Stefan Dirsch
b7ed257592
- u_xorg-wrapper-Xserver-Options-Whitelist-Filter.patch
* replaced by improved version written by Matthias Gerstner of
our security team
+ simplified the option parsing code a bit
+ changed the "ignore forbidden argument" logic into an "abort
on forbidden argument" logic. This is safer and avoids
surprises on the user's end that could occur if the desired
command line arguments aren't effective but the Xorg server is
still started.
+ tried to adjust to the coding style present in the file
(mostly the function name)
+ added some logic to apply the option filtering only to
non-root users when Xorg is actually started as root. This
should allow for full flexibility if root calls the wrapper or
if the Xorg server only runs with user privileges.
- n_xorg-wrapper-rename-Xorg.patch
* moved Xorg to Xorg.bin and Xorg.sh to Xorg (boo#1175867)
- change default for needs_root_rights to auto in Xwrapper.config
(boo#1175867)
- reenabled SUID wrapper for TW (boo#1175867)
- u_xorg-wrapper-Xserver-Options-Whitelist-Filter.patch
* Xserver option whitelist filter (boo#1175867)
OBS-URL: https://build.opensuse.org/request/show/838619
OBS-URL: https://build.opensuse.org/package/show/X11:XOrg/xorg-x11-server?expand=0&rev=779
21 lines
781 B
Diff
21 lines
781 B
Diff
--- xserver-1.20.9/hw/xfree86/xorg-wrapper.c.old 2020-09-24 03:16:27.270885000 +0200
|
|
+++ xserver-1.20.9/hw/xfree86/xorg-wrapper.c 2020-09-24 03:18:42.047597000 +0200
|
|
@@ -375,7 +375,7 @@ int main(int argc, char *argv[])
|
|
}
|
|
}
|
|
|
|
- snprintf(buf, sizeof(buf), "%s/Xorg", SUID_WRAPPER_DIR);
|
|
+ snprintf(buf, sizeof(buf), "%s/Xorg.bin", SUID_WRAPPER_DIR);
|
|
|
|
/* Check if the server is executable by our real uid */
|
|
if (access(buf, X_OK) != 0) {
|
|
--- xserver-1.20.9/hw/xfree86/Xorg.sh.in.orig 2020-09-24 03:36:20.690412000 +0200
|
|
+++ xserver-1.20.9/hw/xfree86/Xorg.sh.in 2020-09-24 03:36:37.594497000 +0200
|
|
@@ -7,5 +7,5 @@
|
|
if [ -x "$basedir"/Xorg.wrap ]; then
|
|
exec "$basedir"/Xorg.wrap "$@"
|
|
else
|
|
- exec "$basedir"/Xorg "$@"
|
|
+ exec "$basedir"/Xorg.bin "$@"
|
|
fi
|