Accepting request 949264 from Base:System

- Switch from mozjs to duktape:
  * Add duktape-support.patch

Provides the same features as with mozjs, but is *much* smaller both during
build and runtime. Before, installing polkit needed 62.0 MiB, with this it's
just 16.3 MiB. (Tested in an opensuse/tumbleweed container).

I didn't encounter any errors while playing around with it in a Live CD. (forwarded request 949263 from favogt)

OBS-URL: https://build.opensuse.org/request/show/949264
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/polkit?expand=0&rev=80

CVE-2021-4034-pkexec-fix.patch

@@ -0,0 +1,65 @@
+--- a/src/programs/pkcheck.c	
++++ a/src/programs/pkcheck.c	
+@@ -363,6 +363,12 @@ main (int argc, char *argv[])
+   local_agent_handle = NULL;
+   ret = 126;
+ 
++  if (argc < 1)
++    {
++      help();
++      exit(1);
++    }
++
+   /* Disable remote file access from GIO. */
+   setenv ("GIO_USE_VFS", "local", 1);
+ 
+--- a/src/programs/pkexec.c	
++++ a/src/programs/pkexec.c	
+@@ -488,6 +488,17 @@ main (int argc, char *argv[])
+   pid_t pid_of_caller;
+   gpointer local_agent_handle;
+ 
++
++  /*
++   * If 'pkexec' is called wrong, just show help and bail out.
++   */
++  if (argc<1)
++    {
++      clearenv();
++      usage(argc, argv);
++      exit(1);
++    }
++
+   ret = 127;
+   authority = NULL;
+   subject = NULL;
+@@ -614,10 +625,10 @@ main (int argc, char *argv[])
+ 
+       path = g_strdup (pwstruct.pw_shell);
+       if (!path)
+-	{
++        {
+           g_printerr ("No shell configured or error retrieving pw_shell\n");
+           goto out;
+-	}
++        }
+       /* If you change this, be sure to change the if (!command_line)
+ 	 case below too */
+       command_line = g_strdup (path);
+@@ -636,7 +647,15 @@ main (int argc, char *argv[])
+           goto out;
+         }
+       g_free (path);
+-      argv[n] = path = s;
++      path = s;
++
++      /* argc<2 and pkexec runs just shell, argv is guaranteed to be null-terminated.
++       * /-less shell shouldn't happen, but let's be defensive and don't write to null-termination
++       */
++      if (argv[n] != NULL)
++      {
++        argv[n] = path;
++      }
+     }
+   if (access (path, F_OK) != 0)
+     {

polkit.changes

@@ -1,3 +1,15 @@
+-------------------------------------------------------------------
+Wed Jan 26 11:44:35 UTC 2022 - Fabian Vogt <fvogt@suse.com>
+
+- Switch from mozjs to duktape:
+  * Add duktape-support.patch
+
+-------------------------------------------------------------------
+Tue Jan 25 18:15:16 UTC 2022 - Marcus Meissner <meissner@suse.com>
+
+- Fixed pkexec Local Privilege Escalation aka pwnkit (CVE-2021-4034 bsc#1194568)
+  CVE-2021-4034-pkexec-fix.patch
+
 -------------------------------------------------------------------
 Mon Dec  6 10:27:20 UTC 2021 - Dirk Müller <dmueller@suse.com>
 

polkit.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package polkit
 #
-# Copyright (c) 2021 SUSE LLC
+# Copyright (c) 2022 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -38,6 +38,10 @@ Patch2:         pkexec.patch
 Patch3:         polkit-keyinit.patch
 # adjust path to polkit-agent-helper-1 (bsc#1180474)
 Patch4:         polkit-adjust-libexec-path.patch
+# PATCH-FIX-UPSTREAM CVE-2021-4034-pkexec-fix.patch meissner@ -- bsc#1194568 VUL-0: CVE-2021-4034: polkit: pkexec Local Privilege Escalation aka pwnkit
+Patch5:         CVE-2021-4034-pkexec-fix.patch
+# PATCH-FIX-UPSTREAM https://gitlab.freedesktop.org/polkit/polkit/-/commit/c7fc4e1b61f0fd82fc697c19c604af7e9fb291a2.patch, without .gitlab-ci.yml (not in the tarball)
+Patch6:         duktape-support.patch
 BuildRequires:  gcc-c++
 BuildRequires:  gtk-doc
 BuildRequires:  intltool
@@ -48,11 +52,11 @@ BuildRequires:  pam-devel
 BuildRequires:  pkgconfig
 BuildRequires:  systemd-rpm-macros
 BuildRequires:  sysuser-tools
+BuildRequires:  pkgconfig(duktape) >= 2.2.0
 BuildRequires:  pkgconfig(gio-unix-2.0) >= 2.32.0
 BuildRequires:  pkgconfig(gmodule-2.0) >= 2.32.0
 BuildRequires:  pkgconfig(gobject-introspection-1.0) >= 0.6.2
 BuildRequires:  pkgconfig(libsystemd)
-BuildRequires:  pkgconfig(mozjs-78)
 BuildRequires:  pkgconfig(systemd)
 # gtk-doc drags indirectyly ruby in for one of the helpers. This in turn causes a build cycle.
 #!BuildIgnore:  ruby
@@ -146,6 +150,7 @@ export SUID_LDFLAGS="-z now -pie"
 	--enable-introspection \
 	--enable-examples \
 	--enable-libsystemd-login \
+	--with-duktape \
 	%{nil}
 %make_build libprivdir=%{_libexecdir}/polkit-1
 %sysusers_generate_pre %{SOURCE3} polkit system-user-polkitd.conf