capng_c 0.2.3 → 0.2.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: de6f1d1c03adc792bf92f5da7f5c7ac85b35c3df5a155718b2b97abafa19d3be
-  data.tar.gz: 46c69dcfcea97099d5e64319a7ea9cf19a636fe8cf08e88d7b0bbc1f89e6a80e
+  metadata.gz: 0105fa2095d7aa7ae42d367d00931c5c0ddf7b3a008b15b973bb830e6c68c3e1
+  data.tar.gz: 8a23e8b4f859ee8299a79790f45809c55d776c650635d9a5a3dc84e73fb6eab1
 SHA512:
-  metadata.gz: 1b8e5bddcfd632b9c3d3bd1716239079c4e8e85f72fe626a5d508d8c94f598875ccf7e155b3b7686ed63b538b8427e0bd3937609866ac3c07076a87b4e76be0f
-  data.tar.gz: 138eef80b0d44a7ba757909a8ceb2979a9cd642c33e1a457ed7da2494cee7d754e0f1b1658df92b87c9780d1df39ac4cd088b2e89cf390648630673c64db0ce0
+  metadata.gz: d3be8cd98b0d17043f5988d156118d068ea3e1e96a605b93f5e676300bb7d093ff9b2cc22ac211dc19dff042e3a1af2a415867ac9454dab4b86739ac98d460d3
+  data.tar.gz: 2c3892a0c6a6e6a5ab52c1d175bf93e4451d1d12fb94bc8c8e698e453465b1d5e9954eb782d16236eb28a100abef673298e48e714bf6a45359b0b3a3b2ed5987

data/.github/dependabot.yml

@@ -0,0 +1,23 @@
+version: 2
+updates:
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: 'monthly'
+    groups:
+      # PR: "Security update [package] from [old] to [new]"
+      # This PR should be merged in hurry
+      security-updates:
+        applies-to: security-updates
+        patterns:
+          - '*'
+
+      # PR: "Bump [package] from [old] to [new]"
+      # No need to be merged this PR in hurry. It is enough to merge
+      # once in a month.
+      monthly-updates:
+        applies-to: version-updates
+        patterns:
+          - '*'
+    # Allow to create PR both of security and normal updates.
+    open-pull-requests-limit: 1

data/.github/workflows/apt.yml

@@ -9,12 +9,12 @@ jobs:
       fail-fast: false
       matrix:
         label:
-          - Debian GNU/Linux Buster amd64
+          - Debian GNU/Linux Bookworm amd64
           - Ubuntu Bionic amd64
           - Ubuntu Focal amd64
         include:
-          - label: Debian GNU/Linux Buster amd64
-            test-docker-image: debian:buster
+          - label: Debian GNU/Linux Bookworm amd64
+            test-docker-image: debian:bookworm
             test-script: ci/apt-test.sh
           - label: Ubuntu Bionic amd64
             test-docker-image: ubuntu:bionic
@@ -24,7 +24,7 @@ jobs:
             test-script: ci/apt-test.sh
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: rake compile & rake test
         run: |
           docker run \
@@ -32,4 +32,4 @@ jobs:
           --tty \
           --volume ${PWD}:/capng \
           ${{ matrix.test-docker-image }} \
-          /capng/${{ matrix.test-script }}
+          /capng/${{ matrix.test-script }}

data/.github/workflows/linux.yml

@@ -1,24 +1,36 @@
 name: Multiple Ruby version tests
 on:
-  - push
-  - pull_request
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '0 0 1 * *'
 jobs:
+  ruby-versions:
+    uses: ruby/actions/.github/workflows/ruby_versions.yml@master
+    with:
+      engine: cruby
+      min_version: 2.5
   build:
+    needs: ruby-versions
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
-        ruby: [ '2.5', '2.6' , '2.7', '3.0', '3.1', '3.2', '3.3', '3.4' ]
+        ruby: ${{ fromJson(needs.ruby-versions.outputs.versions) }}
+        exclude:
+          - ruby: head
         os:
           - ubuntu-latest
     name: Ruby ${{ matrix.ruby }} unit testing on ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Install dependencies
       run: |
         sudo apt update
         sudo apt -V install libcap-ng-dev
-    - uses: ruby/setup-ruby@v1
+    - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
       with:
         ruby-version: ${{ matrix.ruby }}
     - name: unit testing

