summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorThomas Deutschmann <whissi@gentoo.org>2018-01-25 23:34:18 +0100
committerThomas Deutschmann <whissi@gentoo.org>2018-01-25 23:34:34 +0100
commit9a70b58bd58ff19395c55abbf0a2e620a5a56f3a (patch)
tree595ca00a5466b7257fc1f8557ffbecd65b42e4fb
parentnet-mail/mailshears: new revision to update ruby targets. (diff)
downloadgentoo-9a70b58.tar.gz
gentoo-9a70b58.tar.bz2
gentoo-9a70b58.zip
app-admin/collectd: bump, fixes CVE-2017-16820 & #628540
Ebuild changes: =============== - To address bug 628540, we no longer run collectd in daemon mode, instead we will run collectd everywhere in foreground and let the init system handle the PID file. - /run/collectd/ (default location for collectd's UNIX socket) is now maintained using tmpfiles service. Bug: https://bugs.gentoo.org/628540 Bug: https://bugs.gentoo.org/637538 Package-Manager: Portage-2.3.20, Repoman-2.3.6
-rw-r--r--app-admin/collectd/collectd-5.7.2-r1.ebuild541
-rw-r--r--app-admin/collectd/files/collectd-5.7.2-CVE-2017-16820.patch39
-rw-r--r--app-admin/collectd/files/collectd.confd-r249
-rw-r--r--app-admin/collectd/files/collectd.initd-r270
-rw-r--r--app-admin/collectd/files/collectd.tmpfile1
5 files changed, 700 insertions, 0 deletions
diff --git a/app-admin/collectd/collectd-5.7.2-r1.ebuild b/app-admin/collectd/collectd-5.7.2-r1.ebuild
new file mode 100644
index 00000000000..57b4bf62aef
--- /dev/null
+++ b/app-admin/collectd/collectd-5.7.2-r1.ebuild
@@ -0,0 +1,541 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="6"
+
+PYTHON_COMPAT=( python{2_7,3_4,3_5,3_6} )
+JAVA_PKG_OPT_USE="collectd_plugins_java"
+
+inherit autotools fcaps flag-o-matic java-pkg-opt-2 linux-info multilib perl-functions python-single-r1 systemd tmpfiles user
+
+DESCRIPTION="Collects system statistics and provides mechanisms to store the values"
+
+HOMEPAGE="https://collectd.org/"
+SRC_URI="${HOMEPAGE%/}/files/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~x86"
+IUSE="contrib debug java kernel_Darwin kernel_FreeBSD kernel_linux perl selinux static-libs udev xfs"
+
+# The plugin lists have to follow here since they extend IUSE
+
+# Plugins that don't build (e.g. dependencies not in Gentoo)
+# apple_sensors: Requires libIOKit
+# aquaero: Requires aerotools-ng/libaquaero5
+# barometer: Requires libi2c (i2c_smbus_read_i2c_block_data)
+# dpdkstat: Requires dpdk
+# grpc: Requires libgrpc
+# intel_rdt Requires libpqos from intel-cmt-cat project
+# lpar: Requires libperfstat (AIX only)
+# mic: Requires Intel Many Integrated Core Architecture API
+# (part of Intel's Xeon Phi software)
+# netapp: Requires libnetapp (http://communities.netapp.com/docs/DOC-1110)
+# pf: Requires BSD packet filter
+# pinba: Requires MySQL Pinba engine (http://pinba.org/)
+# tape: Requires libkstat (Solaris only)
+# write_mongodb: https://github.com/collectd/collectd/issues/492
+# write_riemann: Requires riemann-c-client
+# xmms: Requires libxmms (v1)
+# zone: Solaris only...
