Add patches for CVE-2013-4319 (#484320).

Package-Manager: portage-2.2.7/cvs/Linux x86_64
Manifest-Sign-Key: 0x4D7043C9

8 files changed, 365 insertions, 12 deletions

diff --git a/sys-cluster/torque/ChangeLog b/sys-cluster/torque/ChangeLog
index 91c59eae77ab..e1a703fc12d9 100644
--- a/sys-cluster/torque/ChangeLog
+++ b/sys-cluster/torque/ChangeLog
@@ -1,6 +1,17 @@
 # ChangeLog for sys-cluster/torque
 # Copyright 1999-2013 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-cluster/torque/ChangeLog,v 1.156 2013/12/23 17:35:39 jsbronder Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-cluster/torque/ChangeLog,v 1.157 2013/12/23 18:01:35 jsbronder Exp $
+
+*torque-4.1.5.1-r1 (23 Dec 2013)
+*torque-2.5.12-r1 (23 Dec 2013)
+*torque-2.4.16-r1 (23 Dec 2013)
+
+  23 Dec 2013; Justin Bronder <jsbronder@gentoo.org> torque-2.4.16.ebuild,
+  +torque-2.4.16-r1.ebuild, -torque-2.5.12.ebuild, +torque-2.5.12-r1.ebuild,
+  -torque-4.1.5.1.ebuild, +torque-4.1.5.1-r1.ebuild,
+  +files/CVE-2013-4319-2.x-root-submit-fix.patch,
+  +files/CVE-2013-4319-4.x-root-submit-fix.patch:
+  Add patches for CVE-2013-4319 (#484320).
 
   23 Dec 2013; Justin Bronder <jsbronder@gentoo.org> -torque-2.3.13.ebuild,
   -torque-3.0.6-r1.ebuild:
diff --git a/sys-cluster/torque/Manifest b/sys-cluster/torque/Manifest
index ff5dff3b0461..8a077d91fa48 100644
--- a/sys-cluster/torque/Manifest
+++ b/sys-cluster/torque/Manifest
@@ -4,6 +4,8 @@ Hash: SHA256
 AUX 0001-fix-parallel-doc-install.patch 1510 SHA256 ad576c6449e078841f8f3dad1515d74264b66d43dfe5232007aca4c467120b22 SHA512 bdb4599d54b3f9768d5fc2a0f12879d6828e434b7fd1121e74313b65ae4eb920337b3a897bae08cebf46836a69eb7c9b1da109a5918a00e442790302f34fd5df WHIRLPOOL 39e738de637f802ab2e968611e2b19d76c9cba4995374c17c6e5e49b93170548f844e55d0128409648c11edf070d4ce2779f8904e28d44ae96531f4d255d1ac3
 AUX 0002-fix-implicit-declaration-warnings.patch 1325 SHA256 e3ca220f3a30ad68eaabc2152bf5e9e60fc09347d9f61edccb755d7837ef2764 SHA512 2edb5ce8a3cc5dd33c68e4b016a18a63ee576dfbe2e99aee0b0254c673f6bf5af9a6be40bd2a9d3ce8f7bc53b16e8b078d521929690ead3b5b4f6dfc8edc433c WHIRLPOOL 8a4f23c42edbab177915d3b02963120d4ae646c2cf2a13f31556762135efbf14263aa2d3b8268afeff668373344bdf2d55b6a82a72d4477b17f5528dd260ef76
 AUX 0003-disable-automagic-doc-building.patch 1424 SHA256 e76ffde27da8d1ef456f7b728be83a148f8d69a217dd16cedb0a33d39c1d183b SHA512 a9c34435a9a25e3232d68d2758bcd33aaff0b63ffe2f5f8fab9c2a49b228ffe2e0cc699bac73c27e5343168340e157517e8462e40adbe1c3996b3d57f1c0b3da WHIRLPOOL f191f8e1100be571713590bff98547837b165ec3988591dfe9dc6a2e378414650100412a077320a222dada3b409fd5b36270bf33d1d9054a0afcc4f731dc7c5d
+AUX CVE-2013-4319-2.x-root-submit-fix.patch 1253 SHA256 a6ebd0c0966148ecb34fb885911e163f93749be72fc5a2e58f11f3c7a9523f45 SHA512 78780ad87e997f22b6abbc3cb51c313616e90320d997705c534c35fbc7f5738b7a2e0ace33051e6e15d4f6e0ab6f97ab9f1ef60dcee5fc4544db13b0a72ea5c4 WHIRLPOOL 64eaf701099da902282b3e1debb6bbfa323fc266ad067047c43dcb353463bf2df7475066f9e263cc9a506b2905aba19c290d50a419ee56a0daa65f237693ede7