data/.github/workflows/yum.yml

@@ -28,7 +28,7 @@ jobs:
             test-script: ci/yum-test.sh
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: rake compile & rake test
         run: |
           docker run \

data/Gemfile

@@ -4,3 +4,7 @@ source "https://rubygems.org"
 gemspec
 
 gem "irb"
+
+if Gem::Version.new(RUBY_VERSION) >= Gem::Version.new('3.0.0') && RUBY_PLATFORM.include?('linux')
+  gem 'ruby_memcheck', '~> 3.0'
+end

data/README.md

@@ -1,8 +1,8 @@
 # Capng_c
 
-![Multiple Ruby version tests](https://github.com/fluent-plugins-nursery/capng_c/workflows/Multiple%20Ruby%20version%20tests/badge.svg?branch=main)
-![Apt based Linux](https://github.com/fluent-plugins-nursery/capng_c/workflows/Apt%20based%20Linux/badge.svg?branch=main)
-![Yum based Linux](https://github.com/fluent-plugins-nursery/capng_c/workflows/Yum%20based%20Linux/badge.svg?branch=main)
+[![Multiple Ruby version tests](https://github.com/fluent-plugins-nursery/capng_c/actions/workflows/linux.yml/badge.svg)](https://github.com/fluent-plugins-nursery/capng_c/actions/workflows/linux.yml)
+[![Apt based Linux](https://github.com/fluent-plugins-nursery/capng_c/actions/workflows/apt.yml/badge.svg)](https://github.com/fluent-plugins-nursery/capng_c/actions/workflows/apt.yml)
+[![Yum based Linux](https://github.com/fluent-plugins-nursery/capng_c/actions/workflows/yum.yml/badge.svg)](https://github.com/fluent-plugins-nursery/capng_c/actions/workflows/yum.yml)
 
 libcap-ng bindings for Ruby.
 

data/Rakefile

@@ -18,4 +18,11 @@ end
 
 CLEAN.include('lib/capng/capng.*')
 
+if Gem::Version.new(RUBY_VERSION) >= Gem::Version.new('3.0.0') && RUBY_PLATFORM.include?('linux')
+  require 'ruby_memcheck'
+  namespace :test do
+    RubyMemcheck::TestTask.new(valgrind: :compile)
+  end
+end
+
 task :default => [:clobber, :compile, :test]

data/capng_c.gemspec

@@ -28,7 +28,7 @@ Gem::Specification.new do |spec|
   spec.extensions = ["ext/capng/extconf.rb"]
   spec.required_ruby_version = Gem::Requirement.new(">= 2.4".freeze)
 
-  spec.add_development_dependency "bundler", [">= 1.16", "< 3"]
+  spec.add_development_dependency "bundler"
   spec.add_development_dependency "rake", "~> 13.0"
   spec.add_development_dependency "rake-compiler", "~> 1.0"
   spec.add_development_dependency "test-unit", "~> 3.3.3"

data/ext/capng/capng.c

@@ -75,7 +75,7 @@ capng_get_file_descriptor(VALUE rb_file)
 #else
   rb_io_t* fptr = NULL;
 
-  fptr = RFILE(rb_file)->fptr;
+  GetOpenFile(rb_file, fptr);
   return fptr->fd;
 #endif
 }

data/ext/capng/extconf.rb

@@ -20,6 +20,10 @@ includedir = RbConfig::CONFIG["includedir"]
 
 dir_config("capng", includedir, libdir)
 
+unless find_executable("pkg-config")
+  raise "Require pkg-config due to install capng_c gem. Please install pkg-config."
+end
+
 pkg_config("libcap-ng")
 $CFLAGS << " -Wall -std=c99 -fPIC "
 # $CFLAGS << " -g -O0"

data/ext/capng/print.c

@@ -129,8 +129,11 @@ rb_capng_print_caps_text(VALUE self, VALUE rb_where_name_or_type,
       result = capng_print_caps_text(CAPNG_PRINT_BUFFER, capability_type);
   }
 