+COLLECTD_IMPOSSIBLE_PLUGINS="apple_sensors aquaero barometer dpdkstat grpc
+ intel_rdt lpar mic netapp pf pinba tape write_mongodb
+ write_riemann xmms zone"
+
+# Plugins that have been (compile) tested and can be enabled via COLLECTD_PLUGINS
+COLLECTD_TESTED_PLUGINS="aggregation amqp apache apcups ascent battery bind
+ ceph cgroups chrony conntrack contextswitch cpu cpufreq cpusleep
+ csv curl curl_json curl_xml dbi df disk dns drbd email
+ entropy ethstat exec fhcount filecount fscache gmond gps hddtemp
+ hugepages interface ipc ipmi iptables ipvs irq java lua
+ load logfile log_logstash lvm madwifi match_empty_counter
+ match_hashed match_regex match_timediff match_value mbmon md
+ memcachec memcached memory modbus mqtt multimeter mysql netlink
+ network network nfs nginx notify_desktop notify_email notify_nagios
+ ntpd numa nut olsrd onewire openldap openvpn oracle perl ping
+ postgresql powerdns processes protocols python python redis
+ routeros rrdcached rrdtool sensors serial sigrok smart snmp statsd
+ swap syslog table tail tail_csv target_notification target_replace
+ target_scale target_set tcpconns teamspeak2 ted thermal threshold
+ tokyotyrant turbostat unixsock uptime users uuid varnish virt
+ vmem vserver wireless write_graphite write_http write_kafka
+ write_log write_prometheus write_redis write_sensu write_tsdb
+ xencpu zfs_arc zookeeper"
+
+COLLECTD_DISABLED_PLUGINS="${COLLECTD_IMPOSSIBLE_PLUGINS}"
+
+COLLECTD_ALL_PLUGINS=${COLLECTD_TESTED_PLUGINS}
+
+for plugin in ${COLLECTD_ALL_PLUGINS}; do
+ IUSE="${IUSE} collectd_plugins_${plugin}"
+done
+unset plugin
+
+# Now come the dependencies.
+
+COMMON_DEPEND="
+ dev-libs/libgcrypt:=
+ dev-libs/libltdl:0=
+ perl? ( dev-lang/perl:=[ithreads] )
+ udev? ( virtual/udev )
+ xfs? ( sys-fs/xfsprogs )
+ collectd_plugins_amqp? ( net-libs/rabbitmq-c )
+ collectd_plugins_apache? ( net-misc/curl:0= )
+ collectd_plugins_ascent? ( net-misc/curl:0= dev-libs/libxml2:2= )
+ collectd_plugins_bind? ( net-misc/curl:0= dev-libs/libxml2:2= )
+ collectd_plugins_ceph? ( dev-libs/yajl:= )
+ collectd_plugins_curl? ( net-misc/curl:0= )
+ collectd_plugins_curl_json? ( net-misc/curl:0= dev-libs/yajl:= )
+ collectd_plugins_curl_xml? ( net-misc/curl:0= dev-libs/libxml2:2= )
+ collectd_plugins_dbi? ( dev-db/libdbi )
+ collectd_plugins_dns? ( net-libs/libpcap )
+ collectd_plugins_gmond? ( sys-cluster/ganglia )
+ collectd_plugins_gps? ( sci-geosciences/gpsd:= )
+ collectd_plugins_ipmi? ( >=sys-libs/openipmi-2.0.16-r1 )
+ collectd_plugins_iptables? ( >=net-firewall/iptables-1.4.13:0= )
+ collectd_plugins_log_logstash? ( dev-libs/yajl:= )
+ collectd_plugins_lua? ( dev-lang/lua:0= )
+ collectd_plugins_lvm? ( sys-fs/lvm2 )
+ collectd_plugins_memcachec? ( dev-libs/libmemcached )
+ collectd_plugins_modbus? ( dev-libs/libmodbus )
+ collectd_plugins_mqtt? ( app-misc/mosquitto )
+ collectd_plugins_mysql? ( >=virtual/mysql-5.0 )
+ collectd_plugins_netlink? ( net-libs/libmnl )
+ collectd_plugins_nginx? ( net-misc/curl:0= )
+ collectd_plugins_notify_desktop? ( x11-libs/libnotify )
+ collectd_plugins_notify_email? ( net-libs/libesmtp )
+ collectd_plugins_nut? ( >=sys-power/nut-2.7.2-r2 )
+ collectd_plugins_openldap? ( net-nds/openldap )
+ collectd_plugins_onewire? ( >=sys-fs/owfs-3.1:= )
+ collectd_plugins_oracle? ( dev-db/oracle-instantclient-basic )
+ collectd_plugins_perl? ( dev-lang/perl:=[ithreads] )
+ collectd_plugins_ping? ( net-libs/liboping )
