!36 [sync] PR-35: fix CVE-2024-23454

From: @openeuler-sync-bot 
Reviewed-by: @wenwj0 
Signed-off-by: @wenwj0

0003-compatible-with-gcc12.patch

@@ -0,0 +1,10 @@
+--- hadoop-3.1.4-src/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-nativetask/src/CMakeLists.txt	2020-07-21 01:17:58.000000000 +0800
++++ hadoop-3.1.4-src/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-nativetask/src/CMakeLists.txt	2023-07-21 16:33:10.948752821 +0800
+@@ -27,6 +27,7 @@
+ # Add extra compiler and linker flags.
+ # -Wno-sign-compare
+ hadoop_add_compiler_flags("-DNDEBUG -DSIMPLE_MEMCPY -fno-strict-aliasing -fsigned-char")
++set(CMAKE_CXX_STANDARD 11)
+ 
+ # Source location.
+ set(SRC main/native)

0004-fix_build_issue_on_riscv.patch

@@ -0,0 +1,20 @@
+--- hadoop-3.1.4-src/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-nativetask/src/main/native/src/lib/primitives.h.ori	2020-07-21 01:17:58.000000000 +0800
++++ hadoop-3.1.4-src/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-nativetask/src/main/native/src/lib/primitives.h	2022-09-03 12:43:35.309454600 +0800
+@@ -99,6 +99,8 @@
+ inline uint32_t bswap(uint32_t val) {
+ #ifdef __aarch64__
+   __asm__("rev %w[dst], %w[src]" : [dst]"=r"(val) : [src]"r"(val));
++#elif defined(__ppc64__)||(__PPC64__)||(__powerpc64__)||(__riscv)
++  return __builtin_bswap32(val);
+ #else
+   __asm__("bswap %0" : "=r" (val) : "0" (val));
+ #endif
+@@ -108,6 +110,8 @@
+ inline uint64_t bswap64(uint64_t val) {
+ #ifdef __aarch64__
+   __asm__("rev %[dst], %[src]" : [dst]"=r"(val) : [src]"r"(val));
++#elif defined(__ppc64__)||(__PPC64__)||(__powerpc64__)||(__riscv)
++  return __builtin_bswap64(val);
+ #else
+ #ifdef __X64
+   __asm__("bswapq %0" : "=r" (val) : "0" (val));

0005-upgrade_os-maven_plugin_to_1.7.1.patch

@@ -0,0 +1,11 @@
+--- hadoop-3.1.4-src/hadoop-project/pom.xml.ori	2020-07-21 14:34:40.000000000 +0800
++++ hadoop-3.1.4-src/hadoop-project/pom.xml	2022-08-26 13:33:06.382209900 +0800
+@@ -85,7 +85,7 @@
+ 
+     <!-- Maven protoc compiler -->
+     <protobuf-maven-plugin.version>0.5.1</protobuf-maven-plugin.version>
+-    <os-maven-plugin.version>1.5.0.Final</os-maven-plugin.version>
++    <os-maven-plugin.version>1.7.1</os-maven-plugin.version>
+ 
+     <zookeeper.version>3.4.13</zookeeper.version>
+     <curator.version>2.13.0</curator.version>

0006-Enhance-access-control-for-RunJar.patch

@@ -0,0 +1,58 @@
+From 7c30e7ffb65f9a58a85b3b556f8c0de04c1b4b20 Mon Sep 17 00:00:00 2001
+From: He Xiaoqiao <hexiaoqiao@apache.org>
+Date: Mon, 15 Jan 2024 16:01:08 +0800
+Subject: [PATCH] HADOOP-19031. Enhance access control for RunJar.
+
+---
+ .../java/org/apache/hadoop/util/RunJar.java     | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/RunJar.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/RunJar.java
+index 239d464..20c2d13 100644
+--- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/RunJar.java
++++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/RunJar.java
+@@ -28,10 +28,15 @@ import java.lang.reflect.Method;
+ import java.net.MalformedURLException;
+ import java.net.URL;
+ import java.net.URLClassLoader;
++import java.nio.file.Files;
++import java.nio.file.attribute.FileAttribute;
++import java.nio.file.attribute.PosixFilePermission;
++import java.nio.file.attribute.PosixFilePermissions;
+ import java.util.ArrayList;
+ import java.util.Arrays;
+ import java.util.Enumeration;
+ import java.util.List;
++import java.util.Set;
+ import java.util.jar.JarEntry;
+ import java.util.jar.JarFile;
+ import java.util.jar.JarInputStream;
+@@ -278,20 +283,18 @@ public class RunJar {
+ 
+     final File workDir;
+     try {
+-      workDir = File.createTempFile("hadoop-unjar", "", tmpDir);
+-    } catch (IOException ioe) {
++      FileAttribute<Set<PosixFilePermission>> perms = PosixFilePermissions
++          .asFileAttribute(PosixFilePermissions.fromString("rwx------"));
++      workDir = Files.createTempDirectory(tmpDir.toPath(), "hadoop-unjar", perms).toFile();
++    } catch (IOException | SecurityException e) {
+       // If user has insufficient perms to write to tmpDir, default
+       // "Permission denied" message doesn't specify a filename.
+       System.err.println("Error creating temp dir in java.io.tmpdir "
+-                         + tmpDir + " due to " + ioe.getMessage());
++                         + tmpDir + " due to " + e.getMessage());
+       System.exit(-1);
+       return;
+     }
+ 
+-    if (!workDir.delete()) {
+-      System.err.println("Delete failed for " + workDir);
+-      System.exit(-1);
+-    }
+     ensureDirectory(workDir);
+ 
+     ShutdownHookManager.get().addShutdownHook(
+-- 
+2.43.0
+

