!133 [sync] PR-132: Improve farm systemd services

From: @openeuler-sync-bot 
Reviewed-by: @wk333 
Signed-off-by: @wk333

CVE-2024-3019.patch

@@ -0,0 +1,31 @@
+From 3bde240a2acc85e63e2f7813330713dd9b59386e Mon Sep 17 00:00:00 2001
+From: Nathan Scott <nathans@redhat.com>
+Date: Wed, 27 Mar 2024 14:51:28 +1100
+Subject: [PATCH] pmproxy: disable Redis protocol proxying by default
+
+origin: https://github.com/performancecopilot/pcp/commit/3bde240a2acc85e63e2f7813330713dd9b59386e
+
+If a redis-server has been locked down in terms of connections,
+we want to prevent pmproxy from being allowed to send arbitrary
+RESP commands to it.
+
+This protocol proxying doesn't affect PCP functionality at all,
+its more of a developer/sysadmin convenience when Redis used in
+cluster mode (relatively uncommon compared to localhost mode).
+---
+ src/pmproxy/pmproxy.conf | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/pmproxy/pmproxy.conf b/src/pmproxy/pmproxy.conf
+index e54891792e..4cbc1c96af 100644
+--- a/src/pmproxy/pmproxy.conf
++++ b/src/pmproxy/pmproxy.conf
+@@ -29,7 +29,7 @@ pcp.enabled = true
+ http.enabled = true
+ 
+ # support Redis protocol proxying
+-redis.enabled = true
++redis.enabled = false
+ 
+ # support SSL/TLS protocol wrapping
+ secure.enabled = true

fix-out-of-range-mpstat.patch

@@ -0,0 +1,26 @@
+From 9e7d6b2796f669a5e41f5e4fb5ea349a39d8795b Mon Sep 17 00:00:00 2001
+From: caodongxia <315816521@qq.com>
+Date: Thu, 14 Jul 2022 15:16:42 +0800
+Subject: [PATCH] fix out of range
+
+---
+ src/pcp/mpstat/pcp-mpstat.py | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/pcp/mpstat/pcp-mpstat.py b/src/pcp/mpstat/pcp-mpstat.py
+index fefb6aa..17da944 100755
+--- a/src/pcp/mpstat/pcp-mpstat.py
++++ b/src/pcp/mpstat/pcp-mpstat.py
+@@ -602,6 +602,9 @@ class MpstatReport(pmcc.MetricGroupPrinter):
+             # need two fetches to report rate converted counter metrics
+             return
+ 
++        if not group['hinv.ncpu'].netValues or not group['kernel.uname.sysname'].netValues:
++            return
++
+         if self.Machine_info_count == 0:
+             self.print_machine_info(group, manager)
+             self.Machine_info_count = 1
+-- 
+2.23.0
+

pcp.spec

@@ -55,10 +55,18 @@
 Name:             pcp
 Version:          5.3.7
 Summary:          System-level performance monitoring and performance management
-Release:          2
+Release:          7
 License:          GPL-2.0-or-later and LGPL-2.0-or-later and CC-BY-SA-3.0
 URL:              https://pcp.io
 Source0:          https://github.com/performancecopilot/pcp/archive/refs/tags/%{version}.tar.gz
+#Refer:           https://github.com/performancecopilot/pcp/pull/822
+Patch0:           fix-out-of-range-mpstat.patch
+Patch1:           CVE-2024-3019.patch
+Patch2:           redhat-issues-RHEL-57796-pmcd-pmstore-corruption.patch
+Patch3:           redhat-issues-RHEL-57799-pmpost-symlink-handling.patch
+Patch4:           redhat-bugzilla-2135314-pmfind-fix.patch
+Patch5:           redhat-issues-RHEL-34586-pmproxy-pmcd-fd-leak.patch
+Patch6:           redhat-issues-RHEL-57788-pmdahacluster-update.patch
 BuildRequires: make
 BuildRequires: gcc gcc-c++
 BuildRequires: procps autoconf bison flex
@@ -1021,7 +1029,7 @@ monitoring systems using live and archived Performance Co-Pilot
 
 %package selinux
 Summary:          PCP selinux policy
-License:          GPLv2+ and CC-BY
+License:          GPL-2.0-or-later and CC-BY-3.0
 BuildRequires:    selinux-policy-devel selinux-policy-targeted setools-console
 Requires:         policycoreutils selinux-policy-targeted
 %description selinux
@@ -1385,10 +1393,8 @@ exit 0
 
 %post devel
 chown -R pcpqa:pcpqa %{_testsdir} 2>/dev/null
-systemctl restart pmcd >/dev/null 2>&1
-systemctl restart pmlogger >/dev/null 2>&1
-systemctl enable pmcd >/dev/null 2>&1
-systemctl enable pmlogger >/dev/null 2>&1
+systemctl restart pmcd pmlogger >/dev/null 2>&1
+systemctl enable pmcd pmlogger >/dev/null 2>&1
 exit 0
 
 %pre
@@ -1617,32 +1623,16 @@ exit 0
 %preun zeroconf
 if [ "$1" -eq 0 ]
 then
-    %systemd_preun pmlogger_daily_report.timer
-    %systemd_preun pmlogger_daily_report.service
+    %systemd_preun pmlogger_daily_report.timer pmlogger_daily_report.service
 fi
 
 %preun
 if [ "$1" -eq 0 ]
 then
-    %systemd_preun pmlogger.service
-    %systemd_preun pmlogger_farm.service
-    %systemd_preun pmie.service
-    %systemd_preun pmie_farm.service
-    %systemd_preun pmproxy.service
-    %systemd_preun pmcd.service
-    %systemd_preun pmie_daily.timer
-    %systemd_preun pmlogger_daily.timer
-    %systemd_preun pmlogger_check.timer
-    %systemd_preun pmlogger_farm_check.timer
-    %systemd_preun pmie_farm_check.timer
+    %systemd_preun pmlogger_check.timer pmlogger_daily.timer pmlogger_farm_check.timer pmlogger_farm_check.service pmlogger_farm.service pmlogger.service pmie_check.timer pmie_daily.timer pmie_farm_check.timer pmie_farm_check.service pmie_farm.service pmie.service pmproxy.service pmfind.service pmcd.service
+ 
+    systemctl stop pmlogger.service pmie.service pmproxy.service pmfind.service pmcd.service >/dev/null 2>&1
 
-    systemctl stop pmlogger.service >/dev/null 2>&1
-    systemctl stop pmlogger_farm.service >/dev/null 2>&1
-    systemctl stop pmie.service >/dev/null 2>&1
-    systemctl stop pmie_farm.service >/dev/null 2>&1
-    systemctl stop pmproxy.service >/dev/null 2>&1
-    systemctl stop pmcd.service >/dev/null 2>&1
-    
     PCP_PMNS_DIR=%{_pmnsdir}
     rm -f "$PCP_PMNS_DIR/.NeedRebuild" >/dev/null 2>&1
 fi
@@ -1658,16 +1648,8 @@ for PMDA in dm nfsclient openmetrics ; do
     fi
 done
 pmieconf -c enable dmthin
-systemctl restart pmcd >/dev/null 2>&1
-systemctl restart pmlogger >/dev/null 2>&1
-systemctl restart pmlogger_farm >/dev/null 2>&1
-systemctl restart pmie >/dev/null 2>&1
-systemctl restart pmie_farm >/dev/null 2>&1
-systemctl enable pmcd >/dev/null 2>&1
-systemctl enable pmlogger >/dev/null 2>&1
-systemctl enable pmlogger_farm >/dev/null 2>&1
-systemctl enable pmie >/dev/null 2>&1
-systemctl enable pmie_farm >/dev/null 2>&1
+systemctl restart pmcd pmlogger pmie >/dev/null 2>&1
+systemctl enable pmcd pmlogger pmie >/dev/null 2>&1
 
 %post selinux
 %{selinux_handle_policy "$1" "pcpupstream"}
@@ -1685,28 +1667,15 @@ PCP_LOG_DIR=%{_logsdir}
 %{install_file "$PCP_LOG_DIR/pmlogger" .NeedRewrite}
 rm -f %{_sysconfdir}/systemd/system/pm*.requires/pm*-poll.* >/dev/null 2>&1 || true
 
-if systemctl is-enabled pmlogger.service >/dev/null; then
-systemctl enable pmlogger_farm.service pmlogger_farm_check.service
-systemctl start pmlogger_farm.service pmlogger_farm_check.service
-fi
-if systemctl is-enabled pmie.service >/dev/null; then
-systemctl enable pmie_farm.service pmie_farm_check.service
-systemctl start pmie_farm.service pmie_farm_check.service
-fi
-
 %systemd_postun_with_restart pmcd.service
 %systemd_post pmcd.service
 %systemd_postun_with_restart pmlogger.service
 %systemd_post pmlogger.service
-%systemd_postun_with_restart pmlogger_farm.service
-%systemd_post pmlogger_farm.service
-%systemd_post pmlogger_farm_check.service
 %systemd_postun_with_restart pmie.service
 %systemd_post pmie.service
-%systemd_postun_with_restart pmie_farm.service
-%systemd_post pmie_farm.service
-%systemd_post pmie_farm_check.service
-systemctl condrestart pmproxy.service >/dev/null 2>&1
+%systemd_postun_with_restart pmproxy.service
+%systemd_post pmproxy.service
+%systemd_post pmfind.service
 %{rebuild_pmns "$PCP_PMNS_DIR" .NeedRebuild}
 
 %ldconfig_scriptlets libs
@@ -1930,6 +1899,26 @@ systemctl condrestart pmproxy.service >/dev/null 2>&1
 
