diff --git a/net-analyzer/monitoring-plugins/Manifest b/net-analyzer/monitoring-plugins/Manifest index bf0cd41dd230f..20dd4cfa5c9e7 100644 --- a/net-analyzer/monitoring-plugins/Manifest +++ b/net-analyzer/monitoring-plugins/Manifest @@ -1 +1,2 @@ DIST monitoring-plugins-2.4.0.tar.gz 2746382 BLAKE2B 3e062b9392b4e5885a549ca619eee25f29517e83682e0eb76c8780235b48ab26d79994827c1167e981a993ece3f3f339de61874c912e6fcb17b4cb1af22e97d9 SHA512 7e9aae7768ed9fccbaf377fc54a70374f6a41e8e8ef95cf7440e44fca1080eb23e6b3d737214c96d772eb9a32cdfdbf1b88e0eb35eda0690047d5fe1b485a6b2 +DIST monitoring-plugins-3.0.1.tar.gz 3005747 BLAKE2B a9eef6b2fa7e8c138d10c222fc575426138ea19cf0a33516daac55cec6fd3d511c8921ca81d95e2d78dd37cc1fc438a959340b6f4d4c01c087134429573f85e7 SHA512 c9f462debec7a444eb1bbe76331d824c76d4e795881069543bbb588710121253fb3870b4e80dbeb711b39741f1f0fbfef533953283ab2779298b4843c4002ad8 diff --git a/net-analyzer/monitoring-plugins/files/monitoring-plugins-3.0.1-check-ntp-buildfix.patch b/net-analyzer/monitoring-plugins/files/monitoring-plugins-3.0.1-check-ntp-buildfix.patch new file mode 100644 index 0000000000000..875ec5773119a --- /dev/null +++ b/net-analyzer/monitoring-plugins/files/monitoring-plugins-3.0.1-check-ntp-buildfix.patch @@ -0,0 +1,36 @@ +From e84ecb1dc8e27a27c35267077764c0ea10f12306 Mon Sep 17 00:00:00 2001 +From: Michael Orlitzky +Date: Fri, 3 Jul 2026 22:04:49 -0400 +Subject: [PATCH] plugins/check_ntp_time.c: add missing sockaddr_un -> sockaddr + cast + +Newer GCC with -Werror=incompatible-pointer-types enabled by default +will choke on this: + + check_ntp_time.c: In function 'offset_request': + check_ntp_time.c:404:42: error: passing argument 2 of 'connect' from + incompatible pointer type [-Wincompatible-pointer-types] + 404 | if (connect(socklist[0], &unix_socket, sizeof(unix_socket))) { + | ^~~~~~~~~~~~ + | | + | struct sockaddr_un * +--- + plugins/check_ntp_time.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/plugins/check_ntp_time.c b/plugins/check_ntp_time.c +index 2d9a6f40..5ad615c2 100644 +--- a/plugins/check_ntp_time.c ++++ b/plugins/check_ntp_time.c +@@ -401,7 +401,7 @@ static offset_request_wrapper offset_request(const char *host, const char *port, + } + strncpy(unix_socket.sun_path, host, sizeof(unix_socket.sun_path)); + +- if (connect(socklist[0], &unix_socket, sizeof(unix_socket))) { ++ if (connect(socklist[0], (struct sockaddr *)&unix_socket, sizeof(unix_socket))) { + /* don't die here, because it is enough if there is one server + answering in time. This also would break for dual ipv4/6 stacked + ntp servers when the client only supports on of them. +-- +2.54.0 + diff --git a/net-analyzer/monitoring-plugins/metadata.xml b/net-analyzer/monitoring-plugins/metadata.xml index 3eec6ade7c4a3..f2ec8c895a00b 100644 --- a/net-analyzer/monitoring-plugins/metadata.xml +++ b/net-analyzer/monitoring-plugins/metadata.xml @@ -22,6 +22,10 @@ Install games-util/qstat required for monitoring FPS servers. Disabling the flag does not remove any plugins. + + Use filesystem capabilities for privileged executables like + check_icmp (preferable to suid). + Install net-analyzer/fping required for fancy ping monitoring. Disabling the flag does not remove any plugins. @@ -43,6 +47,10 @@ net-analyzer/net-snmp required for monitoring SNMP values. Disabling the flag does not