args) ->
+     case ejabberd_sup:start_link() of
+ 	{ok, SupPid} ->
+ 	    register_elixir_config_hooks(),
++        {module, sd_notify} == code:load_file(sd_notify) andalso sd_notify:sd_notify(0, "READY=1\nSTATUS=Initialized\nMAINPID=" ++ os:getpid() ++ "\n"),
+ 	    {T2, _} = statistics(wall_clock),
+ 	    ?INFO_MSG("ejabberd ~s is started in the node ~p in ~.2fs",
+ 		      [?VERSION, node(), (T2-T1)/1000]),
 -- 
-2.11.0
+2.14.2
 

diff --git a/ejabberd-0005-ejabberdctl-should-not-try-to-create-the-ejabberd-us.patch b/ejabberd-0005-ejabberdctl-should-not-try-to-create-the-ejabberd-us.patch
deleted file mode 100644
index 70cf833..0000000
--- a/ejabberd-0005-ejabberdctl-should-not-try-to-create-the-ejabberd-us.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From ce75f79ee70af1b43beb1a00e5501dbdc5532cc3 Mon Sep 17 00:00:00 2001
-From: Randy Barlow <randy@electronsweatshop.com>
-Date: Thu, 1 Dec 2016 10:58:59 -0500
-Subject: [PATCH] ejabberdctl should not try to create the ejabberd user's
- home.
-
-Also, explicitly use bash as the shell when using su to be the
-ejabberd user.
----
- ejabberdctl.template | 7 +------
- 1 file changed, 1 insertion(+), 6 deletions(-)
-
-diff --git a/ejabberdctl.template b/ejabberdctl.template
-index 5b34ebe..00e4113 100755
---- a/ejabberdctl.template
-+++ b/ejabberdctl.template
-@@ -22,12 +22,7 @@ if [ "$INSTALLUSER" != "" ] ; then
-     EXEC_CMD="false"
-     for GID in `id -G`; do
-         if [ $GID -eq 0 ] ; then
--            INSTALLUSER_HOME=$(getent passwd "$INSTALLUSER" | cut -d: -f6)
--            if [ -n "$INSTALLUSER_HOME" ] && [ ! -d "$INSTALLUSER_HOME" ] ; then
--                mkdir -p "$INSTALLUSER_HOME"
--                chown "$INSTALLUSER" "$INSTALLUSER_HOME"
--            fi
--            EXEC_CMD="su $INSTALLUSER -c"
-+            EXEC_CMD="su $INSTALLUSER -s /usr/bin/bash -c"
-         fi
-     done
-     if [ `id -g` -eq `id -g $INSTALLUSER` ] ; then
--- 
-2.10.2
-

diff --git a/ejabberd.fc b/ejabberd.fc
new file mode 100644
index 0000000..e797d62
--- /dev/null
+++ b/ejabberd.fc
@@ -0,0 +1,7 @@
+/usr/bin/ejabberdctl    --  gen_context(system_u:object_r:ejabberd_exec_t,s0)
+
+/usr/lib/systemd/system/ejabberd.* -- gen_context(system_u:object_r:ejabberd_unit_t,s0)
+
+/var/lib/ejabberd(/.*)? gen_context(system_u:object_r:ejabberd_var_lib_t,s0)
+
+/var/log/ejabberd(/.*)? gen_context(system_u:object_r:ejabberd_var_log_t,s0)

diff --git a/ejabberd.if b/ejabberd.if
new file mode 100644
index 0000000..91ef4a4
--- /dev/null
+++ b/ejabberd.if
@@ -0,0 +1,34 @@
+## <summary>ejabberd is a Free and Open Source distributed fault-tolerant: Jabber/XMPP server. </summary>
+########################################
+## <summary>
+##	All of the rules required to
+##	administrate an ejabberd environment.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`ejabberd_admin',`
+	gen_require(`
+		type ejabberd_t, ejabberd_exec_t;
+		type ejabberd_var_lib_t, ejabberd_var_log_t;
+	')
+
+    admin_process_pattern($1, ejabberd_t)
+
+    init_startstop_service($1, $2, ejabberd_t, ejabberd_initrc_exec_t, ejabberd_unit_t)
+
+	files_search_var_lib($1)
+	admin_pattern($1, ejabberd_var_lib_t)
+
+	logging_search_logs($1)
+	admin_pattern($1, ejabberd_var_log_t)
+')

diff --git a/ejabberd.spec b/ejabberd.spec
index e1c1ecc..5c32128 100644
--- a/ejabberd.spec
+++ b/ejabberd.spec
@@ -4,14 +4,14 @@
 