-  if (result)
-    return rb_str_new2(result);
+  if (result) {
+    VALUE obj = rb_str_new2(result);
+    free(result);
+    return obj;
+  }
   else
     return rb_str_new2("none");
 }
@@ -191,8 +194,11 @@ rb_capng_print_caps_numeric(VALUE self, VALUE rb_where_name_or_type,
       result = capng_print_caps_numeric(CAPNG_PRINT_BUFFER, select);
   }
 
-  if (result)
-    return rb_str_new2(result);
+  if (result) {
+    VALUE obj = rb_str_new2(result);
+    free(result);
+    return obj;
+  }
   else
     return rb_str_new2("none");
 }

data/ext/capng/state.c

@@ -52,7 +52,14 @@ capng_state_free(void* ptr)
 {
   struct CapNGState* state = (struct CapNGState*)ptr;
   if (state) {
-    state->state = NULL;
+    /* Release any saved libcap-ng state that was never restored, otherwise the
+     * heap block returned by capng_save_state() leaks on GC. capng_c never
+     * stages additional groups, so the saved state owns no nested allocations
+     * and a plain free() fully releases it. */
+    if (state->state) {
+      free(state->state);
+      state->state = NULL;
+    }
   }
 
   xfree(ptr);
@@ -95,12 +102,16 @@ static VALUE
 rb_capng_state_save(VALUE self)
 {
   struct CapNGState* capng_state;
-  void* state = NULL;
 
   TypedData_Get_Struct(self, struct CapNGState, &rb_capng_state_type, capng_state);
 
-  state = capng_save_state();
-  capng_state->state = state;
+  /* Free any previously saved state so repeated #save does not leak. */
+  if (capng_state->state) {
+    free(capng_state->state);
+    capng_state->state = NULL;
+  }
+
+  capng_state->state = capng_save_state();
 
   return Qnil;
 }
@@ -116,12 +127,15 @@ static VALUE
 rb_capng_state_restore(VALUE self)
 {
   struct CapNGState* capng_state;
-  void* state = NULL;
 
   TypedData_Get_Struct(self, struct CapNGState, &rb_capng_state_type, capng_state);
 
-  state = capng_state->state;
-  capng_restore_state(&state);
+  /* Pass the struct field itself so capng_restore_state() frees the block and
+   * resets our pointer to NULL. Passing a local copy (the previous behaviour)
+   * left capng_state->state dangling, causing a use-after-free / double-free on
+   * a second #restore. With the field NULLed, a repeated #restore is a safe
+   * no-op because libcap-ng ignores a NULL saved state. */
+  capng_restore_state(&capng_state->state);
 
   return Qnil;
 }

data/lib/capng/version.rb

@@ -1,3 +1,3 @@
 class CapNG
-  VERSION = "0.2.3"
+  VERSION = "0.2.5"
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: capng_c
 version: !ruby/object:Gem::Version
-  version: 0.2.3
+  version: 0.2.5
 platform: ruby
 authors:
 - Hiroshi Hatake
-autorequire: 
 bindir: exe
 cert_chain: []
-date: 2025-01-14 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -16,20 +15,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.16'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '3'
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.16'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '3'
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -95,6 +88,7 @@ extensions:
 extra_rdoc_files: []
 files:
 - ".clang-format"
+- ".github/dependabot.yml"
 - ".github/workflows/apt.yml"
 - ".github/workflows/linux.yml"
 - ".github/workflows/yum.yml"
@@ -134,7 +128,6 @@ metadata:
   allowed_push_host: https://rubygems.org
   homepage_uri: https://github.com/fluent-plugins-nursery/capng_c
   source_code_uri: https://github.com/fluent-plugins-nursery/capng_c
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -149,8 +142,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.5
-signing_key: 
+rubygems_version: 4.0.16
 specification_version: 4
 summary: libcap-ng bindings for Ruby.
 test_files: []