Package init
This commit is contained in:
dogsheng
parent
a77837e5e0
commit
fb432e0c8e
27
0001-CVE-2019-14865.patch
Normal file
27
0001-CVE-2019-14865.patch
Normal file
@ -0,0 +1,27 @@
|
||||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Hans de Goede <hdegoede@redhat.com>
|
||||
Date: Wed, 13 Nov 2019 12:15:43 +0100
|
||||
Subject: [PATCH] grub-set-bootflag: Update comment about running as root
|
||||
through pkexec
|
||||
|
||||
We have stopped using pkexec for grub-set-bootflag, instead it is now
|
||||
installed suid root, update the comment accordingly.
|
||||
|
||||
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
|
||||
---
|
||||
util/grub-set-bootflag.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/util/grub-set-bootflag.c b/util/grub-set-bootflag.c
|
||||
index 6a79ee67444..65d74ce010f 100644
|
||||
--- a/util/grub-set-bootflag.c
|
||||
+++ b/util/grub-set-bootflag.c
|
||||
@@ -18,7 +18,7 @@
|
||||
*/
|
||||
|
||||
/*
|
||||
- * NOTE this gets run by users as root (through pkexec), so this does not
|
||||
+ * NOTE this gets run by users as root (its suid root), so this does not
|
||||
* use any grub library / util functions to allow for easy auditing.
|
||||
* The grub headers are only included to get certain defines.
|
||||
*/
|
||||
156
0002-CVE-2019-14865.patch
Normal file
156
0002-CVE-2019-14865.patch
Normal file
@ -0,0 +1,156 @@
|
||||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Hans de Goede <hdegoede@redhat.com>
|
||||
Date: Wed, 13 Nov 2019 13:02:01 +0100
|
||||
Subject: [PATCH] grub-set-bootflag: Write new env to tmpfile and then rename
|
||||
|
||||
Make the grubenv writing code in grub-set-bootflag more robust by
|
||||
writing the modified grubenv to a tmpfile first and then renaming the
|
||||
tmpfile over the old grubenv (following symlinks).
|
||||
|
||||
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
|
||||
|
||||
---
|
||||
util/grub-set-bootflag.c | 87 +++++++++++++++++++++++++++++++++++++++++++-----
|
||||
1 file changed, 78 insertions(+), 9 deletions(-)
|
||||
|
||||
diff --git a/util/grub-set-bootflag.c b/util/grub-set-bootflag.c
|
||||
index 32f1c10..d3b80a0 100644
|
||||
--- a/util/grub-set-bootflag.c
|
||||
+++ b/util/grub-set-bootflag.c
|
||||
@@ -26,7 +26,9 @@
|
||||
#include <config-util.h> /* For *_DIR_NAME defines */
|
||||
#include <grub/types.h>
|
||||
#include <grub/lib/envblk.h> /* For GRUB_ENVBLK_DEFCFG define */
|
||||
+#include <limits.h>
|
||||
#include <stdio.h>
|
||||
+#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <unistd.h>
|
||||
|
||||
@@ -52,8 +54,10 @@ int main(int argc, char *argv[])
|
||||
{
|
||||
/* NOTE buf must be at least the longest bootflag length + 4 bytes */
|
||||
char env[GRUBENV_SIZE + 1], buf[64], *s;
|
||||
+ /* +1 for 0 termination, +6 for "XXXXXX" in tmp filename */
|
||||
+ char env_filename[PATH_MAX + 1], tmp_filename[PATH_MAX + 6 + 1];
|
||||
const char *bootflag;
|
||||
- int i, len, ret;
|
||||
+ int i, fd, len, ret;
|
||||
FILE *f;
|
||||
|
||||
if (argc != 2)
|
||||
@@ -75,7 +79,32 @@ int main(int argc, char *argv[])
|
||||
bootflag = bootflags[i];
|
||||
len = strlen (bootflag);
|
||||
|
||||
- f = fopen (GRUBENV, "r");
|
||||
+ /*
|
||||
+ * Really become root. setuid avoids an user killing us, possibly leaking
|
||||
+ * the tmpfile. setgid avoids the new grubenv's gid being that of the user.
|
||||
+ */
|
||||
+ ret = setuid(0);
|
||||
+ if (ret)
|
||||
+ {
|
||||
+ perror ("Error setuid(0) failed");
|
||||
+ return 1;
|
||||
+ }
|
||||
+
|
||||
+ ret = setgid(0);
|
||||
+ if (ret)
|
||||
+ {
|
||||
+ perror ("Error setgid(0) failed");
|
||||
+ return 1;
|
||||
+ }
|
||||
+
|
||||
+ /* Canonicalize GRUBENV filename, resolving symlinks, etc. */
|
||||
+ if (!realpath(GRUBENV, env_filename))
|
||||
+ {
|
||||
+ perror ("Error canonicalizing " GRUBENV " filename");
|
||||
+ return 1;
|
||||
+ }
|
||||
+
|
||||
+ f = fopen (env_filename, "r");
|
||||
if (!f)
|
||||
{
|
||||
perror ("Error opening " GRUBENV " for reading");
|
||||
@@ -129,30 +158,70 @@ int main(int argc, char *argv[])
|
||||
snprintf(buf, sizeof(buf), "%s=1\n", bootflag);
|
||||
memcpy(s, buf, len + 3);
|
||||
|
||||
- /* "r+", don't truncate so that the diskspace stays reserved */
|
||||
- f = fopen (GRUBENV, "r+");
|
||||
+
|
||||
+ /*
|
||||
+ * Create a tempfile for writing the new env. Use the canonicalized filename
|
||||
+ * for the template so that the tmpfile is in the same dir / on same fs.