 
 Name:           ejabberd
-Version:        17.01
-Release:        6%{?dist}
+Version:        17.07
+Release:        1%{?dist}
 
 License:        GPLv2+
 Summary:        A distributed, fault-tolerant Jabber/XMPP server
 URL:            http://www.ejabberd.im/
 VCS:            scm:git:https://github.com/processone/ejabberd.git
-Source0:        https://github.com/processone/%{name}/archive/%{version}.tar.gz
+Source0:        https://github.com/processone/%{name}/archive/%{version}/%{name}-%{version}.tar.gz
 Source2:        ejabberd.logrotate
 
 # Support for systemd
@@ -24,48 +24,52 @@ Source11:       ejabberd.pam
 # polkit support
 Source12:       ejabberdctl.polkit.actions
 Source13:       ejabberdctl.polkit.rules
+# SELinux module
+Source14:       ejabberd.te
+Source15:       ejabberd.fc
+Source16:       ejabberd.if
 
 
 # Use ejabberd as an example for PAM service name (fedora/epel-specific)
 Patch1: ejabberd-0001-Fix-PAM-service-example-name-to-match-actual-one.patch
+# https://github.com/processone/ejabberd/issues/1850
+Patch2: ejabberd-0002-Drop-post_hook_configure-from-rebar.config.patch
 # Fedora-specific
 Patch3: ejabberd-0003-Install-into-BINDIR-instead-of-SBINDIR.patch
 # Fedora-specific
 Patch4: ejabberd-0004-Enable-systemd-notification-if-available.patch
-# Patch the ejabberdctl script to su with bash when run as root. Also patch out
-# code that tries to create the ejabberd user's home folder since that's the
-# RPM's job.
-Patch5: ejabberd-0005-ejabberdctl-should-not-try-to-create-the-ejabberd-us.patch
-
-BuildRequires:  elixir >= 1.2.6
-BuildRequires:  erlang-cache_tab >= 1.0.6
-BuildRequires:  erlang-esip >= 1.0.10
+
+
+BuildRequires:  elixir >= 1.4.4
+BuildRequires:  erlang-cache_tab >= 1.0.9
+BuildRequires:  erlang-esip >= 1.0.13
 BuildRequires:  erlang-ezlib >= 1.0.2
-BuildRequires:  erlang-fast_tls >= 1.0.10
-BuildRequires:  erlang-fast_xml >= 1.1.19
-BuildRequires:  erlang-fast_yaml >= 1.0.8
-BuildRequires:  erlang-iconv >= 1.0.3
+BuildRequires:  erlang-fast_tls >= 1.0.13
+BuildRequires:  erlang-fast_xml >= 1.1.23
+BuildRequires:  erlang-fast_yaml >= 1.0.10
+BuildRequires:  erlang-iconv >= 1.0.5
 BuildRequires:  erlang-jiffy >= 0.14.8
-BuildRequires:  erlang-lager >= 3.2.1
+BuildRequires:  erlang-lager >= 3.4.2
 BuildRequires:  erlang-luerl >= 0.2
 BuildRequires:  erlang-meck >= 0.8.4
 BuildRequires:  erlang-odbc
-BuildRequires:  erlang-p1_mysql >= 1.0.2
+BuildRequires:  erlang-p1_mysql >= 1.0.3
 BuildRequires:  erlang-p1_oauth2 >= 0.6.1
-BuildRequires:  erlang-epam >= 1.0.0
-BuildRequires:  erlang-p1_pgsql >= 1.1.2
-BuildRequires:  erlang-p1_utils >= 1.0.6
+BuildRequires:  erlang-p1_pam >= 1.0.3
+BuildRequires:  erlang-p1_pgsql >= 1.1.3
+BuildRequires:  erlang-p1_utils >= 1.0.9
 BuildRequires:  erlang-rebar
 BuildRequires:  erlang-riak_client
 BuildRequires:  erlang-sd_notify
-BuildRequires:  erlang-stringprep >= 1.0.7
-BuildRequires:  erlang-stun >= 1.0.9
-BuildRequires:  erlang-xmpp >= 1.1.6
+BuildRequires:  erlang-stringprep >= 1.0.9
+BuildRequires:  erlang-stun >= 1.0.12
+BuildRequires:  erlang-xmpp >= 1.1.13
 BuildRequires:  expat-devel >= 1.95
 BuildRequires:  git
 BuildRequires:  libyaml-devel >= 0.1.4
 BuildRequires:  openssl-devel >= 1.0.0
 BuildRequires:  pam-devel
+BuildRequires:  selinux-policy-devel
 
 BuildRequires:  autoconf
 BuildRequires:  automake
@@ -98,13 +102,24 @@ platforms (tested on Linux, FreeBSD, NetBSD, Solaris, Mac OS X and
 Windows NT/2000/XP).
 