hadoop-3.1.spec

@@ -12,11 +12,11 @@
 %define _binaries_in_noarch_packages_terminate_build 0
 Name:   hadoop-3.1
 Version: 3.1.4
-Release: 4
+Release: 9
 Summary: A software platform for processing vast amounts of data
 # The BSD license file is missing
 # https://issues.apache.org/jira/browse/HADOOP-9849
-License: Apache-2.0 and MIT and BSD-2-Clause and EPL and Zlib and MPL-2.0
+License: Apache-2.0 and MIT and BSD-2-Clause and EPL-1.0 and Zlib and MPL-2.0
 URL:     https://%{real_name}.apache.org
 Source0: https://www.apache.org/dist/%{real_name}/core/%{real_name}-%{version}/%{real_name}-%{version}-src.tar.gz
 Source1: %{real_name}-layout.sh
@@ -35,7 +35,10 @@ Source13: %{real_name}-yarn-site.xml
 
 Patch1: 0001-sys_errlist-undeclared.patch
 Patch2: 0002-bugfix-invalid-variable-name.patch
-
+Patch3: 0003-compatible-with-gcc12.patch
+Patch4: 0004-fix_build_issue_on_riscv.patch
+Patch5: 0005-upgrade_os-maven_plugin_to_1.7.1.patch
+Patch6: 0006-Enhance-access-control-for-RunJar.patch
 
 BuildRoot: %{_tmppath}/%{real_name}-%{version}-%{release}-root
 BuildRequires: java-1.8.0-openjdk-devel maven hostname maven-local tomcat cmake snappy openssl-devel 
@@ -243,6 +246,9 @@ This package contains files needed to run Apache Hadoop YARN in secure mode.
 %prep
 %autosetup -p1 -n %{real_name}-%{version}-src
 mvn install:install-file -DgroupId=com.google.protobuf -DartifactId=protoc -Dversion=2.5.0 -Dclassifier=linux-aarch_64 -Dpackaging=exe -Dfile=/usr/bin/protoc
+%ifarch riscv64
+mvn install:install-file -DgroupId=com.google.protobuf -DartifactId=protoc -Dversion=2.5.0 -Dclassifier=linux-riscv64 -Dpackaging=exe -Dfile=/usr/bin/protoc
+%endif
 mvn install:install-file -DgroupId=org.fusesource.leveldbjni -DartifactId=leveldbjni-all -Dversion=1.8 -Dpackaging=jar -Dfile=/usr/lib/java/leveldbjni-all.jar
 mvn install:install-file -DgroupId=org.fusesource.leveldbjni -DartifactId=leveldbjni -Dversion=1.8 -Dpackaging=jar -Dfile=/usr/lib/java/leveldbjni/leveldbjni.jar
 mvn install:install-file -DgroupId=org.iq80.leveldb -DartifactId=leveldb-api -Dversion=0.7 -Dpackaging=jar -Dfile=/usr/share/java/leveldb-java/leveldb-api.jar
@@ -298,6 +304,17 @@ mvn install:install-file -DgroupId=orn.fusesource.hawtjni -DartifactId=hawtjni-r
 %mvn_file :%{real_name}-common::tests: %{real_name}/%{real_name}-common
 
 %build
+if [[ "%{?toolchain}" == "clang" ]]
+then
+  export CXXFLAGS="$CXXFLAGS -mcpu=generic+Crc -Wno-reserved-user-defined-literal"
+  export CFLAGS="$CFLAGS -mcpu=generic+Crc -Wno-reserved-user-defined-literal"
+fi
+
+%ifarch riscv64
+export MAVEN_OPTS="-Xms2048M -Xmx8000M"
+function keepalive() { while true; do date; sleep 3600; done }
+keepalive &
+%endif
 mvn -Dsnappy.lib=/usr/lib64 -Dbundle.snappy -Dcontainer-executor.conf.dir=%{_sysconfdir}/%{real_name} -Pdist,native -DskipTests -DskipIT -Dmaven.javadoc.skip=true package
 
 %install
@@ -1113,6 +1130,22 @@ fi
 %config(noreplace) %{_sysconfdir}/%{real_name}/container-executor.cfg
 
 %changelog
+* Mon Oct 14 2024 Deyuan Fan <fandeyuan@kylinos.cn> - 3.1.4-9
+- fix CVE-2024-23454
+
+* Sun May 12 2024 Dingli Zhang <dingli@iscas.ac.cn> - 3.1.4-8
+- Fix build on riscv64
+- Upgrade os-maven-plugin to 1.7.1
+
+* Wed Oct 11 2023 luofeng <luofeng13@huawei.com> - 3.1.4-7
+- support clang build
+
+* Fri Jul 21 2023 wenweijian <wenweijian2@huawei.com> - 3.1.4-6
+- compatiable with gcc12
+
+* Wed Jun 15 2022 Chenyx <chenyixiong3@huawei.com> - 3.1.4-5
+- License compliance rectification
+
 * Mon Jul 12 2021 lingsheng <lingsheng@huawei.com> - 3.1.4-4
 - Fix stop service failure