remove any plugins. + + Fall back to suid for privileged checks like check_icmp if + filecaps are disabled or unavailable. + monitoring-plugins/monitoring-plugins diff --git a/net-analyzer/monitoring-plugins/monitoring-plugins-2.4.0-r2.ebuild b/net-analyzer/monitoring-plugins/monitoring-plugins-3.0.1.ebuild similarity index 71% rename from net-analyzer/monitoring-plugins/monitoring-plugins-2.4.0-r2.ebuild rename to net-analyzer/monitoring-plugins/monitoring-plugins-3.0.1.ebuild index a86935897c034..b8d5ee1cad23d 100644 --- a/net-analyzer/monitoring-plugins/monitoring-plugins-2.4.0-r2.ebuild +++ b/net-analyzer/monitoring-plugins/monitoring-plugins-3.0.1.ebuild @@ -1,18 +1,19 @@ -# Copyright 1999-2025 Gentoo Authors +# Copyright 1999-2026 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 EAPI=8 -inherit flag-o-matic +inherit fcaps flag-o-matic DESCRIPTION="50+ standard plugins for Icinga, Naemon, Nagios, Shinken, Sensu" -HOMEPAGE="https://www.monitoring-plugins.org/" +HOMEPAGE="https://www.monitoring-plugins.org/ + https://github.com/monitoring-plugins/monitoring-plugins/" SRC_URI="https://www.monitoring-plugins.org/download/${P}.tar.gz" LICENSE="GPL-3" SLOT="0" -KEYWORDS="~amd64 ~arm ~arm64 ~sparc ~x86" -IUSE="curl gnutls ipv6 ldap mysql dns fping game postgres radius rpc samba snmp ssh +ssl" +KEYWORDS="~amd64 ~arm ~arm64 ~riscv ~sparc ~x86" +IUSE="curl gnutls ipv6 ldap mysql dns fping game postgres radius rpc samba snmp ssh +ssl suid" # Most of the plugins use automagic dependencies, i.e. the plugin will # get built if the binary it uses is installed. For example, check_snmp @@ -51,8 +52,6 @@ DEPEND="${REAL_DEPEND} # Basically everything collides with nagios-plugins. RDEPEND="${DEPEND} - acct-group/nagios - acct-user/nagios !net-analyzer/nagios-plugins" # At least one test is interactive. @@ -68,7 +67,13 @@ QA_CONFIG_IMPL_DECL_SKIP=( alignof ) +PATCHES=( "${FILESDIR}/${P}-check-ntp-buildfix.patch" ) + +DOCS=( ACKNOWLEDGEMENTS AUTHORS CODING ChangeLog FAQ \ + NEWS README REQUIREMENTS SUPPORT THANKS ) + src_configure() { + # https://github.com/monitoring-plugins/monitoring-plugins/issues/2295 append-flags -fno-strict-aliasing # Use an array to prevent econf from mangling the ping args. @@ -104,8 +109,34 @@ src_configure() { --sysconfdir="/etc/nagios" } -DOCS=( ACKNOWLEDGEMENTS AUTHORS CODING ChangeLog FAQ \ - NEWS README REQUIREMENTS SUPPORT THANKS ) +src_install() { + default + + # Prefer capabilities to suid. Beware that fcaps and fperms require + # two different kinds of paths; fperms always prepends ${ED}, but + # fcaps only does so it if the path does not already start with a + # slash. Anyway, begin by removing suid unconditionally. + local pd="usr/$(get_libdir)/nagios/plugins" + + if use filecaps; then + local flags msg + if use suid; then + # use suid if setcap fails + flags="-m u+s" + msg=" (with suid fallback)" + fi + einfo "replacing suid bits with filecaps${msg}" + fperms ug-s /"${pd}"/check_{dhcp,icmp} + fcaps ${flags} cap_net_bind_service "${pd}"/check_dhcp + fcaps ${flags} cap_net_bind_service,cap_net_raw "${pd}"/check_icmp + else + # no filecaps, just suid (or not) + if ! use suid; then + einfo "stripping suid bits" + fperms ug-s /"${pd}"/check_{dhcp,icmp} + fi + fi +} pkg_postinst() { elog "This ebuild has a number of USE flags that determine what you"