+ collectd_plugins_postgresql? ( dev-db/postgresql:= )
+ collectd_plugins_python? ( ${PYTHON_DEPS} )
+ collectd_plugins_redis? ( dev-libs/hiredis:= )
+ collectd_plugins_routeros? ( net-libs/librouteros )
+ collectd_plugins_rrdcached? ( net-analyzer/rrdtool:= )
+ collectd_plugins_rrdtool? ( net-analyzer/rrdtool:= )
+ collectd_plugins_sensors? ( sys-apps/lm_sensors )
+ collectd_plugins_sigrok? ( <sci-libs/libsigrok-0.4:= dev-libs/glib:2 )
+ collectd_plugins_smart? ( dev-libs/libatasmart )
+ collectd_plugins_snmp? ( net-analyzer/net-snmp )
+ collectd_plugins_tokyotyrant? ( net-misc/tokyotyrant )
+ collectd_plugins_varnish? ( www-servers/varnish )
+ collectd_plugins_virt? ( app-emulation/libvirt:= dev-libs/libxml2:2= )
+ collectd_plugins_write_http? ( net-misc/curl:0= dev-libs/yajl:= )
+ collectd_plugins_write_kafka? ( >=dev-libs/librdkafka-0.9.0.99:= dev-libs/yajl:= )
+ collectd_plugins_write_prometheus? ( >=dev-libs/protobuf-c-1.2.1-r1:= net-libs/libmicrohttpd:= )
+ collectd_plugins_write_redis? ( dev-libs/hiredis:= )
+ collectd_plugins_xencpu? ( app-emulation/xen-tools:= )
+
+ kernel_FreeBSD? (
+ collectd_plugins_disk? ( sys-libs/libstatgrab:= )
+ collectd_plugins_interface? ( sys-libs/libstatgrab:= )
+ collectd_plugins_load? ( sys-libs/libstatgrab:= )
+ collectd_plugins_memory? ( sys-libs/libstatgrab:= )
+ collectd_plugins_swap? ( sys-libs/libstatgrab:= )
+ collectd_plugins_users? ( sys-libs/libstatgrab:= )
+ )"
+
+# Enforcing !=sys-kernel/linux-headers-4.5 > due to #577846
+DEPEND="${COMMON_DEPEND}
+ collectd_plugins_iptables? ( || ( <=sys-kernel/linux-headers-4.4 >=sys-kernel/linux-headers-4.6 ) )
+ collectd_plugins_java? ( >=virtual/jdk-1.6 )
+ virtual/pkgconfig"
+
+RDEPEND="${COMMON_DEPEND}
+ collectd_plugins_java? ( >=virtual/jre-1.6 )
+ collectd_plugins_syslog? ( virtual/logger )
+ selinux? ( sec-policy/selinux-collectd )
+ !<sys-apps/openrc-0.18.2"
+
+REQUIRED_USE="
+ collectd_plugins_python? ( ${PYTHON_REQUIRED_USE} )
+ collectd_plugins_smart? ( udev )"
+
+PATCHES=(
+ "${FILESDIR}"/${PN}-5.6.0-gentoo.patch
+ "${FILESDIR}"/${PN}-5.7.2-issue-2443.patch
+ "${FILESDIR}"/${PN}-5.7.2-CVE-2017-16820.patch
+)
+
+# @FUNCTION: collectd_plugin_kernel_linux
+# @DESCRIPTION:
+# USAGE: <plugin name> <kernel_options> <severity>
+# kernel_options is a list of kernel configurations options; the check tests whether at least
+# one of them is enabled. If no, depending on the third argument an elog, ewarn, or eerror message
+# is emitted.
+collectd_plugin_kernel_linux() {
+ local multi_opt opt
+ if has ${1} ${COLLECTD_ALL_PLUGINS}; then
+ if use collectd_plugins_${1}; then
+ for opt in ${2}; do
+ if linux_chkconfig_present ${opt}; then
+ return 0;
+ fi
+ done
+ multi_opt=${2//\ /\ or\ }
+ case ${3} in
+ (info)
+ elog "The ${1} plugin can use kernel features that are disabled now; enable ${multi_opt} in your kernel"
+ ;;
+ (warn)
+ ewarn "The ${1} plugin uses kernel features that are disabled now; enable ${multi_opt} in your kernel"
+ ;;
+ (error)
+ eerror "The ${1} plugin needs kernel features that are disabled now; enable ${multi_opt} in your kernel"
+ ;;
+ (*)
+ die "function collectd_plugin_kernel_linux called with invalid third argument"
+ ;;
+ esac
+ fi
+ fi
+}
+
+collectd_linux_kernel_checks() {
+ if ! linux_chkconfig_present PROC_FS; then
+ ewarn "/proc file system support is disabled, many plugins will not be able to read any statistics from your system unless you enable PROC_FS in your kernel"
