Upgrade to 122

backport-CVE-2021-4034.patch

@@ -1,79 +0,0 @@
-From a2bf5c9c83b6ae46cbd5c779d3055bff81ded683 Mon Sep 17 00:00:00 2001
-From: Jan Rybar <jrybar@redhat.com>
-Date: Tue, 25 Jan 2022 17:21:46 +0000
-Subject: [PATCH] pkexec: local privilege escalation (CVE-2021-4034)
-
----
- src/programs/pkcheck.c |  5 +++++
- src/programs/pkexec.c  | 23 ++++++++++++++++++++---
- 2 files changed, 25 insertions(+), 3 deletions(-)
-
-diff --git a/src/programs/pkcheck.c b/src/programs/pkcheck.c
-index f1bb4e1..768525c 100644
---- a/src/programs/pkcheck.c
-+++ b/src/programs/pkcheck.c
-@@ -363,6 +363,11 @@ main (int argc, char *argv[])
-   local_agent_handle = NULL;
-   ret = 126;
- 
-+  if (argc < 1)
-+    {
-+      exit(126);
-+    }
-+
-   /* Disable remote file access from GIO. */
-   setenv ("GIO_USE_VFS", "local", 1);
- 
-diff --git a/src/programs/pkexec.c b/src/programs/pkexec.c
-index 7698c5c..84e5ef6 100644
---- a/src/programs/pkexec.c
-+++ b/src/programs/pkexec.c
-@@ -488,6 +488,15 @@ main (int argc, char *argv[])
-   pid_t pid_of_caller;
-   gpointer local_agent_handle;
- 
-+
-+  /*
-+   * If 'pkexec' is called THIS wrong, someone's probably evil-doing. Don't be nice, just bail out.
-+   */
-+  if (argc<1)
-+    {
-+      exit(127);
-+    }
-+
-   ret = 127;
-   authority = NULL;
-   subject = NULL;
-@@ -614,10 +623,10 @@ main (int argc, char *argv[])
- 
-       path = g_strdup (pwstruct.pw_shell);
-       if (!path)
--	{
-+        {
-           g_printerr ("No shell configured or error retrieving pw_shell\n");
-           goto out;
--	}
-+        }
-       /* If you change this, be sure to change the if (!command_line)
- 	 case below too */
-       command_line = g_strdup (path);
-@@ -636,7 +645,15 @@ main (int argc, char *argv[])
-           goto out;
-         }
-       g_free (path);
--      argv[n] = path = s;
-+      path = s;
-+
-+      /* argc<2 and pkexec runs just shell, argv is guaranteed to be null-terminated.
-+       * /-less shell shouldn't happen, but let's be defensive and don't write to null-termination
-+       */
-+      if (argv[n] != NULL)
-+      {
-+        argv[n] = path;
-+      }
-     }
-   if (access (path, F_OK) != 0)
-     {
--- 
-1.8.3.1
-

backport-CVE-2021-4115-GHSL-2021-077-fix.patch

@@ -1,83 +0,0 @@
-From 41cb093f554da8772362654a128a84dd8a5542a7 Mon Sep 17 00:00:00 2001
-From: Jan Rybar <jrybar@redhat.com>
-Date: Mon, 21 Feb 2022 08:29:05 +0000
-Subject: [PATCH] CVE-2021-4115 (GHSL-2021-077) fix
-
----
- src/polkit/polkitsystembusname.c | 38 ++++++++++++++++++++++++++++++++++----
- 1 file changed, 34 insertions(+), 4 deletions(-)
-
-diff --git a/src/polkit/polkitsystembusname.c b/src/polkit/polkitsystembusname.c
-index 8ed1363..2fbf5f1 100644
---- a/src/polkit/polkitsystembusname.c
-+++ b/src/polkit/polkitsystembusname.c
-@@ -62,6 +62,10 @@ enum
-   PROP_NAME,
- };
- 
-+
-+guint8 dbus_call_respond_fails;      // has to be global because of callback
-+
-+
- static void subject_iface_init (PolkitSubjectIface *subject_iface);
- 
- G_DEFINE_TYPE_WITH_CODE (PolkitSystemBusName, polkit_system_bus_name, G_TYPE_OBJECT,
-@@ -364,6 +368,7 @@ on_retrieved_unix_uid_pid (GObject              *src,
-   if (!v)
-     {
-       data->caught_error = TRUE;
-+      dbus_call_respond_fails += 1;
-     }
-   else
-     {
-@@ -405,6 +410,8 @@ polkit_system_bus_name_get_creds_sync (PolkitSystemBusName           *system_bus
-   tmp_context = g_main_context_new ();
-   g_main_context_push_thread_default (tmp_context);
- 
-+  dbus_call_respond_fails = 0;
-+
-   /* Do two async calls as it's basically as fast as one sync call.
-    */
-   g_dbus_connection_call (connection,
-@@ -432,11 +439,34 @@ polkit_system_bus_name_get_creds_sync (PolkitSystemBusName           *system_bus
- 			  on_retrieved_unix_uid_pid,
- 			  &data);
- 
--  while (!((data.retrieved_uid && data.retrieved_pid) || data.caught_error))
--    g_main_context_iteration (tmp_context, TRUE);
-+  while (TRUE)
-+  {
-+    /* If one dbus call returns error, we must wait until the other call
-+     * calls _call_finish(), otherwise fd leak is possible.
-+     * Resolves: GHSL-2021-077
-+    */
- 
--  if (data.caught_error)
--    goto out;
-+    if ( (dbus_call_respond_fails > 1) )
-+    {
-+      // we got two faults, we can leave
-+      goto out;
-+    }
-+
-+    if ((data.caught_error && (data.retrieved_pid || data.retrieved_uid)))
-+    {
-+      // we got one fault and the other call finally finished, we can leave
-+      goto out;
-+    }
-+
-+    if ( !(data.retrieved_uid && data.retrieved_pid) )
-+    {
-+      g_main_context_iteration (tmp_context, TRUE);
-+    }
-+    else
-+    {
-+      break;
-+    }
-+  }
- 
-   if (out_uid)
-     *out_uid = data.uid;
--- 
-1.8.3.1
-