 
 %changelog
+* Mon Mar 17 2025 wangkai <13474090681@163.com> - 5.3.7-7
+- Improve farm systemd services
+
+* Mon Oct 14 2024 wangkai <13474090681@163.com> - 5.3.7-6
+- Fix CVE-2024-45769,CVE-2024-45770
+- Fix buffer sizing checks in pmstore PDU handling (RHEL-57805)
+- Guard against symlink attacks in pmpost program (RHEL-57810)
+- Fix libpcp_web webgroup slow request refcounting (RHEL-58306)
+- Updated pmdahacluster for newer crm_mon versions (RHEL-50693)
+- Fix invalid memory access in pmfind utility (BZ 2135314)
+
+* Thu Jun 13 2024 wangkai <13474090681@163.com> - 5.3.7-5
+- License compliance rectification
+
+* Fri Mar 29 2024 wangkai <13474090681@163.com> - 5.3.7-4
+- Fix CVE-2024-3019
+
+* Mon Feb 13 2023 wangkai <wangkai385@h-partners.com> - 5.3.7-3
+- Fix out of range in pcp-mpstat
+
 * Thu Nov 17 2022 caodongxia <caodongxia@h-partners.com> - 5.3.7-2
 - Replace openEuler with vendor macro
 

redhat-bugzilla-2135314-pmfind-fix.patch

@@ -0,0 +1,534 @@
+diff -Naurp pcp-5.3.7.orig/qa/1985 pcp-5.3.7/qa/1985
+--- pcp-5.3.7.orig/qa/1985	1970-01-01 10:00:00.000000000 +1000
++++ pcp-5.3.7/qa/1985	2022-10-19 21:32:03.971832371 +1100
+@@ -0,0 +1,38 @@
++#!/bin/sh
++# PCP QA Test No. 1985
++# Exercise a pmfind fix - valgrind-enabled variant.
++#
++# Copyright (c) 2022 Red Hat.  All Rights Reserved.
++#
++
++seq=`basename $0`
++echo "QA output created by $seq"
++
++# get standard environment, filters and checks
++. ./common.product
++. ./common.filter
++. ./common.check
++
++_check_valgrind
++
++_cleanup()
++{
++    cd $here
++    $sudo rm -rf $tmp $tmp.*
++}
++
++status=0	# success is the default!
++$sudo rm -rf $tmp $tmp.* $seq.full
++trap "_cleanup; exit \$status" 0 1 2 3 15
++
++# real QA test starts here
++export seq
++./1986 --valgrind \
++| $PCP_AWK_PROG '
++skip == 1 && $1 == "==="       { skip = 0 }
++/^=== std err ===/             { skip = 1 }
++skip == 0              { print }
++skip == 1              { print >>"'$here/$seq.full'" }'
++
++# success, all done
++exit
+diff -Naurp pcp-5.3.7.orig/qa/1985.out pcp-5.3.7/qa/1985.out
+--- pcp-5.3.7.orig/qa/1985.out	1970-01-01 10:00:00.000000000 +1000
++++ pcp-5.3.7/qa/1985.out	2022-10-19 21:32:03.971832371 +1100
+@@ -0,0 +1,11 @@
++QA output created by 1985
++QA output created by 1986 --valgrind
++=== std out ===
++SOURCE HOSTNAME
++=== filtered valgrind report ===
++Memcheck, a memory error detector
++Command: pmfind -S -m probe=127.0.0.1/32
++LEAK SUMMARY:
++definitely lost: 0 bytes in 0 blocks
++indirectly lost: 0 bytes in 0 blocks
++ERROR SUMMARY: 0 errors from 0 contexts ...
+diff -Naurp pcp-5.3.7.orig/qa/1986 pcp-5.3.7/qa/1986
+--- pcp-5.3.7.orig/qa/1986	1970-01-01 10:00:00.000000000 +1000
++++ pcp-5.3.7/qa/1986	2022-10-19 21:32:03.971832371 +1100
+@@ -0,0 +1,62 @@
++#!/bin/sh
++# PCP QA Test No. 1986
++# Exercise libpcp_web timers pmfind regression fix.
++#
++# Copyright (c) 2022 Red Hat.  All Rights Reserved.
++#
++
++if [ $# -eq 0 ]
++then
++    seq=`basename $0`
++    echo "QA output created by $seq"
++else
++    # use $seq from caller, unless not set
++    [ -n "$seq" ] || seq=`basename $0`
++    echo "QA output created by `basename $0` $*"
++fi
++
++# get standard environment, filters and checks
++. ./common.product
++. ./common.filter
++. ./common.check
++
++do_valgrind=false
++if [ "$1" = "--valgrind" ]
++then
++    _check_valgrind
++    do_valgrind=true
++fi
++
++test -x $PCP_BIN_DIR/pmfind || _notrun No support for pmfind
++
++_cleanup()
++{
++    cd $here
++    $sudo rm -rf $tmp $tmp.*
++}
++
++status=0	# success is the default!
++hostname=`hostname || echo localhost`
++$sudo rm -rf $tmp $tmp.* $seq.full
++trap "_cleanup; exit \$status" 0 1 2 3 15
++
++_filter()
++{
++    sed \
++	-e "s@$tmp@TMP@g" \
++	-e "s/ $hostname/ HOSTNAME/" \
++	-e 's/^[a-f0-9][a-f0-9]* /SOURCE /' \
++    # end
++}
++
++# real QA test starts here
++if $do_valgrind
++then
++    _run_valgrind pmfind -S -m probe=127.0.0.1/32
++else
++    pmfind -S -m probe=127.0.0.1/32
++fi \
++| _filter
++
++# success, all done
++exit
+diff -Naurp pcp-5.3.7.orig/qa/1986.out pcp-5.3.7/qa/1986.out
+--- pcp-5.3.7.orig/qa/1986.out	1970-01-01 10:00:00.000000000 +1000
++++ pcp-5.3.7/qa/1986.out	2022-10-19 21:32:03.971832371 +1100
+@@ -0,0 +1,2 @@
++QA output created by 1986
++SOURCE HOSTNAME
+diff -Naurp pcp-5.3.7.orig/qa/group pcp-5.3.7/qa/group
+--- pcp-5.3.7.orig/qa/group	2022-10-19 20:49:42.638708707 +1100
++++ pcp-5.3.7/qa/group	2022-10-19 21:32:03.972832359 +1100
+@@ -1974,4 +1974,6 @@ x11
+ 1957 libpcp local valgrind
+ 1978 atop local
+ 1984 pmlogconf pmda.redis local
++1985 pmfind local valgrind
++1986 pmfind local
+ 4751 libpcp threads valgrind local pcp helgrind
+diff -Naurp pcp-5.3.7.orig/src/libpcp_web/src/webgroup.c pcp-5.3.7/src/libpcp_web/src/webgroup.c
+--- pcp-5.3.7.orig/src/libpcp_web/src/webgroup.c	2021-11-01 13:02:26.000000000 +1100
++++ pcp-5.3.7/src/libpcp_web/src/webgroup.c	2022-10-19 21:32:03.973832346 +1100
+@@ -287,11 +287,24 @@ webgroup_new_context(pmWebGroupSettings
+ }
+ 
+ static void
++webgroup_timers_stop(struct webgroups *groups)
++{
++    if (groups->active) {
++	uv_timer_stop(&groups->timer);
++	uv_close((uv_handle_t *)&groups->timer, NULL);
++	pmWebTimerRelease(groups->timerid);
++	groups->timerid = -1;
++	groups->active = 0;
++    }
++}
++
++static void
+ webgroup_garbage_collect(struct webgroups *groups)
+ {
+     dictIterator        *iterator;
+     dictEntry           *entry;
+     context_t		*cp;
++    unsigned int	count = 0, drops = 0;
+ 
+     if (pmDebugOptions.http || pmDebugOptions.libweb)
+ 	fprintf(stderr, "%s: started\n", "webgroup_garbage_collect");
+@@ -308,33 +321,40 @@ webgroup_garbage_collect(struct webgroup
+ 		uv_mutex_unlock(&groups->mutex);
+ 		webgroup_drop_context(cp, groups);
+ 		uv_mutex_lock(&groups->mutex);
++		drops++;
+ 	    }
++	    count++;
+ 	}
+ 	dictReleaseIterator(iterator);
++
++	/* if dropping the last remaining context, do cleanup */
++	if (groups->active && drops == count) {
++	    if (pmDebugOptions.http || pmDebugOptions.libweb)
++		fprintf(stderr, "%s: freezing\n", "webgroup_garbage_collect");
++	    webgroup_timers_stop(groups);
++	}
+ 	uv_mutex_unlock(&groups->mutex);
+     }
+ 
+     if (pmDebugOptions.http || pmDebugOptions.libweb)
+-	fprintf(stderr, "%s: finished\n", "webgroup_garbage_collect");
++	fprintf(stderr, "%s: finished [%u drops from %u entries]\n",
++			"webgroup_garbage_collect", drops, count);
+ }
+ 
+ static void
+ refresh_maps_metrics(void *data)
+ {
+     struct webgroups	*groups = (struct webgroups *)data;
++    unsigned int	value;
+ 
+-    if (groups->metrics) {
+-	unsigned int	value;
+-
+-	value = dictSize(contextmap);
+-	mmv_set(groups->map, groups->metrics[CONTEXT_MAP_SIZE], &value);
+-	value = dictSize(namesmap);
+-	mmv_set(groups->map, groups->metrics[NAMES_MAP_SIZE], &value);
+-	value = dictSize(labelsmap);
+-	mmv_set(groups->map, groups->metrics[LABELS_MAP_SIZE], &value);
+-	value = dictSize(instmap);
+-	mmv_set(groups->map, groups->metrics[INST_MAP_SIZE], &value);
+-    }
++    value = contextmap? dictSize(contextmap) : 0;
++    mmv_set(groups->map, groups->metrics[CONTEXT_MAP_SIZE], &value);
++    value = namesmap? dictSize(namesmap) : 0;
++    mmv_set(groups->map, groups->metrics[NAMES_MAP_SIZE], &value);
++    value = labelsmap? dictSize(labelsmap) : 0;
++    mmv_set(groups->map, groups->metrics[LABELS_MAP_SIZE], &value);
++    value = instmap? dictSize(instmap) : 0;
++    mmv_set(groups->map, groups->metrics[INST_MAP_SIZE], &value);
+ }
+ 
+ static void
+@@ -487,6 +507,7 @@ pmWebGroupDestroy(pmWebGroupSettings *se
+ 	if (pmDebugOptions.libweb)
+ 	    fprintf(stderr, "%s: destroy context %p gp=%p\n", "pmWebGroupDestroy", cp, gp);
+ 
++	webgroup_deref_context(cp);
+ 	webgroup_drop_context(cp, gp);
+     }
+     sdsfree(msg);
+@@ -2394,17 +2415,12 @@ pmWebGroupClose(pmWebGroupModule *module
+ 
+     if (groups) {
+ 	/* walk the contexts, stop timers and free resources */
+-	if (groups->active) {
+-	    groups->active = 0;
+-	    uv_timer_stop(&groups->timer);
+-	    pmWebTimerRelease(groups->timerid);
+-	    groups->timerid = -1;
+-	}
+ 	iterator = dictGetIterator(groups->contexts);
+ 	while ((entry = dictNext(iterator)) != NULL)
+ 	    webgroup_drop_context((context_t *)dictGetVal(entry), NULL);
+ 	dictReleaseIterator(iterator);
+ 	dictRelease(groups->contexts);
++	webgroup_timers_stop(groups);
+ 	memset(groups, 0, sizeof(struct webgroups));
+ 	free(groups);
+     }
+diff -Naurp pcp-5.3.7.orig/src/pmfind/source.c pcp-5.3.7/src/pmfind/source.c
+--- pcp-5.3.7.orig/src/pmfind/source.c	2021-02-17 15:27:41.000000000 +1100
++++ pcp-5.3.7/src/pmfind/source.c	2022-10-19 21:32:03.973832346 +1100
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2020 Red Hat.
++ * Copyright (c) 2020,2022 Red Hat.
+  *
+  * This program is free software; you can redistribute it and/or modify it
+  * under the terms of the GNU General Public License as published by the
+@@ -25,6 +25,7 @@ static pmWebGroupSettings settings;
+ typedef struct {
+     sds			source;
+     sds			hostspec;
++    unsigned int	refcount;
+ } context_t;
+ 
+ typedef struct {
+@@ -38,22 +39,34 @@ typedef struct {
+ } sources_t;
+ 
+ static void
++source_release(sources_t *sp, context_t *cp, sds ctx)
++{
++    pmWebGroupDestroy(&settings, ctx, sp);
