dev-db/postgresql: Security Bump

Security update fixes issues: 1. CVE-2015-5288: The crypt() function included with the optional pgCrypto extension could be exploited to read a few additional bytes of memory. No working exploit for this issue has been developed. 2. CVE-2015-5289: json or jsonb input values constructed from arbitrary user input can crash the PostgreSQL server and cause a denial of service. Also added note for new installations that re-sourcing /etc/profile is reuiqred to pick up environment changes, like MANPATH so man can find pages installed in non-standard locations. Package-Manager: portage-2.2.20.1
johu · Oct 8, 2015 · e32726a · e32726a
1 parent 6ad7838
commit e32726a
Show file tree

Hide file tree

Showing 9 changed files with 2,865 additions and 0 deletions.
diff --git a/dev-db/postgresql/Manifest b/dev-db/postgresql/Manifest
@@ -1,5 +1,12 @@
 DIST postgresql-9.0.22.tar.bz2 15046629 SHA256 94d4b20d854cd7fa4c9c322c0b602751edbc5ca0d4f29fe92f996e28bb32f8a5 SHA512 19e7888f92c0cc6c948dd78831768fd7184fc4bc25ca1950a76f5175ed1763b8a34949e90eebbb063b072fbcac64c9fdf6072f5a22eaaae0c33e93cf6c49955b WHIRLPOOL 8b785c90a40fc32975cb81a9d8bf22bdd8667fd26710a962cecbf81c25f6348b3c49f30a91066ad8bb1bffce55658bab50181a2a82e217a7e71d7d361f2e5d92
+DIST postgresql-9.0.23.tar.bz2 15045569 SHA256 3dbcbe19c814139a3f4be8bc6b49db804753cbc49979f345083e835c52b4d7de SHA512 db8fe64a5a5a1caae97e792ee5b8bcc375c6d6e10ef9c35f1003f174745568854dc5a7a58dbaf46794dcd35dee5a13f6eb1ba356f9618134b601b7759c753c9f WHIRLPOOL 5177facff628271a0d57d1f2925cfc04796020492c4102f0b0c6fa34149da9ddd9ccb0a38629e320521fe82163bdd4aa56f74af3a887ff4389cd9f62e921c53a
 DIST postgresql-9.1.18.tar.bz2 15822081 SHA256 2726d526666904b454f87fe2ae54357c2ab9eb8aba299a4c904829b7598584a8 SHA512 ba51e431c947b749c6522fd887ecbf50bf50cc08f2323b122a35fb18fccceb46d50f0e632a5b19df9855b5a29c98534d19f241d31e5bc235b0b06e8fb210210e WHIRLPOOL 59b5e6fb5626d630e41a8c0497480948d5bb0751fffbe1602dc62009948bad047c2ddc805caa3510157924c0fc74ead2fb2a71d0569d5c1b56eae753d9dbcd1a
+DIST postgresql-9.1.19.tar.bz2 15843978 SHA256 cbd5057451147dd63a1e764176a4e17a7795773be1e4266ea9faa951064c0ec6 SHA512 23dd4108556edcc667f599c5663356a1106bc239a1c5337d153c13a1e1871d52316825b84802bbc1d79612dfa4c9c77f4c4b96d59d23d7338988bdf370e956d4 WHIRLPOOL 6845fd8071032e987ab65a642ca04adbc8b464332bac8c346f01e011411947aa4341ea596fd910342124fcbae4cc25410c25ab695894b0b68d20441df5424722
 DIST postgresql-9.2.13.tar.bz2 16401289 SHA256 5dcbd6209a8c0f508504fa433486583a42caaa240c823e1b3576db8a72db6a44 SHA512 0bcf8284aad756a70cd5e6d34a9f2cc17825151740da1c90a459edbf188a9a366831b71999803d301f0de35a5778f524b72779818b89599ffeb41cf1c2140077 WHIRLPOOL 3859e3e5c994441bc931ee92042a08eeb7b1196301b603f311372c2c2c65083b38713f4eac3e06c243703c2446a260b1ae861b7690f1fea03184d0518b10b486