backport-build-Add-fallback-looking-for-duktape-s-library-and.patch

@@ -1,29 +0,0 @@
-From b533b25208f4ea32bed1808bd824e70cfe4b6629 Mon Sep 17 00:00:00 2001
-From: Daniel E <daniel.engberg.lists@pyret.net>
-Date: Wed, 30 Mar 2022 14:30:42 +0000
-Subject: [PATCH] build: Add fallback looking for duktape's library and header
-
----
- meson.build | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/meson.build b/meson.build
-index dd09b28..c6765fd 100644
---- a/meson.build
-+++ b/meson.build
-@@ -137,7 +137,11 @@ duktape_req_version = '>= 2.2.0'
- 
- js_engine = get_option('js_engine')
- if js_engine == 'duktape'
--  js_dep = dependency('duktape', version: duktape_req_version)
-+  js_dep = dependency('duktape', version: duktape_req_version, required: false)
-+  if not js_dep.found()
-+    message('Falling back to looking for library and header...')
-+    js_dep = cc.find_library('duktape', has_headers: ['duktape.h'], required: true)
-+  endif
-   libm_dep = cc.find_library('m')
-   thread_dep = dependency('threads')
-   func = 'pthread_condattr_setclock'
--- 
-1.8.3.1
-

polkit-0.120.tar.gz.sign

@@ -1,11 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQEzBAABCAAdFiEEf/t9a9gxR9dChOMXjOswMP/c4lgFAmFbBdIACgkQjOswMP/c
-4ljEgQgAtj7WctCA7ZqOBAgcr+8NHSzxMJHbiNPDMg4bJB3xVipyQYCfyv8dNANd
-33tTjDGjBN5Dn/Mp7FbxBHsTaUCcvnV11IeDq4AnVT1yrL3E1Tc4B08rQAEUSwZY
-eIuO4GJTbIs79Qtj6tjILcKhKNBBezUyMRgRpq/XYZKlwdlPZkhec2tGtP3wVZCW
-VlYliQfMvV4aJV2PRcVcITnFuWYvV28iI5nl466iE60MmaJOiPeJKFbXM73jiVeP
-QGPljAeGWiZ9xa2a2EFbBbyyiKo1B1kvdp0wgYaeGElw/ulcbUAPpzsh4+aTaX6l
-xJpnVpz9f+opD7/YpyAms4RRkQbMLQ==
-=UyNU
------END PGP SIGNATURE-----

polkit.spec

@@ -1,22 +1,17 @@
 Name:             polkit
-Version:          0.120
+Version:          122
-Release:          8
+Release:          1
 Summary:          Define and Handle authorizations tool
 License:          LGPLv2+
 URL:              http://www.freedesktop.org/wiki/Software/polkit
-Source0:          http://www.freedesktop.org/software/polkit/releases/%{name}-%{version}.tar.gz
+Source0:          https://gitlab.freedesktop.org/polkit/polkit/-/archive/%{version}/%{name}-%{version}.tar.gz
-Source1:          http://www.freedesktop.org/software/polkit/releases/%{name}-%{version}.tar.gz.sign
 
 Patch0:           modify-admin-authorization-from-wheel-group-to-root.patch
-Patch1:           backport-CVE-2021-4034.patch
+Patch1:           fix-core-dump-problem.patch
-Patch2:           backport-CVE-2021-4115-GHSL-2021-077-fix.patch
-Patch3:           backport-Added-support-for-duktape-as-JS-engine.patch
-Patch4:           backport-build-Add-fallback-looking-for-duktape-s-library-and.patch
-Patch5:           fix-core-dump-problem.patch
 