++    sdsfree(cp->hostspec);
++    sdsfree(cp->source);
++    free(cp);
++}
++
++static void
+ sources_release(void *arg, const struct dictEntry *entry)
+ {
+     sources_t	*sp = (sources_t *)arg;
+     context_t	*cp = (context_t *)dictGetVal(entry);
+     sds		ctx = (sds)entry->key;
+ 
+-    pmWebGroupDestroy(&settings, ctx, sp);
+-    sdsfree(cp->hostspec);
+-    sdsfree(cp->source);
++    if (pmDebugOptions.discovery)
++	fprintf(stderr, "releasing context %s\n", ctx);
++
++    source_release(sp, cp, ctx);
+ }
+ 
+ static void
+-sources_containers(sources_t *sp, sds id, dictEntry *uniq)
++sources_containers(sources_t *sp, context_t *cp, sds id, dictEntry *uniq)
+ {
+     uv_mutex_lock(&sp->mutex);
+-    sp->count++;	/* issuing another PMWEBAPI request */
++    /* issuing another PMWEBAPI request */
++    sp->count++;
++    cp->refcount++;
+     uv_mutex_unlock(&sp->mutex);
+ 
+     pmWebGroupScrape(&settings, id, sp->params, sp);
+@@ -75,6 +88,7 @@ on_source_context(sds id, pmWebSource *s
+ 
+     cp->source = sdsdup(src->source);
+     cp->hostspec = sdsdup(src->hostspec);
++    cp->refcount = 1;
+ 
+     uv_mutex_lock(&sp->mutex);
+     dictAdd(sp->contexts, id, cp);
+@@ -84,7 +98,7 @@ on_source_context(sds id, pmWebSource *s
+     if (entry) {	/* source just discovered */
+ 	printf("%s %s\n", src->source, src->hostspec);
+ 	if (containers)
+-	    sources_containers(sp, id, entry);
++	    sources_containers(sp, cp, id, entry);
+     }
+ }
+ 
+@@ -116,7 +130,9 @@ static void
+ on_source_done(sds context, int status, sds message, void *arg)
+ {
+     sources_t	*sp = (sources_t *)arg;
+-    int		count = 0, release = 0;
++    context_t	*cp;
++    dictEntry	*he;
++    int		remove = 0, count = 0, release = 0;
+ 
+     if (pmDebugOptions.discovery)
+ 	fprintf(stderr, "done on context %s (sts=%d)\n", context, status);
+@@ -127,19 +143,26 @@ on_source_done(sds context, int status,
+     uv_mutex_lock(&sp->mutex);
+     if ((count = --sp->count) <= 0)
+ 	release = 1;
++    if ((he = dictFind(sp->contexts, context)) != NULL &&
++	(cp = (context_t *)dictGetVal(he)) != NULL &&
++	(--cp->refcount <= 0))
++	remove = 1;
+     uv_mutex_unlock(&sp->mutex);
+ 
++    if (remove) {
++	if (pmDebugOptions.discovery)
++	    fprintf(stderr, "remove context %s\n", context);
++	source_release(sp, cp, context);
++	dictDelete(sp->contexts, context);
++    }
++
+     if (release) {
+ 	unsigned long	cursor = 0;
+-
+-	if (pmDebugOptions.discovery)
+-	   fprintf(stderr, "release context %s (sts=%d)\n", context, status);
+ 	do {
+ 	    cursor = dictScan(sp->contexts, cursor, sources_release, NULL, sp);
+ 	} while (cursor);
+-    } else {
+-	if (pmDebugOptions.discovery)
+-	    fprintf(stderr, "not yet releasing (count=%d)\n", count);
++    } else if (pmDebugOptions.discovery) {
++	fprintf(stderr, "not yet releasing (count=%d)\n", count);
+     }
+ }
+ 
+@@ -190,6 +213,7 @@ sources_discovery_start(uv_timer_t *arg)
+     }
+ 
+     dictRelease(dp);
++    pmWebTimerClose();
+ }
+ 
+ /*
+@@ -214,8 +238,8 @@ source_discovery(int count, char **urls)
+     uv_mutex_init(&find.mutex);
+     find.urls = urls;
+     find.count = count;	/* at least one PMWEBAPI request for each url */
+-    find.uniq = dictCreate(&sdsDictCallBacks, NULL);
+-    find.params = dictCreate(&sdsDictCallBacks, NULL);
++    find.uniq = dictCreate(&sdsKeyDictCallBacks, NULL);
++    find.params = dictCreate(&sdsOwnDictCallBacks, NULL);
+     dictAdd(find.params, sdsnew("name"), sdsnew("containers.state.running"));
+     find.contexts = dictCreate(&sdsKeyDictCallBacks, NULL);
+ 
+@@ -230,6 +254,7 @@ source_discovery(int count, char **urls)
+ 
+     pmWebGroupSetup(&settings.module);
+     pmWebGroupSetEventLoop(&settings.module, loop);
++    pmWebTimerSetEventLoop(loop);
+ 
+     /*
+      * Start a one-shot timer to add a start function into the loop
+@@ -244,7 +269,9 @@ source_discovery(int count, char **urls)
+     /*
+      * Finished, release all resources acquired so far
+      */
++    pmWebGroupClose(&settings.module);
+     uv_mutex_destroy(&find.mutex);
++    dictRelease(find.uniq);
+     dictRelease(find.params);
+     dictRelease(find.contexts);
+     return find.status;
+diff -Naurp pcp-5.3.7.orig/src/pmproxy/src/server.c pcp-5.3.7/src/pmproxy/src/server.c
+--- pcp-5.3.7.orig/src/pmproxy/src/server.c	2022-04-05 09:05:43.000000000 +1000
++++ pcp-5.3.7/src/pmproxy/src/server.c	2022-10-19 21:31:43.831093354 +1100
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2018-2019,2021 Red Hat.
++ * Copyright (c) 2018-2019,2021-2022 Red Hat.
+  *
+  * This program is free software; you can redistribute it and/or modify it
+  * under the terms of the GNU Lesser General Public License as published
+@@ -310,17 +310,21 @@ on_write_callback(uv_callback_t *handle,
+     struct client		*client = (struct client *)request->writer.data;
+     int				sts;
+ 
++    (void)handle;
+     if (pmDebugOptions.af)
+ 	fprintf(stderr, "%s: client=%p\n", "on_write_callback", client);
+ 
+     if (client->stream.secure == 0) {
+ 	sts = uv_write(&request->writer, (uv_stream_t *)&client->stream,
+ 		 &request->buffer[0], request->nbuffers, request->callback);
+-	if (sts != 0)
+-	    fprintf(stderr, "%s: ERROR uv_write failed\n", "on_write_callback");
++	if (sts != 0) {
++	    pmNotifyErr(LOG_ERR, "%s: %s - uv_write failed [%s]: %s\n",
++			pmGetProgname(), "on_write_callback",
++			uv_err_name(sts), uv_strerror(sts));
++	    client_close(client);
++	}
+     } else
+ 	secure_client_write(client, request);
+-    (void)handle;
+     return 0;
+ }
+ 
+@@ -455,14 +459,16 @@ on_client_connection(uv_stream_t *stream
+     uv_handle_t		*handle;
+ 
+     if (status != 0) {
+-	fprintf(stderr, "%s: client connection failed: %s\n",
+-			pmGetProgname(), uv_strerror(status));
++	pmNotifyErr(LOG_ERR, "%s: %s - %s failed [%s]: %s\n",
++		    pmGetProgname(), "on_client_connection", "connection",
++		    uv_err_name(status), uv_strerror(status));
+ 	return;
+     }
+ 
+     if ((client = calloc(1, sizeof(*client))) == NULL) {
+-	fprintf(stderr, "%s: out-of-memory for new client\n",
+-			pmGetProgname());
++	pmNotifyErr(LOG_ERR, "%s: %s - %s failed [%s]: %s\n",
++			pmGetProgname(), "on_client_connection", "calloc",
++			"ENOMEM", strerror(ENOMEM));
+ 	return;
+     }
+     if (pmDebugOptions.context | pmDebugOptions.af)
+@@ -476,16 +482,18 @@ on_client_connection(uv_stream_t *stream
+ 
+     status = uv_tcp_init(proxy->events, &client->stream.u.tcp);
+     if (status != 0) {
+-	fprintf(stderr, "%s: client tcp init failed: %s\n",
+-			pmGetProgname(), uv_strerror(status));
++	pmNotifyErr(LOG_ERR, "%s: %s - %s failed [%s]: %s\n",
++		    pmGetProgname(), "on_client_connection", "uv_tcp_init",
++		    uv_err_name(status), uv_strerror(status));
+ 	client_put(client);
+ 	return;
+     }
+ 
+     status = uv_accept(stream, (uv_stream_t *)&client->stream.u.tcp);
+     if (status != 0) {
+-	fprintf(stderr, "%s: client tcp init failed: %s\n",
+-			pmGetProgname(), uv_strerror(status));
++	pmNotifyErr(LOG_ERR, "%s: %s - %s failed [%s]: %s\n",
++		    pmGetProgname(), "on_client_connection", "uv_accept",
++		    uv_err_name(status), uv_strerror(status));
+ 	client_put(client);
+ 	return;
+     }
+@@ -496,8 +504,9 @@ on_client_connection(uv_stream_t *stream
+     status = uv_read_start((uv_stream_t *)&client->stream.u.tcp,
+ 			    on_buffer_alloc, on_client_read);
+     if (status != 0) {
+-	fprintf(stderr, "%s: client read start failed: %s\n",
+-			pmGetProgname(), uv_strerror(status));
++	pmNotifyErr(LOG_ERR, "%s: %s - %s failed [%s]: %s\n",
++		    pmGetProgname(), "on_client_connection", "uv_read_start",
++		    uv_err_name(status), uv_strerror(status));
+ 	client_close(client);
+     }
+ }
+@@ -530,8 +539,9 @@ open_request_port(struct proxy *proxy, s
+ 
+     sts = uv_listen((uv_stream_t *)&stream->u.tcp, maxpending, on_client_connection);
+     if (sts != 0) {
+-	fprintf(stderr, "%s: socket listen error %s\n",
+-			pmGetProgname(), uv_strerror(sts));
++	pmNotifyErr(LOG_ERR, "%s: %s - uv_listen failed [%s]: %s\n",
++			pmGetProgname(), "open_request_port",
++			uv_err_name(sts), uv_strerror(sts));
+ 	uv_close(handle, NULL);
+ 	return -ENOTCONN;
+     }
+@@ -554,15 +564,23 @@ open_request_local(struct proxy *proxy,
+     uv_pipe_init(proxy->events, &stream->u.local, 0);
+     handle = (uv_handle_t *)&stream->u.local;
+     handle->data = (void *)proxy;
+-    uv_pipe_bind(&stream->u.local, name);
++    sts = uv_pipe_bind(&stream->u.local, name);
++    if (sts != 0) {
++	pmNotifyErr(LOG_ERR, "%s: %s - uv_pipe_bind %s failed [%s]: %s\n",
++			pmGetProgname(), "open_request_local", name,
++			uv_err_name(sts), uv_strerror(sts));
++	uv_close(handle, NULL);
++	return -ENOTCONN;
++    }
+ #ifdef HAVE_UV_PIPE_CHMOD
+     uv_pipe_chmod(&stream->u.local, UV_READABLE | UV_WRITABLE);
+ #endif
+ 
+     sts = uv_listen((uv_stream_t *)&stream->u.local, maxpending, on_client_connection);
+     if (sts != 0) {
+-	fprintf(stderr, "%s: local listen error %s\n",
+-			pmGetProgname(), uv_strerror(sts));
++	pmNotifyErr(LOG_ERR, "%s: %s - %s failed [%s]: %s\n",
++		    pmGetProgname(), "open_request_local", "uv_listen",
++		    uv_err_name(sts), uv_strerror(sts));
+ 	uv_close(handle, NULL);
+         return -ENOTCONN;
+     }