+AUX CVE-2013-4319-4.x-root-submit-fix.patch 1412 SHA256 ef88bbbfbda9f7c0d8a98fbd4a0b02e9c662678ba02eac12fbc50521d4d01581 SHA512 89f0b5fedfef5b0db1cdb3d190c7c2fa9c07d175e9b3020ec685e9553d710882ece1155249edeea25902c134ce52bf171fd1e7b2256716351e0e80d3fca5618c WHIRLPOOL 7ee954e3bae8336489bc4e2aed43256d2ecff29e332076255013c78415b4cc5b159b15ab1bc5575493df676393ecd0fd89a1dff4493374f689d3258ad2b7ae57
 AUX disable-automagic-doc-building-2.4.14.patch 1610 SHA256 bc795f22f4c152e27954223f790d341dab06a78aa390c382511b9013d94e965c SHA512 3171d695a983af08e5e3f5590129a56d75daa5d20b7c1fe2a3f0580f27482147dfcfa7cdae9f9597c668fe0c4417223bc1077aae2ee17950c1915d5bf3dec9fb WHIRLPOOL 84ff179d9b82e03a1e6ac4360f3c9797d559341e52e8fb1954653f40c8267a9e994abdb78ad8bc17113e1bacbd53077e343710f3210911c4fc854efaa4db6f54
 AUX pbs_mom-init.d 1083 SHA256 8be6003cc86cc9deff259414615b5cb4099f10c13930f91dd1ecee5572b98ae2 SHA512 8770087494eb3dacd4c19f5835ef9534e9924dcb8d6e4d97ac3b70dcec7c8c2585aaa4491a4166d31f6a7b74fa47db4115cb721ea6356f0863929b5a3e865bf4 WHIRLPOOL 44607077202cb520f1b4af1114d17816385c0008fcf9d38d416ac867ee5e1145957d0292e1f970a71f7c6b4dd1a3d3e575da743b42970652dee5e204f79127d7
 AUX pbs_mom-init.d-munge 1148 SHA256 c8c5dc40960512f8a0410f50114d3d71f92c17811342acd6a01cbf0475b16cbe SHA512 ace375eed3dde368683e184f0f190023bafffdcdac39bebec39866f18be9552e2b02ea0b688ac8f75c676b3d30e61e7e0e03b961a8e17b71ca646afd2d57347b WHIRLPOOL effbe164dfbdfab4cd44ccae74a727a8dc3bfa335c8e991f84a9c1b4ee5ae5ee142b000dc724f4ff8b1e1dca0f6f8db2a32d23090727ad4f85d105bbf2c52b9f
@@ -19,15 +21,16 @@ AUX trqauthd-init.d 594 SHA256 3f3d603e78a21acf88e96c7affc9bbf56ca8568ce17165d3a
 DIST torque-2.4.16.tar.gz 5705768 SHA256 48b1344e13baf974053dbd2faea3e2d24bb6ea8d785805d78623ae06747c0a0d SHA512 481d76b08f4d22704f858d490fd7cd1f8be2d41e2b5969df299c50f0acdf6a1763be2d0debb8a6bd77bd8b9747b9c3c666d701b2b75d8aaf150e10c1081c3be5 WHIRLPOOL 6e89a4e9ac3fd7fdf8b3d38568302a02bfb1aea0203786bade4bb03aaa2fda7f4bbfb2664be5d203d6984f5676980e77035140f41bf00065bd27e9acd38f227c
 DIST torque-2.5.12.tar.gz 5862988 SHA256 436b4d84464e3be0538a4dc0a657b5ae113da6b429d449261e95e13a2a96316b SHA512 12615e412bf90b4248f76e28627ece21116969e4f009629598482ec4432a5e8b6b10ce695e3abc1e3ac43fa2325b5e04b176316ef3c21e4795cb610101f9afae WHIRLPOOL 57b636b34fd72967304babe11340852c0d06519d60705ac088483831b688517104a7ef064dd7b0375cfc35f093858754f65a9f4fd026a65ead85d0544323d682
 DIST torque-4.1.5.1.tar.gz 6214726 SHA256 10fa10625256d26e9371abbc98ca8ecf307ccc2ef117e32a0bf806de105037dd SHA512 630b4a9c7d9d6b14bc807dfba868e78894856d24e7b10703c76b519edf78876e33ef158edd6dd8abeb3ffb6bfe8036e74eff23501d476ef9ebe817b46d2e3c5c WHIRLPOOL 6709a3eec73f39c27d4dd02ab62d74448a93a442bdf585d5f244142de8f54b42fdd841c773226589de4c3e0a9c881bdd51d4c04bf57235136086cab18dd6fa42
