CVE-2021-44225.patch

@@ -1,39 +0,0 @@
-From 7977fec0be89ae6fe87405b3f8da2f0b5e415e3d Mon Sep 17 00:00:00 2001
-From: Vincent Bernat <vincent@bernat.ch>
-Date: Tue, 23 Nov 2021 06:50:59 +0100
-Subject: [PATCH] dbus: fix policy to not be overly broad
-The DBus policy did not restrict the message destination, allowing any
-user to inspect and manipulate any property.
-CVE-2021-44225
-https://nvd.nist.gov/vuln/detail/CVE-2021-44225
-Reference:https://github.com/acassen/keepalived/commit/7977fec0be89ae6fe87405b3f8da2f0b5e415e3d.patch
-Conflict:NA
-Signed-off-by: Vincent Bernat <vincent@bernat.ch>
----
- keepalived/dbus/org.keepalived.Vrrp1.conf | 13 ++++++++-----
- 1 file changed, 8 insertions(+), 5 deletions(-)
-diff --git a/keepalived/dbus/org.keepalived.Vrrp1.conf b/keepalived/dbus/org.keepalived.Vrrp1.conf
-index 2b78a575c..b5ced6085 100644
---- a/keepalived/dbus/org.keepalived.Vrrp1.conf
-+++ b/keepalived/dbus/org.keepalived.Vrrp1.conf
-@@ -3,12 +3,15 @@
-  "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
- <busconfig>
- 	<policy user="root">
--		<allow own="org.keepalived.Vrrp1"/>
--		<allow send_destination="org.keepalived.Vrrp1"/>
-+		<allow own="org.keepalived.Vrrp1" />
-+		<allow send_destination="org.keepalived.Vrrp1" />
- 	</policy>
- 	<policy context="default">
--		<allow send_interface="org.freedesktop.DBus.Introspectable" />
--		<allow send_interface="org.freedesktop.DBus.Peer" />
--		<allow send_interface="org.freedesktop.DBus.Properties" />
-+		<allow send_destination="org.keepalived.Vrrp1"
-+		       send_interface="org.freedesktop.DBus.Introspectable" />
-+		<allow send_destination="org.keepalived.Vrrp1"
-+		       send_interface="org.freedesktop.DBus.Peer" />
-+		<allow send_destination="org.keepalived.Vrrp1"
-+		       send_interface="org.freedesktop.DBus.Properties" />
- 	</policy>
- </busconfig>

keepalived.service

@@ -5,7 +5,7 @@ Wants=network-online.target
 
 [Service]
 Type=forking
-PIDFile=/run/keepalived.pid
+PIDFile=/var/run/keepalived.pid
 KillMode=process
 EnvironmentFile=-/etc/sysconfig/keepalived
 ExecStart=/usr/sbin/keepalived $KEEPALIVED_OPTIONS

keepalived.spec

@@ -2,13 +2,12 @@
 %bcond_without vrrp
 %bcond_without sha1
 %bcond_with profile
-%bcond_without nftables
 %bcond_with debug
 
 %global _hardened_build 1
 
 Name:		keepalived
-Version:	2.2.4
+Version:	2.0.12
 Release:	2
 Summary:	High Availability monitor built upon LVS, VRRP and service pollers
 License:	GPLv2+
@@ -16,11 +15,8 @@ URL:		http://www.keepalived.org/
 Source0:	http://www.keepalived.org/software/keepalived-%{version}.tar.gz
 Source1: 	keepalived.service
 
-Patch0001:	CVE-2021-44225.patch
-
 BuildRequires:	net-snmp-devel gcc systemd-units openssl-devel libnl3-devel
-BuildRequires:  ipset-devel iptables-devel libnfnetlink-devel libnftnl-devel
-BuildRequires:  file-devel libmnl-devel
+BuildRequires:  ipset-devel iptables-devel libnfnetlink-devel
 %{?systemd requires}
 
 %description
@@ -42,13 +38,12 @@ or all together to provide resilient infrastructures.
 %package_help
 
 %prep
-%autosetup -n %{name}-%{version} -p1
+%autosetup -n %{name}-%{version}
 
 %build
 %configure  %{?with_debug:--enable-debug}  %{?with_profile:--enable-profile} \
             %{!?with_vrrp:--disable-vrrp} %{?with_sha1:--enable-sha1} \
 	    --with-init=systemd %{!?with_vrrp:--disable-vrrp} \
-            %{?with_nftables:--enable-nftables --disable-iptables --disable-ipset} \
 	    %{?with_snmp:--enable-snmp --enable-snmp-rfc} \
             
 %make_build STRIP=/bin/true
@@ -92,23 +87,5 @@ install -Dd -m 0755 %{buildroot}%{_libexecdir}/keepalived
 %{_mandir}/man*
 
 %changelog
-* Tue Mar 29 2022 kwb0523 <kwb0523@163.com> -  2.2.4-2
-- Type:bugfix
-- ID:NA 
-- SUG:NA
-- DESC:fix CVE-2021-44225
-
-* Tue Dec 21 2021 kwb0523 <kwb0523@163.com> -  2.2.4-1
-- Type:bugfix
-- ID:NA 
-- SUG:NA
-- DESC:upgrade keepalived to 2.2.4
-
-* Thu Jun 10 2021 wangxp006 <wangxp006@163.com> -  2.0.20-3
-- Type:bugfix
-- ID:NA 
-- SUG:NA
-- DESC:backport upstream patches
-
-* Tue May 12 2020 openEuler Buildteam <buildteam@openeuler.org> - 2.0.20-2
+* Sat Dec 21 2019 openEuler Buildteam <buildteam@openeuler.org> - 2.0.12-2
 - Package init