redhat-issues-RHEL-34586-pmproxy-pmcd-fd-leak.patch

@@ -0,0 +1,320 @@
+diff -Naurp pcp-5.3.7.orig/qa/src/test_pcp_sockets.python pcp-5.3.7/qa/src/test_pcp_sockets.python
+--- pcp-5.3.7.orig/qa/src/test_pcp_sockets.python	1970-01-01 10:00:00.000000000 +1000
++++ pcp-5.3.7/qa/src/test_pcp_sockets.python	2024-09-09 13:47:06.848083320 +1000
+@@ -0,0 +1,23 @@
++import socket
++import cpmapi as api
++from pcp import pmapi
++
++address = 'localhost'
++port = 44321
++
++c = []
++for i in range(0, 1234):
++    print('context', i)
++    ctx = pmapi.pmContext(api.PM_CONTEXT_HOST, "local:")
++    print('created', i)
++    c.append(ctx)
++
++s = []
++for i in range(0, 1234):
++    sock = socket.socket()
++    print('socket', i)
++    sock.connect((address, port))
++    print('connect', i)
++    sock.send(b"abba\r")  # -- gives a too-large PDU
++    print('send', i)
++    # s.append(sock)  # -- exercise pduread: timeout
+diff -Naurp pcp-5.3.7.orig/src/libpcp/src/pdu.c pcp-5.3.7/src/libpcp/src/pdu.c
+--- pcp-5.3.7.orig/src/libpcp/src/pdu.c	2022-04-05 09:05:43.000000000 +1000
++++ pcp-5.3.7/src/libpcp/src/pdu.c	2024-09-09 13:47:06.869083364 +1000
+@@ -186,10 +186,7 @@ pduread(int fd, char *buf, int len, int
+ 		 * Need all parts of the PDU to be received by dead_hand
+ 		 * This enforces a low overall timeout for the whole PDU
+ 		 * (as opposed to just a timeout for individual calls to
+-		 * recv).  A more invasive alternative (better) approach
+-		 * would see all I/O performed in the main event loop,
+-		 * and I/O routines transformed to continuation-passing
+-		 * style.
++		 * recv).
+ 		 */
+ 		gettimeofday(&dead_hand, NULL);
+ 		dead_hand.tv_sec += wait.tv_sec;
+@@ -499,9 +496,10 @@ PM_FAULT_RETURN(PM_ERR_TIMEOUT);
+ 	if (len == -1) {
+ 	    if (! __pmSocketClosed()) {
+ 		char	errmsg[PM_MAXERRMSGLEN];
+-		pmNotifyErr(LOG_ERR, "%s: fd=%d hdr read: len=%d: %s",
+-			    "__pmGetPDU", fd, len,
+-			    pmErrStr_r(-oserror(), errmsg, sizeof(errmsg)));
++		if (pmDebugOptions.pdu)
++		    pmNotifyErr(LOG_ERR, "%s: fd=%d hdr read: len=%d: %s",
++			        "__pmGetPDU", fd, len,
++			        pmErrStr_r(-oserror(), errmsg, sizeof(errmsg)));
+ 	    }
+ 	}
+ 	else if (len >= (int)sizeof(php->len)) {
+@@ -520,15 +518,17 @@ PM_FAULT_RETURN(PM_ERR_TIMEOUT);
+ 	}
+ 	else if (len < 0) {
+ 	    char	errmsg[PM_MAXERRMSGLEN];
+-	    pmNotifyErr(LOG_ERR, "%s: fd=%d hdr read: len=%d: %s",
+-			"__pmGetPDU", fd, len,
+-			pmErrStr_r(len, errmsg, sizeof(errmsg)));
++	    if (pmDebugOptions.pdu)
++		pmNotifyErr(LOG_ERR, "%s: fd=%d hdr read: len=%d: %s",
++			    "__pmGetPDU", fd, len,
++			    pmErrStr_r(len, errmsg, sizeof(errmsg)));
+ 	    __pmUnpinPDUBuf(pdubuf);
+ 	    return PM_ERR_IPC;
+ 	}
+ 	else if (len > 0) {
+-	    pmNotifyErr(LOG_ERR, "%s: fd=%d hdr read: bad len=%d",
+-			"__pmGetPDU", fd, len);
++	    if (pmDebugOptions.pdu)
++		pmNotifyErr(LOG_ERR, "%s: fd=%d hdr read: bad len=%d",
++			    "__pmGetPDU", fd, len);
+ 	    __pmUnpinPDUBuf(pdubuf);
+ 	    return PM_ERR_IPC;
+ 	}
+@@ -547,8 +547,9 @@ check_read_len:
+ 	 * PDU length indicates insufficient bytes for a PDU header
+ 	 * ... looks like DOS attack like PV 935490
+ 	 */
+-	pmNotifyErr(LOG_ERR, "%s: fd=%d illegal PDU len=%d in hdr",
+-		    "__pmGetPDU", fd, php->len);
++	if (pmDebugOptions.pdu)
++	    pmNotifyErr(LOG_ERR, "%s: fd=%d illegal PDU len=%d in hdr",
++			"__pmGetPDU", fd, php->len);
+ 	__pmUnpinPDUBuf(pdubuf);
+ 	return PM_ERR_IPC;
+     }
+@@ -559,16 +560,18 @@ check_read_len:
+ 	 * (note, pmcd and pmdas have to be able to _send_ large PDUs,
+ 	 * e.g. for a pmResult or instance domain enquiry)
+ 	 */
+-	if (len < (int)(sizeof(php->len) + sizeof(php->type)))
+-	    /* PDU too short to provide a valid type */
+-	    pmNotifyErr(LOG_ERR, "%s: fd=%d bad PDU len=%d in hdr "
+-			"exceeds maximum client PDU size (%d)",
+-			"__pmGetPDU", fd, php->len, ceiling);
+-	else
+-	    pmNotifyErr(LOG_ERR, "%s: fd=%d type=0x%x bad PDU len=%d in hdr "
+-			"exceeds maximum client PDU size (%d)",
+-			"__pmGetPDU", fd, (unsigned)ntohl(php->type),
+-			php->len, ceiling);
++	if (pmDebugOptions.pdu) {
++	    if (len < (int)(sizeof(php->len) + sizeof(php->type)))
++		/* PDU too short to provide a valid type */
++		pmNotifyErr(LOG_ERR, "%s: fd=%d bad PDU len=%d in hdr"
++			    " exceeds maximum client PDU size (%d)",
++			    "__pmGetPDU", fd, php->len, ceiling);
++	    else
++		pmNotifyErr(LOG_ERR, "%s: fd=%d type=0x%x bad PDU len=%d in hdr"
++			    " exceeds maximum client PDU size (%d)",
++			    "__pmGetPDU", fd, (unsigned)ntohl(php->type),
++			    php->len, ceiling);
++	}
+ 	__pmUnpinPDUBuf(pdubuf);
+ 	return PM_ERR_TOOBIG;
+     }
+@@ -608,6 +611,10 @@ check_read_len:
+ 		__pmUnpinPDUBuf(pdubuf);
+ 		return PM_ERR_TIMEOUT;
+ 	    }
++	    else if (!pmDebugOptions.pdu) {
++		__pmUnpinPDUBuf(pdubuf);
++	        return PM_ERR_IPC;
++	    }
+ 	    else if (len < 0) {
+ 		char	errmsg[PM_MAXERRMSGLEN];
+ 		pmNotifyErr(LOG_ERR, "%s: fd=%d data read: len=%d: %s",
+@@ -641,7 +648,8 @@ check_read_len:
+ 	 * PDU type is bad ... could be a possible mem leak attack like
+ 	 * https://bugzilla.redhat.com/show_bug.cgi?id=841319
+ 	 */
+-	pmNotifyErr(LOG_ERR, "%s: fd=%d illegal PDU type=%d in hdr",
++	if (pmDebugOptions.pdu)
++	    pmNotifyErr(LOG_ERR, "%s: fd=%d illegal PDU type=%d in hdr",
+ 			"__pmGetPDU", fd, php->type);
+ 	__pmUnpinPDUBuf(pdubuf);
+ 	return PM_ERR_IPC;
+diff -Naurp pcp-5.3.7.orig/src/libpcp_web/src/load.h pcp-5.3.7/src/libpcp_web/src/load.h
+--- pcp-5.3.7.orig/src/libpcp_web/src/load.h	2021-02-17 15:27:41.000000000 +1100
++++ pcp-5.3.7/src/libpcp_web/src/load.h	2024-09-09 13:45:56.531933622 +1000
+@@ -42,8 +42,9 @@ typedef struct context {
+     unsigned int	setup	: 1;	/* context established */
+     unsigned int	cached	: 1;	/* context/source in cache */
+     unsigned int	garbage	: 1;	/* context pending removal */
++    unsigned int	inactive: 1;	/* context removal deferred */
+     unsigned int	updated : 1;	/* context labels are updated */
+-    unsigned int	padding : 4;	/* zero-filled struct padding */
++    unsigned int	padding : 3;	/* zero-filled struct padding */
+     unsigned int	refcount : 16;	/* currently-referenced counter */
+     unsigned int	timeout;	/* context timeout in milliseconds */