+DIST postgresql-9.2.14.tar.bz2 16451398 SHA256 54c20b3f320a48c38487f2711e98b2fa3f9ce4305905a294ad0449e8b4fb292e SHA512 268015d9e397ee62eebbbc9abf1ee25d0d4aa6bf5943b404009b3aab31f485b8523353c679beed34cc00304b9d4c7aca9de0ba841d9841dbf885d05d1a5692a1 WHIRLPOOL 4f6d5d6989a67d14082ddb215411b55d0dc0be29772e6a593b4df133489ff4a7e6c265d0830adba64d4c6be47e17a949cbc21d6570dceb9362399649af2be88e
+DIST postgresql-9.3.10.tar.bz2 16995860 SHA256 e5444f0f76aff98a251400b7c28bc361d65e3d72d8d6cb9bb5d8361a69541531 SHA512 6b048fd1d0b38f72bab6ea70e40f10e7b805b94fc4c6fd865e0ec5e86da3c54043f20059dbf716d29eb4ca787dc50da561b1c7b48ab9f3096ebc651300855672 WHIRLPOOL b8ea15a04d18535662832d444b556aedffaa8c954b52dcd42d548f53f93b8a9dbfbe9298f63c26d44c8b757e8c10d76711c303cd83c84d9c86bf23c2837e74ce
 DIST postgresql-9.3.9.tar.bz2 16959310 SHA256 f73bd0ec2028511732430beb22414a022d2114231366e8cbe78c149793910549 SHA512 c6a9cae07968c99039910bb98d3e365fc285d2cdef02dd594128bd69ae65926392b18b65b0e13c3f17c366413bffbe226b6e8ce3453774b0439745b18ea129a8 WHIRLPOOL bcbc66a7b846b42c2d17d187e8b2c751afda8e5cdc7fa385ba1145f84e34950fad3b82fc1d04ae7ff9b7de01fd5705d9e507aa841880b97df2edb2ac8749a5fd
 DIST postgresql-9.4.4.tar.bz2 17616272 SHA256 538ed99688d6fdbec6fd166d1779cf4588bf2f16c52304e5ef29f904c43b0013 SHA512 e0f0efc2e3a01c93dad98796476808d60be243841104ceb496d2227214a9b4c5a32c5f550f0a456b0c64f2458aae32026960b63f68188269d367d900683a6061 WHIRLPOOL 9041b4b4e1b53bc97345fe587bc874df1185ef76fe105bfb54e9c882f3fd51841448e92deb12e1415ce76158da0683fcff333e08b9e54a8be565562ebfec6175
+DIST postgresql-9.4.5.tar.bz2 17660960 SHA256 b87c50c66b6ea42a9712b5f6284794fabad0616e6ae420cf0f10523be6d94a39 SHA512 01ad4b5a097efa70f74a9e96b764c32953a9df57d6bf81b893a1e552475f6aba0381580dcd1f27b2c443ce89fecc429eeeb0219af60a0b2f84798f76eb1757f5 WHIRLPOOL 8ea0e9a40cefa53568071f2137bac996898f9bd486cfb5cfcf8bb49590816833f37878f10caabffb9d3127e047f00c916b8830594a485ebe16fb9fe6fc834c95
+DIST postgresql-9.5alpha1.tar.bz2 18103456 SHA256 c97779f6c539e9072fa853fca8273f910f08805ae74456a01ab1fd0841ecfca2 SHA512 b220bf7f3ac97aaa790d09f981c7050ebed0d08517e61749d10e2f837cac0de259ca650aae4c31295147d7791a1a8f1c973057448937e386fb197b1b03cf9ec1 WHIRLPOOL 7bfac23f5942bc557655f2c6f97d6ad1bf6bfd568fb0497ed127c50dec4ef07ae88f89568588e20e00f681c921a512b14e61f3ca6a506508d17e96d8eb4f0817
+DIST postgresql-9.5beta1.tar.bz2 18291273 SHA256 b53199e2667982de2039ad7e30467f67c5d7af678e69d6211de8ba1cac75c9f0 SHA512 e8881939bdba346f3770102324d7b011c16e4529603280459e17587e06d933c9f3505b40c5cc82ed3f0410ffd88b5e2f18b2a3272aa4680c3798cf7a0fcc0374 WHIRLPOOL 0cf2c3fd40b2a8d482da5a1597abbc20d239f577c6472a03f8d9795a3e8ef142dfaad7a1eeebf2b2544e34712c243bbd9de63fb4045c4ce15dbde8ec74acb707
diff --git a/dev-db/postgresql/postgresql-9.0.23.ebuild b/dev-db/postgresql/postgresql-9.0.23.ebuild
@@ -0,0 +1,382 @@
+# Copyright 1999-2015 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+EAPI="5"
+
+# Testing within Portage's environment is broken, and the patch no
+# longer applies cleanly.