-BuildRequires:    gcc-c++ glib2-devel >= 2.30.0 expat-devel pam-devel gtk-doc intltool
+BuildRequires:    gcc-c++ glib2-devel >= 2.30.0 expat-devel pam-devel gtk-doc gettext-devel
-BuildRequires:    gobject-introspection-devel systemd systemd-devel
+BuildRequires:    gobject-introspection-devel systemd systemd-devel dbus-devel
-BuildRequires:    libxslt autoconf automake libtool pkgconfig(duktape) >= 2.2.0
+BuildRequires:    pkgconfig(duktape) >= 2.2.0 meson git
 Requires:         dbus
 Requires:         %{name}-libs%{?_isa} = %{version}-%{release}
 Requires(pre):    shadow-utils
@@ -24,7 +19,7 @@ Requires(post):   /sbin/ldconfig, systemd
 Requires(preun):  systemd
 Requires(postun): /sbin/ldconfig, systemd
 
-Obsoletes:        PolicyKit <= 0.10 polkit-desktop-policy < 0.103 polkit-js-engine < 0.110-4 polkit < 0.113-3
+Obsoletes:        PolicyKit <= 0.10 polkit-desktop-policy < 0.103 polkit-js-engine < 0.120-5 polkit < 0.113-3
 Provides:         PolicyKit = 0.11 polkit-desktop-policy = 0.103 polkit-js-engine = %{version}-%{release}
 Conflicts:        polkit-gnome < 0.97
 
@@ -43,7 +38,7 @@ Summary:          Development files for %{name}
 Requires:         %{name}-libs%{?_isa} = %{version}-%{release}
 Requires:         %{name}-help = %{version}-%{release}
 Requires:         glib2-devel
-Obsoletes:        PolicyKit-devel <= 0.10 PolicyKit-docs <= 0.10 polkit-docs
+Obsoletes:        PolicyKit-devel <= 0.10 PolicyKit-docs <= 0.10
 Provides:         PolicyKit-devel = 0.11 PolicyKit-docs = 0.11 polkit-docs
 
 %description      devel
@@ -55,22 +50,18 @@ Development files for polkit.
 %autosetup -n %{name}-%{version} -p1
 
 %build
-autoreconf -fi
+%meson -D gtk_doc=true \
-export CFLAGS='-fPIC %optflags'
+       -D introspection=true \
-export LDFLAGS='-pie -Wl,-z,now -Wl,-z,relro'
+       -D man=true \
-%configure --enable-gtk-doc \
+       -D session_tracking=libsystemd-login \
-        --disable-static \
+       -D examples=false \
-        --enable-introspection \
+       -D tests=false \
-        --disable-examples \
+       -D js_engine=duktape
-        --enable-libsystemd-login=yes \
-        --with-duktape
 
-%make_build
+%meson_build
-
-sed -i 's/=\"ientry-idm[0-9]\{5,32\}\"/=\"ientry-idm123456789123456\"/g' docs/polkit/html/polit-index.html
 
 %install
-%make_install
+%meson_install
 
 %delete_la
 
@@ -91,18 +82,19 @@ exit 0
 %systemd_postun_with_restart polkit.service
 
 %files -f polkit-1.lang
-%doc COPYING NEWS README
+%doc COPYING NEWS.md README.md
-%dir %{_sysconfdir}/polkit-1
-%{_sysconfdir}/polkit-1/rules.d/50-default.rules
-%attr(0700,polkitd,root) %dir %{_sysconfdir}/polkit-1/rules.d
 %{_datadir}/dbus-1/system.d/org.freedesktop.PolicyKit1.conf
-%{_sysconfdir}/pam.d/polkit-1
-%{_unitdir}/polkit.service
 %{_datadir}/dbus-1/system-services/*
+%{_unitdir}/polkit.service
 %dir %{_datadir}/polkit-1/
 %dir %{_datadir}/polkit-1/actions
 %attr(0700,polkitd,root) %dir %{_datadir}/polkit-1/rules.d
 %{_datadir}/polkit-1/actions/org.freedesktop.policykit.policy
+%{_datadir}/polkit-1/policyconfig-1.dtd
+%dir %{_sysconfdir}/polkit-1
+%{_datadir}/polkit-1/rules.d/50-default.rules
+%attr(0700,polkitd,root) %dir %{_sysconfdir}/polkit-1/rules.d
+%{_sysconfdir}/pam.d/polkit-1
 %{_bindir}/pkaction
 %{_bindir}/pkcheck
 %{_bindir}/pkttyagent
@@ -131,6 +123,9 @@ exit 0
 %{_datadir}/man/man8/*
 
 %changelog
+* Wed Feb 01 2023 wangyu <wangyu283@huawei.com> - 122-1
+- Upgrade to 122
+
 * Thu Dec 15 2022 shenxiangwei <shenxiangwei1@huawei.com> - 0.120-8
 - fix core dump problem