+     uv_timer_t		timer;
+diff -Naurp pcp-5.3.7.orig/src/libpcp_web/src/webgroup.c pcp-5.3.7/src/libpcp_web/src/webgroup.c
+--- pcp-5.3.7.orig/src/libpcp_web/src/webgroup.c	2024-09-09 13:44:34.166748200 +1000
++++ pcp-5.3.7/src/libpcp_web/src/webgroup.c	2024-09-09 13:45:56.531933622 +1000
+@@ -134,9 +134,18 @@ webgroup_timeout_context(uv_timer_t *arg
+      * is returned to zero by the caller, or background cleanup
+      * finds this context and cleans it.
+      */
+-    if (cp->refcount == 0 && cp->garbage == 0) {
+-	cp->garbage = 1;
+-	uv_timer_stop(&cp->timer);
++    if (cp->refcount == 0) {
++	if (cp->garbage == 0) {
++	    cp->garbage = 1;
++	    uv_timer_stop(&cp->timer);
++	}
++    } else {
++	/*
++	 * Context timed out but still referenced, must wait
++	 * until the caller releases its reference (shortly)
++	 * before beginning garbage collection process.
++	 */
++	cp->inactive = 1;
+     }
+ }
+ 
+@@ -298,20 +307,28 @@ webgroup_garbage_collect(struct webgroup
+     dictIterator        *iterator;
+     dictEntry           *entry;
+     context_t		*cp;
+-    unsigned int	count = 0, drops = 0;
++    unsigned int	count = 0, drops = 0, garbageset = 0, inactiveset = 0;
+ 
+     if (pmDebugOptions.http || pmDebugOptions.libweb)
+-	fprintf(stderr, "%s: started\n", "webgroup_garbage_collect");
++	fprintf(stderr, "%s: started for groups %p\n",
++			"webgroup_garbage_collect", groups);
+ 
+     /* do context GC if we get the lock (else don't block here) */
+     if (uv_mutex_trylock(&groups->mutex) == 0) {
+ 	iterator = dictGetSafeIterator(groups->contexts);
+ 	for (entry = dictNext(iterator); entry;) {
+ 	    cp = (context_t *)dictGetVal(entry);
++	    if (cp->privdata != groups)
++		continue;
+ 	    entry = dictNext(iterator);
+-	    if (cp->garbage && cp->privdata == groups) {
++	    if (cp->garbage)
++		garbageset++;
++	    if (cp->inactive && cp->refcount == 0)
++		inactiveset++;
++	    if (cp->garbage || (cp->inactive && cp->refcount == 0)) {
+ 		if (pmDebugOptions.http || pmDebugOptions.libweb)
+-		    fprintf(stderr, "GC context %u (%p)\n", cp->randomid, cp);
++		    fprintf(stderr, "GC dropping context %u (%p)\n",
++				    cp->randomid, cp);
+ 		uv_mutex_unlock(&groups->mutex);
+ 		webgroup_drop_context(cp, groups);
+ 		uv_mutex_lock(&groups->mutex);
+@@ -324,7 +341,8 @@ webgroup_garbage_collect(struct webgroup
+ 	/* if dropping the last remaining context, do cleanup */
+ 	if (groups->active && drops == count) {
+ 	    if (pmDebugOptions.http || pmDebugOptions.libweb)
+-		fprintf(stderr, "%s: freezing\n", "webgroup_garbage_collect");
++		fprintf(stderr, "%s: freezing groups %p\n",
++				"webgroup_garbage_collect", groups);
+ 	    webgroup_timers_stop(groups);
+ 	}
+ 	uv_mutex_unlock(&groups->mutex);
+@@ -334,8 +352,10 @@ webgroup_garbage_collect(struct webgroup
+     }
+ 
+     if (pmDebugOptions.http || pmDebugOptions.libweb)
+-	fprintf(stderr, "%s: finished [%u drops from %u entries]\n",
+-			"webgroup_garbage_collect", drops, count);
++	fprintf(stderr, "%s: finished [%u drops from %u entries,"
++			" %u garbageset, %u inactiveset]\n",
++			"webgroup_garbage_collect", drops, count,
++			garbageset, inactiveset);
+ }
+ 
+ static void
+@@ -354,7 +374,7 @@ webgroup_use_context(struct context *cp,
+     int			sts;
+     struct webgroups    *gp = (struct webgroups *)cp->privdata;
+ 
+-    if (cp->garbage == 0) {
++    if (cp->garbage == 0 && cp->inactive == 0) {
+ 	if (cp->setup == 0) {
+ 	    if ((sts = pmReconnectContext(cp->context)) < 0) {
+ 		infofmt(*message, "cannot reconnect context: %s",
+@@ -424,7 +444,7 @@ webgroup_lookup_context(pmWebGroupSettin
+ 	    *status = -ENOTCONN;
+ 	    return NULL;
+ 	}
+-	if (cp->garbage == 0) {
++	if (cp->garbage == 0 && cp->inactive == 0) {
+ 	    access.username = cp->username;
+ 	    access.password = cp->password;
+ 	    access.realm = cp->realm;
+diff -Naurp pcp-5.3.7.orig/src/pmcd/src/client.c pcp-5.3.7/src/pmcd/src/client.c
+--- pcp-5.3.7.orig/src/pmcd/src/client.c	2018-01-15 15:49:13.000000000 +1100
++++ pcp-5.3.7/src/pmcd/src/client.c	2024-09-09 13:47:06.870083366 +1000
+@@ -74,7 +74,8 @@ NotifyEndContext(int ctx)
+ ClientInfo *
+ AcceptNewClient(int reqfd)
+ {
+-    static unsigned int	seq = 0;
++    static unsigned int	seq, saved, count;
++    static struct timeval then;
+     int			i, fd;
+     __pmSockLen		addrlen;
+     struct timeval	now;
+@@ -83,21 +84,30 @@ AcceptNewClient(int reqfd)
+     addrlen = __pmSockAddrSize();
+     fd = __pmAccept(reqfd, client[i].addr, &addrlen);
+     if (fd == -1) {
+-    	if (neterror() == EPERM) {
+-	    pmNotifyErr(LOG_NOTICE, "AcceptNewClient(%d): "
+-	 	          "Permission Denied\n", reqfd);
+-	}
+-    	else if (neterror() == ECONNABORTED) {
++	if (neterror() == ECONNABORTED) {
+ 	    /* quietly ignore this one ... */
+ 	    ;
+ 	}
+ 	else {
+-	    /*
+-	     * unexpected ... ignore the client (we used to kill off pmcd
+-	     * but that seems way too extreme)
++	    /* Permission denied or an unexpected error (e.g. EMFILE)
++	     * - rate limit the logging and make this client go away.
+ 	     */
+-	    pmNotifyErr(LOG_ERR, "AcceptNewClient(%d): Unexpected error from __pmAccept: %d: %s\n",
+-			    reqfd, neterror(), netstrerror());
++	    pmtimevalNow(&now);
++	    if (neterror() != saved || now.tv_sec > then.tv_sec + 60) {
++		if (neterror() == EPERM)
++		    pmNotifyErr(LOG_NOTICE, "AcceptNewClient(%d): "
++				"Permission Denied (%d suppressed)\n",
++				reqfd, count);
++		else
++		    pmNotifyErr(LOG_ERR, "AcceptNewClient(%d): "
++				"Accept error (%d suppressed): %d: %s\n",
++				reqfd, count, neterror(), netstrerror());
++		saved = neterror();
++		count = 0;
++	    } else {
++		count++;
++	    }
++	    then = now;
+ 	}
+ 	client[i].fd = -1;
+ 	DeleteClient(&client[i]);
+diff -Naurp pcp-5.3.7.orig/src/pmcd/src/pmcd.c pcp-5.3.7/src/pmcd/src/pmcd.c
+--- pcp-5.3.7.orig/src/pmcd/src/pmcd.c	2021-10-13 10:48:23.000000000 +1100
++++ pcp-5.3.7/src/pmcd/src/pmcd.c	2024-09-09 13:47:06.871083368 +1000
+@@ -685,7 +685,7 @@ HandleReadyAgents(__pmFdSet *readyFds)
+ }
+ 
+ static void
+-CheckNewClient(__pmFdSet * fdset, int rfd, int family)
++CheckNewClient(__pmFdSet *fdset, int rfd, int family)
+ {
+     int		s, sts, accepted = 1;
+     __uint32_t	challenge;