+ fi
+
+ if ! linux_chkconfig_present SYSFS; then
+ ewarn "/sys file system support is disabled, many plugins will not be able to read any statistics from your system unless you enable SYSFS in your kernel"
+ fi
+
+ # battery.c: /proc/pmu/battery_%i
+ # battery.c: /proc/acpi/battery
+ collectd_plugin_kernel_linux battery ACPI_BATTERY warn
+
+ # cgroups.c: /sys/fs/cgroup/
+ collectd_plugin_kernel_linux cgroups CGROUPS warn
+
+ # cpufreq.c: /sys/devices/system/cpu/cpu%d/cpufreq/
+ collectd_plugin_kernel_linux cpufreq SYSFS warn
+ collectd_plugin_kernel_linux cpufreq CPU_FREQ_STAT warn
+
+ # drbd.c: /proc/drbd
+ collectd_plugin_kernel_linux drbd BLK_DEV_DRBD warn
+
+ # conntrack.c: /proc/sys/net/netfilter/*
+ collectd_plugin_kernel_linux conntrack NETFILTER warn
+
+ # fscache.c: /proc/fs/fscache/stats
+ collectd_plugin_kernel_linux fscache FSCACHE warn
+
+ # nfs.c: /proc/net/rpc/nfs
+ # nfs.c: /proc/net/rpc/nfsd
+ collectd_plugin_kernel_linux nfs NFS_COMMON warn
+
+ # serial.c: /proc/tty/driver/serial
+ # serial.c: /proc/tty/driver/ttyS
+ collectd_plugin_kernel_linux serial SERIAL_CORE warn
+
+ # swap.c: /proc/meminfo
+ collectd_plugin_kernel_linux swap SWAP warn
+
+ # thermal.c: /proc/acpi/thermal_zone
+ # thermal.c: /sys/class/thermal
+ collectd_plugin_kernel_linux thermal ACPI_THERMAL warn
+
+ # turbostat.c: /dev/cpu/%d/msr
+ collectd_plugin_kernel_linux turbostat X86_MSR warn
+
+ # vmem.c: /proc/vmstat
+ collectd_plugin_kernel_linux vmem VM_EVENT_COUNTERS warn
+
+ # vserver.c: /proc/virtual
+ collectd_plugin_kernel_linux vserver VSERVER warn
+
+ # uuid.c: /sys/hypervisor/uuid
+ collectd_plugin_kernel_linux uuid SYSFS info
+
+ # wireless.c: /proc/net/wireless
+ collectd_plugin_kernel_linux wireless "WIRELESS MAC80211 IEEE80211" warn
+
+ # zfs_arc.c: /proc/spl/kstat/zfs/arcstats
+ collectd_plugin_kernel_linux zfs_arc "SPL ZFS" warn
+}
+
+pkg_setup() {
+ if use kernel_linux; then
+ linux-info_pkg_setup
+
+ if linux_config_exists; then
+ einfo "Checking your linux kernel configuration:"
+ collectd_linux_kernel_checks
+ else
+ elog "Cannot find a linux kernel configuration. Continuing anyway."
+ fi
+ fi
+
+ if use collectd_plugins_java; then
+ java-pkg-opt-2_pkg_setup
+ fi
+
+ use collectd_plugins_python && python-single-r1_pkg_setup
+
+ enewgroup collectd
+ enewuser collectd -1 -1 /var/lib/collectd collectd
+}
+
+src_prepare() {
+ default
+
+ # There's some strange prefix handling in the default config file, resulting in
+ # paths like "/usr/var/..."
+ sed -i -e "s:@prefix@/var:/var:g" src/collectd.conf.in || die
+
+ # fix installdirs for perl, bug 444360
+ sed -i -e 's/INSTALL_BASE=$(DESTDIR)$(prefix) //' bindings/Makefile.am || die
+
+ # Adjust upstream's systemd unit
+ # - Get rid of EnvironmentFile directive; These files don't exist on Gentoo!
+ # - Add User=collectd to run collectd as user "collectd" per default
+ sed -i \
+ -e '/^EnvironmentFile=.*/d' \
+ -e '/^\[Service\]/aUser=collectd' \
+ contrib/systemd.${PN}.service || die
+
+ if use collectd_plugins_java; then
+ # Set javac -source and -target flags according to (R)DEPEND.
+ sed -i -e "s/\$(JAVAC)/\0 $(java-pkg_javac-args)/g" bindings/java/Makefile.am || die
+ fi
+
+ ebegin "Removing bundled libltdl"
+ rm -rf libltdl || die
+ eend 0
+
+ eautoreconf
+}
+
+src_configure() {
+ # Now come the lists of os-dependent plugins. Any plugin that is not listed anywhere here
+ # should work independent of the operating system.