-EBUILD torque-2.4.16.ebuild 7910 SHA256 f3d655a519c10a2294a8e3a24e8dc7f80912584ec6ff53f1ac247faa664b465e SHA512 f11810cf13288de001e7a8f8c3f2bac53cf49448ef20eb56f40a41d7fadbaeee5cc84b966825a4b7c9cbfc764eef4606215308c5cd226a907ea32cf51a813d1c WHIRLPOOL 92e2e3334b00ec1a93ad772d66fc206d4141a6a8c368d8f3ed5d9a8bfbb48b43680be78f027270d4f47367682afc6e5bfdab08f9381da8f4311b63b4d4b45339
-EBUILD torque-2.5.12.ebuild 7585 SHA256 a662f828d4c06089e7a10ee7a299e498b60a4c6164e2ba954e4b10a25947b882 SHA512 a75cbe9ae95fd1d10144c1109278e19f974fde717db46ff1ec7687724dd0504a68053d1982558a32976aef64f1629006c2aae621f45a83e7ea04c2e36b376414 WHIRLPOOL 51a4d770c8a46544fc1a58b11632c50def6c14df29e5766109f39822de50257e1758417086f03e07f072819009500dd093e747b8c3d2171110527047735609d8
-EBUILD torque-4.1.5.1.ebuild 7072 SHA256 83971c93ad06bae0883d49d4a5f84f9dea0a1b80008bdee45bd168ea9c6c6f45 SHA512 f3941d17a42e9894ab9bfeafb67154b076048bd06b6bf85d76249f89e0d6f06670f50b4219ebba2905d10f1fe390cd8eb7dbe34497902a4193a6fd48963d4081 WHIRLPOOL ad7985f74f4dedb306f2be9458ea83a83156c5c8ff74a1a7b75a3b749ea4b6ab431eefbb6924415b626c94f3f45fea15d4059758702612ea630d373454c280e1
-MISC ChangeLog 26410 SHA256 3c44033f8d0066be915f4eee61d660368226a12baa94f8ca9d7f9e93f13f799a SHA512 3d1d8b2307614f89228583c1e9655c5d89d6a9e8c0f55d98cc307a87c36c31ad7986e869d1da75fecfad95db0b087aff705a5369b986cb7bfb6f4ecdd026036a WHIRLPOOL 31f931097e21652910da84015ad54e98af8d353a35f39fd231fdb817c359d843efa056230723b07707642e85eed0512aa15c0615bc3fdd2278b5649724a43f58
+EBUILD torque-2.4.16-r1.ebuild 7982 SHA256 3a27f21485579c62f4b8bd9bc2792619a7c6a6225bae6bccdf2037e298f7e5b4 SHA512 7e31c39614ae6fa7a327998ea2761d49f6bef9b8cf435c7cfc2d1f39cd883be2e9117d41675582afbb49a12843576977114d276f1b0aa06b61539d1b248486a4 WHIRLPOOL e127172b6743f661043f0928ee993511e2fd0ae91461e3d731f21cfeae5e356dfdd7524442c016088e29e6856e7963bb21fc1554263c91137ed814b2e39a37b3
+EBUILD torque-2.4.16.ebuild 7972 SHA256 3f929819df583b8b882caf00c29195301acd3bec481848bbb06f229e6e43011b SHA512 0bfc6fa70c6868a1b89f6a298ca7e9c8c5eb0c8d2ab5467879ea51d7e4d5f7f1e01da6fb25f1a139d7093fba9d58cdd5c973e340c21c17f425d34aa7643c422a WHIRLPOOL bbcb6e9106a32814e5f340c00193a192f4c45b36538b985ad0d72d2ad25c5a0726ceeaadcee65f97fc64cabe7a26087859b7429e4ac27e70c8b92a39455b2362
+EBUILD torque-2.5.12-r1.ebuild 7651 SHA256 94edf8036b307bec9c7d344616b9556be08351167a591451610c2467a1f919f3 SHA512 f048dc12d885e39dbed1ebeff479ec2ebe68919f3ca77ad8c2d667e73c87ded18d5bde8f5277fd993cf08929859ab1cc0e8dc6fe6bb3e7f70198287da859661d WHIRLPOOL c64836443340a1d76c53493ef892a3bd757845469f6f714a50ffb3da64cb6e56c9556fce9af2f9ce1cd86c9318be0fc9934e153622cf8bbe2cef98796ba69a79
+EBUILD torque-4.1.5.1-r1.ebuild 7142 SHA256 eb0d4fc1e8bc17349a3d847895bd9542407574cd0fc2286fd43456ddf6a0c8a8 SHA512 2666681d75dfe6d23e75f6d771e00014173acd2362fb69f75b65074f57d09173a0f1576e01005e963292b1e0927dfc1b15ce386d9d4e8a656dd43a5709ec9ba2 WHIRLPOOL 0540d8898841a883dcb7eabc3b68e4c56db97f0f5f820410fa4a88dd85401a7fbabd2f86b2381436917abf0613d081bc735f03743907c55f5604707cc90e3464
