- Add 0001-util-never-follow-symlinks-in-rm_rf_children.patch: fix

CVE-2012-1174 (bnc#752281).

OBS-URL: https://build.opensuse.org/package/show/Base:System/systemd?expand=0&rev=260

0001-util-never-follow-symlinks-in-rm_rf_children.patch

@@ -0,0 +1,32 @@
+From 5ebff5337594d690b322078c512eb222d34aaa82 Mon Sep 17 00:00:00 2001
+From: Michal Schmidt <mschmidt@redhat.com>
+Date: Fri, 2 Mar 2012 10:39:10 +0100
+Subject: [PATCH] util: never follow symlinks in rm_rf_children()
+
+The function checks if the entry is a directory before recursing, but
+there is a window between the check and the open, during which the
+directory could be replaced with a symlink.
+
+CVE-2012-1174
+https://bugzilla.redhat.com/show_bug.cgi?id=803358
+---
+ src/util.c |    3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/src/util.c b/src/util.c
+index 20cbc2b..dfc1dc6 100644
+--- a/src/util.c
++++ b/src/util.c
+@@ -3593,7 +3593,8 @@ static int rm_rf_children(int fd, bool only_dirs, bool honour_sticky) {
+                 if (is_dir) {
+                         int subdir_fd;
+ 
+-                        if ((subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC)) < 0) {
++                        subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW);
++                        if (subdir_fd < 0) {
+                                 if (ret == 0 && errno != ENOENT)
+                                         ret = -errno;
+                                 continue;
+-- 
+1.7.7
+

systemd-gtk.changes

@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Mon Mar 19 10:11:23 UTC 2012 - fcrozat@suse.com
+
+- Add 0001-util-never-follow-symlinks-in-rm_rf_children.patch: fix
+  CVE-2012-1174 (bnc#752281).
+
 -------------------------------------------------------------------
 Fri Mar 16 09:21:54 UTC 2012 - fcrozat@suse.com
 

systemd.changes

@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Mon Mar 19 10:11:23 UTC 2012 - fcrozat@suse.com
+
+- Add 0001-util-never-follow-symlinks-in-rm_rf_children.patch: fix
+  CVE-2012-1174 (bnc#752281).
+
 -------------------------------------------------------------------
 Fri Mar 16 09:21:54 UTC 2012 - fcrozat@suse.com
 

systemd.spec

@@ -86,6 +86,7 @@ Patch39:        correct_plymouth_paths_and_conflicts.patch
 # Never add any patches to this package without the upstream commit id
 # in the patch. Any patches added here without a very good reason to make
 # an exception will be silently removed with the next version update.
+Patch40:        0001-util-never-follow-symlinks-in-rm_rf_children.patch
 
 %description
 Systemd is a system and service manager, compatible with SysV and LSB
@@ -144,6 +145,7 @@ Plymouth integration for systemd
 %patch36 -p1
 %patch38 -p1
 %patch39 -p1
+%patch40 -p1
 
 %build
 autoreconf -fiv