+
+ local linux_plugins="barometer battery cpu cpufreq disk
+ drbd entropy ethstat hugepages interface iptables
+ ipvs irq ipc load memory md netlink nfs numa processes
+ serial swap tcpconns thermal turbostat users vmem wireless
+ zfc_arc"
+
+ local need_libstatgrab=0
+ local libstatgrab_plugins="cpu disk interface load memory swap users"
+ local bsd_plugins="cpu tcpconns ${libstatgrab_plugins} zfc_arc"
+
+ local darwin_plugins="apple_sensors battery cpu disk interface memory processes tcpconns"
+
+ local osdependent_plugins="${linux_plugins} ${bsd_plugins} ${darwin_plugins}"
+ local myos_plugins=""
+ if use kernel_linux; then
+ einfo "Enabling Linux plugins."
+ myos_plugins=${linux_plugins}
+ elif use kernel_FreeBSD; then
+ einfo "Enabling FreeBSD plugins."
+ myos_plugins=${bsd_plugins}
+ elif use kernel_Darwin; then
+ einfo "Enabling Darwin plugins."
+ myos_plugins=${darwin_plugins}
+ fi
+
+ local myconf="--disable-werror"
+
+ # Do we debug?
+ myconf+=" $(use_enable debug)"
+
+ # udev support?
+ # Required for smart plugin via REQUIRED_USE; Optional for disk plugin
+ if use udev; then
+ myconf+=" --with-libudev"
+ else
+ myconf+=" --without-libudev"
+ fi
+
+ local plugin
+
+ # Disable what needs to be disabled.
+ for plugin in ${COLLECTD_DISABLED_PLUGINS}; do
+ myconf+=" --disable-${plugin}"
+ done
+
+ # Set enable/disable for each single plugin.
+ for plugin in ${COLLECTD_ALL_PLUGINS}; do
+ if has ${plugin} ${osdependent_plugins}; then
+ # plugin is os-dependent ...
+ if has ${plugin} ${myos_plugins}; then
+ # ... and available in this os
+ myconf+=" $(use_enable collectd_plugins_${plugin} ${plugin})"
+ # ... must we link against libstatgrab? Bug #541518
+ if use kernel_FreeBSD && has ${plugin} ${libstatgrab_plugins}; then
+ einfo "We must link against libstatgrab due to plugin \"${plugin}\" ..."
+ need_libstatgrab=1
+ fi
+ else
+ # ... and NOT available in this os
+ if use collectd_plugins_${plugin}; then
+ ewarn "You try to enable the ${plugin} plugin, but it is not available for this"
+ ewarn "kernel. Disabling it automatically."
+ fi
+ myconf+=" --disable-${plugin}"
+ fi
+ elif [[ "${plugin}" = "collectd_plugins_perl" ]]; then
+ if use collectd_plugins_perl && ! use perl; then
+ ewarn "Perl plugin disabled as perl bindings disabled by -perl use flag"
+ myconf+= --disable-perl
+ else
+ myconf+=" $(use_enable collectd_plugins_${plugin} ${plugin})"
+ fi
+ else
+ myconf+=" $(use_enable collectd_plugins_${plugin} ${plugin})"
+ fi
+ done
+
+ if [ "${need_libstatgrab}" -eq 1 ]; then
+ myconf+=" --with-libstatgrab"
+ else
+ myconf+=" --without-libstatgrab"
+ fi
+
+ # JAVA_HOME is set by eclasses.
+ if use collectd_plugins_java; then
+ myconf+=" --with-java"
+ fi
+
+ # Need libiptc ONLY for iptables. If we try to use it otherwise bug 340109 happens.
+ # lots of libs are only needed for plugins, if they are disabled, also disable the lib
+ use collectd_plugins_iptables || myconf+=" --with-libiptc=no"
+ use collectd_plugins_openldap || myconf+=" --with-libldap=no"
+ use collectd_plugins_redis || use collectd_plugins_write_redis || myconf+=" --with-libhiredis=no"
+ use collectd_plugins_smart || myconf+=" --with-libatasmart=no"
+ use collectd_plugins_gps || myconf+=" --with-libgps=no"
+
+ if use perl; then
+ myconf+=" --with-perl-bindings=INSTALLDIRS=vendor"
+ else
+ myconf+=" --without-perl-bindings"
+ fi
+
+ # No need for v5upgrade
+ myconf+=" --disable-target_v5upgrade"
+
+ # Python
+ if use collectd_plugins_python; then
+ myconf+=" --with-libpython=yes"
+ export PYTHON_CONFIG=$(python_get_PYTHON_CONFIG)
+ else
+ myconf+=" --with-libpython=no"
+ fi
+
+ # XFS support
+ myconf+=" $(use_enable xfs)"
+
+ # Finally, run econf.