+MISC ChangeLog 26857 SHA256 80afbff56229894cab177e68361ef4e9d6b1456b4d1c889f04df26d8a009c785 SHA512 24888ebcb518c492421401a2bcfe3c8261eb663b982d4d7545cd159882f46f75cc76e5fb23d807d5c27b186a106caf8901863e34fa9770021703549fe52d8987 WHIRLPOOL f575fb1a0dd876dcb91852e1dfa28b1e588316c6b4acda68ee22c88846f7c0aa2f56274a2252cd16ed8a2ba281ceed67948ae92b47fb0e406f83cc5fe1c2402b
 MISC metadata.xml 628 SHA256 10fab1886476e44fabbcda6e7dbbc8452d07cb0de0cefcf6e594312dfe89f7af SHA512 d1c78c4247f209eda60a61c9c611c4a4b87d52f85b112a78b96a4dee6f3cd660aef49547323074d69ffce8c1b916c3914f00282781e2f68f76658e6f9ac7ff9b WHIRLPOOL 243373e602f92a256118e6bee6c3071d5894caf3d53a663abee6929a310cf306b15a6a7bd2a0e76882cfe36cd4e8b6c06bb9e12f49f678d085883d61d4a84cf9
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
-iEYEAREIAAYFAlK4dGwACgkQ4MrvBE1wQ8nTQACeOjMI7+ASUh2cH2sf9iGMaA+2
-huoAoIgAFZnxZ7fi6Fac+Xb9I3/JM9/l
-=HQt/
+iEYEAREIAAYFAlK4eoAACgkQ4MrvBE1wQ8mEVgCgjjoYP3iWFHvQwrEfPwTeYn9g
+njEAoKRDypkPCEm9R5ePq1FQWGDw2Qj9
+=AKoe
 -----END PGP SIGNATURE-----
diff --git a/sys-cluster/torque/files/CVE-2013-4319-2.x-root-submit-fix.patch b/sys-cluster/torque/files/CVE-2013-4319-2.x-root-submit-fix.patch
new file mode 100644
index 000000000000..aa53239f157c
--- /dev/null
+++ b/sys-cluster/torque/files/CVE-2013-4319-2.x-root-submit-fix.patch
@@ -0,0 +1,40 @@
+From 5dee0365a56dd2cc4cfd0b182bc843b4f32c086c Mon Sep 17 00:00:00 2001
+From: Justin Bronder <jsbronder@gmail.com>
+Date: Mon, 23 Dec 2013 12:40:27 -0500
+Subject: [PATCH] CVE-2013-4319: 2.x root submit fix
+
+https://bugs.gentoo.org/show_bug.cgi?id=484320
+http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4319\
+---
+ src/server/process_request.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/src/server/process_request.c b/src/server/process_request.c
+index d4a3c92..b06a333 100644
+--- a/src/server/process_request.c
++++ b/src/server/process_request.c
+@@ -640,6 +640,21 @@ void process_request(
+         log_buffer);
+       }
+ 
++    if (svr_conn[sfds].cn_authen != PBS_NET_CONN_FROM_PRIVIL)
++      {
++      sprintf(log_buffer, "request type %s from host %s rejected (connection not privileged)",
++        reqtype_to_txt(request->rq_type),
++        request->rq_host);
++
++      log_record(PBSEVENT_JOB, PBS_EVENTCLASS_JOB, id, log_buffer);
++
++      req_reject(PBSE_BADHOST, 0, request, NULL, "request not authorized");
++
++      close_client(sfds);
++
++      return;
++      }
++
+     if (!tfind(svr_conn[sfds].cn_addr, &okclients))
+       {
+       sprintf(log_buffer, "request type %s from host %s rejected (host not authorized)",
+-- 
+1.8.3.2
+
diff --git a/sys-cluster/torque/files/CVE-2013-4319-4.x-root-submit-fix.patch b/sys-cluster/torque/files/CVE-2013-4319-4.x-root-submit-fix.patch
new file mode 100644
index 000000000000..3614e42721de
--- /dev/null
+++ b/sys-cluster/torque/files/CVE-2013-4319-4.x-root-submit-fix.patch
