- Added 2 patches to fix bsc#1001765

0001-If-the-notification-message-length-is-0-ignore-the-m.patch
  0001-pid1-don-t-return-any-error-in-manager_dispatch_noti.patch

OBS-URL: https://build.opensuse.org/package/show/Base:System/systemd?expand=0&rev=956

0001-If-the-notification-message-length-is-0-ignore-the-m.patch

@@ -0,0 +1,31 @@
+From 531ac2b2349da02acc9c382849758e07eb92b020 Mon Sep 17 00:00:00 2001
+From: Jorge Niedbalski <jorge.niedbalski@canonical.com>
+Date: Wed, 28 Sep 2016 18:25:50 -0300
+Subject: [PATCH 1/1] If the notification message length is 0, ignore the
+ message (#4237)
+
+Fixes #4234.
+
+Signed-off-by: Jorge Niedbalski <jnr@metaklass.org>
+---
+ src/core/manager.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/core/manager.c b/src/core/manager.c
+index fa8deb9..43e231c 100644
+--- a/src/core/manager.c
++++ b/src/core/manager.c
+@@ -1721,6 +1721,10 @@ static int manager_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t
+ 
+                 return -errno;
+         }
++        if (n == 0) {
++                log_debug("Got zero-length notification message. Ignoring.");
++                return 0;
++        }
+ 
+         CMSG_FOREACH(cmsg, &msghdr) {
+                 if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) {
+-- 
+2.10.0
+

0001-pid1-don-t-return-any-error-in-manager_dispatch_noti.patch

@@ -0,0 +1,49 @@
+From: Franck Bui <fbui@suse.com>
+Date: Thu, 29 Sep 2016 11:59:49 +0200
+Subject: [PATCH 1/1] pid1: don't return any error in
+ manager_dispatch_notify_fd()
+
+If manager_dispatch_notify_fd() fails and returns an error then the handling of
+service notifications will be disabled entirely leading to a compromised system.
+
+For example pid1 won't be able to receive the WATCHDOG messages anymore and
+will kill all services supposed to send such messages.
+---
+ src/core/manager.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/src/core/manager.c b/src/core/manager.c
+index 43e231c..5704005 100644
+--- a/src/core/manager.c
++++ b/src/core/manager.c
+@@ -1716,10 +1716,14 @@ static int manager_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t
+ 
+         n = recvmsg(m->notify_fd, &msghdr, MSG_DONTWAIT|MSG_CMSG_CLOEXEC);
+         if (n < 0) {
+-                if (errno == EAGAIN || errno == EINTR)
+-                        return 0;
++                if (!IN_SET(errno, EAGAIN, EINTR))
++                        log_error("Failed to receive notification message: %m");
+ 
+-                return -errno;
++                /* It's not an option to return an error here since it
++                 * would disable the notification handler entirely. Services
++                 * wouldn't be able to send the WATCHDOG message for
++                 * example... */
++                return 0;
+         }
+         if (n == 0) {
+                 log_debug("Got zero-length notification message. Ignoring.");
+@@ -1746,7 +1750,8 @@ static int manager_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t
+                 r = fdset_new_array(&fds, fd_array, n_fds);
+                 if (r < 0) {
+                         close_many(fd_array, n_fds);
+-                        return log_oom();
++                        log_oom();
++                        return 0;
+                 }
+         }
+ 
+-- 
+2.10.0
+

systemd-mini.changes

@@ -1,3 +1,11 @@
+-------------------------------------------------------------------
+Thu Sep 29 12:51:38 UTC 2016 - fbui@suse.com
+
+- Added 2 patches to fix bsc#1001765
+
+  0001-If-the-notification-message-length-is-0-ignore-the-m.patch
+  0001-pid1-don-t-return-any-error-in-manager_dispatch_noti.patch
+
 -------------------------------------------------------------------
 Thu Sep 29 06:24:01 UTC 2016 - fbui@suse.com
 

systemd-mini.spec

@@ -268,6 +268,8 @@ Patch531:       0001-rules-block-add-support-for-pmem-devices-3683.patch
 Patch532:       0001-journal-set-STATE_ARCHIVED-as-part-of-offlining-2740.patch
 Patch533:       0001-journal-warn-when-we-fail-to-append-a-tag-to-a-journ.patch
 Patch534:       0001-journal-fix-HMAC-calculation-when-appending-a-data-o.patch
+Patch535:       0001-If-the-notification-message-length-is-0-ignore-the-m.patch
+Patch536:       0001-pid1-don-t-return-any-error-in-manager_dispatch_noti.patch
 
 # UDEV PATCHES
 # ============
@@ -619,6 +621,8 @@ cp %{SOURCE7} m4/
 %patch532 -p1
 %patch533 -p1
 %patch534 -p1
+%patch535 -p1
+%patch536 -p1
 
 # udev patches
 %patch1002 -p1

systemd.changes

@@ -1,3 +1,11 @@
+-------------------------------------------------------------------
+Thu Sep 29 12:51:38 UTC 2016 - fbui@suse.com
+
+- Added 2 patches to fix bsc#1001765
+
+  0001-If-the-notification-message-length-is-0-ignore-the-m.patch
+  0001-pid1-don-t-return-any-error-in-manager_dispatch_noti.patch
+
 -------------------------------------------------------------------
 Thu Sep 29 06:24:01 UTC 2016 - fbui@suse.com
 

systemd.spec

@@ -263,6 +263,8 @@ Patch531:       0001-rules-block-add-support-for-pmem-devices-3683.patch
 Patch532:       0001-journal-set-STATE_ARCHIVED-as-part-of-offlining-2740.patch
 Patch533:       0001-journal-warn-when-we-fail-to-append-a-tag-to-a-journ.patch
 Patch534:       0001-journal-fix-HMAC-calculation-when-appending-a-data-o.patch
+Patch535:       0001-If-the-notification-message-length-is-0-ignore-the-m.patch
+Patch536:       0001-pid1-don-t-return-any-error-in-manager_dispatch_noti.patch
 
 # UDEV PATCHES
 # ============
@@ -614,6 +616,8 @@ cp %{SOURCE7} m4/
 %patch532 -p1
 %patch533 -p1
 %patch534 -p1
+%patch535 -p1
+%patch536 -p1
 
 # udev patches
 %patch1002 -p1