+RESTRICT="test"
+
+PYTHON_COMPAT=( python{2_7,3_4} )
+
+inherit eutils flag-o-matic linux-info multilib pam prefix python-single-r1 \
+		systemd user versionator
+
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~ppc-macos ~x86-solaris"
+
+SLOT="$(get_version_component_range 1-2)"
+
+SRC_URI="mirror://postgresql/source/v${PV}/postgresql-${PV}.tar.bz2"
+
+LICENSE="POSTGRESQL GPL-2"
+DESCRIPTION="PostgreSQL RDBMS"
+HOMEPAGE="http://www.postgresql.org/"
+
+LINGUAS="af cs de en es fa fr hr hu it ko nb pl pt_BR ro ru sk sl sv tr
+		 zh_CN zh_TW"
+IUSE="doc kerberos kernel_linux ldap libressl nls pam perl -pg_legacytimestamp python
+	  +readline selinux +server ssl static-libs tcl threads uuid xml zlib"
+
+for lingua in ${LINGUAS}; do
+	IUSE+=" linguas_${lingua}"
+done
+
+wanted_languages() {
+	local enable_langs
+
+	for lingua in ${LINGUAS} ; do
+		use linguas_${lingua} && enable_langs+="${lingua} "
+	done
+
+	echo -n ${enable_langs}
+}
+
+CDEPEND="
+>=app-eselect/eselect-postgresql-1.2.0
+sys-apps/less
+virtual/libintl
+kerberos? ( virtual/krb5 )
+ldap? ( net-nds/openldap )
+pam? ( virtual/pam )
+perl? ( >=dev-lang/perl-5.8 )
+python? ( ${PYTHON_DEPS} )
+readline? ( sys-libs/readline:0= )
+ssl? (
+	!libressl? ( >=dev-libs/openssl-0.9.6-r1:0= )
+	libressl? ( dev-libs/libressl:= )
+)
+tcl? ( >=dev-lang/tcl-8:0= )
+uuid? ( dev-libs/ossp-uuid )
+xml? ( dev-libs/libxml2 dev-libs/libxslt )
+zlib? ( sys-libs/zlib )
+"
+
+DEPEND="${CDEPEND}
+!!<sys-apps/sandbox-2.0
+sys-devel/bison
+sys-devel/flex
+nls? ( sys-devel/gettext )
+xml? ( virtual/pkgconfig )
+"
+
+RDEPEND="${CDEPEND}
+!dev-db/postgresql-docs:${SLOT}
+!dev-db/postgresql-base:${SLOT}
+!dev-db/postgresql-server:${SLOT}
+selinux? ( sec-policy/selinux-postgresql )
+"
+
+pkg_setup() {
+	use server && CONFIG_CHECK="~SYSVIPC" linux-info_pkg_setup
+
+	enewgroup postgres 70
+	enewuser postgres 70 /bin/sh /var/lib/postgresql postgres
+
+	use python && python-single-r1_pkg_setup
+}
+
+src_prepare() {
+	# Work around PPC{,64} compilation bug where bool is already defined
+	sed '/#ifndef __cplusplus/a #undef bool' -i src/include/c.h || die
+
+	# Set proper run directory
+	sed "s|\(PGSOCKET_DIR\s\+\)\"/tmp\"|\1\"${EPREFIX}/run/postgresql\"|" \
+		-i src/include/pg_config_manual.h || die
+
+	epatch "${FILESDIR}/pg_ctl-exit-status.patch"
+
+	use server || epatch "${FILESDIR}/${PN}-${SLOT}-no-server.patch"
+
+	if use pam ; then
+		sed -e "s/\(#define PGSQL_PAM_SERVICE \"postgresql\)/\1-${SLOT}/" \
+			-i src/backend/libpq/auth.c || \
+			die 'PGSQL_PAM_SERVICE rename failed.'