redhat-issues-RHEL-57796-pmcd-pmstore-corruption.patch

@@ -0,0 +1,403 @@
+diff -Naurp pcp-5.3.7.orig/qa/1518 pcp-5.3.7/qa/1518
+--- pcp-5.3.7.orig/qa/1518	1970-01-01 10:00:00.000000000 +1000
++++ pcp-5.3.7/qa/1518	2024-09-09 13:13:14.561437414 +1000
+@@ -0,0 +1,75 @@
++#!/bin/sh
++# PCP QA Test No. 1518
++# SUSE Issue A)
++#	__pmDecodeValueSet() Miscalculates Available Buffer Space
++#	Leading to a Possible Heap Corruption
++#
++# Copyright (c) 2024 Ken McDonell.  All Rights Reserved.
++# Copyright (c) 2024 Matthias Gerstner.  All Rights Reserved.
++#
++
++if [ $# -eq 0 ]
++then
++    seq=`basename $0`
++    echo "QA output created by $seq"
++else
++    # use $seq from caller, unless not set
++    [ -n "$seq" ] || seq=`basename $0`
++    echo "QA output created by `basename $0` $*"
++fi
++
++# get standard environment, filters and checks
++. ./common.product
++. ./common.filter
++. ./common.check
++
++$sudo rm -rf $tmp $tmp.* $seq.full
++
++which nc >/dev/null 2>&1 || _notrun "no nc executable installed"
++_check_valgrind
++
++_cleanup()
++{
++    cat pmcd.log >>$here/$seq.full
++    cd $here
++    $sudo rm -rf $tmp $tmp.*
++}
++
++status=0	# success is the default!
++trap "_cleanup; exit \$status" 0 1 2 3 15
++
++_filter()
++{
++    sed \
++	-e '/^Command: /d' \
++    # end
++}
++
++mkdir $tmp || exit 1
++cd $tmp
++grep sampledso $PCP_PMCDCONF_PATH >pmcd.conf
++cat pmcd.conf >>$here/$seq.full
++port=`_find_free_port`
++echo "port=$port" >>$here/$seq.full
++
++# real QA test starts here
++valgrind $PCP_BINADM_DIR/pmcd -f -Dpdu -c ./pmcd.conf -s ./pmcd.socket -p $port  >out 2>err &
++valgrind_pid=$!
++sleep 2
++pmcd_pid=`$PCP_PS_PROG $PCP_PS_ALL_FLAGS | grep '[p]mcd -f -Dpdu' | $PCP_AWK_PROG '{ print $2 }'`
++echo "pmcd_pid=$pmcd_pid" >>$here/$seq.full
++nc -N -U ./pmcd.socket <$here/binary/decode-value-set-out-of-bound-write 2>&1 \
++| od -c >>$here/$seq.full
++sleep 2
++kill -TERM $pmcd_pid
++wait
++
++echo "expect error to be logged ..."
++grep __pmDecodeValueSet pmcd.log
++
++echo
++echo "and no valgrind badness ..."
++cat out err | _filter_valgrind | _filter
++
++# success, all done
++exit
+diff -Naurp pcp-5.3.7.orig/qa/1518.out pcp-5.3.7/qa/1518.out
+--- pcp-5.3.7.orig/qa/1518.out	1970-01-01 10:00:00.000000000 +1000
++++ pcp-5.3.7/qa/1518.out	2024-09-09 13:13:14.561437414 +1000
+@@ -0,0 +1,11 @@
++QA output created by 1518
++expect error to be logged ...
++__pmDecodeValueSet: PM_ERR_IPC: pmid[0] value[0] vindex=1020 (max=255)
++
++and no valgrind badness ...
++Memcheck, a memory error detector
++LEAK SUMMARY:
++definitely lost: 0 bytes in 0 blocks
++indirectly lost: 0 bytes in 0 blocks
++Rerun with --leak-check=full to see details of leaked memory
++ERROR SUMMARY: 0 errors from 0 contexts ...
+diff -Naurp pcp-5.3.7.orig/qa/group pcp-5.3.7/qa/group
+--- pcp-5.3.7.orig/qa/group	2024-09-09 13:11:13.796450545 +1000
++++ pcp-5.3.7/qa/group	2024-09-09 13:13:49.419437747 +1000
+@@ -1847,6 +1847,7 @@ x11
+ 1490 python local labels
+ 1495 pmlogrewrite labels pmdumplog local
+ 1511 pmcd local pmda.sample
++1518 pmcd libpcp local
+ 1530 pmda.zfs local valgrind
+ 1531 pmda.zfs local valgrind
+ 1532 pmda.zfs local
+diff -Naurp pcp-5.3.7.orig/src/libpcp/src/endian.c pcp-5.3.7/src/libpcp/src/endian.c
+--- pcp-5.3.7.orig/src/libpcp/src/endian.c	2022-04-05 09:05:43.000000000 +1000
++++ pcp-5.3.7/src/libpcp/src/endian.c	2024-09-09 13:20:56.967560588 +1000
+@@ -268,13 +268,17 @@ ntohEventArray(pmValueBlock * const vb,
+ }
+ 
+ void
+-__ntohpmValueBlock(pmValueBlock * const vb)
++__ntohpmValueBlock_hdr(pmValueBlock * const vb)
+ {
+     unsigned int	*ip = (unsigned int *)vb;
+ 
+     /* Swab the first word, which contain vtype and vlen */
+     *ip = ntohl(*ip);
++}
+ 
++void
++__ntohpmValueBlock_buf(pmValueBlock * const vb)
++{
+     switch (vb->vtype) {
+     case PM_TYPE_U64:
+     case PM_TYPE_64:
+@@ -298,6 +302,13 @@ __ntohpmValueBlock(pmValueBlock * const
+ 	break;
+     }
+ }
++
++void
++__ntohpmValueBlock(pmValueBlock * const vb)
++{
++    __ntohpmValueBlock_hdr(vb);
++    __ntohpmValueBlock_buf(vb);
++}
+ #endif
+ 
+ #ifndef __htonpmPDUInfo
+diff -Naurp pcp-5.3.7.orig/src/libpcp/src/internal.h pcp-5.3.7/src/libpcp/src/internal.h
+--- pcp-5.3.7.orig/src/libpcp/src/internal.h	2022-04-05 09:05:43.000000000 +1000
++++ pcp-5.3.7/src/libpcp/src/internal.h	2024-09-09 13:21:44.336608061 +1000
+@@ -60,6 +60,8 @@ extern int __pmGetDate(struct timespec *
+ #define __ntohpmLabel(a)	/* noop */
+ #define __htonpmValueBlock(a)	/* noop */
+ #define __ntohpmValueBlock(a)	/* noop */
++#define __ntohpmValueBlock_hdr(a)	/* noop */
++#define __ntohpmValueBlock_buf(a)	/* noop */
+ #define __htonpmTimespec(a)	/* noop */
+ #define __ntohpmTimespec(a)	/* noop */
+ #define __htonpmTimestamp(a)	/* noop */
+@@ -94,6 +96,8 @@ extern void __htonpmLabel(pmLabel * cons
+ extern void __ntohpmLabel(pmLabel * const) _PCP_HIDDEN;
+ extern void __htonpmValueBlock(pmValueBlock * const) _PCP_HIDDEN;
+ extern void __ntohpmValueBlock(pmValueBlock * const) _PCP_HIDDEN;
++extern void __ntohpmValueBlock_hdr(pmValueBlock * const) _PCP_HIDDEN;
++extern void __ntohpmValueBlock_buf(pmValueBlock * const) _PCP_HIDDEN;
+ extern void __htonpmTimespec(pmTimespec * const ) _PCP_HIDDEN;
+ extern void __ntohpmTimespec(pmTimespec * const ) _PCP_HIDDEN;
+ extern void __htonpmTimestamp(__pmTimestamp * const );
+diff -Naurp pcp-5.3.7.orig/src/libpcp/src/p_result.c pcp-5.3.7/src/libpcp/src/p_result.c
+--- pcp-5.3.7.orig/src/libpcp/src/p_result.c	2022-04-05 09:05:43.000000000 +1000
++++ pcp-5.3.7/src/libpcp/src/p_result.c	2024-09-09 13:27:16.651969214 +1000
+@@ -277,6 +277,135 @@ __pmSendHighResResult(int fd, int from,
+     return __pmSendHighResResult_ctx(NULL, fd, from, result);
+ }
+ 
++/* Check that a network encoded event array is within a given buffer size */
++int
++__pmEventArrayCheck(pmValueBlock * const vb, int highres, int pmid, int value, size_t check)
++{
++    char		*base;
++    int			r;	/* records */
++    int			p;	/* parameters in a record ... */
++    int			nrecords;
++    int			nparams;
++
++    if (highres) {
++	pmHighResEventArray *hreap = (pmHighResEventArray *)vb;
++	base = (char *)&hreap->ea_record[0];
++	if (base > (char *)vb + check) {
++	    if (pmDebugOptions.pdu)
++		fprintf(stderr, "__pmEventArrayCheck #1: PM_ERR_IPC: pmid[%d] value[%d] highres event records past end of PDU buffer\n",
++			pmid, value);
++	    return PM_ERR_IPC;
++	}
++	nrecords = ntohl(hreap->ea_nrecords);
++    }
++    else {
++	pmEventArray *eap = (pmEventArray *)vb;
++	base = (char *)&eap->ea_record[0];
++	if (base > (char *)vb + check) {
++	    if (pmDebugOptions.pdu)
++		fprintf(stderr, "__pmEventArrayCheck #2: PM_ERR_IPC: pmid[%d] value[%d] event records past end of PDU buffer\n",
++			pmid, value);
++	    return PM_ERR_IPC;
++	}
++	nrecords = ntohl(eap->ea_nrecords);
++    }
++
++    /* walk packed event record array */
++    for (r = 0; r < nrecords; r++) {
++	unsigned int flags, type;
++	size_t size, remaining;
++
++	remaining = check - (base - (char *)vb);
++	if (highres) {
++	    pmHighResEventRecord *hrerp = (pmHighResEventRecord *)base;
++	    size = sizeof(hrerp->er_timestamp) + sizeof(hrerp->er_flags) +
