Package init

0001-SECURITY-Pass-uid-of-caller-to-polkit.patch

@@ -0,0 +1,48 @@
+From f44c5776b25ca2abd7569fb8532c6aede9b0c6b0 Mon Sep 17 00:00:00 2001
+From: Colin Walters <walters@verbum.org>
+Date: Thu, 22 Aug 2013 16:05:22 -0400
+Subject: [PATCH] [SECURITY] Pass uid of caller to polkit
+
+Otherwise, we force polkit to look up the uid itself in /proc, which
+is racy if they execve() a setuid binary.
+---
+ rtkit-daemon.c |   11 ++++++++++-
+ 1 files changed, 10 insertions(+), 1 deletions(-)
+
+diff --git a/rtkit-daemon.c b/rtkit-daemon.c
+index 2ebe673..3ecc1f7 100644
+--- a/rtkit-daemon.c
++++ b/rtkit-daemon.c
+@@ -1170,12 +1170,14 @@ static int verify_polkit(DBusConnection *c, struct rtkit_user *u, struct process
+         DBusMessage *m = NULL, *r = NULL;
+         const char *unix_process = "unix-process";
+         const char *pid = "pid";
++        const char *uid = "uid";
+         const char *start_time = "start-time";
+         const char *cancel_id = "";
+         uint32_t flags = 0;
+         uint32_t pid_u32 = p->pid;
+-        uint64_t start_time_u64 = p->starttime;
++        uint32_t uid_u32 = (uint32_t)u->uid;
+         DBusMessageIter iter_msg, iter_struct, iter_array, iter_dict, iter_variant;
++        uint64_t start_time_u64 = p->starttime;
+         int ret;
+         dbus_bool_t authorized = FALSE;
+ 
+@@ -1206,6 +1208,13 @@ static int verify_polkit(DBusConnection *c, struct rtkit_user *u, struct process
+         assert_se(dbus_message_iter_close_container(&iter_dict, &iter_variant));
+         assert_se(dbus_message_iter_close_container(&iter_array, &iter_dict));
+ 
++        assert_se(dbus_message_iter_open_container(&iter_array, DBUS_TYPE_DICT_ENTRY, NULL, &iter_dict));
++        assert_se(dbus_message_iter_append_basic(&iter_dict, DBUS_TYPE_STRING, &uid));
++        assert_se(dbus_message_iter_open_container(&iter_dict, DBUS_TYPE_VARIANT, "u", &iter_variant));
++        assert_se(dbus_message_iter_append_basic(&iter_variant, DBUS_TYPE_UINT32, &uid_u32));
++        assert_se(dbus_message_iter_close_container(&iter_dict, &iter_variant));
++        assert_se(dbus_message_iter_close_container(&iter_array, &iter_dict));
++
+         assert_se(dbus_message_iter_close_container(&iter_struct, &iter_array));
+         assert_se(dbus_message_iter_close_container(&iter_msg, &iter_struct));
+ 
+-- 
+1.7.1
+

format-security.patch

@@ -0,0 +1,13 @@
+diff -ruN rtkit-0.11.orig/Makefile.am rtkit-0.11/Makefile.am
+--- rtkit-0.11.orig/Makefile.am	2017-05-12 12:56:52.245623657 -0400
++++ rtkit-0.11/Makefile.am	2017-05-12 13:24:27.206304970 -0400
+@@ -18,6 +18,8 @@
+ AM_CFLAGS = $(WARNINGFLAGS) $(PTHREAD_CFLAGS)
+ AM_LDFLAGS = $(GCLDFLAGS)
+ 
++CFLAGS += -Wno-error=format-security
++
+ ACLOCAL_AMFLAGS = -I m4
+ 
+ policykitdir = $(datadir)/polkit-1/actions/
+Binary files rtkit-0.11.orig/.Makefile.am.swp and rtkit-0.11/.Makefile.am.swp differ

rtkit-controlgroup.patch

@@ -0,0 +1,14 @@
+diff --git rtkit-0.11/rtkit-daemon.service.in~ rtkit-0.11/rtkit-daemon.service.in
+index 3dfefa6..d0dc786 100644
+--- rtkit-0.11/rtkit-daemon.service.in~
++++ rtkit-0.11/rtkit-daemon.service.in
+@@ -27,9 +27,5 @@ CapabilityBoundingSet=CAP_SYS_NICE CAP_DAC_READ_SEARCH CAP_SYS_PTRACE CAP_SYS_CH
+ PrivateTmp=yes
+ PrivateNetwork=yes
+ 
+-# Work around the fact that the Linux currently doesn't assign any RT
+-# budget to CPU control groups that have none configured explicitly
+-ControlGroup=cpu:/
+-
+ [Install]
+ WantedBy=graphical.target

