From 02d4177d4d7d0dd4c62177be210f721e7785bf89522d3eed942279fc7b312a55 Mon Sep 17 00:00:00 2001 From: Dominique Leuenberger Date: Thu, 8 Jul 2021 14:26:50 +0000 Subject: [PATCH 1/2] Accepting request 904548 from home:schubi2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Move /etc/polkit-1/rules.d/50-default.rules to /usr/share/polkit-1/rules.d/50-default.rules. The first location is only for admin changes. - Fix verifyscript: the path to the binary was wrongly defined as %{_libexecdir}/lib. - CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync() (bsc#1186497) CVE-2021-3560.patch - Move /etc/dbus-1/system.d to /usr/share/dbus-1/system.d, the first location is only for admin changes - Move pam configuration to /usr/etc/pam.d move to libexec dir is still not complete: - add polkit-adjust-libexec-path.patch: There is another hard coded reference of lib/ in the code that this patch addresses. - also adjust invocation of %set_permissions and %verify_permissions to new libexec dir location. - also set libprivdir during build, otherwhise systemd and D-Bus service files contain the wrong path and we'll get runtime errors. - Install private binaries into libexec instead of into lib. For this an override of the custom libprivdir variable is necessary, because upstream explicitly moved away from libexecdir via upstram commit 6fbcc6cd839680fcefd81c4a43676e7c031c9859. - Update to version 0.118: + Updated dependency to mozjs78. + Tarball fixes. - Replace pkgconfig(mozjs-68) for pkgconfig(mozjs-78) BuildRequires following upstreams port. - Update to version 0.117: + Activated Gitlab CI. + Updated dependency to mozjs68. + Memory management fixes. + Updated translations. - Replace pkgconfig(mozjs-60) for pkgconfig(mozjs-68) BuildRequires following upstreams port. - Fix usage of libexecdir instead of prefix/lib where applicable. - polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053) - Update to version 0.116: + Leaking zombie child processes. + Possible resource leak found by static analyzer. + Output messages tuneup. + Sanity fixes. + pkttyagent tty echo disabled on SIGINT. + HACKING: add link to Code of Conduct. + polkitbackend: comment typos fix. + configure.ac: fix detection of systemd with cgroups v2. + CVE-2018-19788 High UIDs overflow fix. + CVE-2019-6133 Slowfork vulnerability fix. + Allow unset process-uid. + Port the JS authority to mozjs-60. + Use JS_EncodeStringToUTF8. + Updated translations. - Replace pkgconfig(mozjs-52) with pkgconfig(mozjs-60) BuildRequires following upstreams changes. - Drop patches fixed upstream: + polkit-fix-possible-resource-leak.patch + polkit-fix-leaking-zombie-child-processes.patch + polkit-CVE-2018-19788.patch - Refresh patches with quilt. - Use systemd_ordering instead of systemd_requires: strictly speaking, polkit does not require systemd to be present. Just that when we install on a system with systemd (e.g outside containers) we would want systemd to be present before installing polkit. Help also reduce a cycle without special hacks in systemd.spec. - bsc#1130588: Require shadow instead of old pwdutils - User proper Requires(pre)/Requires(post) for permissions and shadow - polkit-CVE-2018-19788.patch: Fixed handling of UIDs over MAX_UINT (bsc#1118277 CVE-2018-19788) - Add polkit-fix-possible-resource-leak.patch: Fix possible resource leak found by static analyzer. - Add polkit-fix-leaking-zombie-child-processes.patch: polkitd: fix zombie not reaped when js spawned process timed out (fdo#106021). - Update to version 0.115: - Fix CVE-2018-1116: Trusting client-supplied UID (bsc#1099031) - jsauthority: pass "%s" format string to remaining report function (obsoletes polkit-jsauthority-pass-format-string.patch) - Update to version 0.114: + Port to mozjs 52, the latest version of the firefox JavaScript engine. + Add gettext support for policy files. + Fixes for various memory leaks. + Updated translations. - Update keyring with Ray