++		    sizeof(hrerp->er_nparams);
++	    if (size > remaining) {
++		if (pmDebugOptions.pdu)
++		    fprintf(stderr, "__pmEventArrayCheck #3: PM_ERR_IPC: pmid[%d] value[%d] record[%d] highres event record past end of PDU buffer\n",
++			    pmid, value, r);
++		return PM_ERR_IPC;
++	    }
++	    nparams = ntohl(hrerp->er_nparams);
++	    flags = ntohl(hrerp->er_flags);
++	}
++	else {
++	    pmEventRecord *erp = (pmEventRecord *)base;
++	    size = sizeof(erp->er_timestamp) + sizeof(erp->er_flags) +
++		    sizeof(erp->er_nparams);
++	    if (size > remaining) {
++		if (pmDebugOptions.pdu)
++		    fprintf(stderr, "__pmEventArrayCheck #4: PM_ERR_IPC: pmid[%d] value[%d] record[%d] event record past end of PDU buffer\n",
++			    pmid, value, r);
++		return PM_ERR_IPC;
++	    }
++	    nparams = ntohl(erp->er_nparams);
++	    flags = ntohl(erp->er_flags);
++	}
++
++	if (flags & PM_EVENT_FLAG_MISSED)
++	    nparams = 0;
++
++	base += size;
++	remaining = check - (base - (char *)vb);
++
++	for (p = 0; p < nparams; p++) {
++	    __uint32_t		*tp;	/* points to int holding vtype/vlen */
++	    pmEventParameter	*epp = (pmEventParameter *)base;
++
++	    if (sizeof(pmEventParameter) > remaining) {
++		if (pmDebugOptions.pdu)
++		    fprintf(stderr, "__pmEventArrayCheck #5: PM_ERR_IPC: pmid[%d] value[%d] record[%d] param[%d] event record past end of PDU buffer\n",
++			    pmid, value, r, p);
++		return PM_ERR_IPC;
++	    }
++
++	    tp = (__uint32_t *)&epp->ep_pmid;
++	    tp++;		/* now points to ep_type/ep_len */
++	    *tp = ntohl(*tp);
++	    type = epp->ep_type;
++	    size = epp->ep_len;
++	    *tp = htonl(*tp);	/* leave the buffer how we found it */
++
++	    if (sizeof(pmID) + size > remaining) {
++		if (pmDebugOptions.pdu)
++		    fprintf(stderr, "__pmEventArrayCheck #6: PM_ERR_IPC: pmid[%d] value[%d] record[%d] param[%d] event record past end of PDU buffer\n",
++			    pmid, value, r, p);
++		return PM_ERR_IPC;
++	    }
++
++	    base += sizeof(pmID) + PM_PDU_SIZE_BYTES(size);
++
++	    /*
++	     * final check for the types below, ep_len should be 4 or
++	     * 8, but a malformed PDU could have smaller ep_len values
++	     * and then unpacking these types risk going past the end
++	     * of the  PDU buffer
++	     */
++	    size = 0;
++	    switch (type) {
++		case PM_TYPE_32:
++		case PM_TYPE_U32:
++		case PM_TYPE_FLOAT:
++		    size = 4;	/* 32-bit types */
++		    break;
++		case PM_TYPE_64:
++		case PM_TYPE_U64:
++		case PM_TYPE_DOUBLE:
++		    size = 8;	/* 64-bit types */
++		    break;
++	    }
++	    if (size > 0 && sizeof(pmID) + size > remaining) {
++		if (pmDebugOptions.pdu)
++		    fprintf(stderr, "__pmEventArrayCheck #7: PM_ERR_IPC: pmid[%d] value[%d] record[%d] param[%d] event record past end of PDU buffer\n",
++			    pmid, value, r, p);
++		return PM_ERR_IPC;
++	    }
++	}
++    }
++    return 0;
++}
++
+ #if defined(HAVE_64BIT_PTR)
+ static int
+ __pmDecodeValueSet(__pmPDU *pdubuf, int pdulen, __pmPDU *data, char *pduend,
+@@ -290,7 +419,7 @@ __pmDecodeValueSet(__pmPDU *pdubuf, int
+     int		i, j;
+ /*
+  * Note: all sizes are in units of bytes ... beware that 'data' is in
+- *	 units of __pmPDU
++ *	 units of __pmPDU (four bytes)
+  */
+     int		vsize;		/* size of vlist_t's in PDU buffer */
+     int		nvsize;		/* size of pmValue's after decode */
+@@ -368,11 +497,10 @@ __pmDecodeValueSet(__pmPDU *pdubuf, int
+ 			return PM_ERR_IPC;
+ 		    }
+ 		    vindex = ntohl(pduvp->value.lval);
+-		    if (vindex < 0 || vindex > pdulen) {
++		    if (vindex < 0 || (char *)&pdubuf[vindex] >= pduend) {
+ 			if (pmDebugOptions.pdu && pmDebugOptions.desperate)
+-			    fprintf(stderr, "%s: Bad: pmid[%d] value[%d] "
+-					    "vindex=%d\n",
+-					    "__pmDecodeValueSet", i, j, vindex);
++			    fprintf(stderr, "__pmDecodeValueSet: PM_ERR_IPC: pmid[%d] value[%d] vindex=%d (max=%ld)\n",
++				i, j, vindex, (long)((pduend-(char *)pdubuf) / sizeof(pdubuf[0])-1));
+ 			return PM_ERR_IPC;
+ 		    }
+ 		    pduvbp = (pmValueBlock *)&pdubuf[vindex];
+@@ -387,7 +515,7 @@ __pmDecodeValueSet(__pmPDU *pdubuf, int
+ 					    "__pmDecodeValueSet", i, j);
+ 			return PM_ERR_IPC;
+ 		    }
+-		    __ntohpmValueBlock(pduvbp);
++		    __ntohpmValueBlock_hdr(pduvbp);
+ 		    if (pduvbp->vlen < PM_VAL_HDR_SIZE ||
+ 			pduvbp->vlen > pdulen) {
+ 			if (pmDebugOptions.pdu && pmDebugOptions.desperate)
+@@ -396,13 +524,20 @@ __pmDecodeValueSet(__pmPDU *pdubuf, int
+ 					    i, j, pduvbp->vlen);
+ 			return PM_ERR_IPC;
+ 		    }
+-		    if (pduvbp->vlen > (size_t)(pduend - (char *)pduvbp)) {
++		    if (pduvbp->vlen > check) {
+ 			if (pmDebugOptions.pdu && pmDebugOptions.desperate)
+ 			    fprintf(stderr, "%s: Bad: pmid[%d] value[%d] "
+ 					    "pduvp past end of PDU buffer\n",
+ 					    "__pmDecodeValueSet", i, j);
+ 			return PM_ERR_IPC;
+ 		    }
++		    if (pduvbp->vtype == PM_TYPE_HIGHRES_EVENT ||
++		        pduvbp->vtype == PM_TYPE_EVENT) {
++			vindex = (pduvbp->vtype == PM_TYPE_HIGHRES_EVENT);
++			if (__pmEventArrayCheck(pduvbp, vindex, i, j, check) < 0)
++			    return PM_ERR_IPC;
++		    }
++		    __ntohpmValueBlock_buf(pduvbp);
+ 		    vbsize += PM_PDU_SIZE_BYTES(pduvbp->vlen);
+ 		    if (pmDebugOptions.pdu && pmDebugOptions.desperate) {
+ 			fprintf(stderr, " len: %d type: %d",
+@@ -635,11 +770,10 @@ __pmDecodeValueSet(__pmPDU *pdubuf, int
+ 		} else {
+ 		    /* salvage pmValueBlocks from end of PDU */
+ 		    vindex = ntohl(pduvp->value.lval);
+-		    if (vindex < 0 || vindex > pdulen) {
++		    if (vindex < 0 || (char *)&pdubuf[vindex] >= pduend) {
+ 			if (pmDebugOptions.pdu && pmDebugOptions.desperate)
+-			    fprintf(stderr, "%s: Bad: pmid[%d] value[%d] "
+-					    "vindex=%d\n",
+-					    "__pmDecodeValueSet", i, j, vindex);
++			    fprintf(stderr, "__pmDecodeValueSet: PM_ERR_IPC: pmid[%d] value[%d] vindex=%d (max=%ld)\n",
++				i, j, vindex, (long)((pduend-(char *)pdubuf) / sizeof(pdubuf[0])-1));
+ 			return PM_ERR_IPC;
+ 		    }
+ 		    pduvbp = (pmValueBlock *)&pdubuf[vindex];
+@@ -654,7 +788,8 @@ __pmDecodeValueSet(__pmPDU *pdubuf, int
+ 					    "__pmDecodeValueSet", i, j);
+ 			return PM_ERR_IPC;
+ 		    }
+-		    __ntohpmValueBlock(pduvbp);
++
++		    __ntohpmValueBlock_hdr(pduvbp);
+ 		    if (pduvbp->vlen < PM_VAL_HDR_SIZE ||
+ 			pduvbp->vlen > pdulen) {
+ 			if (pmDebugOptions.pdu && pmDebugOptions.desperate)
+@@ -663,13 +798,20 @@ __pmDecodeValueSet(__pmPDU *pdubuf, int
+ 					    i, j, pduvbp->vlen);
+ 			return PM_ERR_IPC;
+ 		    }
+-		    if (pduvbp->vlen > (size_t)(pduend - (char *)pduvbp)) {
++		    if (pduvbp->vlen > check) {
+ 			if (pmDebugOptions.pdu && pmDebugOptions.desperate)
+ 			    fprintf(stderr, "%s: Bad: pmid[%d] value[%d] "
+ 					    "pduvp past end of PDU buffer\n",
+ 					    "__pmDecodeValueSet", i, j);
+ 			return PM_ERR_IPC;
+ 		    }
++		    if (pduvbp->vtype == PM_TYPE_HIGHRES_EVENT ||
++		        pduvbp->vtype == PM_TYPE_EVENT) {
++			vindex = (pduvbp->vtype == PM_TYPE_HIGHRES_EVENT);
++			if (__pmEventArrayCheck(pduvbp, vindex, i, j, check) < 0)
++			    return PM_ERR_IPC;
++		    }
++		    __ntohpmValueBlock_buf(pduvbp);
+ 		    pduvp->value.pval = pduvbp;
+ 		}
+ 	    }