+ KERNEL_DIR="${KERNEL_DIR}" econf --config-cache \
+ $(use_enable static-libs static) \
+ --localstatedir=/var ${myconf}
+}
+
+src_install() {
+ emake DESTDIR="${D%/}" install
+
+ perl_delete_localpod
+
+ find "${ED}"usr/ -name "*.la" -delete || die
+
+ if use collectd_plugins_java; then
+ java-pkg_regjar "${ED}"usr/share/${PN}/java/*.jar
+ fi
+
+ fowners root:collectd /etc/collectd.conf
+ fperms u=rw,g=r,o= /etc/collectd.conf
+
+ dodoc AUTHORS ChangeLog README
+
+ if use contrib ; then
+ insinto /usr/share/doc/${PF}
+ doins -r contrib
+ fi
+
+ keepdir /var/lib/${PN}
+ fowners collectd:collectd /var/lib/${PN}
+
+ newinitd "${FILESDIR}/${PN}.initd-r2" ${PN}
+ newconfd "${FILESDIR}/${PN}.confd-r2" ${PN}
+ systemd_newunit "contrib/systemd.${PN}.service" ${PN}.service
+
+ insinto /etc/logrotate.d
+ newins "${FILESDIR}/${PN}.logrotate" ${PN}
+
+ newtmpfiles "${FILESDIR}"/${PN}.tmpfile ${PN}.conf
+
+ sed -i -e 's:^.*PIDFile "/var/run/collectd.pid":#PIDFile "/run/collectd.pid":' "${ED}"etc/collectd.conf || die
+ sed -i -e 's:^# SocketFile "/var/run/collectd-unixsock":# SocketFile "/run/collectd/collectd.socket":' "${ED}"etc/collectd.conf || die
+ sed -i -e 's:^.*LoadPlugin perl$:# The new, correct way to load the perl plugin -- \n# <LoadPlugin perl>\n# Globals true\n# </LoadPlugin>:' "${ED}"etc/collectd.conf || die
+ sed -i -e 's:^.*LoadPlugin python$:# The new, correct way to load the python plugin -- \n# <LoadPlugin python>\n# Globals true\n# </LoadPlugin>:' "${ED}"etc/collectd.conf || die
+}
+
+pkg_postinst() {
+ tmpfiles_process "${PN}.conf"
+
+ if use filecaps; then
+ local caps=()
+ use collectd_plugins_ceph && caps+=('CAP_DAC_OVERRIDE')
+ use collectd_plugins_exec && caps+=('CAP_SETUID' 'CAP_SETGID')
+ use collectd_plugins_iptables && caps+=('CAP_NET_ADMIN')
+ use collectd_plugins_filecount && caps+=('CAP_DAC_READ_SEARCH')
+
+ if use collectd_plugins_dns || use collectd_plugins_ping; then
+ caps+=('CAP_NET_RAW')
+ fi
+
+ if use collectd_plugins_turbostat || use collectd_plugins_smart; then
+ caps+=('CAP_SYS_RAWIO')
+ fi
+
+ if [ ${#caps[@]} -gt 0 ]; then
+ local caps_str=$(IFS=","; echo "${caps[*]}")
+ fcaps ${caps_str} usr/sbin/collectd
+ elog "Capabilities for ${EROOT}usr/sbin/collectd set to:"
+ elog " ${caps_str}+EP"
+ elog
+
+ local systemd_unit="${EROOT}usr/lib/systemd/system/collectd.service"
+ if [[ -e "${systemd_unit}" ]]; then
+ caps_str="${caps[*]}"
+ sed -i -e "s:^CapabilityBoundingSet=.*:CapabilityBoundingSet=${caps_str}:" "${systemd_unit}" || \
+ die "Failed to set CapabilityBoundingSet in '${systemd_unit}'"
+
+ elog "CapabilityBoundingSet in '${systemd_unit}'"
+ elog "updated to match capabilities set above."
+ elog
+ fi
+ fi
+ fi
+
+ elog "Note: Collectd is only the collector."
