backport-CVE-2021-4034.patch

@@ -0,0 +1,79 @@
+From a2bf5c9c83b6ae46cbd5c779d3055bff81ded683 Mon Sep 17 00:00:00 2001
+From: Jan Rybar <jrybar@redhat.com>
+Date: Tue, 25 Jan 2022 17:21:46 +0000
+Subject: [PATCH] pkexec: local privilege escalation (CVE-2021-4034)
+
+---
+ src/programs/pkcheck.c |  5 +++++
+ src/programs/pkexec.c  | 23 ++++++++++++++++++++---
+ 2 files changed, 25 insertions(+), 3 deletions(-)
+
+diff --git a/src/programs/pkcheck.c b/src/programs/pkcheck.c
+index f1bb4e1..768525c 100644
+--- a/src/programs/pkcheck.c
++++ b/src/programs/pkcheck.c
+@@ -363,6 +363,11 @@ main (int argc, char *argv[])
+   local_agent_handle = NULL;
+   ret = 126;
+ 
++  if (argc < 1)
++    {
++      exit(126);
++    }
++
+   /* Disable remote file access from GIO. */
+   setenv ("GIO_USE_VFS", "local", 1);
+ 
+diff --git a/src/programs/pkexec.c b/src/programs/pkexec.c
+index 7698c5c..84e5ef6 100644
+--- a/src/programs/pkexec.c
++++ b/src/programs/pkexec.c
+@@ -488,6 +488,15 @@ main (int argc, char *argv[])
+   pid_t pid_of_caller;
+   gpointer local_agent_handle;
+ 
++
++  /*
++   * If 'pkexec' is called THIS wrong, someone's probably evil-doing. Don't be nice, just bail out.
++   */
++  if (argc<1)
++    {
++      exit(127);
++    }
++
+   ret = 127;
+   authority = NULL;
+   subject = NULL;
+@@ -614,10 +623,10 @@ main (int argc, char *argv[])
+ 
+       path = g_strdup (pwstruct.pw_shell);
+       if (!path)
+-	{
++        {
+           g_printerr ("No shell configured or error retrieving pw_shell\n");
+           goto out;
+-	}
++        }
+       /* If you change this, be sure to change the if (!command_line)
+ 	 case below too */
+       command_line = g_strdup (path);
+@@ -636,7 +645,15 @@ main (int argc, char *argv[])
+           goto out;
+         }
+       g_free (path);
+-      argv[n] = path = s;
++      path = s;
++
++      /* argc<2 and pkexec runs just shell, argv is guaranteed to be null-terminated.
++       * /-less shell shouldn't happen, but let's be defensive and don't write to null-termination
++       */
++      if (argv[n] != NULL)
++      {
++        argv[n] = path;
++      }
+     }
+   if (access (path, F_OK) != 0)
+     {
+-- 
+1.8.3.1
+

backport-CVE-2021-4115-GHSL-2021-077-fix.patch

@@ -0,0 +1,83 @@
+From 41cb093f554da8772362654a128a84dd8a5542a7 Mon Sep 17 00:00:00 2001
+From: Jan Rybar <jrybar@redhat.com>
+Date: Mon, 21 Feb 2022 08:29:05 +0000
+Subject: [PATCH] CVE-2021-4115 (GHSL-2021-077) fix
+
+---
+ src/polkit/polkitsystembusname.c | 38 ++++++++++++++++++++++++++++++++++----
+ 1 file changed, 34 insertions(+), 4 deletions(-)
+
+diff --git a/src/polkit/polkitsystembusname.c b/src/polkit/polkitsystembusname.c
+index 8ed1363..2fbf5f1 100644
+--- a/src/polkit/polkitsystembusname.c
++++ b/src/polkit/polkitsystembusname.c
+@@ -62,6 +62,10 @@ enum
+   PROP_NAME,
+ };
+ 
++
++guint8 dbus_call_respond_fails;      // has to be global because of callback
++
++
+ static void subject_iface_init (PolkitSubjectIface *subject_iface);
+ 
+ G_DEFINE_TYPE_WITH_CODE (PolkitSystemBusName, polkit_system_bus_name, G_TYPE_OBJECT,
+@@ -364,6 +368,7 @@ on_retrieved_unix_uid_pid (GObject              *src,
+   if (!v)
+     {
+       data->caught_error = TRUE;
++      dbus_call_respond_fails += 1;
+     }
+   else
+     {
+@@ -405,6 +410,8 @@ polkit_system_bus_name_get_creds_sync (PolkitSystemBusName           *system_bus
+   tmp_context = g_main_context_new ();
+   g_main_context_push_thread_default (tmp_context);
+ 
++  dbus_call_respond_fails = 0;
++
+   /* Do two async calls as it's basically as fast as one sync call.
+    */
+   g_dbus_connection_call (connection,
+@@ -432,11 +439,34 @@ polkit_system_bus_name_get_creds_sync (PolkitSystemBusName           *system_bus
+ 			  on_retrieved_unix_uid_pid,
+ 			  &data);
+ 
+-  while (!((data.retrieved_uid && data.retrieved_pid) || data.caught_error))
+-    g_main_context_iteration (tmp_context, TRUE);
++  while (TRUE)
++  {
++    /* If one dbus call returns error, we must wait until the other call
++     * calls _call_finish(), otherwise fd leak is possible.
++     * Resolves: GHSL-2021-077
++    */
+ 
+-  if (data.caught_error)
+-    goto out;
++    if ( (dbus_call_respond_fails > 1) )
++    {
++      // we got two faults, we can leave
++      goto out;
++    }
++
++    if ((data.caught_error && (data.retrieved_pid || data.retrieved_uid)))
++    {
++      // we got one fault and the other call finally finished, we can leave
++      goto out;
++    }
++
++    if ( !(data.retrieved_uid && data.retrieved_pid) )
++    {
++      g_main_context_iteration (tmp_context, TRUE);
++    }
++    else
++    {
++      break;
++    }
++  }
+ 
+   if (out_uid)
+     *out_uid = data.uid;
+-- 
+1.8.3.1
+