 
-%prep
-%setup -q
+%package selinux
+BuildArch: noarch
+
+Summary: SELinux policy for ejabberd
+
+Requires: selinux-policy
+Requires: selinux-policy-targeted
+Requires(post): /usr/sbin/selinuxenabled
+Requires(post): /usr/sbin/semodule
+Requires(posttrans): /usr/sbin/restorecon
+
+
+%description selinux
+This is the SELinux policy for ejabberd.
 
-%patch1 -p1 -b .pam_name
-%patch3 -p1 -b .use_bindir
-%patch4 -p1 -b .enable_sd_notify
-%patch5 -p1 -b .su_with_bash
+
+%prep
+%autosetup -p1
 
 # Upstream seems to import erlang-xmpp and erlang-fast_xml in a way that isn't compatible with them
 # being system libraries. We need to patch the include statements to fix this.
@@ -117,16 +132,25 @@ find . -name "*.erl" | xargs sed -i "s/include(\"xmpp.hrl/include_lib(\"xmpp\/in
 find . -name "*.hrl" | xargs sed -i \
     "s/include(\"xmpp_codec.hrl/include_lib(\"xmpp\/include\/xmpp_codec.hrl/"
 
+# A few dependencies are configured to be found in the deps folder instead of in system libs
+# https://github.com/processone/ejabberd/issues/1850
+perl -p -i -e "s|deps/p1_utils/include|$(rpm -ql erlang-p1_utils | grep -E '/include$' )|g" rebar.config
+perl -p -i -e "s|deps/fast_xml/include|$(rpm -ql erlang-fast_xml | grep -E '/include$' )|g" rebar.config
+perl -p -i -e "s|deps/xmpp/include|$(rpm -ql erlang-xmpp | grep -E '/include$' )|g"   rebar.config
+
+cp %{S:14} %{S:15} %{S:16} .
+
 
 %build
 autoreconf -ivf
 
-# Disabled: --enable-hipe --enable-roster-gateway-workaround --enable-transient_supervisors
-#           --enable-full-xml --enable-mssql --enable-tools --enable-riak --enable-http
-%configure --enable-odbc --enable-mysql --enable-pgsql --enable-pam --enable-zlib --enable-iconv --enable-debug --enable-lager --libdir=%{_libdir}/erlang/lib/ --with-erlang=%{_libdir}/erlang/
+%configure --enable-odbc --enable-mysql --enable-pgsql --enable-pam --enable-zlib --enable-iconv --enable-debug --enable-lager --libdir=%{_libdir}/erlang/lib/ --with-erlang=%{_libdir}/erlang/ --enable-system-deps --enable-stun
 
 %{erlang_compile}
 
+# Build the SELinux policy
+make NAME=ejabberd -f /usr/share/selinux/devel/Makefile DISTRO=fedora%{fedora}
+
 
 %install
 %{erlang_install}
@@ -184,6 +208,13 @@ install -p -m 0644 priv/msgs/*.msg %{buildroot}%{_erllibdir}/%{name}-%{version}/
 install -D -p -m 0644 %{S:12} %{buildroot}%{_datadir}/polkit-1/actions/ejabberdctl.policy
 install -D -p -m 0644 %{S:13} %{buildroot}%{_datadir}/polkit-1/rules.d/51-ejabberdctl.rules
 
+# Install the SELinux policy
+install -d  %{buildroot}%{_datadir}/selinux/targeted
+install -d %{buildroot}%{_datadir}/selinux/devel/include/apps
+
+install -p -m 0644 ejabberd.pp %{buildroot}%{_datadir}/selinux/targeted/
+install -p -m 0644 ejabberd.if %{buildroot}%{_datadir}/selinux/devel/include/apps/
+
 
 %check
 %{rebar_eunit}
@@ -251,10 +282,27 @@ chmod 600 ejabberd.pem
 fi)
 
 
+%post selinux
+if /usr/sbin/selinuxenabled ; then
+/usr/sbin/semodule -i %{_datadir}/selinux/targeted/ejabberd.pp
+fi
+
+
+%posttrans selinux
+/usr/sbin/restorecon -i -R /var/lib/ejabberd/
+/usr/sbin/restorecon -i -R /var/log/ejabberd/
+
+
 %preun
 %systemd_preun %{name}.service
 