+ elog " You need to install 'data' sources (applications) locally or"
+ elog " remotely on your own."
+
+ elog
+ elog "Collectd is configured to run as unprivileged user by default."
+ elog "You may want to revisit the configuration."
+ elog
+
+ if use collectd_plugins_email; then
+ ewarn "The email plug-in is deprecated. To submit statistics please use the unixsock plugin."
+ fi
+
+ if use collectd_plugins_smart; then
+ elog ""
+ elog "If you are using smart plugin and don't run collectd as root make sure"
+ elog "that the collectd user is allowed to access the disk you want to monitor"
+ elog "(can be done via udev rule for example) and that collectd has the required"
+ elog "capabilities set (which is the default when package was emerged with"
+ elog "'filecaps' USE flag set)."
+ fi
+
+ if use contrib; then
+ elog "The scripts in /usr/share/doc/${PF}/collection3 for generating graphs need dev-perl/HTML-Parser,"
+ elog "dev-perl/config-general, dev-perl/regexp-common, and net-analyzer/rrdtool[perl] to be installed."
+ fi
+}
diff --git a/app-admin/collectd/files/collectd-5.7.2-CVE-2017-16820.patch b/app-admin/collectd/files/collectd-5.7.2-CVE-2017-16820.patch
new file mode 100644
index 00000000000..0090f2940bf
--- /dev/null
+++ b/app-admin/collectd/files/collectd-5.7.2-CVE-2017-16820.patch
@@ -0,0 +1,39 @@
+CVE-2017-16820: Fix double free of request PDU
+
+https://github.com/collectd/collectd/commit/d16c24542b2f96a194d43a73c2e5778822b9cb47
+
+--- a/src/snmp.c
++++ b/src/snmp.c
+@@ -1357,11 +1357,13 @@ static int csnmp_read_table(host_definition_t *host, data_definition_t *data) {
+ if (oid_list_todo_num == 0) {
+ /* The request is still empty - so we are finished */
+ DEBUG("snmp plugin: all variables have left their subtree");
++ snmp_free_pdu(req);
+ status = 0;
+ break;
+ }
+
+ res = NULL;
++ /* snmp_sess_synch_response always frees our req PDU */
+ status = snmp_sess_synch_response(host->sess_handle, req, &res);
+ if ((status != STAT_SUCCESS) || (res == NULL)) {
+ char *errstr = NULL;
+@@ -1376,8 +1378,6 @@ static int csnmp_read_table(host_definition_t *host, data_definition_t *data) {
+ snmp_free_pdu(res);
+ res = NULL;
+
+- /* snmp_synch_response already freed our PDU */
+- req = NULL;
+ sfree(errstr);
+ csnmp_host_close_session(host);
+
+@@ -1492,9 +1492,6 @@ static int csnmp_read_table(host_definition_t *host, data_definition_t *data) {
+ snmp_free_pdu(res);
+ res = NULL;
+
+- if (req != NULL)
+- snmp_free_pdu(req);
+- req = NULL;
+
+ if (status == 0)
+ csnmp_dispatch_table(host, data, instance_list_head, value_list_head);
diff --git a/app-admin/collectd/files/collectd.confd-r2 b/app-admin/collectd/files/collectd.confd-r2
new file mode 100644
index 00000000000..835936d5bce
--- /dev/null
+++ b/app-admin/collectd/files/collectd.confd-r2
@@ -0,0 +1,49 @@
+# Distributed under the terms of the GNU General Public License v2
+
+# Nice value used to launch collectd, to change priority of the process. As
+# you usually we want to run it in background, a default of 5 is used.
+#
+#COLLECTD_NICELEVEL=5
+
+# Location of configuration file. Modify if you don't like the standard
+# one.
+#
+#COLLECTD_CONFIGFILE="/etc/collectd.conf"
+
+# File used to store the PID file. Usually you won't need to touch it.
+# If you are going to change PID file location make sure that *only*
+# root is allowed to write into that directory.
+#
+#COLLECTD_PIDFILE="/run/collectd.pid"
+
+# User to run collectd as (default is collectd, change to root or give
+# collectd user appropriate privileges if you use one of the plugins that
+# require it, as e.g. ping or iptables plugins)
+#
+#COLLECTD_USER="collectd"
+
+# The default collectd UNIX socket location in /run/collectd is now
+# maintained via tmpfiles service. Therefore, the COLLECTD_GROUP setting
+# isn't used anymore.