|
||||
+ */
|
||||
+ snprintf(tmp_filename, sizeof(tmp_filename), "%sXXXXXX", env_filename);
|
||||
+ fd = mkstemp(tmp_filename);
|
||||
+ if (fd == -1)
|
||||
+ {
|
||||
+ perror ("Creating tmpfile failed");
|
||||
+ return 1;
|
||||
+ }
|
||||
+
|
||||
+ f = fdopen (fd, "w");
|
||||
if (!f)
|
||||
{
|
||||
- perror ("Error opening " GRUBENV " for writing");
|
||||
+ perror ("Error fdopen of tmpfile failed");
|
||||
+ unlink(tmp_filename);
|
||||
return 1;
|
||||
}
|
||||
|
||||
ret = fwrite (env, 1, GRUBENV_SIZE, f);
|
||||
if (ret != GRUBENV_SIZE)
|
||||
{
|
||||
- perror ("Error writing to " GRUBENV);
|
||||
+ perror ("Error writing tmpfile");
|
||||
+ unlink(tmp_filename);
|
||||
return 1;
|
||||
}
|
||||
|
||||
ret = fflush (f);
|
||||
if (ret)
|
||||
{
|
||||
- perror ("Error flushing " GRUBENV);
|
||||
+ perror ("Error flushing tmpfile");
|
||||
+ unlink(tmp_filename);
|
||||
return 1;
|
||||
}
|
||||
|
||||
- fsync (fileno (f));
|
||||
- fclose (f);
|
||||
+ ret = fsync (fileno (f));
|
||||
+ if (ret)
|
||||
+ {
|
||||
+ perror ("Error syncing tmpfile");
|
||||
+ unlink(tmp_filename);
|
||||
+ return 1;
|
||||
+ }
|
||||
+
|
||||
+ ret = fclose (f);
|
||||
+ if (ret)
|
||||
+ {
|
||||
+ perror ("Error closing tmpfile");
|
||||
+ unlink(tmp_filename);
|
||||
+ return 1;
|
||||
+ }
|
||||
+
|
||||
+ /*
|
||||
+ * And finally rename the tmpfile with the new env over the old env, the
|
||||
+ * linux kernel guarantees that this is atomic (from a syscall pov).
|
||||
+ */
|
||||
+ ret = rename(tmp_filename, env_filename);
|
||||
+ if (ret)
|
||||
+ {
|
||||
+ perror ("Error renaming tmpfile to " GRUBENV " failed");
|
||||
+ unlink(tmp_filename);
|
||||
+ return 1;
|
||||
+ }
|
||||
|
||||
return 0;
|
||||
}
|
||||
--
|
||||
1.8.3.1
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
From a8107bb28cc702806ab74dd8a826d59c2ae7be6a Mon Sep 17 00:00:00 2001
|
||||
From: fengtao <fengtao40@huawei.com>
|
||||
Date: Tue, 10 Sep 2019 21:43:31 +0800
|
||||
Subject: [PATCH] fix grub2-setpassword errors for euleros
|
||||
Subject: [PATCH] fix grub2-setpassword errors for openEuler
|
||||
|
||||
---
|
||||
util/grub-set-password.in | 2 +-
|
||||
|
||||
@ -249,6 +249,8 @@ Patch6006: grub-core-loader-efi-fdt.c-Do-not-copy-random-memory.patch
|
||||
Patch6007: arm-Move-initrd-upper-to-leave-more-space-for-kernel.patch
|
||||
Patch6008: normal-menu-Do-not-treat-error-values-as-key-presses.patch
|
||||
Patch6009: osdep-freebsd-Fix-partition-calculation-for-EBR-entr.patch
|
||||
Patch6010: 0001-CVE-2019-14865.patch
|
||||
Patch6011: 0002-CVE-2019-14865.patch
|
||||
Patch9000: 0001-fix-grub-search-configfile-failed-in-net.patch
|
||||
Patch9001: Workaround-for-EFI-Bug-Plan3.patch
|
||||
Patch9002: revert-0067-Be-more-aggro.patch
|
||||
|
||||
@ -7,7 +7,7 @@
|
||||
Name: grub2
|
||||
Epoch: 1
|
||||
Version: 2.02
|
||||
Release: 70
|
||||
Release: 71
|
||||
Summary: Bootloader with support for Linux, Multiboot and more
|
||||
License: GPLv3+
|
||||
URL: http://www.gnu.org/software/grub/
|
||||
@ -356,6 +356,12 @@ fi
|
||||
%{_datadir}/man/man*
|
||||
|
||||
%changelog
|
||||
* Sat Dec 21 2019 openEuler Buildteam <buildteam@openeuler.org> - 2.02-71
|
||||
- Type:cves
|
||||
- Id:NA
|
||||
- SUG:NA
|
||||
- DESC:add cve patches
|
||||
|
||||
* Tue Dec 10 2019 openEuler Buildteam <buildteam@openeuler.org> - 2.02-70
|
||||
- Type:bugfix
|
||||
- Id:NA
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user