 
+%preun selinux
+if [ $1 -eq 0 ] && [ "$(/usr/sbin/semodule -l | grep ejabberd)" = "ejabberd" ]; then
+    /usr/sbin/semodule -s targeted -r ejabberd &> /dev/null
+fi
+
+
 %postun
 %systemd_postun_with_restart %{name}.service
 
@@ -296,7 +344,17 @@ fi)
 %attr(750,ejabberd,ejabberd) %dir /var/log/ejabberd
 
 
+%files selinux
+%{_datadir}/selinux/devel/include/apps/ejabberd.if
+%{_datadir}/selinux/targeted/ejabberd.pp
+
+
 %changelog
+* Sun Oct 22 2017 Randy Barlow <bowlofeggs@fedoraproject.org> - 17.07-1
+- Update to 17.07 (#1427123).
+- https://blog.process-one.net/ejabberd-17-07/
+- Add an SELinux policy subpackage.
+
 * Mon Oct 02 2017 Randy Barlow <bowlofeggs@fedoraproject.org> - 17.01-6
 - Depend on epam instead of p1_pam (#1494988).
 

diff --git a/ejabberd.te b/ejabberd.te
new file mode 100644
index 0000000..4498b11
--- /dev/null
+++ b/ejabberd.te
@@ -0,0 +1,62 @@
+policy_module(ejabberd,0.0)
+
+
+########################################
+#
+# Declarations
+#
+
+# Private type declarations
+type ejabberd_t;
+type ejabberd_exec_t;
+init_daemon_domain(ejabberd_t, ejabberd_exec_t)
+
+type ejabberd_unit_t;
+systemd_unit_file(ejabberd_unit_t)
+
+type ejabberd_var_lib_t;
+files_type(ejabberd_var_lib_t)
+
+type ejabberd_var_log_t;
+logging_log_file(ejabberd_var_log_t)
+
+
+# What will we allow
+allow ejabberd_t self:tcp_socket { accept bind connect create getattr getopt listen read setopt write };
+allow ejabberd_t self:udp_socket { bind connect create getattr getopt read setopt write };
+allow ejabberd_t self:unix_dgram_socket { connect create getopt setopt write };
+
+auth_use_nsswitch(ejabberd_t)
+
+corecmd_exec_bin(ejabberd_t)
+corecmd_exec_shell(ejabberd_t)
+
+corenet_tcp_bind_epmd_port(ejabberd_t)
+corenet_tcp_bind_generic_node(ejabberd_t)
+corenet_tcp_bind_generic_port(ejabberd_t)
+corenet_tcp_bind_jabber_client_port(ejabberd_t)
+corenet_tcp_bind_jabber_interserver_port(ejabberd_t)
+corenet_tcp_connect_epmd_port(ejabberd_t)
+corenet_tcp_connect_generic_port(ejabberd_t)
+corenet_tcp_connect_jabber_interserver_port(ejabberd_t)
+
+corenet_udp_bind_generic_node(ejabberd_t)
+
+dev_read_rand(ejabberd_t)
+dev_read_sysfs(ejabberd_t)
+
+files_search_var_lib(ejabberd_t, ejabberd_var_lib_t, dir)
+
+kernel_dgram_send(ejabberd_t)
+
+logging_create_devlog_dev(ejabberd_t)
+logging_log_filetrans(ejabberd_t, ejabberd_var_log_t, { dir file })
+
+manage_dirs_pattern(ejabberd_t, ejabberd_var_lib_t, ejabberd_var_lib_t)
+manage_dirs_pattern(ejabberd_t, ejabberd_var_log_t, ejabberd_var_log_t)
+manage_files_pattern(ejabberd_t, ejabberd_var_lib_t, ejabberd_var_lib_t)
+manage_files_pattern(ejabberd_t, ejabberd_var_log_t, ejabberd_var_log_t)
+
+miscfiles_read_generic_certs(ejabberd_t)
+
+sysnet_read_config(ejabberd_t)

diff --git a/sources b/sources
index 6c7b7da..141a21a 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (17.01.tar.gz) = 3724667080df3600cc27ed36d489006f2b84d32aefd8edbd853c3c6ee5b2d08a487a776b7f62c3611c0e164452f0216e470d109a28b5cea39b53397e6419ee3d
+SHA512 (ejabberd-17.07.tar.gz) = 1302f965ea049e198163a378c0c8b7e6f87e3c0d52ae56b9d13d77361ab1ec2dc4a8ef1ac0a8df7bfed0125fd28522a31664791714ca002a170a16fe805097d0