mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-09 16:01:54 -09:00
762ddee71c
For more details on the version bump, see: - https://www.zabbix.com/rn/rn7.2.13 - https://www.zabbix.com/rn/rn7.2.12 - https://www.zabbix.com/rn/rn7.2.11 - https://www.zabbix.com/rn/rn7.2.10 - https://www.zabbix.com/rn/rn7.2.9 - https://www.zabbix.com/rn/rn7.2.8 - https://www.zabbix.com/rn/rn7.2.7 - https://www.zabbix.com/rn/rn7.2.6 Fixes the following vulnerabilities: - CVE-2025-27231 The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now reset on 'Host' change. For more information, see: - https://support.zabbix.com/browse/ZBX-27062 - https://nvd.nist.gov/vuln/detail/CVE-2025-27231 - CVE-2025-27236 A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not have access to. For more information, see: - https://support.zabbix.com/browse/ZBX-27060 - https://nvd.nist.gov/vuln/detail/CVE-2025-27236 - CVE-2025-27238 Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them. For more information, see: - https://nvd.nist.gov/vuln/detail/CVE-2025-27238 - https://support.zabbix.com/browse/ZBX-26988 - CVE-2025-49641 A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems. For more information, see: - https://support.zabbix.com/browse/ZBX-27063 - https://nvd.nist.gov/vuln/detail/CVE-2025-49641 Signed-off-by: Thomas Perale <thomas.perale@mind.be> Signed-off-by: Julien Olivain <ju.o@free.fr>
147 lines
4.4 KiB
Makefile
147 lines
4.4 KiB
Makefile
################################################################################
|
|
#
|
|
# zabbix
|
|
#
|
|
################################################################################
|
|
|
|
ZABBIX_VERSION_MAJOR = 7.2
|
|
ZABBIX_VERSION = $(ZABBIX_VERSION_MAJOR).13
|
|
ZABBIX_SITE = https://cdn.zabbix.com/zabbix/sources/stable/$(ZABBIX_VERSION_MAJOR)
|
|
ZABBIX_SELINUX_MODULES = zabbix
|
|
ZABBIX_LICENSE = AGPL-3.0
|
|
ZABBIX_LICENSE_FILES = COPYING
|
|
ZABBIX_CPE_ID_VENDOR = zabbix
|
|
# We're patching m4/netsnmp.m4
|
|
ZABBIX_AUTORECONF = YES
|
|
|
|
ZABBIX_DEPENDENCIES = host-pkgconf pcre2
|
|
ZABBIX_CONF_OPTS = \
|
|
--with-libpcre2 \
|
|
--without-sqlite3 \
|
|
--enable-agent \
|
|
--disable-agent2 \
|
|
--disable-java \
|
|
--disable-proxy \
|
|
--disable-webservice
|
|
|
|
define ZABBIX_USERS
|
|
zabbix -1 zabbix -1 * /var/lib/zabbix - - zabbix user
|
|
endef
|
|
|
|
ZABBIX_SYSTEMD_UNITS += zabbix-agent.service
|
|
|
|
define ZABBIX_CHANGE_PIDFILE_LOCATION
|
|
$(SED) 's%\#\ PidFile=/tmp/zabbix\(.*\).pid%PidFile=/run/zabbix/zabbix\1.pid%g' $(@D)/conf/zabbix_*.conf
|
|
endef
|
|
ZABBIX_POST_PATCH_HOOKS += ZABBIX_CHANGE_PIDFILE_LOCATION
|
|
|
|
ifeq ($(BR2_PACKAGE_OPENIPMI),y)
|
|
ZABBIX_CONF_OPTS += --with-openipmi=$(STAGING_DIR)/usr
|
|
ZABBIX_DEPENDENCIES += openipmi
|
|
else
|
|
ZABBIX_CONF_OPTS += --without-openipmi
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBCURL),y)
|
|
ZABBIX_CONF_OPTS += --with-libcurl=$(STAGING_DIR)/usr/bin/curl-config
|
|
ZABBIX_DEPENDENCIES += libcurl
|
|
else
|
|
ZABBIX_CONF_OPTS += --without-libcurl
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBXML2),y)
|
|
ZABBIX_CONF_OPTS += --with-libxml2=$(STAGING_DIR)/usr
|
|
ZABBIX_DEPENDENCIES += libxml2
|
|
else
|
|
ZABBIX_CONF_OPTS += --without-libxml2
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_NETSNMP_ENABLE_MIBS),y)