Strode public key. - Drop with_systemd define and all conditionals and polkit-no-systemd.patch and ConsoleKit BuildRequires, we only support systemd now. - Drop upstream fixed polkit-itstools.patch. - Rebase pkexec.patch with quilt. - Add gcc-c++ and pkgconfig(mozjs-52) BuildRequires: New dependencies. - Drop conditional pkgconfig(mozjs-17.0) and pkgconfig(mozjs185): no longer supported. - Drop autoconf and automake BuildRequires: They are implicit via libtool BuildRequires. - Replace glib2-devel and gobject-introspection-devel with their pkgconfig counterparts: pkgconfig(gio-unix-2.0), pkgconfig(gmodule-2.0) and pkgconfig(gobject-introspection-1.0). - Add polkit-jsauthority-pass-format-string.patch: jsauthority: pass "%s" format string to remaining report function, patch from upstream git, adding missed commit (bgo#105865). - Drop polkit-revert-session-magic.patch: Upstream systemd bug is since a long time fixed (gh#systemd#58) (boo#954139). - pkexec.patch: pkexec: allow --version and --help even if not setuid - Modernize spec-file by calling spec-cleaner - Add polkit-itstools.patch: Add gettext support for .policy files. - Use gettext as fallback to get potential distro translations for polkit actions. Similar mechnism as used for desktop file translations. That way it's possible to use weblate to add additional translations that are not provided by upstream (polkit-gettext.patch). - Use pkgconfig() instead of requiring systemd package names directly. - systemd.pc is shipped by systemd main package (bsc#983167) Strangely polkit wants systemd.pc to detect that the target system is running systemd even if its configured to build systemd support... - polkit-revert-session-magic.patch: revert a session detection change that could lead to sessions not being detected as active due to a systemd bug. bsc#954139 - Update to 0.113: * Fix CVE-2015-4625 * Fix CVE-2015-3256 * Fix CVE-2015-3255 * Fix CVE-2015-3218 * On systemd-213 and later, the “active” state is shared across all sessions of an user, instead of being tracked separately * pkexec: when not given a program to execute, runs the users’ shell by default - Remove polkit-no-kded-leak.patch (upstreamed) - Try to fix kded leaking due to powerdevil exposing this issue in polkit: (bsc#912889) * polkit-no-kded-leak.patch - Added gpg signature and keyring with David Zeuthen and Miloslav Trmac ids. - Fixed URL - Update to 0.112 + polkitunixprocess: Deprecate racy APIs + pkcheck: Support --process=pid,start-time,uid syntax too (CVE-2013-4288) + Use GOnce for interface type registration + Add czech translation po file to distribution + Update the czech once more with newest pot file - On openSUSE 13.1+, switch from mozjs185 to mozjs-17.0 by: + Conditionally BuildRequire pkgconfig(mozjs-17.0). - Drop libmozjs185-1_0 Recommends: the library is actually required and auto-detected as such by rpm (from 0.111 changes: "The JavaScript interpreter is now mandatory"). - Update to 0.111 + Both js185 and mozjs17 versions of SpiderMonkey are supported + The JavaScript interpreter is now mandatory + Fixed various memory leaks + Respect SUID_CFLAGS and SUID_LDFLAGS + Set process environment from pam_getenvlist() + Fix the build with automake 1.13 - Drop polkit-suid_flags.patch and automake-113.patch, those patches are included in this release - Add automake-113.patch, fixes build with automake-1.13 - Recommend libmozjs185-1_0 which is dlopen'ed and required for JS rules - Update to 0.110 + Set XAUTHORITY environment variable if is unset + Use mutex and condition variables properly + Build fixes. - Changes from version 0.109: + Include gmodule-2.0 to avoid linker errors + Don't require libmozjs185 devel packages for polkit rules to work - Drop polkit-link-gmodule.patch and polkit-libmozjs.patch, those are merged upstream - Only mark the following files as %config, not %config(noreplace): + %{_sysconfdir}/dbus-1/system.d/org.freedesktop.PolicyKit1.conf + %{_sysconfdir}/pam.d/polkit-1 + %{_sysconfdir}/polkit-1/rules.d/50-default.rules PolicyKit's own config files should only be changed for good reason and we want to prefer openSUSE's defaults (you still get an .rpmsafe file) - Add polkit-libmozjs.patch: dlopen libmozjs185.so.1.0 instead of libmozjs185.so, which is packaged in the -devel package (bnc#793562) - Update to version 0.108: + PolkitAgent: Avoid crashing if initializing the server object fails + Fall back to authenticating as uid 0 if the list of admin identities is empty + Dynamically load libmozjs185.so and cope with it not being available + docs: mention the audience for authorization rules + build: Fix .gir generation for parallel make - Only conditionally Require ConsoleKit when with_systemd is 0: systemd support obsoletes ConsoleKit. - Add polkit-link-gmodule.patch: Link against gmodule-2.0. - Change libpolkit0 to require polkit >= %version instead of the exact version. This will ease upgrade problems should there ever be a soname bump of libpolkit0. - Enable systemd inetegration (change with_systemd to 1): As an agreed target for 12.3, systemd integration will be enabled. - Add pwdutils to prereq for groupadd and useradd. - Add polkit-no-systemd.patch: this patch, only applied when not building systemd support, removes the systemd service reference from the dbus .service file. This is needed as the systemd .service file does not get installed in that case and dbus gets confused because it expects it. - Make %{_datadir}/polkit-1/rules.d and %{_sysconfdir}/polkit-1/rules.d owned by user polkitd, as those directories have 0700 as permissions. - Those two changes should fix polkit so it can start. Fix bnc#782395. - Use %{_localstatedir}/lib/polkit for $HOME of polkit user, instead of %{_libexecdir}/polkit-1. The directory is manually created in %install. - Update to version 0.107: + Try harder to look up the right localization + Introduce a polkit.Result enumeration for authorization rules + pkexec: add support for argv1 annotation and mention shebang-wrappers + doc: update guidance on situations where there is no polkit authority - Changes from version 0.106: + Major change: switch from .pkla files (keyfile-format) to .rules files (JavaScript) + Nuke polkitbackend library, localauthority backend and extension system + Run polkitd as an unprivileged user + Add a systemd .service file + Several other code changes. + Updated documentation. - Changes from version 0.105: + Add pkttyagent(1) helper + Make it possible to influence agent registration with an a{sv} parameter + Several other code changes. - Add pkgconfig(mozjs185) BuildRequires: new dependency for the authority backend. - Rebase polkit-no-wheel-group.patch: the admin configuration is now in a .rules file. - Rebase polkit-suid_flags.patch. - Explicitly pass --enable-libsystemd-login or --disable-libsystemd-login, depending on whether we build systemd support. - Add a %pre script to create the polkitd group and user, as polkitd now run as an unprivileged user. - also use -z now for binary hardening - Package /etc/polkit-1/localauthority and its subdirectories. They were forgotten because they were empty, but people might need them to put .pkla files. - Change the way we pass -fpie/-pie: + Drop polkit-pie.patch: this was not upstreamable. + Add polkit-suid_flags.patch: respect SUID_CFLAGS/SUID_LDFLAGS when building the suid binaries (pkexec and polkit-agent-helper-1). + Add autoconf, automake and libtool BuildRequires, and call autoreconf, for the new patch. + Set SUID_CFLAGS to -fPIE and SUID_LDFLAGS to -pie in %build. + Pass --with-pic to configure instead of changing CFLAGS to contain -fPIC. - fixed bnc#743145 - added -fpie/-pie flags to compilation and linking of polkit-agent-helper and pkexec - Split typelib file into typelib-1_0-Polkit-1_0 subpackage. - Add typelib-1_0-Polkit-1_0 Requires to devel subpackage. - Add explicit libpolkit0 