From d7e7e5493818781c460b0b9b37a1edb763b8aa576730152b071a372bea707f0b Mon Sep 17 00:00:00 2001 From: "Dr. Werner Fink" Date: Thu, 16 May 2013 10:06:39 +0000 Subject: [PATCH] Accepting request 175573 from home:vitezslav_cizek:branches:Base:System - set safe umask before creating a plaintext file (bnc#780943) added gpg2-set_umask_before_open_outfile.patch - select proper ciphers when running in FIPS mode (bnc#808958) added gnupg-detect_FIPS_mode.patch OBS-URL: https://build.opensuse.org/request/show/175573 OBS-URL: https://build.opensuse.org/package/show/Base:System/gpg2?expand=0&rev=56 --- gnupg-detect_FIPS_mode.patch | 51 +++++++++++++++++++++++ gnupg-set_umask_before_open_outfile.patch | 42 +++++++++++++++++++ gpg2.changes | 8 ++++ gpg2.spec | 5 +++ 4 files changed, 106 insertions(+) create mode 100644 gnupg-detect_FIPS_mode.patch create mode 100644 gnupg-set_umask_before_open_outfile.patch diff --git a/gnupg-detect_FIPS_mode.patch b/gnupg-detect_FIPS_mode.patch new file mode 100644 index 0000000..3e96ea4 --- /dev/null +++ b/gnupg-detect_FIPS_mode.patch @@ -0,0 +1,51 @@ +Index: gnupg-2.0.19/g10/encode.c +=================================================================== +--- gnupg-2.0.19.orig/g10/encode.c 2013-03-14 14:23:58.009483967 +0100 ++++ gnupg-2.0.19/g10/encode.c 2013-03-14 15:49:50.524306304 +0100 +@@ -732,7 +732,10 @@ encrypt_filter( void *opaque, int contro + if( efx->cfx.dek->algo == -1 ) { + /* because 3DES is implicitly in the prefs, this can only + * happen if we do not have any public keys in the list */ +- efx->cfx.dek->algo = DEFAULT_CIPHER_ALGO; ++ /* Libgcrypt manual says that gcry_version_check must be called ++ before calling gcry_fips_mode_active. */ ++ gcry_check_version (NULL); ++ efx->cfx.dek->algo = gcry_fips_mode_active() ? CIPHER_ALGO_AES : DEFAULT_CIPHER_ALGO; + } + + /* In case 3DES has been selected, print a warning if +Index: gnupg-2.0.19/g10/gpg.c +=================================================================== +--- gnupg-2.0.19.orig/g10/gpg.c 2013-03-14 14:24:00.031545611 +0100 ++++ gnupg-2.0.19/g10/gpg.c 2013-03-14 14:24:37.495687612 +0100 +@@ -1975,7 +1975,7 @@ main (int argc, char **argv) + opt.compress_algo = -1; /* defaults to DEFAULT_COMPRESS_ALGO */ + opt.s2k_mode = 3; /* iterated+salted */ + opt.s2k_count = 0; /* Auto-calibrate when needed. */ +- opt.s2k_cipher_algo = CIPHER_ALGO_CAST5; ++ opt.s2k_cipher_algo = gcry_fips_mode_active() ? CIPHER_ALGO_AES : CIPHER_ALGO_CAST5; + opt.completes_needed = 1; + opt.marginals_needed = 3; + opt.max_cert_depth = 5; +Index: gnupg-2.0.19/g10/mainproc.c +=================================================================== +--- gnupg-2.0.19.orig/g10/mainproc.c 2013-03-14 14:23:58.011484028 +0100 ++++ gnupg-2.0.19/g10/mainproc.c 2013-03-14 15:50:50.970127383 +0100 +@@ -685,9 +685,15 @@ proc_plaintext( CTX c, PACKET *pkt ) + often. There is no good way to specify what algorithms to + use in that case, so these three are the historical + answer. */ +- gcry_md_enable( c->mfx.md, DIGEST_ALGO_RMD160 ); ++ ++ /* Libgcrypt manual says that gcry_version_check must be called ++ before calling gcry_fips_mode_active. */ ++ gcry_check_version (NULL); ++ if( !gcry_fips_mode_active() ) ++ gcry_md_enable( c->mfx.md, DIGEST_ALGO_RMD160 ); + gcry_md_enable( c->mfx.md, DIGEST_ALGO_SHA1 ); +- gcry_md_enable( c->mfx.md, DIGEST_ALGO_MD5 ); ++ if( !gcry_fips_mode_active() ) ++ gcry_md_enable( c->mfx.md, DIGEST_ALGO_MD5 ); + } + if( opt.pgp2_workarounds && only_md5 && !opt.skip_verify ) { + /* This is a kludge to work around a bug in pgp2. It does only diff --git a/gnupg-set_umask_before_open_outfile.patch b/gnupg-set_umask_before_open_outfile.patch new file mode 100644 index 0000000..f941a41 --- /dev/null +++ b/gnupg-set_umask_before_open_outfile.patch @@ -0,0 +1,42 @@ +Index: gnupg-2.0.20/g10/plaintext.c +=================================================================== +--- gnupg-2.0.20.orig/g10/plaintext.c 2013-05-13 14:26:49.290737159 +0200 ++++ gnupg-2.0.20/g10/plaintext.c 2013-05-13 14:43:21.740575875 +0200 +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + #ifdef HAVE_DOSISH_SYSTEM + #include /* for setmode() */ + #endif +@@ -39,6 +40,9 @@ + #include "status.h" + #include "i18n.h" + ++/* define safe permissions for creating plaintext files */ ++#define GPG_SAFE_PERMS (S_IRUSR | S_IWUSR) ++#define GPG_SAFE_UMASK (0777 & ~GPG_SAFE_PERMS) + + /**************** + * Handle a plaintext packet. If MFX is not NULL, update the MDs +@@ -140,10 +144,15 @@ handle_plaintext( PKT_plaintext *pt, md_ + log_error(_("error creating `%s': %s\n"), fname, strerror(errno) ); + goto leave; + } +- else if( !(fp = fopen(fname,"wb")) ) { +- rc = gpg_error_from_syserror (); +- log_error(_("error creating `%s': %s\n"), fname, strerror(errno) ); +- goto leave; ++ else { ++ mode_t saved_umask = umask(GPG_SAFE_UMASK); ++ if( !(fp = fopen(fname,"wb")) ) { ++ rc = gpg_error_from_syserror (); ++ log_error(_("error creating `%s': %s\n"), fname, strerror(errno) ); ++ umask(saved_umask); ++ goto leave; ++ } ++ umask(saved_umask); + } + #else /* __riscos__ */ + /* If no output filename was given, i.e. we constructed it, diff --git a/gpg2.changes b/gpg2.changes index f251875..3e28590 100644 --- a/gpg2.changes +++ b/gpg2.changes @@ -1,3 +1,11 @@ +------------------------------------------------------------------- +Tue May 14 14:00:45 UTC 2013 - vcizek@suse.com + +- set safe umask before creating a plaintext file (bnc#780943) + added gpg2-set_umask_before_open_outfile.patch +- select proper ciphers when running in FIPS mode (bnc#808958) + added gnupg-detect_FIPS_mode.patch + ------------------------------------------------------------------- Fri May 10 19:33:24 UTC 2013 - andreas.stieger@gmx.de diff --git a/gpg2.spec b/gpg2.spec index c235b7b..7c93ae7 100644 --- a/gpg2.spec +++ b/gpg2.spec @@ -64,6 +64,9 @@ Patch4: gnupg-2.0.9-langinfo.patch Patch5: gnupg-2.0.18-files-are-digests.patch Patch6: gnupg-dont-fail-with-seahorse-agent.patch Patch7: gnupg-broken-curl-test.patch +Patch8: gnupg-set_umask_before_open_outfile.patch +Patch9: gnupg-detect_FIPS_mode.patch + BuildRoot: %{_tmppath}/%{name}-%{version}-build %description @@ -81,6 +84,8 @@ gpg-agent, and a keybox library. %patch5 -p1 %patch6 -p1 %patch7 -p1 +%patch8 -p1 +%patch9 -p1 %build autoreconf -fi