pool/gpg2
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accepting request 175573 from home:vitezslav_cizek:branches:Base:System

Browse Source 
- set safe umask before creating a plaintext file (bnc#780943)
  added gpg2-set_umask_before_open_outfile.patch
- select proper ciphers when running in FIPS mode (bnc#808958)
  added gnupg-detect_FIPS_mode.patch

OBS-URL: https://build.opensuse.org/request/show/175573
OBS-URL: https://build.opensuse.org/package/show/Base:System/gpg2?expand=0&rev=56
This commit is contained in:
Dr. Werner Fink 2013-05-16 10:06:39 +00:00 committed by Git OBS Bridge
parent 63ecb964f5
commit d7e7e54938
4 changed files with 106 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
gnupg-detect_FIPS_mode.patch Normal file
View File

@ -0,0 +1,51 @@
Index: gnupg-2.0.19/g10/encode.c
===================================================================
--- gnupg-2.0.19.orig/g10/encode.c 2013-03-14 14:23:58.009483967 +0100
+++ gnupg-2.0.19/g10/encode.c 2013-03-14 15:49:50.524306304 +0100
@@ -732,7 +732,10 @@ encrypt_filter( void *opaque, int contro
if( efx->cfx.dek->algo == -1 ) {
/* because 3DES is implicitly in the prefs, this can only
* happen if we do not have any public keys in the list */
- efx->cfx.dek->algo = DEFAULT_CIPHER_ALGO;
+ /* Libgcrypt manual says that gcry_version_check must be called
+ before calling gcry_fips_mode_active. */
+ gcry_check_version (NULL);
+ efx->cfx.dek->algo = gcry_fips_mode_active() ? CIPHER_ALGO_AES : DEFAULT_CIPHER_ALGO;
}
/* In case 3DES has been selected, print a warning if
Index: gnupg-2.0.19/g10/gpg.c
===================================================================
--- gnupg-2.0.19.orig/g10/gpg.c 2013-03-14 14:24:00.031545611 +0100
+++ gnupg-2.0.19/g10/gpg.c 2013-03-14 14:24:37.495687612 +0100
@@ -1975,7 +1975,7 @@ main (int argc, char **argv)
opt.compress_algo = -1; /* defaults to DEFAULT_COMPRESS_ALGO */
opt.s2k_mode = 3; /* iterated+salted */
opt.s2k_count = 0; /* Auto-calibrate when needed. */
- opt.s2k_cipher_algo = CIPHER_ALGO_CAST5;
+ opt.s2k_cipher_algo = gcry_fips_mode_active() ? CIPHER_ALGO_AES : CIPHER_ALGO_CAST5;
opt.completes_needed = 1;
opt.marginals_needed = 3;
opt.max_cert_depth = 5;
Index: gnupg-2.0.19/g10/mainproc.c
===================================================================
--- gnupg-2.0.19.orig/g10/mainproc.c 2013-03-14 14:23:58.011484028 +0100
+++ gnupg-2.0.19/g10/mainproc.c 2013-03-14 15:50:50.970127383 +0100
@@ -685,9 +685,15 @@ proc_plaintext( CTX c, PACKET *pkt )
often. There is no good way to specify what algorithms to
use in that case, so these three are the historical
answer. */
- gcry_md_enable( c->mfx.md, DIGEST_ALGO_RMD160 );
+
+ /* Libgcrypt manual says that gcry_version_check must be called
+ before calling gcry_fips_mode_active. */
+ gcry_check_version (NULL);
+ if( !gcry_fips_mode_active() )
+ gcry_md_enable( c->mfx.md, DIGEST_ALGO_RMD160 );
gcry_md_enable( c->mfx.md, DIGEST_ALGO_SHA1 );
- gcry_md_enable( c->mfx.md, DIGEST_ALGO_MD5 );
+ if( !gcry_fips_mode_active() )
+ gcry_md_enable( c->mfx.md, DIGEST_ALGO_MD5 );
}
if( opt.pgp2_workarounds && only_md5 && !opt.skip_verify ) {
/* This is a kludge to work around a bug in pgp2. It does only

42
gnupg-set_umask_before_open_outfile.patch Normal file
View File

@ -0,0 +1,42 @@
Index: gnupg-2.0.20/g10/plaintext.c
===================================================================
--- gnupg-2.0.20.orig/g10/plaintext.c 2013-05-13 14:26:49.290737159 +0200
+++ gnupg-2.0.20/g10/plaintext.c 2013-05-13 14:43:21.740575875 +0200
@@ -25,6 +25,7 @@
#include <errno.h>
#include <assert.h>
#include <sys/types.h>
+#include <sys/stat.h>
#ifdef HAVE_DOSISH_SYSTEM
#include <fcntl.h> /* for setmode() */
#endif
@@ -39,6 +40,9 @@
#include "status.h"
#include "i18n.h"
+/* define safe permissions for creating plaintext files */
+#define GPG_SAFE_PERMS (S_IRUSR | S_IWUSR)
+#define GPG_SAFE_UMASK (0777 & ~GPG_SAFE_PERMS)
/****************
* Handle a plaintext packet. If MFX is not NULL, update the MDs
@@ -140,10 +144,15 @@ handle_plaintext( PKT_plaintext *pt, md_
log_error(_("error creating `%s': %s\n"), fname, strerror(errno) );
goto leave;
}
- else if( !(fp = fopen(fname,"wb")) ) {
- rc = gpg_error_from_syserror ();
- log_error(_("error creating `%s': %s\n"), fname, strerror(errno) );
- goto leave;
+ else {
+ mode_t saved_umask = umask(GPG_SAFE_UMASK);
+ if( !(fp = fopen(fname,"wb")) ) {
+ rc = gpg_error_from_syserror ();
+ log_error(_("error creating `%s': %s\n"), fname, strerror(errno) );
+ umask(saved_umask);
+ goto leave;
+ }
+ umask(saved_umask);
}
#else /* __riscos__ */
/* If no output filename was given, i.e. we constructed it,

8
gpg2.changes
View File

@ -1,3 +1,11 @@
-------------------------------------------------------------------
Tue May 14 14:00:45 UTC 2013 - vcizek@suse.com
- set safe umask before creating a plaintext file (bnc#780943)
added gpg2-set_umask_before_open_outfile.patch
- select proper ciphers when running in FIPS mode (bnc#808958)
added gnupg-detect_FIPS_mode.patch
-------------------------------------------------------------------
Fri May 10 19:33:24 UTC 2013 - andreas.stieger@gmx.de

5
gpg2.spec
View File

@ -64,6 +64,9 @@ Patch4: gnupg-2.0.9-langinfo.patch
Patch5: gnupg-2.0.18-files-are-digests.patch
Patch6: gnupg-dont-fail-with-seahorse-agent.patch
Patch7: gnupg-broken-curl-test.patch
Patch8: gnupg-set_umask_before_open_outfile.patch
Patch9: gnupg-detect_FIPS_mode.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-build
%description
@ -81,6 +84,8 @@ gpg-agent, and a keybox library.
%patch5 -p1
%patch6 -p1
%patch7 -p1
%patch8 -p1
%patch9 -p1
%build
autoreconf -fi