forked from pool/libvirt
a78854eae9
c05ec920-polkit0-build.patch fcdfa31f-polkit0-auth.patch OBS-URL: https://build.opensuse.org/package/show/Virtualization/libvirt?expand=0&rev=198
54 lines
2.0 KiB
Diff
54 lines
2.0 KiB
Diff
From a06fab953f99e778883618dd0aeaef8da5d5b32a Mon Sep 17 00:00:00 2001
|
|
From: Jim Fehlig <jfehlig@suse.com>
|
|
Date: Wed, 15 Feb 2012 10:01:50 -0700
|
|
Subject: [PATCH] Fix polkit0 authentication
|
|
|
|
Commit 7033c5f2 introduced some bugs in polkit0 authentication.
|
|
|
|
Fix libvirtd segfault in remoteDispatchAuthPolkit().
|
|
|
|
Fix polkit authentication bypass when caller UID = 0.
|
|
---
|
|
daemon/remote.c | 20 +++++++++-----------
|
|
1 files changed, 9 insertions(+), 11 deletions(-)
|
|
|
|
Index: libvirt-0.9.10/daemon/remote.c
|
|
===================================================================
|
|
--- libvirt-0.9.10.orig/daemon/remote.c
|
|
+++ libvirt-0.9.10/daemon/remote.c
|
|
@@ -2052,16 +2052,16 @@ remoteDispatchAuthList(virNetServerPtr s
|
|
} else if (callerUid == 0) {
|
|
char *ident;
|
|
if (virAsprintf(&ident, "pid:%lld,uid:%d",
|
|
- (long long) callerPid, callerUid) == 0) {
|
|
- VIR_INFO("Bypass polkit auth for privileged client %s",
|
|
- ident);
|
|
- if (virNetServerClientSetIdentity(client, ident) < 0)
|
|
- virResetLastError();
|
|
- else
|
|
- auth = VIR_NET_SERVER_SERVICE_AUTH_NONE;
|
|
- VIR_FREE(ident);
|
|
+ (long long) callerPid, callerUid) < 0) {
|
|
+ virReportOOMError();
|
|
+ goto cleanup;
|
|
}
|
|
- rv = -1;
|
|
+ VIR_INFO("Bypass polkit auth for privileged client %s", ident);
|
|
+ if (virNetServerClientSetIdentity(client, ident) < 0)
|
|
+ virResetLastError();
|
|
+ else
|
|
+ auth = VIR_NET_SERVER_SERVICE_AUTH_NONE;
|
|
+ VIR_FREE(ident);
|
|
}
|
|
}
|
|
|
|
@@ -2592,8 +2592,6 @@ remoteDispatchAuthPolkit(virNetServerPtr
|
|
struct daemonClientPrivate *priv =
|
|
virNetServerClientGetPrivateData(client);
|
|
|
|
- memset(ident, 0, sizeof ident);
|
|
-
|
|
virMutexLock(&priv->lock);
|
|
|
|
action = virNetServerClientGetReadonly(client) ?
|