olemskoi.ru

Per today’s announcement from the PHP Development Group, we have just completed building out updates for our php52 packages bringing them inline with upstream stable 5.2.12.  IUS maintains php52 for Redhat / CentOS Enterprise Linux 4 and 5, and plan to do so until the 5.2 branch is EOL upstream.

Along with this update we have also rebuilt the available PECL packages for php52 for Redhat/CentOS EL 5 only.  The available PECL packages are:

• php52-pecl-memcache
• php52-pecl-apc
• php52-pecl-imagick (new)

As you can see this is a pretty skimpy list.  We are hoping to add more PECL packages to this list, but in order to do so we really need contributions from the community.  Our goal would be to eventually have a comparable list of PECL packages to what EPEL has in their repo.  If you are interested in helping contribute packages to the project, please see the Developer Guide.

Testing IUS Packages

All packages and updates mentioned in this post are currently in ius-el5-testing meaning that they haven’t quite made it to our production/stable repositories.  Any help testing packages is more than extremely appreciated.  If you are interested in contributing to the project by way of testing and feedback, see the Getting Started Guide and more specifically the section from the wiki on Installing Packages from IUS Testing. Once complete either email us or submit feedback via the appropriate tracker on our LaunchPad site.

Along with PHP 5.2.12, there are also updates for:

• mod_wsgi-python31
• rsyslog4

Contacting the IUS Core Development Team

If you are unable to communicate via our bug tracking system, mailing list, answers section, etc please send us an email to coredev@iuscommunity.org.

We also hangout in #iuscommunity on irc.freenode.net.

We have packaged up the latest Python 3 for IUS EL5.  We have added it in hopes of encouraging the Python community to start porting their applications sooner than later.  Along with Python 3 we have also added Mod_WSGI 3.0c5 to make working with Python 3 web applications possible on RHEL/CentOS 5.

Currently, Setup Tools is not Python 3 compatible, and there is heavy debate [read uncertainty] over whether it ever will be.  Because of that the project was forked, and the necessary compatibility is available via the Distribute project.  Distribute is Python 3 compatible and is effectively a drop in replacement for setuptools.

Installing Python 3 from IUS

For new comers to IUS, please see the Getting Started Guide.  Once setup, installation is as easy as:

root@linux ~]# yum install python31 python31-distribute<br />

Once you have python31 and python31-distribute installed, you can install from the cheeze shop as well as access the python3.1 binary:

<br />
root@linux ~]# easy_install-3.1 threecheck<br />
root@linux ~]# python3.1<br />
python> import threecheck<br />

For a list of Python 3 compatible packages, check out PyPI.

Reporting Bugs

We appreciate any feedback you have, good or bad.  If you come across any issues please report a bug at our Launchpad Project Page.

Update: 2009-11-04

We have moved mod_wsgi-python31 to the development repository for the time being until it has exited release candidate and becomes general availability.  Currently, the ius-release package does not have the repo config for development and possible may not for a while.  You can however download the files from the link provided above and install via rpm, or manually add the repo for the development repository.

A vulnerability in both PHP 5.2.11 and 5.3.0 was announced on September 30, 2009 via Security Reason.  Grzegorz Stachowiak discovered an open_basedir bypass in the posix_mkfifo () function allowing a denial of service if the Apache user, or local user has write access to create a .htaccess socket within a DocumentRoot.

The Vulnerability

The vulnerability exists due to the fact that the posix_mkfifo () function in ./ext/posix/posix.c only checks for safe_mode restrictions and not open_basedir restrictions.  Take the following example:

UserX and UserY both have virtual hosts on a shared server with open_basedir enabled restricting files to only be served out of ‘/var/www:/tmp’.  Open Basedir dictates that scripts can only run out of, and access files within the directories specified via the open_basedir setting.

