packages/polkit
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!56 Upgrade to 122

Browse Source 
From: @BornThisWay 
Reviewed-by: @HuaxinLuGitee 
Signed-off-by: @HuaxinLuGitee
This commit is contained in:
openeuler-ci-bot 2023-02-01 08:17:57 +00:00 committed by Gitee
commit 85fdac10e9
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
8 changed files with 28 additions and 3690 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3455
backport-Added-support-for-duktape-as-JS-engine.patch
View File

File diff suppressed because it is too large Load Diff

79
backport-CVE-2021-4034.patch
View File

@ -1,79 +0,0 @@
From a2bf5c9c83b6ae46cbd5c779d3055bff81ded683 Mon Sep 17 00:00:00 2001
From: Jan Rybar <jrybar@redhat.com>
Date: Tue, 25 Jan 2022 17:21:46 +0000
Subject: [PATCH] pkexec: local privilege escalation (CVE-2021-4034)
---
src/programs/pkcheck.c | 5 +++++
src/programs/pkexec.c | 23 ++++++++++++++++++++---
2 files changed, 25 insertions(+), 3 deletions(-)
diff --git a/src/programs/pkcheck.c b/src/programs/pkcheck.c
index f1bb4e1..768525c 100644
--- a/src/programs/pkcheck.c
+++ b/src/programs/pkcheck.c
@@ -363,6 +363,11 @@ main (int argc, char *argv[])
local_agent_handle = NULL;
ret = 126;
+ if (argc < 1)
+ {
+ exit(126);
+ }
+
/* Disable remote file access from GIO. */
setenv ("GIO_USE_VFS", "local", 1);
diff --git a/src/programs/pkexec.c b/src/programs/pkexec.c
index 7698c5c..84e5ef6 100644
--- a/src/programs/pkexec.c
+++ b/src/programs/pkexec.c
@@ -488,6 +488,15 @@ main (int argc, char *argv[])
pid_t pid_of_caller;
gpointer local_agent_handle;
+
+ /*
+ * If 'pkexec' is called THIS wrong, someone's probably evil-doing. Don't be nice, just bail out.
+ */
+ if (argc<1)
+ {
+ exit(127);
+ }
+
ret = 127;
authority = NULL;
subject = NULL;
@@ -614,10 +623,10 @@ main (int argc, char *argv[])
path = g_strdup (pwstruct.pw_shell);
if (!path)
- {
+ {
g_printerr ("No shell configured or error retrieving pw_shell\n");
goto out;
- }
+ }
/* If you change this, be sure to change the if (!command_line)
case below too */
command_line = g_strdup (path);
@@ -636,7 +645,15 @@ main (int argc, char *argv[])
goto out;
}
g_free (path);
- argv[n] = path = s;
+ path = s;
+
+ /* argc<2 and pkexec runs just shell, argv is guaranteed to be null-terminated.
+ * /-less shell shouldn't happen, but let's be defensive and don't write to null-termination
+ */
+ if (argv[n] != NULL)
+ {
+ argv[n] = path;
+ }
}
if (access (path, F_OK) != 0)
{
--
1.8.3.1

83
backport-CVE-2021-4115-GHSL-2021-077-fix.patch
View File

@ -1,83 +0,0 @@
From 41cb093f554da8772362654a128a84dd8a5542a7 Mon Sep 17 00:00:00 2001
From: Jan Rybar <jrybar@redhat.com>
Date: Mon, 21 Feb 2022 08:29:05 +0000
Subject: [PATCH] CVE-2021-4115 (GHSL-2021-077) fix
---
src/polkit/polkitsystembusname.c | 38 ++++++++++++++++++++++++++++++++++----
1 file changed, 34 insertions(+), 4 deletions(-)
diff --git a/src/polkit/polkitsystembusname.c b/src/polkit/polkitsystembusname.c
index 8ed1363..2fbf5f1 100644
--- a/src/polkit/polkitsystembusname.c
+++ b/src/polkit/polkitsystembusname.c
@@ -62,6 +62,10 @@ enum
PROP_NAME,
};
+
+guint8 dbus_call_respond_fails; // has to be global because of callback
+
+
static void subject_iface_init (PolkitSubjectIface *subject_iface);
G_DEFINE_TYPE_WITH_CODE (PolkitSystemBusName, polkit_system_bus_name, G_TYPE_OBJECT,
@@ -364,6 +368,7 @@ on_retrieved_unix_uid_pid (GObject *src,
if (!v)
{
data->caught_error = TRUE;
+ dbus_call_respond_fails += 1;
}
else
{
@@ -405,6 +410,8 @@ polkit_system_bus_name_get_creds_sync (PolkitSystemBusName *system_bus
tmp_context = g_main_context_new ();
g_main_context_push_thread_default (tmp_context);
+ dbus_call_respond_fails = 0;
+
/* Do two async calls as it's basically as fast as one sync call.
*/
g_dbus_connection_call (connection,
@@ -432,11 +439,34 @@ polkit_system_bus_name_get_creds_sync (PolkitSystemBusName *system_bus
on_retrieved_unix_uid_pid,
&data);
- while (!((data.retrieved_uid && data.retrieved_pid) || data.caught_error))
- g_main_context_iteration (tmp_context, TRUE);
+ while (TRUE)
+ {
+ /* If one dbus call returns error, we must wait until the other call
+ * calls _call_finish(), otherwise fd leak is possible.
+ * Resolves: GHSL-2021-077
+ */
- if (data.caught_error)
- goto out;
+ if ( (dbus_call_respond_fails > 1) )
+ {
+ // we got two faults, we can leave
+ goto out;
+ }
+
+ if ((data.caught_error && (data.retrieved_pid || data.retrieved_uid)))
+ {
+ // we got one fault and the other call finally finished, we can leave
+ goto out;
+ }
+
+ if ( !(data.retrieved_uid && data.retrieved_pid) )
+ {
+ g_main_context_iteration (tmp_context, TRUE);
+ }
+ else
+ {
+ break;
+ }
+ }
if (out_uid)
*out_uid = data.uid;
--
1.8.3.1