@@ -0,0 +1,38 @@
+From 6424696d7b160c8a9ad806c4a6b0f77f0d359962 Mon Sep 17 00:00:00 2001
+From: Justin Bronder <jsbronder@gmail.com>
+Date: Mon, 23 Dec 2013 12:48:22 -0500
+Subject: [PATCH] CVE-2013-4319: 4.x root submit fix
+
+https://bugs.gentoo.org/show_bug.cgi?id=484320
+http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4319
+---
+ src/resmom/mom_process_request.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/src/resmom/mom_process_request.c b/src/resmom/mom_process_request.c
+index 049f63f..813833f 100644
+--- a/src/resmom/mom_process_request.c
++++ b/src/resmom/mom_process_request.c
+@@ -238,6 +238,19 @@ void *mom_process_request(
+       log_record(PBSEVENT_JOB, PBS_EVENTCLASS_JOB, __func__, log_buffer);
+       }
+ 
++    if (svr_conn[chan->sock].cn_authen != PBS_NET_CONN_FROM_PRIVIL)
++      {
++      sprintf(log_buffer, "request type %s from host %s rejected (connection not privileged)",
++        reqtype_to_txt(request->rq_type),
++        request->rq_host);
++
++      log_record(PBSEVENT_JOB, PBS_EVENTCLASS_JOB, __func__, log_buffer);
++      req_reject(PBSE_BADHOST, 0, request, NULL, "request not authorized");
++      mom_close_client(chan->sock);
++      DIS_tcp_cleanup(chan);
++      return NULL;
++      }
++
+     if (!AVL_is_in_tree_no_port_compare(svr_conn[chan->sock].cn_addr, 0, okclients))
+       {
+       sprintf(log_buffer, "request type %s from host %s rejected (host not authorized)",
+-- 
+1.8.3.2
+
diff --git a/sys-cluster/torque/torque-2.4.16-r1.ebuild b/sys-cluster/torque/torque-2.4.16-r1.ebuild
new file mode 100644
index 000000000000..5caa85c2c44e
--- /dev/null
+++ b/sys-cluster/torque/torque-2.4.16-r1.ebuild
@@ -0,0 +1,257 @@
+# Copyright 1999-2013 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sys-cluster/torque/torque-2.4.16-r1.ebuild,v 1.1 2013/12/23 18:01:35 jsbronder Exp $
+
+EAPI=2
+WANT_AUTOMAKE="1.12"
+inherit flag-o-matic eutils linux-info autotools
+
+DESCRIPTION="Resource manager and queuing system based on OpenPBS"
+HOMEPAGE="http://www.adaptivecomputing.com/products/open-source/torque"
+SRC_URI="http://www.adaptivecomputing.com/resources/downloads/${PN}/${P}.tar.gz"
+
+LICENSE="openpbs"
+
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sparc ~x86"
+IUSE="tk +crypt drmaa server +syslog doc cpusets kernel_linux"
+
+# ed is used by makedepend-sh
+DEPEND_COMMON="sys-libs/ncurses
+	sys-libs/readline
+	tk? ( dev-lang/tk )
+	syslog? ( virtual/logger )
+	!games-util/qstat"
+
+DEPEND="${DEPEND_COMMON}
+	doc? ( drmaa? (
+		|| ( <app-doc/doxygen-1.7.6.1[latex,-nodot]	>=app-doc/doxygen-1.7.6.1[latex,dot] )
+	) )
+	sys-apps/ed"
+
+RDEPEND="${DEPEND_COMMON}
+	crypt? ( net-misc/openssh )
+	!crypt? ( net-misc/netkit-rsh )"
+
+pkg_setup() {
+	PBS_SERVER_HOME="${PBS_SERVER_HOME:-/var/spool/torque}"
+
+	# Find a Torque server to use.  Check environment, then
+	# current setup (if any), and fall back on current hostname.