Requires to devel subpackage: it was missing before. - Remove explicit glib2-devel Requires from devel subpackage: it will automatically be added the pkgconfig() way. - Improve summary of libpolkit0 subpackage. - A quick test reveals that the systemd backend does not integrate very well with packages yet, revert. - Previous update missed systemd-devel in buildrequires without it no systemd support is built - Update to version 0.104: + Add optional systemd support + Add netgroup support (fdo#43610) + Add unit tests (fdo#43608) - Changes from version 0.103: + Mistype in DBus object: PoliycKit1 -> PolicyKit1 + Add support for the org.freedesktop.policykit.imply annotation + Add --no-debug option and use this for D-Bus activation + Add org.freedesktop.policykit.owner annotation (fdo#41025) + Default to AdminIdentities=unix-group:wheel for local authority - Drop patches that were taken from upstream: + 0001-Add-support-for-the-org.freedesktop.policykit.imply-a.diff + 0002-Add-no-debug-option-and-use-this-for-D-Bus-activation.diff + 0003-Bug-41025-Add-org.freedesktop.policykit.owner-annotat.diff - Add polkit-no-wheel-group.patch: do not allow the wheel group as admin identity, and revert to only accept the root user for this. - pick some patches from git to add support for org.freedesktop.policykit.imply, disable debug spam and allow unprivileged users to query authorizations (bnc#698250) - Update to version 0.102: + pkexec: - fdo#38769: Support running X11 apps - Avoid time-of-check-to-time-of-use problems with parent process + Fix backend crash if a .policy file does not specify + Fix multi-line pam prompt handling + Don't show diagnostic messages intended for the administrator to the end user + PolkitUnixProcess: - Clarify that the real uid is returned, not the effective one - Record the uid of the process + Backend: Use polkit_unix_process_get_uid() to get the owner of a process + Introspection fixes: - Add --c-include to the gir files - Specify exported pkg-config files in GIRs + Build fix. - Drop polkit-CVE-2011-1485-1.patch, polkit-CVE-2011-1485-2.patch, polkit-CVE-2011-1485-3.patch, polkit-CVE-2011-1485-4.patch: fixed upstream. - Remove service usage, following the new consensus on Factory packaging. - BuildIgnore ruby, which is being dragged in via indirect dependencies by gtk-doc for one of the helpers, which we do not need during the build of polkit. Not dragging ruby in resolves a build-cycle. - Use %set_permissions instead of deprecated %run_permissions in %post. - Add permissions PreReq, which was missing before. - use LGPLv2.1+ in spec file - stat race condition (CVE-2011-1485) (bnc#688788) - Remove PolkitAgent-1.0.typelib from main package, it is in library package. - update to 0.101: * tons of bug fixes, see NEWS - fix file list - Update to version 0.99: + Remove duplicate definitions of enumeration types + Fix (correct) GCC warning about possibly-uninitialized variable + Fix another GCC uninitialized variable warning + fdo#29816: Install polkitagentenumtypes.h - Drop polkit-install-missing-header.patch: fixed upstream. - Update to version 0.98: + Fix scanning of unix-process subjects + Add textual authentication agent and use it in pkexec(1) + Fix ConsoleKit interaction bug + pkexec: add --disable-internal-agent option + pkcheck: add --enable-internal-agent option + Fix wording in pkexec(1) man page + Various doc cleanups - Changes from version 0.97: + Port to GDBus + Add shadow authentication support + Remove Lock Down functionality + fdo#26982: pkexec information disclosure vulnerability + Make polkitd accept --replace and gracefully handle SIGINT + Implement polkit_temporary_authorization_new_for_gvariant() + Make NameOwnerChanged a private impl detail of the interactive authority + Add a GPermission implementation + PolkitAuthority: Implement failable initialization + PolkitAuthority: Add g_return_if_fail() checks + Add g_return_if_fail() to all public API