Accepting request 949264 from Base:System
- Switch from mozjs to duktape: * Add duktape-support.patch Provides the same features as with mozjs, but is *much* smaller both during build and runtime. Before, installing polkit needed 62.0 MiB, with this it's just 16.3 MiB. (Tested in an opensuse/tumbleweed container). I didn't encounter any errors while playing around with it in a Live CD. (forwarded request 949263 from favogt) OBS-URL: https://build.opensuse.org/request/show/949264 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/polkit?expand=0&rev=80
This commit is contained in:
Dominique Leuenberger
Git OBS Bridge
commit
5725474185
65
CVE-2021-4034-pkexec-fix.patch
Normal file
65
CVE-2021-4034-pkexec-fix.patch
Normal file
@ -0,0 +1,65 @@
|
||||
--- a/src/programs/pkcheck.c
|
||||
+++ a/src/programs/pkcheck.c
|
||||
@@ -363,6 +363,12 @@ main (int argc, char *argv[])
|
||||
local_agent_handle = NULL;
|
||||
ret = 126;
|
||||
|
||||
+ if (argc < 1)
|
||||
+ {
|
||||
+ help();
|
||||
+ exit(1);
|
||||
+ }
|
||||
+
|
||||
/* Disable remote file access from GIO. */
|
||||
setenv ("GIO_USE_VFS", "local", 1);
|
||||
|
||||
--- a/src/programs/pkexec.c
|
||||
+++ a/src/programs/pkexec.c
|
||||
@@ -488,6 +488,17 @@ main (int argc, char *argv[])
|
||||
pid_t pid_of_caller;
|
||||
gpointer local_agent_handle;
|
||||
|
||||
+
|
||||
+ /*
|
||||
+ * If 'pkexec' is called wrong, just show help and bail out.
|
||||
+ */
|
||||
+ if (argc<1)
|
||||
+ {
|
||||
+ clearenv();
|
||||
+ usage(argc, argv);
|
||||
+ exit(1);
|
||||
+ }
|
||||
+
|
||||
ret = 127;
|
||||
authority = NULL;
|
||||
subject = NULL;
|
||||
@@ -614,10 +625,10 @@ main (int argc, char *argv[])
|
||||
|
||||
path = g_strdup (pwstruct.pw_shell);
|
||||
if (!path)
|
||||
- {
|
||||
+ {
|
||||
g_printerr ("No shell configured or error retrieving pw_shell\n");
|
||||
goto out;
|
||||
- }
|
||||
+ }
|
||||
/* If you change this, be sure to change the if (!command_line)
|
||||
case below too */
|
||||
command_line = g_strdup (path);
|
||||
@@ -636,7 +647,15 @@ main (int argc, char *argv[])
|
||||
goto out;
|
||||
}
|
||||
g_free (path);
|
||||
- argv[n] = path = s;
|
||||
+ path = s;
|
||||
+
|
||||
+ /* argc<2 and pkexec runs just shell, argv is guaranteed to be null-terminated.
|
||||
+ * /-less shell shouldn't happen, but let's be defensive and don't write to null-termination
|
||||
+ */
|
||||
+ if (argv[n] != NULL)
|
||||
+ {
|
||||
+ argv[n] = path;
|
||||
+ }
|
||||
}
|
||||
if (access (path, F_OK) != 0)
|
||||
{
|
||||
3449
duktape-support.patch
Normal file
3449
duktape-support.patch
Normal file
File diff suppressed because it is too large
Load Diff
@ -1,3 +1,15 @@
|
||||
-------------------------------------------------------------------
|
||||
Wed Jan 26 11:44:35 UTC 2022 - Fabian Vogt <fvogt@suse.com>
|
||||
|
||||
- Switch from mozjs to duktape:
|
||||
* Add duktape-support.patch
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue Jan 25 18:15:16 UTC 2022 - Marcus Meissner <meissner@suse.com>
|
||||
|
||||
- Fixed pkexec Local Privilege Escalation aka pwnkit (CVE-2021-4034 bsc#1194568)
|
||||
CVE-2021-4034-pkexec-fix.patch
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Dec 6 10:27:20 UTC 2021 - Dirk Müller <dmueller@suse.com>
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
#
|
||||
# spec file for package polkit
|
||||
#
|
||||
# Copyright (c) 2021 SUSE LLC
|
||||
# Copyright (c) 2022 SUSE LLC
|
||||
#
|
||||
# All modifications and additions to the file contributed by third parties
|
||||
# remain the property of their copyright owners, unless otherwise agreed
|
||||
@ -38,6 +38,10 @@ Patch2: pkexec.patch
|
||||
Patch3: polkit-keyinit.patch
|
||||
# adjust path to polkit-agent-helper-1 (bsc#1180474)
|
||||
Patch4: polkit-adjust-libexec-path.patch
|
||||
# PATCH-FIX-UPSTREAM CVE-2021-4034-pkexec-fix.patch meissner@ -- bsc#1194568 VUL-0: CVE-2021-4034: polkit: pkexec Local Privilege Escalation aka pwnkit
|
||||
Patch5: CVE-2021-4034-pkexec-fix.patch
|
||||
# PATCH-FIX-UPSTREAM https://gitlab.freedesktop.org/polkit/polkit/-/commit/c7fc4e1b61f0fd82fc697c19c604af7e9fb291a2.patch, without .gitlab-ci.yml (not in the tarball)
|
||||
Patch6: duktape-support.patch
|
||||
BuildRequires: gcc-c++
|
||||
BuildRequires: gtk-doc
|
||||
BuildRequires: intltool
|
||||
@ -48,11 +52,11 @@ BuildRequires: pam-devel
|
||||
BuildRequires: pkgconfig
|
||||
BuildRequires: systemd-rpm-macros
|
||||
BuildRequires: sysuser-tools
|
||||
BuildRequires: pkgconfig(duktape) >= 2.2.0
|
||||
BuildRequires: pkgconfig(gio-unix-2.0) >= 2.32.0
|
||||
BuildRequires: pkgconfig(gmodule-2.0) >= 2.32.0
|
||||
BuildRequires: pkgconfig(gobject-introspection-1.0) >= 0.6.2
|
||||
BuildRequires: pkgconfig(libsystemd)
|
||||
BuildRequires: pkgconfig(mozjs-78)
|
||||
BuildRequires: pkgconfig(systemd)
|
||||
# gtk-doc drags indirectyly ruby in for one of the helpers. This in turn causes a build cycle.
|
||||
#!BuildIgnore: ruby
|
||||
@ -146,6 +150,7 @@ export SUID_LDFLAGS="-z now -pie"
|
||||
--enable-introspection \
|
||||
--enable-examples \
|
||||
--enable-libsystemd-login \
|
||||
--with-duktape \
|
||||
%{nil}
|
||||
%make_build libprivdir=%{_libexecdir}/polkit-1
|
||||
%sysusers_generate_pre %{SOURCE3} polkit system-user-polkitd.conf
|
||||
|
||||
Loading…
Reference in New Issue
Block a user