+	fi
+
+	epatch_user
+}
+
+src_configure() {
+	case ${CHOST} in
+		*-darwin*|*-solaris*)
+			use nls && append-libs intl
+			;;
+	esac
+
+	export LDFLAGS_SL="${LDFLAGS}"
+	export LDFLAGS_EX="${LDFLAGS}"
+
+	local PO="${EPREFIX%/}"
+
+	econf \
+		--prefix="${PO}/usr/$(get_libdir)/postgresql-${SLOT}" \
+		--datadir="${PO}/usr/share/postgresql-${SLOT}" \
+		--docdir="${PO}/usr/share/doc/${PF}" \
+		--includedir="${PO}/usr/include/postgresql-${SLOT}" \
+		--mandir="${PO}/usr/share/postgresql-${SLOT}/man" \
+		--sysconfdir="${PO}/etc/postgresql-${SLOT}" \
+		--with-system-tzdata="${PO}/usr/share/zoneinfo" \
+		$(use_enable !pg_legacytimestamp integer-datetimes) \
+		$(use_enable threads thread-safety) \
+		$(use_with kerberos gssapi) \
+		$(use_with kerberos krb5) \
+		$(use_with ldap) \
+		$(use_with pam) \
+		$(use_with perl) \
+		$(use_with python) \
+		$(use_with readline) \
+		$(use_with ssl openssl) \
+		$(use_with tcl) \
+		$(use_with uuid ossp-uuid) \
+		$(use_with xml libxml) \
+		$(use_with xml libxslt) \
+		$(use_with zlib) \
+		"$(use_enable nls nls "$(wanted_languages)")"
+}
+
+src_compile() {
+	emake
+	emake -C contrib
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+	emake DESTDIR="${D}" install -C contrib
+
+	dodoc README HISTORY doc/{TODO,bug.template}
+
+	# man pages are already built, but if we have the target make them,
+	# they'll be generated from source before being installed so we
+	# manually install man pages.
+	# We use ${SLOT} instead of doman for postgresql.eselect
+	insinto /usr/share/postgresql-${SLOT}/man/
+	doins -r doc/src/sgml/man{1,3,7}
+	if ! use server; then
+		# Remove man pages for non-existent binaries
+		for m in {initdb,pg_{controldata,ctl,resetxlog},post{gres,master}}; do
+			rm "${ED}/usr/share/postgresql-${SLOT}/man/man1/${m}.1"
+		done
+	fi
+	docompress /usr/share/postgresql-${SLOT}/man/man{1,3,7}
+
+	insinto /etc/postgresql-${SLOT}
+	newins src/bin/psql/psqlrc.sample psqlrc
+
+	dodir /etc/eselect/postgresql/slots/${SLOT}
+	echo "postgres_ebuilds=\"\${postgres_ebuilds} ${PF}\"" > \
+		"${ED}/etc/eselect/postgresql/slots/${SLOT}/base"
+
+	use static-libs || find "${ED}" -name '*.a' -delete
+
+	if use doc ; then
+		docinto html
+		dodoc doc/src/sgml/html/*
+
+		docinto sgml
+		dodoc doc/src/sgml/*.{sgml,dsl}
+	fi
+
+	if use server; then
+		sed -e "s|@SLOT@|${SLOT}|g" -e "s|@LIBDIR@|$(get_libdir)|g" \
+			"${FILESDIR}/${PN}.confd" | newconfd - ${PN}-${SLOT}
+
+		sed -e "s|@SLOT@|${SLOT}|g" -e "s|@LIBDIR@|$(get_libdir)|g" \
+			"${FILESDIR}/${PN}.init-pre_9.2" | newinitd - ${PN}-${SLOT}
+
+		sed -e "s|@SLOT@|${SLOT}|g" -e "s|@LIBDIR@|$(get_libdir)|g" \
+			"${FILESDIR}/${PN}.service" | \
+			systemd_newunit - ${PN}-${SLOT}.service
+
+		systemd_newtmpfilesd "${FILESDIR}"/${PN}.tmpfilesd ${PN}-${SLOT}.conf
+
+		newbin "${FILESDIR}"/${PN}-check-db-dir ${PN}-${SLOT}-check-db-dir
+
+		use pam && pamd_mimic system-auth ${PN}-${SLOT} auth account session
+
+		if use prefix ; then
+			keepdir /run/postgresql
+			fperms 0775 /run/postgresql
+		fi
+	fi
+}
+
+pkg_postinst() {
+	postgresql-config update
+
+	elog "If you need a global psqlrc-file, you can place it in:"
+	elog "    ${EROOT%/}/etc/postgresql-${SLOT}/"
+
+	if [[ -z ${REPLACING_VERSIONS} ]] ; then
+		elog
+		elog "It looks like this is your first time installing PostgreSQL. Run the"
