Compare commits
10 Commits
cd4e77f0c1
...
ce0217e9be
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
ce0217e9be | ||
|
|
6b6ab807c3 | ||
|
|
b1c51a8ac8 | ||
|
|
70a412561c | ||
|
|
07a61cecee | ||
|
|
91db04a5cc | ||
|
|
0d7c47ae01 | ||
|
|
260062b8a5 | ||
|
|
ba3fb14dce | ||
|
|
aebafed94e |
@ -1,48 +0,0 @@
|
||||
From f44c5776b25ca2abd7569fb8532c6aede9b0c6b0 Mon Sep 17 00:00:00 2001
|
||||
From: Colin Walters <walters@verbum.org>
|
||||
Date: Thu, 22 Aug 2013 16:05:22 -0400
|
||||
Subject: [PATCH] [SECURITY] Pass uid of caller to polkit
|
||||
|
||||
Otherwise, we force polkit to look up the uid itself in /proc, which
|
||||
is racy if they execve() a setuid binary.
|
||||
---
|
||||
rtkit-daemon.c | 11 ++++++++++-
|
||||
1 files changed, 10 insertions(+), 1 deletions(-)
|
||||
|
||||
diff --git a/rtkit-daemon.c b/rtkit-daemon.c
|
||||
index 2ebe673..3ecc1f7 100644
|
||||
--- a/rtkit-daemon.c
|
||||
+++ b/rtkit-daemon.c
|
||||
@@ -1170,12 +1170,14 @@ static int verify_polkit(DBusConnection *c, struct rtkit_user *u, struct process
|
||||
DBusMessage *m = NULL, *r = NULL;
|
||||
const char *unix_process = "unix-process";
|
||||
const char *pid = "pid";
|
||||
+ const char *uid = "uid";
|
||||
const char *start_time = "start-time";
|
||||
const char *cancel_id = "";
|
||||
uint32_t flags = 0;
|
||||
uint32_t pid_u32 = p->pid;
|
||||
- uint64_t start_time_u64 = p->starttime;
|
||||
+ uint32_t uid_u32 = (uint32_t)u->uid;
|
||||
DBusMessageIter iter_msg, iter_struct, iter_array, iter_dict, iter_variant;
|
||||
+ uint64_t start_time_u64 = p->starttime;
|
||||
int ret;
|
||||
dbus_bool_t authorized = FALSE;
|
||||
|
||||
@@ -1206,6 +1208,13 @@ static int verify_polkit(DBusConnection *c, struct rtkit_user *u, struct process
|
||||
assert_se(dbus_message_iter_close_container(&iter_dict, &iter_variant));
|
||||
assert_se(dbus_message_iter_close_container(&iter_array, &iter_dict));
|
||||
|
||||
+ assert_se(dbus_message_iter_open_container(&iter_array, DBUS_TYPE_DICT_ENTRY, NULL, &iter_dict));
|
||||
+ assert_se(dbus_message_iter_append_basic(&iter_dict, DBUS_TYPE_STRING, &uid));
|
||||
+ assert_se(dbus_message_iter_open_container(&iter_dict, DBUS_TYPE_VARIANT, "u", &iter_variant));
|
||||
+ assert_se(dbus_message_iter_append_basic(&iter_variant, DBUS_TYPE_UINT32, &uid_u32));
|
||||
+ assert_se(dbus_message_iter_close_container(&iter_dict, &iter_variant));
|
||||
+ assert_se(dbus_message_iter_close_container(&iter_array, &iter_dict));
|
||||
+
|
||||
assert_se(dbus_message_iter_close_container(&iter_struct, &iter_array));
|
||||
assert_se(dbus_message_iter_close_container(&iter_msg, &iter_struct));
|
||||
|
||||
--
|
||||
1.7.1
|
||||
|
||||
@ -1,13 +0,0 @@
|
||||
diff -ruN rtkit-0.11.orig/Makefile.am rtkit-0.11/Makefile.am
|
||||
--- rtkit-0.11.orig/Makefile.am 2017-05-12 12:56:52.245623657 -0400
|
||||
+++ rtkit-0.11/Makefile.am 2017-05-12 13:24:27.206304970 -0400
|
||||
@@ -18,6 +18,8 @@
|
||||
AM_CFLAGS = $(WARNINGFLAGS) $(PTHREAD_CFLAGS)
|
||||
AM_LDFLAGS = $(GCLDFLAGS)
|
||||
|
||||
+CFLAGS += -Wno-error=format-security
|
||||
+
|
||||
ACLOCAL_AMFLAGS = -I m4
|
||||
|
||||
policykitdir = $(datadir)/polkit-1/actions/
|
||||
Binary files rtkit-0.11.orig/.Makefile.am.swp and rtkit-0.11/.Makefile.am.swp differ
|
||||
Binary file not shown.