With the vulnerability in posix_mkfifo (), UserX can craft a script that generates a fifo socket file named ‘.htaccess’ in UserY’s directory (if writable by Apache or UserX) such as:

<br />
posix_mkfifo('/home/UserY/www/.htaccess', 0777);

This will successfully create the file  ‘/home/UserY/www/.htaccess’.  The next time that a file is requested from /home/UserY/www Apache attempts to read the .htaccess file and simply hangs because the fifo socket file can not be read properly by Apache.

The Fix

The PHP developers have patched this bug in upstream CVS, which has been backported by the IUS CoreDev team and applied to our php52 and php53 packages.

Installing IUS Patched RPMs for RHEL/CentOS

Packages are available for RHEL/CentOS 4 (php52) and RHEL/CentOS 5 (php52, php53).  For installation/upgrade instructions see the Getting Started page and/or check out the Wiki for more information.

Other IUS Package Updates

In addition to these package updates we have also released a number of other updates to IUS Stable.  Please see the full announcements:

• Updates Pushed to IUS Stable for Redhat/CentOS EL 5
• Updates Pushed to IUS Stable for Redhat/CentOS EL 4

Thanks!

—
BJ Dierkes
Linux Systems Engineer IV / [RH]acker
Infrastructure Services [OS & Applications]
Rackspace Hosting

A vulnerability in both PHP 5.2.11 and 5.3.0 was announced on September 30, 2009 via Security Reason.  Grzegorz Stachowiak discovered a safe_mode bypass in the tempnam () function allowing any local user or any scripts owned by the Apache user, with writable permissions on another user’s directory to bypass safe_mode restrictions.

The Vulnerability

The vulnerability exists due to the fact that the tempnam () function in ./ext/standard/file.c only checks for open_basedir restrictions and not standard safe_mode UID/GID restrictions.  Take the following example:

UserX and UserY both have virtual hosts on a shared server with safe_mode enabled.  Safe mode dictates that scripts owned by UserX can not access UserY’s directories/files… even though the Apache user is the one executing the scripts and has system level permissions to access both.

With the vulnerability in tempnam (), UserX can craft a script that generates a temp file in UserY’s directory (if writable by Apache or UserX) such as:

<br />
tempnam('/home/UserY/www', 'user_x_file.php');

This will successfully create a file in ‘/home/UserY/www’ that UserX can then write to, and execute.

The Fix

The PHP developers have patched this bug in upstream CVS, which has been backported by the IUS CoreDev team and applied to our php52 and php53 packages.  The diffs are available here:

• Patch for PHP 5.3.0
• Patch for PHp 5.2.11

Installing IUS Patched RPMs for RHEL/CentOS

Packages are available for RHEL/CentOS 4 (php52) and RHEL/CentOS 5 (php52, php53).  For installation/upgrade instructions see the Getting Started page and/or check out the Wiki for more information.

Other IUS Package Updates

In addition to these package updates we have also released a number of other updates to IUS Stable.  Please see our other announcements:

• Updates Pushed to IUS Stable for Redhat/CentOS EL 5
• Updates Pushed to IUS Stable for Redhat/CentOS EL 4

Thanks!

—
BJ Dierkes
Linux Systems Engineer IV / [RH]acker
Infrastructure Services [OS & Applications]
Rackspace Hosting

The IUS CoreDev Team has decided to make our packages for PHP 5.2 and MySQL 5.0 available for Red Hat Enterprise Linux  and CentOS 4.  Initially we were going to completely ignore RHEL4, however we feel it could greatly benefit a lot of people to have an upgraded PHP/MySQL stack should they not have the option to upgrade their servers.

It should be noted, we will not be adding any other packages to the RHEL4 repositories.  We will maintain  PHP 5.2 and MySQL 5.0 on RHEL4 as long as we can (they are essentially the same exact packages as on RHEL5) but there is no guarantee of course.

Information on how to upgrade PHP and MySQL on RHEL/CentOS 4 can be found on the IUS Community Project Wiki.