backport-build-Add-fallback-looking-for-duktape-s-library-and.patch

@@ -0,0 +1,29 @@
+From b533b25208f4ea32bed1808bd824e70cfe4b6629 Mon Sep 17 00:00:00 2001
+From: Daniel E <daniel.engberg.lists@pyret.net>
+Date: Wed, 30 Mar 2022 14:30:42 +0000
+Subject: [PATCH] build: Add fallback looking for duktape's library and header
+
+---
+ meson.build | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/meson.build b/meson.build
+index dd09b28..c6765fd 100644
+--- a/meson.build
++++ b/meson.build
+@@ -137,7 +137,11 @@ duktape_req_version = '>= 2.2.0'
+ 
+ js_engine = get_option('js_engine')
+ if js_engine == 'duktape'
+-  js_dep = dependency('duktape', version: duktape_req_version)
++  js_dep = dependency('duktape', version: duktape_req_version, required: false)
++  if not js_dep.found()
++    message('Falling back to looking for library and header...')
++    js_dep = cc.find_library('duktape', has_headers: ['duktape.h'], required: true)
++  endif
+   libm_dep = cc.find_library('m')
+   thread_dep = dependency('threads')
+   func = 'pthread_condattr_setclock'
+-- 
+1.8.3.1
+

polkit-0.120.tar.gz.sign

@@ -0,0 +1,11 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQEzBAABCAAdFiEEf/t9a9gxR9dChOMXjOswMP/c4lgFAmFbBdIACgkQjOswMP/c
+4ljEgQgAtj7WctCA7ZqOBAgcr+8NHSzxMJHbiNPDMg4bJB3xVipyQYCfyv8dNANd
+33tTjDGjBN5Dn/Mp7FbxBHsTaUCcvnV11IeDq4AnVT1yrL3E1Tc4B08rQAEUSwZY
+eIuO4GJTbIs79Qtj6tjILcKhKNBBezUyMRgRpq/XYZKlwdlPZkhec2tGtP3wVZCW
+VlYliQfMvV4aJV2PRcVcITnFuWYvV28iI5nl466iE60MmaJOiPeJKFbXM73jiVeP
+QGPljAeGWiZ9xa2a2EFbBbyyiKo1B1kvdp0wgYaeGElw/ulcbUAPpzsh4+aTaX6l
+xJpnVpz9f+opD7/YpyAms4RRkQbMLQ==
+=UyNU
+-----END PGP SIGNATURE-----

polkit.spec

@@ -1,24 +1,29 @@
 Name:             polkit
-Version:          123
+Version:          0.120
-Release:          1
+Release:          6
 Summary:          Define and Handle authorizations tool
 License:          LGPLv2+
 URL:              http://www.freedesktop.org/wiki/Software/polkit
-Source0:          https://gitlab.freedesktop.org/polkit/polkit/-/archive/%{version}/%{name}-%{version}.tar.gz
+Source0:          http://www.freedesktop.org/software/polkit/releases/%{name}-%{version}.tar.gz
+Source1:          http://www.freedesktop.org/software/polkit/releases/%{name}-%{version}.tar.gz.sign
 
 Patch0:           modify-admin-authorization-from-wheel-group-to-root.patch
+Patch1:           backport-CVE-2021-4034.patch
+Patch2:           backport-CVE-2021-4115-GHSL-2021-077-fix.patch
+Patch3:           backport-Added-support-for-duktape-as-JS-engine.patch
+Patch4:           backport-build-Add-fallback-looking-for-duktape-s-library-and.patch
 
-BuildRequires:    gcc-c++ glib2-devel >= 2.30.0 expat-devel pam-devel gtk-doc gettext-devel
+BuildRequires:    gcc-c++ glib2-devel >= 2.30.0 expat-devel pam-devel gtk-doc intltool
-BuildRequires:    gobject-introspection-devel systemd systemd-devel dbus-devel
+BuildRequires:    gobject-introspection-devel systemd systemd-devel
-BuildRequires:    pkgconfig(duktape) >= 2.2.0 meson git
+BuildRequires:    libxslt autoconf automake libtool pkgconfig(duktape) >= 2.2.0
-Requires:         dbus polkit-pkla-compat
+Requires:         dbus
 Requires:         %{name}-libs%{?_isa} = %{version}-%{release}
 Requires(pre):    shadow-utils
 Requires(post):   /sbin/ldconfig, systemd
 Requires(preun):  systemd
 Requires(postun): /sbin/ldconfig, systemd
 
