Changelog for
trousers-0.3.15-150400.118.2.x86_64.rpm :
* Mon Feb 26 2024 pgajdosAATTsuse.com- Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN
* Sat Dec 30 2023 gcomes.obsAATTgmail.com- add Requires(post): udev, Requires(post): coreutils
* the post scriptlet uses udevamd and chown
* Mon Aug 22 2022 dimstarAATTopensuse.org- BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors.
* Tue Apr 12 2022 meissnerAATTsuse.com- changed urls to https (except main URL which has no https)
* Thu Nov 25 2021 jsegitzAATTsuse.com- Added hardening to systemd service(s) (bsc#1181400). Modified:
* tcsd.service
* Tue Oct 05 2021 matthias.gerstnerAATTsuse.com- move libraries to /usr/lib (bsc#1191102)
* Thu Nov 05 2020 matthias.gerstnerAATTsuse.com- update to new upstream version 0.3.15: - Corrected mutliple security issues that existed if the tcsd is started by root instead of the tss user. CVE-2020-24332, CVE-2020-24330, CVE-2020-24331 - Replaced use of _no_optimize with asm memory barrier - Fixed multiple potential instances of use after free memory handling - Removed unused global variables which caused build issue on some distros- drop gcc-10.patch: now contained in upstream tarball- drop bsc1164472.patch: now contained in upstream tarball- adjusted %setup macro invocation which seemed to be wrong
* Mon Jul 27 2020 matthias.gerstnerAATTsuse.com- In a previous commit the Requires line for the tss user got accidentally dropped. This change reintroduces it.
* Tue Jun 02 2020 matthias.gerstnerAATTsuse.com- add gcc-10.patch: fixes the build on gcc 10 by removing unused global variables. This patch was posted on the TrouSerS mailing list [1]. [1]: https://sourceforge.net/p/trousers/mailman/message/36951419/
* Wed May 20 2020 matthias.gerstnerAATTsuse.com- get rid of %pre/%post logic that fixes the old packaging bug. Turns out %pretrans and %posttrans had their purpose before, because the logic needed to run before old files owned by the package got deleted. But I\'m not reimplementing this strange logic in Lua ... users that didn\'t get the fix yet will have to live with it.
* Wed May 20 2020 matthias.gerstnerAATTsuse.com- fix a potential tss user to root privilege escalation when running tcsd (bsc#1164472). To do this run tcsd as the \'tss\' user right away to prevent badly designed privilege drop and initialization code to run.- add bsc1164472.patch: additionally harden operation of tcsd when running as root. No longer follow symlinks in /var/lib/tpm. Drop gid to tss main group. require /etc/tcsd.conf to be owned by root:tss mode 0640.
* Wed May 13 2020 matthias.gerstnerAATTsuse.com- add correct Requires(pre) and change %pretrans and %posttrans into %pre and %post. %pretrans can\'t have any dependencies and therefore can only be %implemented in lua. This currently leads to build errors \"/bin/sh: no such file or directory\".
* Wed Feb 19 2020 matthias.gerstnerAATTsuse.com- leave creation of /var/lib/tpm to the new system-user-tss package. Otherwise we\'re getting conflicts in packages depending on trousers (bsc#1162360).
* Fri Jan 31 2020 msuchanekAATTsuse.com- Use system-users for tss user creation (boo#1162360).
* Tue Nov 26 2019 matthias.gerstnerAATTsuse.com- Fix a local symlink attack problem with the %posttrans scriptlet (bsc#1157651, CVE-2019-18898). A rogue tss user could have used this attack to gain ownership of arbitrary files in the system during installation/update of the trousers package.
* Mon Sep 09 2019 matthias.gerstnerAATTsuse.com- add fix-lto.patch: This fixes the rpmlint error: trousers-devel.x86_64: E: lto-no-text-in-archive (Badness: 10000) /usr/lib64/libtddl.a objcopy/strip seem not to support the LTO linking and discard the actual text section from libtddl.a. By passing -ffat-lto-objects the object format is kept compatible with unaware tools and fixes the error.
* Fri Apr 26 2019 mvetterAATTsuse.com- bsc#1130588: Require shadow instead of old pwdutils
* Fri Oct 26 2018 matthias.gerstnerAATTsuse.com- fix mode of /var/lib/tpm, was missing the execute bit in the previous version.- implement a backup and restore logic for /var/lib/tpm/system.data.
* to prevent removal of validly stored trousers state during update. See previous comment for the packaging error that leads to this requirement.
* Wed Oct 24 2018 matthias.gerstnerAATTsuse.com- fix wrong installation of system.data.{auth,noauth} into /var/lib/tpm. These files are only sample files that
*can
* be used to fake that ownership was already taken by trousers, when other TPM stacks did that already. These files should not be there by default. Therefore install them into /usr/share/trousers instead, to allow the user to use them at his own discretion (fixes bsc#1111381).
* Sun Jan 01 2017 mailaenderAATTopensuse.org- Update to version 0.3.14 (see ChangeLog) (FATE#321450)
* Fri May 06 2016 jengelhAATTinai.de- Check for user/group existence before attempting to add them, and remove error suppression from these calls.- Avoid runtime dependency on systemd, the macros can all deal with its absence.
* Fri Jun 19 2015 crrodriguezAATTopensuse.org- Force GNU inline semantics, fixes build with GCC5
* Thu Apr 02 2015 mpluskalAATTsuse.com- Cleanup spec-file with spec-cleaner- Update prerequires- Use systemd unit file
* replace tcsd.init with tcsd.service