|
|
ZABBIX_CONF_OPTS += --with-net-snmp=$(STAGING_DIR)/usr/bin/net-snmp-config
|
|
ZABBIX_DEPENDENCIES += netsnmp
|
|
else
|
|
ZABBIX_CONF_OPTS += --without-net-snmp
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_OPENLDAP),y)
|
|
ZABBIX_CONF_OPTS += --with-ldap=$(STAGING_DIR)/usr
|
|
ZABBIX_DEPENDENCIES += openldap
|
|
else
|
|
ZABBIX_CONF_OPTS += --without-ldap
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBSSH2),y)
|
|
ZABBIX_CONF_OPTS += --with-ssh2=$(STAGING_DIR)/usr
|
|
ZABBIX_DEPENDENCIES += libssh2
|
|
else
|
|
ZABBIX_CONF_OPTS += --without-ssh2
|
|
endif
|
|
|
|
# Only one of openssl or gnutls should be enabled. libressl is not
|
|
# supported, which is why we test BR2_PACKAGE_LIBOPENSSL, not
|
|
# BR2_PACKAGE_OPENSSL
|
|
ifeq ($(BR2_PACKAGE_LIBOPENSSL),y)
|
|
ZABBIX_CONF_OPTS += --with-openssl=$(STAGING_DIR)/usr --without-gnutls
|
|
ZABBIX_DEPENDENCIES += openssl
|
|
else ifeq ($(BR2_PACKAGE_GNUTLS),y)
|
|
ZABBIX_CONF_OPTS += --with-gnutls=$(STAGING_DIR)/usr --without-openssl
|
|
ZABBIX_DEPENDENCIES += gnutls
|
|
else
|
|
ZABBIX_CONF_OPTS += --without-gnutls --without-openssl
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_ZABBIX_SERVER),y)
|
|
|
|
ZABBIX_DEPENDENCIES += libevent zlib
|
|
ZABBIX_CONF_OPTS += \
|
|
--enable-server \
|
|
--with-libevent=$(STAGING_DIR)/usr \
|
|
--with-libpthread=$(STAGING_DIR)/usr \
|
|
--with-zlib=$(STAGING_DIR)/usr
|
|
ZABBIX_SYSTEMD_UNITS += zabbix-server.service
|
|
|
|
ifeq ($(BR2_PACKAGE_ZABBIX_SERVER_COPY_FRONTEND),y)
|
|
define ZABBIX_SERVER_COPY_FRONTEND
|
|
mkdir -p $(TARGET_DIR)/var/www/zabbix/
|
|
cp -dpfr $(@D)/ui/* $(TARGET_DIR)/var/www/zabbix/
|
|
endef
|
|
ZABBIX_POST_INSTALL_TARGET_HOOKS += ZABBIX_SERVER_COPY_FRONTEND
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_ZABBIX_SERVER_MYSQL),y)
|
|
ZABBIX_DEPENDENCIES += mariadb
|
|
ZABBIX_CONF_OPTS += --with-mysql=$(STAGING_DIR)/usr/bin/mysql_config --without-postgresql
|
|
ZABBIX_DATABASE = mysql
|
|
else ifeq ($(BR2_PACKAGE_ZABBIX_SERVER_POSTGRESQL),y)
|
|
ZABBIX_DEPENDENCIES += postgresql
|
|
ZABBIX_CONF_OPTS += --with-postgresql=$(STAGING_DIR)/usr/bin/pg_config --without-mysql
|
|
ZABBIX_DATABASE = postgresql
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_ZABBIX_SERVER_COPY_DUMPS),y)
|
|
define ZABBIX_SERVER_COPY_DUMPS
|
|
mkdir -p $(TARGET_DIR)/var/lib/zabbix/schema/
|
|
install -m 644 $(@D)/database/$(ZABBIX_DATABASE)/*.sql $(TARGET_DIR)/var/lib/zabbix/schema/
|
|
endef
|
|
ZABBIX_POST_INSTALL_TARGET_HOOKS += ZABBIX_SERVER_COPY_DUMPS
|
|
endif
|
|
|
|
endif # BR2_PACKAGE_ZABBIX_SERVER
|
|
|
|
# zabbix uses custom --enable-{static,shared} options, instead of
|
|
# standard libtool directives resulting in a build failure with libcurl
|
|
# or openssl.
|
|
ifeq ($(BR2_SHARED_STATIC_LIBS),y)
|
|
ZABBIX_CONF_OPTS += --disable-static
|
|
endif
|
|
|
|
define ZABBIX_INSTALL_INIT_SYSTEMD
|
|
$(foreach unit,$(ZABBIX_SYSTEMD_UNITS),\
|
|
$(INSTALL) -D -m 0644 $(ZABBIX_PKGDIR)/$(unit) $(TARGET_DIR)/usr/lib/systemd/system/$(unit) && \
|
|
mkdir -p $(TARGET_DIR)/etc/systemd/system/multi-user.target.wants && \
|
|
ln -fs -r $(TARGET_DIR)/usr/lib/systemd/system/$(unit) $(TARGET_DIR)/etc/systemd/system/multi-user.target.wants/$(unit)
|
|
)
|
|
endef
|
|
|
|
$(eval $(autotools-package))
|