-Obsoletes:        PolicyKit <= 0.10 polkit-desktop-policy < 0.103 polkit-js-engine < 0.120-5 polkit < 0.113-3
+Obsoletes:        PolicyKit <= 0.10 polkit-desktop-policy < 0.103 polkit-js-engine < 0.110-4 polkit < 0.113-3
 Provides:         PolicyKit = 0.11 polkit-desktop-policy = 0.103 polkit-js-engine = %{version}-%{release}
 Conflicts:        polkit-gnome < 0.97
 
@@ -37,7 +42,7 @@ Summary:          Development files for %{name}
 Requires:         %{name}-libs%{?_isa} = %{version}-%{release}
 Requires:         %{name}-help = %{version}-%{release}
 Requires:         glib2-devel
-Obsoletes:        PolicyKit-devel <= 0.10 PolicyKit-docs <= 0.10
+Obsoletes:        PolicyKit-devel <= 0.10 PolicyKit-docs <= 0.10 polkit-docs
 Provides:         PolicyKit-devel = 0.11 PolicyKit-docs = 0.11 polkit-docs
 
 %description      devel
@@ -49,18 +54,22 @@ Development files for polkit.
 %autosetup -n %{name}-%{version} -p1
 
 %build
-%meson -D gtk_doc=true \
+autoreconf -i
-       -D introspection=true \
+export CFLAGS='-fPIC %optflags'
-       -D man=true \
+export LDFLAGS='-pie -Wl,-z,now -Wl,-z,relro'
-       -D session_tracking=libsystemd-login \
+%configure --enable-gtk-doc \
-       -D examples=false \
+        --disable-static \
-       -D tests=false \
+        --enable-introspection \
-       -D js_engine=duktape
+        --disable-examples \
+        --enable-libsystemd-login=yes \
+        --with-duktape
 
-%meson_build
+%make_build
+
+sed -i 's/=\"ientry-idm[0-9]\{5,32\}\"/=\"ientry-idm123456789123456\"/g' docs/polkit/html/polit-index.html
 
 %install
-%meson_install
+%make_install
 
 %delete_la
 
@@ -81,19 +90,18 @@ exit 0
 %systemd_postun_with_restart polkit.service
 
 %files -f polkit-1.lang
-%doc COPYING NEWS.md README.md
+%doc COPYING NEWS README
+%dir %{_sysconfdir}/polkit-1
+%{_sysconfdir}/polkit-1/rules.d/50-default.rules
+%attr(0700,polkitd,root) %dir %{_sysconfdir}/polkit-1/rules.d
 %{_datadir}/dbus-1/system.d/org.freedesktop.PolicyKit1.conf
-%{_datadir}/dbus-1/system-services/*
+%{_sysconfdir}/pam.d/polkit-1
 %{_unitdir}/polkit.service
+%{_datadir}/dbus-1/system-services/*
 %dir %{_datadir}/polkit-1/
 %dir %{_datadir}/polkit-1/actions
 %attr(0700,polkitd,root) %dir %{_datadir}/polkit-1/rules.d
 %{_datadir}/polkit-1/actions/org.freedesktop.policykit.policy
-%{_datadir}/polkit-1/policyconfig-1.dtd
-%dir %{_sysconfdir}/polkit-1
-%{_datadir}/polkit-1/rules.d/50-default.rules
-%attr(0700,polkitd,root) %dir %{_sysconfdir}/polkit-1/rules.d
-%{_sysconfdir}/pam.d/polkit-1
 %{_bindir}/pkaction
 %{_bindir}/pkcheck
 %{_bindir}/pkttyagent
@@ -122,27 +130,6 @@ exit 0
 %{_datadir}/man/man8/*
 
 %changelog
-* Tue Jan 30 2024 wangyu <wangqingsan@huawei.com> - 123-1
-- update to 123
-  - duktape:prevent wrongful termination of runway thread
-  - harden the security features of the systemd service
-  - add packit build tool
-  - systemd:set User/Group and don't change uid/gid if already set
-  - stop installing /usr/share/polkit-1/rules.d as 700/polkitd
-  - moving the 50-default.rules file location
-
-* Fri Feb 17 2023 wangyu <wangyu283@huawei.com> - 122-2
-- revert: delete the expired polkit-pkla-compat
-
-* Wed Feb 01 2023 wangyu <wangyu283@huawei.com> - 122-1
-- Upgrade to 122
-
-* Thu Dec 15 2022 shenxiangwei <shenxiangwei1@huawei.com> - 0.120-8
-- fix core dump problem
-
-* Fri Nov 11 2022 wangyu <wangyu283@huawei.com> - 0.120-7
-- remake even configure scripts and configuration headers that are newer than their input files
-
 * Mon Aug 22 2022 gengqihu <qihu@nfschina.com> - 0.120-6
 - delete the expired polkit-pkla-compat