+	if [ -z "${PBS_SERVER_NAME}" ]; then
+		if [ -f "${ROOT}${PBS_SERVER_HOME}/server_name" ]; then
+			PBS_SERVER_NAME="$(<${ROOT}${PBS_SERVER_HOME}/server_name)"
+		else
+			PBS_SERVER_NAME=$(hostname -f)
+		fi
+	fi
+
+	USE_CPUSETS="--disable-cpuset"
+	if use cpusets; then
+		if ! use kernel_linux; then
+			einfo
+			elog "    Torque currently only has support for cpusets in linux."
+			elog "Assuming you didn't really want this USE flag."
+			einfo
+		else
+			linux-info_pkg_setup
+			einfo
+			elog "    Torque support for cpusets is still in development, you may"
+			elog "wish to disable it for production use."
+			einfo
+			if ! linux_config_exists || ! linux_chkconfig_present CPUSETS; then
+				einfo
+				elog "    Torque support for cpusets will require that you recompile"
+				elog "your kernel with CONFIG_CPUSETS enabled."
+				einfo
+			fi
+			USE_CPUSETS="--enable-cpuset"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Unused and causes breakage when switching from glibc to tirpc.
+	# https://github.com/adaptivecomputing/torque/pull/148
+	sed -i '/rpc\/rpc\.h/d' src/lib/Libnet/net_client.c || die
+
+	epatch "${FILESDIR}"/0002-fix-implicit-declaration-warnings.patch
+	epatch "${FILESDIR}"/disable-automagic-doc-building-2.4.14.patch
+	epatch "${FILESDIR}"/CVE-2013-4319-2.x-root-submit-fix.patch
+
+	sed -i \
+		-e 's,\(COMPACT_LATEX *=\).*,\1 NO,' \
+		-e 's,\(GENERATE_MAN *=\).*,\1 NO,' \
+		src/drmaa/Doxyfile.in || die
+	sed -i \
+		-e '/INSTALL_DATA/d' \
+		src/drmaa/Makefile.am || die
+	eautoreconf
+}
+
+src_configure() {
+	local myconf="--with-rcp=mom_rcp"
+
+	use crypt && myconf="--with-rcp=scp"
+
+	if use drmaa && use doc; then
+		myconf="${myconf} --enable-apidocs"
+	else
+		myconf="${myconf} --disable-apidocs"
+	fi
+
+	econf \
+		$(use_enable tk gui) \
+		$(use_enable syslog) \
+		$(use_enable server) \
+		$(use_enable drmaa) \
+		--with-server-home=${PBS_SERVER_HOME} \
+		--with-environ=/etc/pbs_environment \
+		--with-default-server=${PBS_SERVER_NAME} \
+		--disable-gcc-warnings \
+		${USE_CPUSETS} \
+		${myconf}
+}
+
+# WARNING
+# OpenPBS is extremely stubborn about directory permissions. Sometimes it will
+# just fall over with the error message, but in some spots it will just ignore
+# you and fail strangely. Likewise it also barfs on our .keep files!