entry points + Use polkit_authority_get_sync() instead of deprecated polkit_authority_get + PolkitBackend: Don't export unneeded convenience API + Update GI annotations + Don't dist org.freedesktop.ConsoleKit.xml. + Properly reference headers + fdo#29051: Configuration reload on every query - Drop pkexec-information-disclosure.patch: fixed upstream. - Add polkit-install-missing-header.patch to install a header that should get installed. - Remove eggdbus-devel BuildRequires. - Build with introspection support: add gobject-introspection BuildRequires and pass --enable-introspection to configure. - Fix groups of all packages to be valid groups. - use %_smp_mflags - fix pkexec information disclosure (fdo#26982, CVE-2010-0750, bnc#593959) - add baselibs.conf - new upstream release 0.96 - Bug 25367 — Also read local authority configuration data from /etc - Run the open_session part of the PAM stack in pkexec(1) - Bug 25594 – System logging - Properly handle return value from getpwnam_r() - Fix error message when no authentication agent is available - Make pkexec(1) validate environment variables - Make pkexec(1) use the syslogging facilities - Save original cwd in pkexec(1) since it will change during the life-time - Complain on stderr, not stdout - Don't log authorization checks - update to 0.95: The major change this release is that the lockdown feature has been cleaned up in a way so it isn't specific to the local authority. See the NEWS files for more details. - Package documentation as noarch - Add Requires on polkit to libpolkit0: all applications using libpolkit0 will really need polkit to be installed to work properly. - new upstream release 0.94 - Allow unprivileged callers to check authorizations - Don't spawn man(1) from a setuid program - Add polkit.retains_authorization_after_challenge to authz result - Ensure all fds except stdin/stdout/stderr are closed after exec(2) - Be more careful when determining process start time - Remove temporary authorization when the subject it applies to vanishes - Generate GI gir and typelibs for libpolkit-gobject-1 - drop patches which are in the release now - disable introspection - add upstream patches: polkit-close-stdfds.patch polkit-no-man-spawn.patch polkit-proc-stat-parse-fix.patch - drop rpmlint patch - check for the right binary in verify_permisisons - disable suid bit for now to get software build on top - split out libraries to follow shared library policy - update to version 0.93 - initial import of polkit 0.92 OBS-URL: https://build.opensuse.org/request/show/904548 OBS-URL: https://build.opensuse.org/package/show/Base:System/polkit?expand=0&rev=158 --- polkit.changes | 7 +++++++ polkit.spec | 3 ++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/polkit.changes b/polkit.changes index 378f04a..1afe3be 100644 --- a/polkit.changes +++ b/polkit.changes @@ -1,3 +1,10 @@ +------------------------------------------------------------------- +Wed Jul 7 08:15:04 UTC 2021 - Stefan Schubert diff --git a/polkit.spec b/polkit.spec index fc636a6..f3ff61f 100644 --- a/polkit.spec +++ b/polkit.spec @@ -151,6 +151,7 @@ mkdir -p %{buildroot}%{_datadir}/dbus-1/system.d mv %{buildroot}%{_sysconfdir}/dbus-1/system.d/* %{buildroot}%{_datadir}/dbus-1/system.d/ mkdir -p %{buildroot}%{_distconfdir}/pam.d mv %{buildroot}%{_sysconfdir}/pam.d/* %{buildroot}%{_distconfdir}/pam.d/ +mv %{buildroot}%{_sysconfdir}/polkit-1/rules.d/50-default.rules %{buildroot}%{_datadir}/polkit-1/rules.d/50-default.rules %pre getent group polkitd > /dev/null || groupadd -r polkitd @@ -202,10 +203,10 @@ exit 0 %dir %{_datadir}/polkit-1/actions %{_datadir}/polkit-1/actions/org.freedesktop.policykit.policy %attr(0700,polkitd,root) %dir %{_datadir}/polkit-1/rules.d +%{_datadir}/polkit-1/rules.d/50-default.rules %{_distconfdir}/pam.d/polkit-1 %dir %{_sysconfdir}/polkit-1 %attr(0700,polkitd,root) %dir %{_sysconfdir}/polkit-1/rules.d -%config %{_sysconfdir}/polkit-1/rules.d/50-default.rules %{_bindir}/pkaction %{_bindir}/pkcheck %verify(not mode) %attr(4755,root,root) %{_bindir}/pkexec From 6cbbca05c76b67cc618fc23482c9de3a79e32c660bd5b3ec52f09a9482e113b0 Mon Sep 17 00:00:00 2001 From: Marcus Meissner Date: Mon, 19 Jul 2021 06:47:41 +0000 Subject: [PATCH 2/2] Accepting request 906939 from home:gmbr3:Active - Change to using systemd-sysusers - Remove unneeded shadow dependency, no longer required due to systemd-sysusers - Fix 50-default.rules file-parent-ownership-mismatch warning - Remove --with-pic, no effect with --disable-static OBS-URL: https://build.opensuse.org/request/show/906939 OBS-URL: https://build.opensuse.org/package/show/Base:System/polkit?expand=0&rev=159 --- polkit.changes | 9 +++++++++ polkit.spec | 16 +++++++++------- system-user-polkitd.conf | 2 ++ 3 files changed, 20 insertions(+), 7 deletions(-) create mode 100644 system-user-polkitd.conf diff --git a/polkit.changes b/polkit.changes index 1afe3be..9e79af6 100644 --- a/polkit.changes +++ b/polkit.changes @@ -1,3 +1,12 @@ +------------------------------------------------------------------- +Sun Jul 18 12:16:13 UTC 2021 - Callum Farmer + +- Change to using systemd-sysusers +- Remove unneeded shadow dependency, no longer required due to + systemd-sysusers +- Fix 50-default.rules file-parent-ownership-mismatch warning +- Remove --with-pic, no effect with --disable-static + ------------------------------------------------------------------- Wed Jul 7 08:15:04 UTC 2021 - Stefan Schubert = 2.32.0 BuildRequires: pkgconfig(gmodule-2.0) >= 2.32.0 BuildRequires: pkgconfig(gobject-introspection-1.0) >= 0.6.2 @@ -59,7 +61,7 @@ BuildRequires: pkgconfig(systemd) #!BuildIgnore: ruby Requires: dbus-1 Requires: libpolkit0 = %{version}-%{release} -Requires(pre): shadow +%sysusers_requires Requires(post): permissions %systemd_ordering @@ -128,13 +130,13 @@ export SUID_LDFLAGS="-z now -pie" %configure \ --with-os-type=suse \ --enable-gtk-doc \ - --with-pic \ --disable-static \ --enable-introspection \ --enable-examples \ --enable-libsystemd-login \ %{nil} %make_build libprivdir=%{_libexecdir}/polkit-1 +%sysusers_generate_pre %{SOURCE3} polkit system-user-polkitd.conf %install # install explicitly into libexec. upstream has some unflexible logic for @@ -152,12 +154,11 @@ mv %{buildroot}%{_sysconfdir}/dbus-1/system.d/* %{buildroot}%{_datadir}/dbus-1/s mkdir -p %{buildroot}%{_distconfdir}/pam.d mv %{buildroot}%{_sysconfdir}/pam.d/* %{buildroot}%{_distconfdir}/pam.d/ mv %{buildroot}%{_sysconfdir}/polkit-1/rules.d/50-default.rules %{buildroot}%{_datadir}/polkit-1/rules.d/50-default.rules +mkdir -p %{buildroot}%{_sysusersdir} +install -m0644 %{SOURCE3} %{buildroot}%{_sysusersdir}/ -%pre -getent group polkitd > /dev/null || groupadd -r polkitd -getent passwd polkitd > /dev/null || useradd -r -g polkitd -d %{_localstatedir}/lib/polkit -s /sbin/nologin -c "User for polkitd" polkitd +%pre -f polkit.pre %service_add_pre polkit.service -exit 0 %preun %service_del_preun polkit.service @@ -203,7 +204,7 @@ exit 0 %dir %{_datadir}/polkit-1/actions %{_datadir}/polkit-1/actions/org.freedesktop.policykit.policy %attr(0700,polkitd,root) %dir %{_datadir}/polkit-1/rules.d -%{_datadir}/polkit-1/rules.d/50-default.rules +%attr(0700,polkitd,root) %{_datadir}/polkit-1/rules.d/50-default.rules %{_distconfdir}/pam.d/polkit-1 %dir %{_sysconfdir}/polkit-1 %attr(0700,polkitd,root) %dir %{_sysconfdir}/polkit-1/rules.d @@ -216,6 +217,7 @@ exit 0 %verify(not mode) %attr(4755,root,root) %{_libexecdir}/polkit-1/polkit-agent-helper-1 # $HOME for polkit user %dir %{_localstatedir}/lib/polkit +%{_sysusersdir}/system-user-polkitd.conf %{_unitdir}/polkit.service %files devel diff --git a/system-user-polkitd.conf b/system-user-polkitd.conf new file mode 100644 index 0000000..59ba3ba --- /dev/null +++ b/system-user-polkitd.conf @@ -0,0 +1,2 @@ +#Type Name ID GECOS Home directory Shell +u polkitd - "User for polkitd" /var/lib/polkit -