@ -1,14 +0,0 @@
|
||||
diff --git rtkit-0.11/rtkit-daemon.service.in~ rtkit-0.11/rtkit-daemon.service.in
|
||||
index 3dfefa6..d0dc786 100644
|
||||
--- rtkit-0.11/rtkit-daemon.service.in~
|
||||
+++ rtkit-0.11/rtkit-daemon.service.in
|
||||
@@ -27,9 +27,5 @@ CapabilityBoundingSet=CAP_SYS_NICE CAP_DAC_READ_SEARCH CAP_SYS_PTRACE CAP_SYS_CH
|
||||
PrivateTmp=yes
|
||||
PrivateNetwork=yes
|
||||
|
||||
-# Work around the fact that the Linux currently doesn't assign any RT
|
||||
-# budget to CPU control groups that have none configured explicitly
|
||||
-ControlGroup=cpu:/
|
||||
-
|
||||
[Install]
|
||||
WantedBy=graphical.target
|
||||
@ -1,12 +0,0 @@
|
||||
diff --git a/configure.ac b/configure.ac
|
||||
index 5a77363..45721a5 100644
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -112,6 +112,7 @@ CC="$PTHREAD_CC"
|
||||
|
||||
AC_SEARCH_LIBS([sched_setscheduler], [rt])
|
||||
AC_SEARCH_LIBS([clock_gettime], [rt])
|
||||
+AC_SEARCH_LIBS([mq_getattr], [rt])
|
||||
AC_SEARCH_LIBS([cap_init], [cap])
|
||||
|
||||
PKG_CHECK_MODULES(DBUS, dbus-1)
|
||||
45
rtkit.spec
45
rtkit.spec
@ -1,20 +1,17 @@
|
||||
%global revision 20161005
|
||||
Name: rtkit
|
||||
Version: 0.11
|
||||
Release: 25
|
||||
Version: 0.13
|
||||
Release: 1
|
||||
Summary: REALTIMEKIT Realtime Policy and Watchdog Daemon
|
||||
|
||||
License: GPLv3+ and BSD
|
||||
URL: https://github.com/heftig/rtkit
|
||||
Source0: https://github.com/heftig/rtkit/releases/download/v0.12/%{name}-%{version}.tar.gz
|
||||
Source0: %{url}/archive/refs/tags/v%{version}.tar.gz
|
||||
|
||||
|
||||
BuildRequires: systemd dbus-devel libcap-devel polkit-devel libtool autoconf automake
|
||||
BuildRequires: vim-common
|
||||
Requires: dbus polkit
|
||||
|
||||
Patch1: rtkit-mq_getattr.patch
|
||||
Patch2: 0001-SECURITY-Pass-uid-of-caller-to-polkit.patch
|
||||
Patch3: rtkit-controlgroup.patch
|
||||
Patch4: format-security.patch
|
||||
|
||||
%systemd_requires
|
||||
|
||||
%package_help
|
||||
@ -30,17 +27,14 @@ be used by normal user processes.