+pbs_createspool() {
+	local root="$1"
+	local s="$(dirname "${PBS_SERVER_HOME}")"
+	local h="${PBS_SERVER_HOME}"
+	local sp="${h}/server_priv"
+	einfo "Building spool directory under ${D}${h}"
+	local a d m
+	local dir_spec="
+			0755:${h}/aux 0700:${h}/checkpoint
+			0755:${h}/mom_logs 0751:${h}/mom_priv 0751:${h}/mom_priv/jobs
+			1777:${h}/spool 1777:${h}/undelivered"
+
+	if use server; then
+		dir_spec="${dir_spec} 0755:${h}/sched_logs
+			0755:${h}/sched_priv/accounting 0755:${h}/server_logs
+			0750:${h}/server_priv 0755:${h}/server_priv/accounting
+			0750:${h}/server_priv/acl_groups 0750:${h}/server_priv/acl_hosts
+			0750:${h}/server_priv/acl_svr 0750:${h}/server_priv/acl_users
+			0750:${h}/server_priv/jobs 0750:${h}/server_priv/queues"
+	fi
+
+	for a in ${dir_spec}; do
+		d="${a/*:}"
+		m="${a/:*}"
+		if [[ ! -d "${root}${d}" ]]; then
+			install -d -m${m} "${root}${d}"
+		else
+			chmod ${m} "${root}${d}"
+		fi
+		# (#149226) If we're running in src_*, then keepdir
+		if [[ "${root}" = "${D}" ]]; then
+			keepdir ${d}
+		fi
+	done
+}
+
+src_install() {
+	# Make directories first
+	pbs_createspool "${D}"
+
+	emake DESTDIR="${D}" install || die "make install failed"
+
+	dodoc CHANGELOG README.* Release_Notes || die "dodoc failed"
+	if use doc; then
+		dodoc doc/admin_guide.ps doc/*.pdf || die "dodoc failed"
+		if use drmaa; then
+			dohtml -r src/drmaa/doc/html/* || die
+			dodoc src/drmaa/drmaa.pdf || die
+		fi
+	fi
+
+	# The build script isn't alternative install location friendly,
+	# So we have to fix some hard-coded paths in tclIndex for xpbs* to work
+	for file in `find "${D}" -iname tclIndex`; do
+		sed -e "s/${D//\// }/ /" "${file}" > "${file}.new" || die
+		mv "${file}.new" "${file}" || die
+	done
+
+	if use server; then
+		newinitd "${FILESDIR}"/pbs_server-init.d pbs_server
+		newinitd "${FILESDIR}"/pbs_sched-init.d pbs_sched
+	fi
+	newinitd "${FILESDIR}"/pbs_mom-init.d pbs_mom
+	newconfd "${FILESDIR}"/torque-conf.d torque
+	newenvd "${FILESDIR}"/torque-env.d 25torque
+
+	[ -d "${D}"/usr/share/doc/torque-drmaa ] && \
+		rm -rf "${D}"/usr/share/doc/torque-drmaa
+}
+
+pkg_preinst() {
+	if [[ -f "${ROOT}etc/pbs_environment" ]]; then
+		cp "${ROOT}etc/pbs_environment" "${D}"/etc/pbs_environment
+	fi
+
+	echo "${PBS_SERVER_NAME}" > "${D}${PBS_SERVER_HOME}/server_name"
+
+	# Fix up the env.d file to use our set server home.
+	sed -i "s:/var/spool/torque:${PBS_SERVER_HOME}:g" \
+		"${D}"/etc/env.d/25torque || die
+}
+
+pkg_postinst() {
+	pbs_createspool "${ROOT}"
+	elog "    If this is the first time torque has been installed, then you are not"
+	elog "ready to start the server.  Please refer to the documentation located at:"
+	elog "http://www.clusterresources.com/wiki/doku.php?id=torque:torque_wiki"
+
+	elog "    For a basic setup, you may use emerge --config ${PN}"
+}
+
+# root will be setup as the primary operator/manager, the local machine
+# will be added as a node and we'll create a simple queue, batch.
+pkg_config() {
+	local h="$(echo "${ROOT}/${PBS_SERVER_HOME}" | sed 's:///*:/:g')"
+	local rc=0
+
+	ebegin "Configuring Torque"
+	einfo "Using ${h} as the pbs homedir"
+	einfo "Using ${PBS_SERVER_NAME} as the pbs_server"
+
+	# Check for previous configuration and bail if found.
+	if [ -e "${h}/server_priv/acl_svr/operators" ] \
+		|| [ -e "${h}/server_priv/nodes" ] \
+		|| [ -e "${h}/mom_priv/config" ]; then
+		ewarn "Previous Torque configuration detected.  Press any key to"
+		ewarn "continue or press Control-C to abort now"
+		read
+	fi
+
+	# pbs_mom configuration.
+	echo "\$pbsserver ${PBS_SERVER_NAME}" > "${h}/mom_priv/config"
+	echo "\$logevent 255" >> "${h}/mom_priv/config"
+
+	if use server; then
+		local qmgr="${ROOT}/usr/bin/qmgr -c"
+		# pbs_server bails on repeated backslashes.
