commit: d04d6fdaaf260a2f30ee109c85507382ccf1a2cf Author: Brett A C Sheffield <bacs <AT> librecast <DOT> net> AuthorDate: Sun Mar 8 18:12:20 2026 +0000 Commit: Michael Orlitzky <mjo <AT> gentoo <DOT> org> CommitDate: Mon Mar 9 02:17:05 2026 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d04d6fda
app-text/groonga: fix privilege escalation bug Prevent privilege escalation via PID file manipulation. Revbump -> 16.0.0-r1 (security bug). Bug: https://bugs.gentoo.org/630758 Suggested-by: Michael Orlitzky <mjo <AT> gentoo.org> Signed-off-by: Brett A C Sheffield <bacs <AT> librecast.net> Signed-off-by: Michael Orlitzky <mjo <AT> gentoo.org> app-text/groonga/files/groonga.confd | 7 +- app-text/groonga/files/groonga.initd | 26 ++++--- app-text/groonga/groonga-16.0.0-r1.ebuild | 111 ++++++++++++++++++++++++++++++ 3 files changed, 131 insertions(+), 13 deletions(-) diff --git a/app-text/groonga/files/groonga.confd b/app-text/groonga/files/groonga.confd index f70b8e5b8342..53672b0102a3 100644 --- a/app-text/groonga/files/groonga.confd +++ b/app-text/groonga/files/groonga.confd @@ -1,8 +1,7 @@ -# Copyright 1999-2014 Gentoo Foundation +# Copyright 1999-2026 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 #GROONGA_USER=groonga #GROONGA_GROUP=groonga -#GROONGA_PID=/run/groonga/groonga.pid -#CONFIG_FILE=/etc/groonga/groonga.conf -DATABASE=/var/lib/groonga/db +#GROONGA_CONFIG=/etc/groonga/groonga.conf +GROONGA_DATABASE=/var/lib/groonga/db diff --git a/app-text/groonga/files/groonga.initd b/app-text/groonga/files/groonga.initd index 7d11ab6f7984..a10516d4efda 100644 --- a/app-text/groonga/files/groonga.initd +++ b/app-text/groonga/files/groonga.initd @@ -1,20 +1,28 @@ #!/sbin/openrc-run -# Copyright 1999-2014 Gentoo Foundation +# Copyright 1999-2026 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 -command=/usr/bin/groonga -command_args="-d --pid-path ${GROONGA_PID:-/run/groonga/groonga.pid} --config-path=${CONFIG_FILE:-/etc/groonga/groonga.conf} ${DATABASE}" -pidfile="${GROONGA_PID:-/run/groonga/groonga.pid}" -start_stop_daemon_args="--quiet --user ${GROONGA_USER:-groonga}:${GROONGA_GROUP:-groonga}" +command="/usr/bin/groonga" +pidfile="/run/${RC_SVCNAME}.pid" + +# Groonga can't drop permissions on its own so there's no safe way to +# use the PID file that it would create if we started it as an +# unprivileged user and let it daemonize itself (and write its own PID +# file). Run it in "server" (i.e. foreground) mode instead, and have +# OpenRC background it and manage its PID file. +command_args="-s + --config-path=${GROONGA_CONFIG:-/etc/groonga/groonga.conf} + ${GROONGA_DATABASE}" +command_user="${GROONGA_USER:-groonga}:${GROONGA_GROUP:-groonga}" +command_background="true" depend() { use net } start_pre() { - checkpath -d /run/groonga -o ${GROONGA_USER:-groonga}:${GROONGA_GROUP:-groonga} - if [ ! -e "${DATABASE}" ] ; then - einfo "Creating database ${DATABASE}" - su -s /bin/sh -c "/usr/bin/groonga -n ${DATABASE} quit" ${GROONGA_USER:-groonga} + if [ ! -e "${GROONGA_DATABASE}" ] ; then + einfo "Creating database ${GROONGA_DATABASE}" + su -s /bin/sh -c "${command} -n ${GROONGA_DATABASE} quit" ${GROONGA_USER:-groonga} fi } diff --git a/app-text/groonga/groonga-16.0.0-r1.ebuild b/app-text/groonga/groonga-16.0.0-r1.ebuild new file mode 100644 index 000000000000..d5468bb799ce --- /dev/null +++ b/app-text/groonga/groonga-16.0.0-r1.ebuild @@ -0,0 +1,111 @@ +# Copyright 1999-2026 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +DISTUTILS_USE_PEP517=setuptools +PYTHON_COMPAT=( python3_{11..14} ) + +inherit distutils-r1 libtool + +DESCRIPTION="An Embeddable Fulltext Search Engine" +HOMEPAGE="https://groonga.org/"; +SRC_URI="https://packages.groonga.org/source/${PN}/${P}.tar.gz"; + +LICENSE="LGPL-2.1" +SLOT="0" +KEYWORDS="~amd64 ~x86" +IUSE="benchmark debug doc +exact-alloc-count examples futex libedit libevent lzo +mecab msgpack +nfkc sphinx static-libs uyield zeromq zlib zstd" + +DEPEND=" + acct-group/groonga + acct-user/groonga + >=dev-libs/onigmo-6.1.1:0= + dev-libs/rapidjson + dev-libs/xxhash + benchmark? ( >=dev-libs/glib-2.8 ) + libedit? ( >=dev-libs/libedit-3 ) + libevent? ( dev-libs/libevent:0= ) + lzo? ( dev-libs/lzo ) + mecab? ( >=app-text/mecab-0.80 ) + msgpack? ( dev-libs/msgpack:= ) + sphinx? ( >=dev-python/sphinx-1.0.1 ) + zeromq? ( net-libs/zeromq:0= ) + zlib? ( virtual/zlib:= ) + zstd? ( app-arch/zstd:0= ) +" +RDEPEND="${DEPEND}" +BDEPEND=" + virtual/pkgconfig +" + +distutils_enable_sphinx doc/source \ + dev-python/myst-parser \ + dev-python/pydata-sphinx-theme + +src_prepare() { + default + + elibtoolize +} + +src_configure() { + # httpd is a bundled copy of nginx; disabled for security reasons + # prce only is used with httpd + # Apache arrow, kytea and libstemmer are not available in Gentoo repo + # ruby is only used for an http test + local econfopts=( + --disable-groonga-httpd + --without-pcre + --without-kytea + --without-libstemmer + --disable-arrow + --with-log-path="${EPREFIX}"/var/log/${PN}.log + --without-luajit + --without-ruby + --with-shared-onigmo + --with-onigmo=system + --with-xxhash + --without-jemalloc + $(use_enable benchmark) + $(use_enable debug memory-debug) + $(use_enable doc document) + $(use_enable exact-alloc-count) + $(use_enable futex) + $(use_enable libedit) + $(use_with libevent) + $(use_with lzo) + $(use_with mecab) + $(use_enable msgpack message-pack) + $(use_with msgpack message-pack "${ESYSROOT}/usr") + $(use_enable nfkc) + $(use_with sphinx sphinx-build) + $(use_enable static-libs static) + $(use_enable uyield) + $(use_enable zeromq) + $(use_with zlib) + $(use_with zstd) + ) + + econf "${econfopts[@]}" +} + +src_compile() { + use doc && MAKEOPTS+=" -j1" # docs fail with parallel build. Bug: 904135 +} + +src_install() { + default + + find "${ED}" -name '*.la' -delete || die + + newinitd "${FILESDIR}/${PN}.initd" ${PN} + newconfd "${FILESDIR}/${PN}.confd" ${PN} + + keepdir /var/{log,lib}/${PN} + fowners groonga:groonga /var/{log,lib}/${PN} + + if ! use examples ; then + rm -r "${ED}/usr/share/${PN}" || die + fi +}