redhat-issues-RHEL-57799-pmpost-symlink-handling.patch

@@ -0,0 +1,99 @@
+diff -Naurp pcp-5.3.7.orig/qa/640 pcp-5.3.7/qa/640
+--- pcp-5.3.7.orig/qa/640	2017-08-17 10:54:57.000000000 +1000
++++ pcp-5.3.7/qa/640	2024-09-09 13:41:12.440235947 +1000
+@@ -6,6 +6,10 @@
+ # years; so we now simply check the right permissions are in place
+ # and move right along...
+ #
++# Aug 2024 update
++# SuSE Issue G identifies another possible exploit, so try that
++# as well.
++#
+ # Copyright (c) 1995-2002 Silicon Graphics, Inc.  All Rights Reserved.
+ #
+ 
+@@ -17,13 +21,54 @@ echo "QA output created by $seq"
+ . ./common.filter
+ . ./common.check
+ 
+-status=0	# success is the default!
+-trap "$sudo rm -f $tmp.*; exit \$status" 0 1 2 3 15
++rm -f $seq.full
++ls -li $PCP_LOG_DIR/NOTICES $tmp/badness >>$seq.full 2>&1
++
++_cleanup()
++{
++    if [ -f $PCP_LOG_DIR/NOTICES.$seq ]
++    then
++	$sudo rm -f $PCP_LOG_DIR/NOTICES
++	$sudo mv $PCP_LOG_DIR/NOTICES.$seq $PCP_LOG_DIR/NOTICES
++    fi
++    ls -li $PCP_LOG_DIR/NOTICES $tmp/badness >>$seq.full 2>&1
++    $sudo rm -rf $tmp $tmp.*
++}
++
++status=1	# failure is the default!
++trap "_cleanup; exit \$status" 0 1 2 3 15
++
++_filter()
++{
++    sed \
++	-e "s@$PCP_LOG_DIR@PCP_LOG_DIR@g" \
++	-e '/^pmpost:/s/\[.*]/[DATE]/' \
++    # end
++}
+ 
+ # real QA test starts here
+ pmpost=$PCP_BINADM_DIR/pmpost
+-echo "Using pmpost binary: $pmpost" > $seq.full
++echo "Using pmpost binary: $pmpost" >>$seq.full
+ test -u "$pmpost" && echo "FAIL: pmpost has setuid bit set"
+ test -g "$pmpost" && echo "FAIL: pmpost has setgid bit set"
++
++$sudo mkdir $tmp || exit
++$sudo chmod 700 $tmp || exit
++$sudo -u $PCP_USER mv $PCP_LOG_DIR/NOTICES $PCP_LOG_DIR/NOTICES.$seq
++
++$sudo -u $PCP_USER ln -s $tmp/badness $PCP_LOG_DIR/NOTICES >>$seq.full
++$pmpost ordinary user 2>&1 | _filter
++$sudo ls -li $PCP_LOG_DIR/NOTICES $tmp/badness >>$seq.full 2>&1
++$sudo -u pcp $pmpost pcp user 2>&1 | _filter
++$sudo ls -li $PCP_LOG_DIR/NOTICES $tmp/badness >>$seq.full 2>&1
++$sudo $pmpost root user 2>&1 | _filter
++$sudo ls -li $PCP_LOG_DIR/NOTICES $tmp/badness >>$seq.full 2>&1
++if $sudo test -f $tmp/badness
++then
++    $sudo cat $tmp/badness
++fi
++
+ echo "Test complete"
++
++status=0
+ exit
+diff -Naurp pcp-5.3.7.orig/qa/640.out pcp-5.3.7/qa/640.out
+--- pcp-5.3.7.orig/qa/640.out	2017-08-17 10:54:57.000000000 +1000
++++ pcp-5.3.7/qa/640.out	2024-09-09 13:41:12.440235947 +1000
+@@ -1,2 +1,5 @@
+ QA output created by 640
++pmpost: unposted message: [DATE] ordinary user
++pmpost: unposted message: [DATE] pcp user
++pmpost: unposted message: [DATE] root user
+ Test complete
+diff -Naurp pcp-5.3.7.orig/src/pmpost/pmpost.c pcp-5.3.7/src/pmpost/pmpost.c
+--- pcp-5.3.7.orig/src/pmpost/pmpost.c	2021-02-17 15:27:41.000000000 +1100
++++ pcp-5.3.7/src/pmpost/pmpost.c	2024-09-09 13:41:12.440235947 +1000
+@@ -141,8 +141,12 @@ main(int argc, char **argv)
+ 	goto oops;
+     }
+ 
+-    if ((fd = open(notices, O_WRONLY|O_APPEND, 0)) < 0) {
+-	if ((fd = open(notices, O_WRONLY|O_CREAT|O_APPEND, 0664)) < 0) {
++    if ((fd = open(notices, O_WRONLY|O_APPEND|O_NOFOLLOW, 0)) < 0) {
++	if (oserror() == ELOOP) {
++	    /* last component is symlink => attack? ... bail! */
++	    goto oops;
++	}
++	if ((fd = open(notices, O_WRONLY|O_CREAT|O_APPEND|O_NOFOLLOW, 0664)) < 0) {
+ 	    fprintf(stderr, "pmpost: cannot open or create file \"%s\": %s\n",
+ 		notices, osstrerror());
+ 	    goto oops;