Accepting request 453044 from home:Alexander_Naumov:branches:Base:System

fix GNU Screen API: bnc#1020870

OBS-URL: https://build.opensuse.org/request/show/453044
OBS-URL: https://build.opensuse.org/package/show/Base:System/screen?expand=0&rev=68

fix_enable_logfile.patch

@@ -0,0 +1,72 @@
+From: Alexander Naumov <alexander_naumov@opensuse.org>
+Date: Thu, 26 Jan 2017 23:44:43 +0100
+Subject: [PATCH] Adding "-L logfile" option for setting new logfile's name
+References: bnc#1020870
+
+Now it's possible to set your own lofile name with
+this option ONLY. It fixes API of old versions.
+
+Signed-off-by: Alexander Naumov <alexander_naumov@opensuse.org>
+---
+diff --git a/src/doc/screen.1 b/src/doc/screen.1
+index 23b4d7b..5b14d91 100644
+--- doc/screen.1
++++ doc/screen.1
+@@ -261,9 +261,12 @@ Ask your system administrator if you are not sure. Remove sessions with the
+ .B \-L
+ tells
+ .I screen
+-to turn on automatic output logging for the windows. By default, logfile's name
+-is screenlog.1. You can sets new name: add it right after -L option e.g. "screen
+--L my_logfile".
++to turn on automatic output logging for the windows.
++.TP 5
++.BI "\-L logfile " file
++By default logfile name is \*Qscreenlog.0\*Q. You can also set new logfile name
++with the \*Qlogfile\*Q option. Keep in mind that logfile name can not start with
++the "-" symbol.
+ .TP 5
+ .B \-m
+ causes
+diff --git a/src/screen.c b/src/screen.c
+index 64650e9..9e1072a 100644
+--- screen.c
++++ screen.c
+@@ -302,7 +302,7 @@ struct passwd *ppp;
+ pw_try_again:
+ #endif
+   n = 0;
+-  if (ppp->pw_passwd[0] == '#' && ppp->pw_passwd[1] == '#' & strcmp(ppp->pw_passwd + 2, ppp->pw_name) == 0)
++  if (ppp->pw_passwd[0] == '#' && ppp->pw_passwd[1] == '#' && strcmp(ppp->pw_passwd + 2, ppp->pw_name) == 0)
+     n = 13;
+   for (; n < 13; n++) {
+     char c = ppp->pw_passwd[n];
+@@ -667,18 +667,16 @@ int main(int ac, char** av)
+             break;
+ 
+           case 'L':
+-            if (--ac != 0) {
+-              screenlogfile = SaveStr(*++av);
+-              if (screenlogfile[0] == '-')
++            if (--ac > 0 && !strcmp(*++av, "logfile")) {
++              *++av; // Now '*av' is a logfile parameter
++
++              if (strlen(*av) > PATH_MAX)
++                Panic(1, "-L: logfile name too long. (max. %d char)", PATH_MAX);
++
++              if (*av[0] == '-')
+                 Panic(0, "-L: logfile name can not start with \"-\" symbol");
+-              if (strlen(screenlogfile) > PATH_MAX)
+-                Panic(0, "-L: logfile name too long. (max. %d char)", PATH_MAX);
+-
+-              FILE *w_check;
+-              if ((w_check = fopen(screenlogfile, "w")) == NULL)
+-                Panic(0, "-L: logfile name access problem");
+-              else
+-                fclose(w_check);
++
++              screenlogfile = SaveStr(*av);
+             }
+             nwin_options.Lflag = 1;
+             break;
+

screen.changes

@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Fri Jan 27 22:32:17 UTC 2017 - alexander_naumov@opensuse.org
+
+- Add fix_enable_logfile.patch
+  * fix loging screen API (bnc#1020870) 
+  * fix privilege escalation
+
 -------------------------------------------------------------------
 Thu Jan 17 23:11:38 UTC 2017 - alexander_naumov@opensuse.org
 

screen.spec

@@ -49,6 +49,7 @@ Source1:        screen.conf
 Source2:        http://ftp.gnu.org/gnu/screen/%{name}-%{version}.tar.gz.sig
 Source3:        https://savannah.gnu.org/project/memberlist-gpgkeys.php?group=screen&download=1#/%{name}.keyring
 Patch0:         global_screenrc.patch
+Patch1:         fix_enable_logfile.patch
 Patch6:         libtinfo.diff
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 
@@ -63,6 +64,8 @@ Documentation: man page
 %setup
 # global_screenrc.patch
 %patch0
+# PATCH-FEATURE-UPSTREAM fix_enable_logfile.patch
+%patch1
 # libtinfo.diff
 %patch6