+		elog "following command in all active shells to pick up changes to the default"
+		elog "environemnt:"
+		elog "    source /etc/profile"
+	fi
+
+	if use server ; then
+		elog
+		elog "Gentoo specific documentation:"
+		elog "https://wiki.gentoo.org/wiki/PostgreSQL"
+		elog
+		elog "Official documentation:"
+		elog "http://www.postgresql.org/docs/${SLOT}/static/index.html"
+		elog
+		elog "The default location of the Unix-domain socket is:"
+		elog "    ${EROOT%/}/run/postgresql/"
+		elog
+		elog "Before initializing the database, you may want to edit PG_INITDB_OPTS"
+		elog "so that it contains your preferred locale in:"
+		elog "    ${EROOT%/}/etc/conf.d/postgresql-${SLOT}"
+		elog
+		elog "Then, execute the following command to setup the initial database"
+		elog "environment:"
+		elog "    emerge --config =${CATEGORY}/${PF}"
+	fi
+}
+
+pkg_prerm() {
+	if use server && [[ -z ${REPLACED_BY_VERSION} ]] ; then
+		ewarn "Have you dumped and/or migrated the ${SLOT} database cluster?"
+		ewarn "\thttps://wiki.gentoo.org/wiki/PostgreSQL/QuickStart#Migrating_PostgreSQL"
+
+		ebegin "Resuming removal in 10 seconds (Control-C to cancel)"
+		sleep 10
+		eend 0
+	fi
+}
+
+pkg_postrm() {
+	postgresql-config update
+}
+
+pkg_config() {
+	use server || die "USE flag 'server' not enabled. Nothing to configure."
+
+	[[ -f "${EROOT%/}/etc/conf.d/postgresql-${SLOT}" ]] \
+		&& source "${EROOT%/}/etc/conf.d/postgresql-${SLOT}"
+	[[ -z "${PGDATA}" ]] && PGDATA="${EROOT%/}/etc/postgresql-${SLOT}/"
+	[[ -z "${DATA_DIR}" ]] \
+		&& DATA_DIR="${EROOT%/}/var/lib/postgresql/${SLOT}/data"
+
+	# environment.bz2 may not contain the same locale as the current system
+	# locale. Unset and source from the current system locale.
+	if [ -f "${EROOT%/}/etc/env.d/02locale" ]; then
+		unset LANG
+		unset LC_CTYPE
+		unset LC_NUMERIC
+		unset LC_TIME
+		unset LC_COLLATE
+		unset LC_MONETARY
+		unset LC_MESSAGES
+		unset LC_ALL
+		source "${EROOT%/}/etc/env.d/02locale"
+		[ -n "${LANG}" ] && export LANG
+		[ -n "${LC_CTYPE}" ] && export LC_CTYPE
+		[ -n "${LC_NUMERIC}" ] && export LC_NUMERIC
+		[ -n "${LC_TIME}" ] && export LC_TIME
+		[ -n "${LC_COLLATE}" ] && export LC_COLLATE
+		[ -n "${LC_MONETARY}" ] && export LC_MONETARY
+		[ -n "${LC_MESSAGES}" ] && export LC_MESSAGES
+		[ -n "${LC_ALL}" ] && export LC_ALL
+	fi
+
+	einfo "You can modify the paths and options passed to initdb by editing:"
+	einfo "    ${EROOT%/}/etc/conf.d/postgresql-${SLOT}"
+	einfo
+	einfo "Information on options that can be passed to initdb are found at:"
+	einfo "    http://www.postgresql.org/docs/${SLOT}/static/creating-cluster.html"
+	einfo "    http://www.postgresql.org/docs/${SLOT}/static/app-initdb.html"
+	einfo
+	einfo "PG_INITDB_OPTS is currently set to:"
+	if [[ -z "${PG_INITDB_OPTS}" ]] ; then
+		einfo "    (none)"
+	else
+		einfo "    ${PG_INITDB_OPTS}"
+	fi
+	einfo
+	einfo "Configuration files will be installed to:"
+	einfo "    ${PGDATA}"
+	einfo
+	einfo "The database cluster will be created in:"
+	einfo "    ${DATA_DIR}"
+	einfo
+	while [ "$correct" != "true" ] ; do
+		einfo "Are you ready to continue? (y/n)"
+		read answer
+		if [[ $answer =~ ^[Yy]([Ee][Ss])?$ ]] ; then
+			correct="true"
+		elif [[ $answer =~ ^[Nn]([Oo])?$ ]] ; then
+			die "Aborting initialization."