29
backport-build-Add-fallback-looking-for-duktape-s-library-and.patch
View File

@ -1,29 +0,0 @@
From b533b25208f4ea32bed1808bd824e70cfe4b6629 Mon Sep 17 00:00:00 2001
From: Daniel E <daniel.engberg.lists@pyret.net>
Date: Wed, 30 Mar 2022 14:30:42 +0000
Subject: [PATCH] build: Add fallback looking for duktape's library and header
---
meson.build | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/meson.build b/meson.build
index dd09b28..c6765fd 100644
--- a/meson.build
+++ b/meson.build
@@ -137,7 +137,11 @@ duktape_req_version = '>= 2.2.0'
js_engine = get_option('js_engine')
if js_engine == 'duktape'
- js_dep = dependency('duktape', version: duktape_req_version)
+ js_dep = dependency('duktape', version: duktape_req_version, required: false)
+ if not js_dep.found()
+ message('Falling back to looking for library and header...')
+ js_dep = cc.find_library('duktape', has_headers: ['duktape.h'], required: true)
+ endif
libm_dep = cc.find_library('m')
thread_dep = dependency('threads')
func = 'pthread_condattr_setclock'
--
1.8.3.1

BIN
polkit-0.120.tar.gz
View File

Binary file not shown.

11
polkit-0.120.tar.gz.sign
View File

@ -1,11 +0,0 @@
-----BEGIN PGP SIGNATURE-----
iQEzBAABCAAdFiEEf/t9a9gxR9dChOMXjOswMP/c4lgFAmFbBdIACgkQjOswMP/c
4ljEgQgAtj7WctCA7ZqOBAgcr+8NHSzxMJHbiNPDMg4bJB3xVipyQYCfyv8dNANd
33tTjDGjBN5Dn/Mp7FbxBHsTaUCcvnV11IeDq4AnVT1yrL3E1Tc4B08rQAEUSwZY
eIuO4GJTbIs79Qtj6tjILcKhKNBBezUyMRgRpq/XYZKlwdlPZkhec2tGtP3wVZCW
VlYliQfMvV4aJV2PRcVcITnFuWYvV28iI5nl466iE60MmaJOiPeJKFbXM73jiVeP
QGPljAeGWiZ9xa2a2EFbBbyyiKo1B1kvdp0wgYaeGElw/ulcbUAPpzsh4+aTaX6l
xJpnVpz9f+opD7/YpyAms4RRkQbMLQ==
=UyNU
-----END PGP SIGNATURE-----

BIN
polkit-122.tar.gz Normal file
View File

Binary file not shown.