+# If you are going to change UNIX socket location or change COLLECTD_USER
+# setting above, make sure you overwrite /usr/lib/tmpfiles.d/collectd.conf
+# via copy in /etc/tmpfiles.d/collectd.conf to match your setup.
+#COLLECTD_GROUP="collectd"
+
+# You can use this configuration option to pass additional options to the
+# start-stop-daemon, see start-stop-daemon(8) for more details.
+# Per default we wait 1000ms after we have started the service to ensure
+# that the daemon is really up and running.
+#COLLECTD_SSDARGS="--wait 1000"
+
+# The termination timeout (start-stop-daemon parameter "retry") ensures
+# that the service will be terminated within a given time (25 + 5 seconds
+# per default) when you are stopping the service.
+#COLLECTD_TERMTIMEOUT="TERM/25/KILL/5"
+
+# Options to collectd
+# See collectd(8) for more details
+# Notes:
+# * Do not specify another PIDFILE but use the variable above to change the location
+# * Do not specify another CONFIGFILE but use the variable above to change the location
+#COLLECTD_OPTS=""
diff --git a/app-admin/collectd/files/collectd.initd-r2 b/app-admin/collectd/files/collectd.initd-r2
new file mode 100644
index 00000000000..0a4ca71494f
--- /dev/null
+++ b/app-admin/collectd/files/collectd.initd-r2
@@ -0,0 +1,70 @@
+#!/sbin/openrc-run
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+COLLECTD_CONFIGFILE=${COLLECTD_CONFIGFILE:-"/etc/collectd.conf"}
+COLLECTD_PIDFILE=${COLLECTD_PIDFILE:-"/run/collectd.pid"}
+COLLECTD_NICELEVEL=${COLLECTD_NICELEVEL:-5}
+COLLECTD_USER=${COLLECTD_USER:-"collectd"}
+COLLECTD_GROUP=${COLLECTD_GROUP:-"collectd"}
+COLLECTD_SSDARGS=${COLLECTD_SSDARGS:-"--wait 1000"}
+COLLECTD_TERMTIMEOUT=${COLLECTD_TERMTIMEOUT:-"TERM/25/KILL/5"}
+COLLECTD_OPTS=${COLLECTD_OPTS:-""}
+
+command="/usr/sbin/collectd"
+command_args="${COLLECTD_OPTS} -C \"${COLLECTD_CONFIGFILE}\" -f"
+command_background=true
+command_user="${COLLECTD_USER}"
+start_stop_daemon_args="${COLLECTD_SSDARGS} --nice ${COLLECTD_NICELEVEL}"
+pidfile="${COLLECTD_PIDFILE}"
+retry="${COLLECTD_TERMTIMEOUT}"
+
+extra_commands="configtest"
+description_configtest="Run collectd's internal config check."
+
+required_files="\"${COLLECTD_CONFIGFILE}\""
+
+depend() {
+ use dns
+}
+
+_checkconfig() {
+ if [ $(sed '/^$\|^#/d' "${COLLECTD_CONFIGFILE}" | grep 'LoadPlugin[[:space:]]\+oracle' | wc -l) -ge 1 ] ; then
+ if [ -e /etc/env.d/50oracle-instantclient-basic ] ; then
+ . /etc/env.d/50oracle-instantclient-basic
+ export ORACLE_HOME
+ export TNS_ADMIN
+ else
+ ewarn "Unable to set Oracle environment, Oracle plugin wont work"
+ fi
+ fi
+
+ local test_command="${command} -t -C \"${COLLECTD_CONFIGFILE}\""
+
+ eval ${test_command} 1>/dev/null 2>&1
+ ret=$?
+ if [ $ret -ne 0 ]; then
+ eerror "${SVCNAME} has detected an error in your configuration:"
+ eval ${test_command}
+ fi
+
+ return $ret
+}
+
+configtest() {
+ ebegin "Checking ${SVCNAME} configuration"
+ _checkconfig
+ eend $?
+}
+
+start_pre() {
+ if [ "${RC_CMD}" != "restart" ]; then
+ configtest || return 1
+ fi
+}
+
+stop_pre() {
+ if [ "${RC_CMD}" = "restart" ]; then
+ configtest || return 1
+ fi
+}
diff --git a/app-admin/collectd/files/collectd.tmpfile b/app-admin/collectd/files/collectd.tmpfile
new file mode 100644
index 00000000000..4524a56ec18
--- /dev/null
+++ b/app-admin/collectd/files/collectd.tmpfile
@@ -0,0 +1 @@
+d /run/collectd 0770 collectd collectd