rtkit-mq_getattr.patch

@@ -0,0 +1,12 @@
+diff --git a/configure.ac b/configure.ac
+index 5a77363..45721a5 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -112,6 +112,7 @@ CC="$PTHREAD_CC"
+ 
+ AC_SEARCH_LIBS([sched_setscheduler], [rt])
+ AC_SEARCH_LIBS([clock_gettime], [rt])
++AC_SEARCH_LIBS([mq_getattr], [rt])
+ AC_SEARCH_LIBS([cap_init], [cap])
+ 
+ PKG_CHECK_MODULES(DBUS, dbus-1)

rtkit.spec

@@ -0,0 +1,77 @@
+Name:             rtkit
+Version:          0.11
+Release:          21
+Summary:          REALTIMEKIT Realtime Policy and Watchdog Daemon
+
+License:          GPLv3+ and BSD
+URL:              https://github.com/heftig/rtkit
+Source0:          https://github.com/heftig/rtkit/releases/download/v0.12/%{name}-%{version}.tar.xz
+
+BuildRequires:    systemd dbus-devel libcap-devel polkit-devel libtool autoconf automake
+Requires:         dbus  polkit 
+
+Patch1:           rtkit-mq_getattr.patch
+# Patch2 is from fedora 29
+Patch2:           0001-SECURITY-Pass-uid-of-caller-to-polkit.patch
+Patch3:           rtkit-controlgroup.patch
+Patch4:           format-security.patch
+
+%systemd_requires
+
+%package_help
+
+%description
+RealtimeKit is a D-Bus system service that changes the
+scheduling policy of user processes/threads to SCHED_RR
+(i.e. realtime scheduling mode) on request. It is intended to
+be used as a secure mechanism to allow real-time scheduling to
+be used by normal user processes.
+
+%prep
+%autosetup -n %{name}-%{version} -p1
+
+%build
+autoreconf -vif
+%configure --with-systemdsystemunitdir=%{_unitdir}
+%make_build V=1
+./rtkit-daemon --introspect > org.freedesktop.RealtimeKit1.xml
+
+%install
+make install DESTDIR=%{buildroot}
+mkdir %{buildroot}%{_datadir}/dbus-1/interfaces/
+cp %{_builddir}/%{name}-%{version}/org.freedesktop.RealtimeKit1.xml \
+   %{buildroot}%{_datadir}/dbus-1/interfaces/org.freedesktop.RealtimeKit1.xml
+
+%pre
+getent group rtkit >/dev/null 2>&1 || groupadd -r -g 172 rtkit
+getent passwd rtkit >/dev/null 2>&1 || useradd -r -l -u 172 -g rtkit \
+        -d /proc -s /sbin/nologin -c "RealtimeKit" rtkit
+:;
+
+%post
+%systemd_post %{name}-daemon.service
+dbus-send --system --type=method_call \
+          --dest=org.freedesktop.DBus / org.freedesktop.DBus.ReloadConfig >/dev/null 2>&1 || :
+
+%preun
+%systemd_preun %{name}-daemon.service
+
+%postun
+%systemd_postun
+
+%files
+%doc rtkit.c rtkit.h GPL LICENSE README
+%config(noreplace) %{_sysconfdir}/dbus-1/system.d/org.freedesktop.RealtimeKit1.conf
+%attr(0755,root,root) %{_libexecdir}/rtkit-daemon
+%attr(0755,root,root) %{_sbindir}/rtkitctl
+%attr(0644,root,root) %{_datadir}/dbus-1/interfaces/org.freedesktop.RealtimeKit1.xml
+%{_datadir}/dbus-1/system-services/*.service
+%{_datadir}/polkit-1/actions/*.policy
+%{_unitdir}/rtkit-daemon.service
+
+%files help
+%{_mandir}/man8/rtkitctl.8.gz
+
+%changelog
+* Wed Sep 11 2019 openEuler Buildteam <buildteam@openeuler.org> - 0.11-21
+- Package Init