+		if ! echo "y" | "${ROOT}"/usr/sbin/pbs_server -d "${h}" -t create; then
+			eerror "Failed to start pbs_server"
+			rc=1
+		else
+			${qmgr} "set server operators = root@$(hostname -f)" ${PBS_SERVER_NAME}
+			${qmgr} "create queue batch" ${PBS_SERVER_NAME}
+			${qmgr} "set queue batch queue_type = Execution" ${PBS_SERVER_NAME}
+			${qmgr} "set queue batch started = True" ${PBS_SERVER_NAME}
+			${qmgr} "set queue batch enabled = True" ${PBS_SERVER_NAME}
+			${qmgr} "set server default_queue = batch" ${PBS_SERVER_NAME}
+			${qmgr} "set server resources_default.nodes = 1" ${PBS_SERVER_NAME}
+			${qmgr} "set server scheduling = True" ${PBS_SERVER_NAME}
+
+			"${ROOT}"/usr/bin/qterm -t quick ${PBS_SERVER_NAME} || rc=1
+
+			# Add the local machine as a node.
+			echo "$(hostname -f) np=1" > "${h}/server_priv/nodes"
+		fi
+	fi
+	eend ${rc}
+}
diff --git a/sys-cluster/torque/torque-2.4.16.ebuild b/sys-cluster/torque/torque-2.4.16.ebuild
index b2b964bf545f..15435b5fb5d1 100644
--- a/sys-cluster/torque/torque-2.4.16.ebuild
+++ b/sys-cluster/torque/torque-2.4.16.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2013 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-cluster/torque/torque-2.4.16.ebuild,v 1.13 2013/06/01 19:49:33 jsbronder Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-cluster/torque/torque-2.4.16.ebuild,v 1.14 2013/12/23 18:01:35 jsbronder Exp $
 
 EAPI=2
 WANT_AUTOMAKE="1.12"
@@ -77,6 +77,7 @@ src_prepare() {
 
 	epatch "${FILESDIR}"/0002-fix-implicit-declaration-warnings.patch
 	epatch "${FILESDIR}"/disable-automagic-doc-building-2.4.14.patch
+	epatch "${FILESDIR}"/CVE-2013-4319-2.x-root-submit-fix.patch
 
 	sed -i \
 		-e 's,\(COMPACT_LATEX *=\).*,\1 NO,' \
diff --git a/sys-cluster/torque/torque-2.5.12.ebuild b/sys-cluster/torque/torque-2.5.12-r1.ebuild
index eb5697614d31..2db5baa1eef2 100644
--- a/sys-cluster/torque/torque-2.5.12.ebuild
+++ b/sys-cluster/torque/torque-2.5.12-r1.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2013 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-cluster/torque/torque-2.5.12.ebuild,v 1.6 2013/06/01 19:49:33 jsbronder Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-cluster/torque/torque-2.5.12-r1.ebuild,v 1.1 2013/12/23 18:01:35 jsbronder Exp $
 
 EAPI=4
 
@@ -76,6 +76,8 @@ pkg_setup() {
 }
 
 src_prepare() {
+	epatch "${FILESDIR}"/CVE-2013-4319-2.x-root-submit-fix.patch
+
 	# Unused and causes breakage when switching from glibc to tirpc.
 	# https://github.com/adaptivecomputing/torque/pull/148
 	sed -i '/rpc\/rpc\.h/d' src/lib/Libnet/net_client.c || die
diff --git a/sys-cluster/torque/torque-4.1.5.1.ebuild b/sys-cluster/torque/torque-4.1.5.1-r1.ebuild
index 487efd9dd472..294b54165130 100644
--- a/sys-cluster/torque/torque-4.1.5.1.ebuild
+++ b/sys-cluster/torque/torque-4.1.5.1-r1.ebuild
@@ -1,8 +1,8 @@
 # Copyright 1999-2013 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-cluster/torque/torque-4.1.5.1.ebuild,v 1.4 2013/06/12 06:53:19 jlec Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-cluster/torque/torque-4.1.5.1-r1.ebuild,v 1.1 2013/12/23 18:01:35 jsbronder Exp $
 
-EAPI=2
+EAPI=4
 inherit flag-o-matic eutils linux-info
 
 DESCRIPTION="Resource manager and queuing system based on OpenPBS"
@@ -75,6 +75,7 @@ src_prepare() {
 	sed -i '/mk_default_ld_lib_file || return 1/d' buildutils/pbs_mkdirs.in || die
 
 	epatch "${FILESDIR}"/${P}-tcl8.6.patch
+	epatch "${FILESDIR}"/CVE-2013-4319-4.x-root-submit-fix.patch
 }
 
 src_configure() {