+		else
+			echo "Answer not recognized"
+		fi
+	done
+
+	if [ -n "$(ls -A ${DATA_DIR} 2> /dev/null)" ] ; then
+		eerror "The given directory, '${DATA_DIR}', is not empty."
+		eerror "Modify DATA_DIR to point to an empty directory."
+		die "${DATA_DIR} is not empty."
+	fi
+
+	einfo "Creating the data directory ..."
+	if [[ ${EUID} == 0 ]] ; then
+		mkdir -p "${DATA_DIR}"
+		chown -Rf postgres:postgres "${DATA_DIR}"
+		chmod 0700 "${DATA_DIR}"
+	fi
+
+	einfo "Initializing the database ..."
+
+	if [[ ${EUID} == 0 ]] ; then
+		su postgres -c "${EROOT%/}/usr/$(get_libdir)/postgresql-${SLOT}/bin/initdb -D \"${DATA_DIR}\" ${PG_INITDB_OPTS}"
+	else
+		"${EROOT%/}"/usr/$(get_libdir)/postgresql-${SLOT}/bin/initdb -U postgres -D "${DATA_DIR}" ${PG_INITDB_OPTS}
+	fi
+
+	if [[ "${DATA_DIR%/}" != "${PGDATA%/}" ]] ; then
+		mv "${DATA_DIR%/}"/{pg_{hba,ident},postgresql}.conf "${PGDATA}"
+		ln -s "${PGDATA%/}"/{pg_{hba,ident},postgresql}.conf "${DATA_DIR%/}"
+	fi
+
+	cat <<- EOF >> "${PGDATA%/}"/postgresql.conf
+		# This is here because of https://bugs.gentoo.org/show_bug.cgi?id=518522
+		# On the off-chance that you might need to work with UTF-8 encoded
+		# characters in PL/Perl
+		plperl.on_init = 'use utf8; use re; package utf8; require "utf8_heavy.pl";'
+	EOF
+
+	einfo "The autovacuum function, which was in contrib, has been moved to the main"
+	einfo "PostgreSQL functions starting with 8.1, and starting with 8.4 is now enabled"
+	einfo "by default. You can disable it in the cluster's:"
+	einfo "    ${PGDATA%/}/postgresql.conf"
+	einfo
+	einfo "The PostgreSQL server, by default, will log events to:"
+	einfo "    ${DATA_DIR%/}/postmaster.log"
+	einfo
+	if use prefix ; then
+		einfo "The location of the configuration files have moved to:"
+		einfo "    ${PGDATA}"
+		einfo "To start the server:"
+		einfo "    pg_ctl start -D ${DATA_DIR} -o '-D ${PGDATA} --data-directory=${DATA_DIR}'"
+		einfo "To stop:"
+		einfo "    pg_ctl stop -D ${DATA_DIR}"
+		einfo
+		einfo "Or move the configuration files back:"
+		einfo "mv ${PGDATA}*.conf ${DATA_DIR}"
+	else
+		einfo "You should use the '${EROOT%/}/etc/init.d/postgresql-${SLOT}' script to run PostgreSQL"
+		einfo "instead of 'pg_ctl'."
+	fi
+}