Reporting Bugs

As always we appreciate your feedback, and ask that you please submit bug reports via our LaunchPad Project Page.

Mirror Updates

Please allow 24 hours from the time of this writing before expecting your local neighborhood mirror to carry this update.

The following builds have been pushed to IUS Stable for Redhat/CentOS EL 5

• python26-2.6.2-1.ius
• mysql51-5.1.39-1.ius

Update details follow… please expect 24 hours for your local mirrors to sync.

Build: python26-2.6.2-1.ius

Python is an interpreted, interactive, object-oriented programming language

Update Information:

%changelog
* Tue Sep 01 2009 BJ Dierkes  - 2.6.2-1.ius
- Latest sources from upstream.
- Replaced Patch0: python-2.6-config.patch with
  Patch0: Python-2.6.2-rhconfig.patch
- Replaced Patch3: python-2.6-canonicalize.patch with
  Patch3: python-2.6.2-canonicalize.patch
- Replaced Patch200: python-2.6-autoconf.patch with
  Patch200: Python-2.6.2-autoconf.patch
- Removed Patch10: python-2.5.2-binutils-no-dep.patch
- Build with system ffi
- Add -lcrypt to crypto module

References:

[ 1 ] Bug #437070 – Python 2.6.2 Source Update Available
https://bugs.launchpad.net/ius/+bug/437070

Build: mysql51-5.1.39-1.ius

MySQL is a multi-user, multi-threaded SQL database server.

Update Information:

%changelog
* Fri Sep 25 2009 BJ Dierkes  - 5.1.39-1.ius
- Latest sources from upstream.
- Added _with_innodb_plugin build option, but left disabled by default
  due to MySQL's claim that it is of beta quality.

References:

[ 1 ] Bug #434120 – MySQL 5.1.39 Source Update
https://bugs.launchpad.net/ius/+bug/434120

Reporting Bugs or No Bugs

Any and all feedback is greatly appreciated, whether it be because you found bugs or to let us know that you didn’t have any issues. Please report all bugs to:

http://bugs.launchpad.net/ius

Thanks!

Per yesterday’s announcement of PHP 5.2.11, the IUS CoreDev Team has updated our php52 RPM set which is currently available for testing.

Installing Packages From Testing

When packages are tagged as ‘testing’ in our buildfarm they are added to the testing repository.  If you have installed the ius-release package then you already have this repo configured in yum, but disabled by default.  Simply issue the following command for the package (s) you want to install from testing:

root@linuxbox ~]# yum install PACKAGE_NAME --enablerepo=ius-testing

OR if you already have our .ius packages installed, simply upgrade.

root@linuxbox ~]# yum upgrade --enablerepo=ius-testing

Providing Feedback

We appreciate any feedback at all, both good and bad. If you have tested or are using these packages already please submit feedback via the tracker for this release. Once we have enough positive feedback or enough time has passed we can push these packages to stable.

2009-09-23 Update

The IUS Packages for php52-5.2.11-1.ius have been pushed to stable.

Latest release to the IUS Stable Repositories brings our mysql50 packages inline with the upstream stable sources of the MySQL 5.0 branch.

https://launchpad.net/ius/mysql50/mysql50-5.0.85-1

RPM ChangeLog:
<br />
* Mon Aug 31 2009 BJ Dierkes <wdierkes@rackspace.com> - 5.0.85-1.ius<br />
- Latest sources from upstream<br />
- Updating default my.cnf a tad<br />
- Adding SOURCE9(my-50-terse.cnf) and SOURCE10(my-50-verbose.cnf) to doc dir.<br />
- Removed Patch221: mysql-5.0.84-disabled_tests.patch<br />
- Added Patch223: mysql-5.0.85-disabled-tests.patch<br />

To upgrade from previous versions of the mysql50 rpms simply execute the following command as root:

root@linuxbox ~]# yum upgrade

To replace stock RHEL or CentOS 5 rpms with IUS packages please see the Getting Started page.