61
polkit.spec
View File

@ -1,22 +1,17 @@
Name: polkit
Version: 0.120
Release: 8
Version: 122
Release: 1
Summary: Define and Handle authorizations tool
License: LGPLv2+
URL: http://www.freedesktop.org/wiki/Software/polkit
Source0: http://www.freedesktop.org/software/polkit/releases/%{name}-%{version}.tar.gz
Source1: http://www.freedesktop.org/software/polkit/releases/%{name}-%{version}.tar.gz.sign
Source0: https://gitlab.freedesktop.org/polkit/polkit/-/archive/%{version}/%{name}-%{version}.tar.gz
Patch0: modify-admin-authorization-from-wheel-group-to-root.patch
Patch1: backport-CVE-2021-4034.patch
Patch2: backport-CVE-2021-4115-GHSL-2021-077-fix.patch
Patch3: backport-Added-support-for-duktape-as-JS-engine.patch
Patch4: backport-build-Add-fallback-looking-for-duktape-s-library-and.patch
Patch5: fix-core-dump-problem.patch
Patch1: fix-core-dump-problem.patch
BuildRequires: gcc-c++ glib2-devel >= 2.30.0 expat-devel pam-devel gtk-doc intltool
BuildRequires: gobject-introspection-devel systemd systemd-devel
BuildRequires: libxslt autoconf automake libtool pkgconfig(duktape) >= 2.2.0
BuildRequires: gcc-c++ glib2-devel >= 2.30.0 expat-devel pam-devel gtk-doc gettext-devel
BuildRequires: gobject-introspection-devel systemd systemd-devel dbus-devel
BuildRequires: pkgconfig(duktape) >= 2.2.0 meson git
Requires: dbus
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
Requires(pre): shadow-utils
@ -24,7 +19,7 @@ Requires(post): /sbin/ldconfig, systemd
Requires(preun): systemd
Requires(postun): /sbin/ldconfig, systemd
Obsoletes: PolicyKit <= 0.10 polkit-desktop-policy < 0.103 polkit-js-engine < 0.110-4 polkit < 0.113-3
Obsoletes: PolicyKit <= 0.10 polkit-desktop-policy < 0.103 polkit-js-engine < 0.120-5 polkit < 0.113-3
Provides: PolicyKit = 0.11 polkit-desktop-policy = 0.103 polkit-js-engine = %{version}-%{release}
Conflicts: polkit-gnome < 0.97
@ -43,7 +38,7 @@ Summary: Development files for %{name}
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
Requires: %{name}-help = %{version}-%{release}
Requires: glib2-devel
Obsoletes: PolicyKit-devel <= 0.10 PolicyKit-docs <= 0.10 polkit-docs
Obsoletes: PolicyKit-devel <= 0.10 PolicyKit-docs <= 0.10
Provides: PolicyKit-devel = 0.11 PolicyKit-docs = 0.11 polkit-docs
%description devel
@ -55,22 +50,18 @@ Development files for polkit.
%autosetup -n %{name}-%{version} -p1
%build
autoreconf -fi
export CFLAGS='-fPIC %optflags'
export LDFLAGS='-pie -Wl,-z,now -Wl,-z,relro'
%configure --enable-gtk-doc \
--disable-static \
--enable-introspection \
--disable-examples \
--enable-libsystemd-login=yes \
--with-duktape
%meson -D gtk_doc=true \
-D introspection=true \
-D man=true \
-D session_tracking=libsystemd-login \
-D examples=false \
-D tests=false \
-D js_engine=duktape
%make_build
sed -i 's/=\"ientry-idm[0-9]\{5,32\}\"/=\"ientry-idm123456789123456\"/g' docs/polkit/html/polit-index.html
%meson_build
%install
%make_install
%meson_install
%delete_la
@ -91,18 +82,19 @@ exit 0
%systemd_postun_with_restart polkit.service
%files -f polkit-1.lang
%doc COPYING NEWS README
%dir %{_sysconfdir}/polkit-1
%{_sysconfdir}/polkit-1/rules.d/50-default.rules
%attr(0700,polkitd,root) %dir %{_sysconfdir}/polkit-1/rules.d
%doc COPYING NEWS.md README.md
%{_datadir}/dbus-1/system.d/org.freedesktop.PolicyKit1.conf
%{_sysconfdir}/pam.d/polkit-1
%{_unitdir}/polkit.service
%{_datadir}/dbus-1/system-services/*
%{_unitdir}/polkit.service
%dir %{_datadir}/polkit-1/
%dir %{_datadir}/polkit-1/actions
%attr(0700,polkitd,root) %dir %{_datadir}/polkit-1/rules.d
%{_datadir}/polkit-1/actions/org.freedesktop.policykit.policy
%{_datadir}/polkit-1/policyconfig-1.dtd
%dir %{_sysconfdir}/polkit-1
%{_datadir}/polkit-1/rules.d/50-default.rules
%attr(0700,polkitd,root) %dir %{_sysconfdir}/polkit-1/rules.d
%{_sysconfdir}/pam.d/polkit-1
%{_bindir}/pkaction
%{_bindir}/pkcheck
%{_bindir}/pkttyagent
@ -131,6 +123,9 @@ exit 0
%{_datadir}/man/man8/*
%changelog
* Wed Feb 01 2023 wangyu <wangyu283@huawei.com> - 122-1
- Upgrade to 122
* Thu Dec 15 2022 shenxiangwei <shenxiangwei1@huawei.com> - 0.120-8
- fix core dump problem