|
||||
%autosetup -n %{name}-%{version} -p1
|
||||
|
||||
%build
|
||||
./autogen.sh
|
||||
autoreconf -vif
|
||||
%configure --with-systemdsystemunitdir=%{_unitdir}
|
||||
export CFLAGS="%{optflags} -Wno-error=format-security"
|
||||
%configure --with-systemdsystemunitdir=%{_unitdir} --libexecdir=%{_libexecdir}/rtkit
|
||||
%make_build V=1
|
||||
./rtkit-daemon --introspect > org.freedesktop.RealtimeKit1.xml
|
||||
|
||||
%install
|
||||
make install DESTDIR=%{buildroot}
|
||||
mkdir %{buildroot}%{_datadir}/dbus-1/interfaces/
|
||||
cp %{_builddir}/%{name}-%{version}/org.freedesktop.RealtimeKit1.xml \
|
||||
%{buildroot}%{_datadir}/dbus-1/interfaces/org.freedesktop.RealtimeKit1.xml
|
||||
|
||||
%pre
|
||||
getent group rtkit >/dev/null 2>&1 || groupadd -r -g 172 rtkit
|
||||
@ -62,18 +56,37 @@ dbus-send --system --type=method_call \
|
||||
%files
|
||||
%doc rtkit.c rtkit.h README
|
||||
%license GPL LICENSE
|
||||
%config(noreplace) %{_sysconfdir}/dbus-1/system.d/org.freedesktop.RealtimeKit1.conf
|
||||
%attr(0755,root,root) %{_libexecdir}/rtkit-daemon
|
||||
%attr(0755,root,root) %{_libexecdir}/rtkit/rtkit-daemon
|
||||
%attr(0755,root,root) %{_sbindir}/rtkitctl
|
||||
%attr(0644,root,root) %{_datadir}/dbus-1/interfaces/org.freedesktop.RealtimeKit1.xml
|
||||
%{_datadir}/dbus-1/system-services/*.service
|
||||
%{_datadir}/polkit-1/actions/*.policy
|
||||
%{_unitdir}/rtkit-daemon.service
|
||||
%{_libexecdir}/rtkit/installed-tests/rtkit/rtkit-test
|
||||
%{_datadir}/dbus-1/system.d/org.freedesktop.RealtimeKit1.conf
|
||||
|
||||
%files help
|
||||
%{_mandir}/man8/rtkitctl.8.gz
|
||||
|
||||
%changelog
|
||||
* Thu Oct 19 2023 li weigang - <weigangli99@gmail.com> - 0.13-1
|
||||
- Type: update
|
||||
- ID: NA
|
||||
- SUG: NA
|
||||
- DESC: update to version 0.13
|
||||
|
||||
* Fri Sep 11 2020 chengguipeng<chengguipeng1@huawei.com> - 0.11-27
|
||||
- Type:bugfix
|
||||
- ID:NA
|
||||
- SUG:NA
|
||||
- DESC:modify source0 url
|
||||
|
||||
* Wed Jan 8 2020 openEuler Buildteam <buildteam@openeuler.org> - 0.11-26
|
||||
- Type:bugfix
|
||||
- ID:NA
|
||||
- SUG:NA
|
||||
- DESC:optimization the spec
|
||||
|
||||
* Tue Dec 31 2019 openEuler Buildteam <buildteam@openeuler.org> - 0.11-25
|
||||
- Type:bugfix
|
||||
- ID:NA
|
||||
|
||||
4
rtkit.yaml
Normal file
4
rtkit.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
version_control: github
|
||||
src_repo: heftig/rtkit
|
||||
tag_prefix: "^v"
|
||||
seperator: "."
|
||||
BIN
v0.13.tar.gz
Normal file
BIN
v0.13.tar.gz
Normal file
Binary file not shown.
Loading…
x
Reference in New Issue
Block a user