From 903afb287a6e7f6306d1eed92a6ce3ea319736679272b8788babd3396b315e44 Mon Sep 17 00:00:00 2001
From: Franck Bui <fbui@suse.com>
Date: Wed, 25 Jan 2017 16:13:23 +0000
Subject: [PATCH] Accepting request 452442 from home:fbui:systemd:Factory

- Don't ship ldconfig.service anymore
  This service was introduced to support stateless systems that
  support offline /usr updates properly.
  AFAIK we don't support any such system for now, so disable it. If
  it's wrong it's easy enough to restore it back.
  Related to bsc#1019470.

- Be more consistent with indentation (*no* functional changes)
  Indentation should use 8 spaces now (no tabs).

- Import commit 2559bc0c076b58f0a649056e79ca90fe5f1d556c
  9c4a759ab systemctl: 'show' don't exit with a failure status if the requested property does not exist [SUSE] (bsc#1021062)
  f9194193b systemctl: remove duplicate entries showed by list-dependencies (#5049) (bsc#1012266)
  2a6653335 rule: don't automatically online standby memory on s390x (bsc#997682)

- Fix permission set on /var/lib/systemd/linger/*
  Those files are created by logind which run with umask(0022), so
  they are not world writable and shouldn't be affected by
  bsc#1020601. But it's cleaner to not let files forever with their
  setuid bit set for no good reason.

- Fix permissions set on permanent timer timestamp files (bsc#1020601) (CVE-2016-10156)
  This change makes sure to fix the permissions of the timestamp files
  which could have been created by an affected version of systemd.
  Local unprivileged users could have run arbitrary code as root if
  systemd previously created world writable suid root files such as
  permanent timer stamp files.

OBS-URL: https://build.opensuse.org/request/show/452442
OBS-URL: https://build.opensuse.org/package/show/Base:System/systemd?expand=0&rev=967
---
 systemd-232.tar.xz   |   4 +-
 systemd-mini.changes |  51 +++++++++++++++++
 systemd-mini.spec    | 130 ++++++++++++++++++++++++-------------------
 systemd.changes      |  51 +++++++++++++++++
 systemd.spec         | 130 ++++++++++++++++++++++++-------------------
 5 files changed, 248 insertions(+), 118 deletions(-)

diff --git a/systemd-232.tar.xz b/systemd-232.tar.xz
index 904a437e..04c9ac5d 100644
--- a/systemd-232.tar.xz
+++ b/systemd-232.tar.xz
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:a0f63b20f91eeed656a9d2bf9ad453cd7cfbb786663714b9b17886624f5ea69c
-size 3211060
+oid sha256:cc6ee1dab9013b879e3ae500b79875651c4462e23a9b9fbeab06597828ee00a3
+size 3211676
diff --git a/systemd-mini.changes b/systemd-mini.changes
index ac7b0364..b7ed294e 100644
--- a/systemd-mini.changes
+++ b/systemd-mini.changes
@@ -1,3 +1,54 @@
+-------------------------------------------------------------------
+Wed Jan 25 15:37:23 UTC 2017 - fbui@suse.com
+
+- Don't ship ldconfig.service anymore
+
+  This service was introduced to support stateless systems that
+  support offline /usr updates properly.
+
+  AFAIK we don't support any such system for now, so disable it. If
+  it's wrong it's easy enough to restore it back.
+
+  Related to bsc#1019470.
+
+-------------------------------------------------------------------
+Wed Jan 25 15:17:06 UTC 2017 - fbui@suse.com
+
+- Be more consistent with indentation (*no* functional changes)
+
+  Indentation should use 8 spaces now (no tabs).
+
+-------------------------------------------------------------------
+Wed Jan 25 14:38:59 UTC 2017 - fbui@suse.com
+
+- Import commit 2559bc0c076b58f0a649056e79ca90fe5f1d556c
+
+  9c4a759ab systemctl: 'show' don't exit with a failure status if the requested property does not exist [SUSE] (bsc#1021062)
+  f9194193b systemctl: remove duplicate entries showed by list-dependencies (#5049) (bsc#1012266)
+  2a6653335 rule: don't automatically online standby memory on s390x (bsc#997682)
+
+-------------------------------------------------------------------
+Wed Jan 25 14:36:34 UTC 2017 - fbui@suse.com
+
+- Fix permission set on /var/lib/systemd/linger/*
+
+  Those files are created by logind which run with umask(0022), so
+  they are not world writable and shouldn't be affected by
+  bsc#1020601. But it's cleaner to not let files forever with their
+  setuid bit set for no good reason.
+
+-------------------------------------------------------------------
+Wed Jan 25 14:33:04 UTC 2017 - fbui@suse.com
+
+- Fix permissions set on permanent timer timestamp files (bsc#1020601) (CVE-2016-10156)
+
+  This change makes sure to fix the permissions of the timestamp files
+  which could have been created by an affected version of systemd.
+
+  Local unprivileged users could have run arbitrary code as root if
+  systemd previously created world writable suid root files such as
+  permanent timer stamp files.
+
 -------------------------------------------------------------------
 Tue Jan 10 10:54:20 UTC 2017 - fbui@suse.com
 
diff --git a/systemd-mini.spec b/systemd-mini.spec
index 0ea7287b..a0b92de5 100644
--- a/systemd-mini.spec
+++ b/systemd-mini.spec
@@ -423,43 +423,44 @@ systemd_cryptsetup_LDFLAGS =\\\
 
 # keep split-usr until all packages have moved their systemd rules to /usr
 %configure \
-  --docdir=%{_docdir}/systemd \
-  --with-pamlibdir=/%{_lib}/security \
-  --with-dbuspolicydir=%{_sysconfdir}/dbus-1/system.d \
-  --with-dbussessionservicedir=%{_datadir}/dbus-1/services \
-  --with-dbussystemservicedir=%{_datadir}/dbus-1/system-services \
-  --with-certificate-root=%{_sysconfdir}/pki/systemd \
+        --docdir=%{_docdir}/systemd \
+        --with-pamlibdir=/%{_lib}/security \
+        --with-dbuspolicydir=%{_sysconfdir}/dbus-1/system.d \
+        --with-dbussessionservicedir=%{_datadir}/dbus-1/services \
+        --with-dbussystemservicedir=%{_datadir}/dbus-1/system-services \
+        --with-certificate-root=%{_sysconfdir}/pki/systemd \
 %if 0%{?bootstrap}
-  --disable-myhostname \
-  --disable-manpages \
+        --disable-myhostname \
+        --disable-manpages \
 %endif
-  --enable-selinux \
-  --enable-split-usr \
-  --disable-static \
-  --disable-lto \
-  --disable-tests \
-  --without-kill-user-processes \
-  --with-rc-local-script-path-start=/etc/init.d/boot.local \
-  --with-rc-local-script-path-stop=/etc/init.d/halt.local \
-  --with-debug-shell=/bin/bash \
-  --disable-smack \
-  --disable-ima \
-  --disable-adm-group \
-  --disable-wheel-group \
+        --enable-selinux \
+        --enable-split-usr \
+        --disable-static \
+        --disable-lto \
+        --disable-tests \
+        --without-kill-user-processes \
+        --with-rc-local-script-path-start=/etc/init.d/boot.local \
+        --with-rc-local-script-path-stop=/etc/init.d/halt.local \
+        --with-debug-shell=/bin/bash \
+        --disable-smack \
+        --disable-ima \
+        --disable-adm-group \
+        --disable-wheel-group \
+        --disable-ldconfig \
 %if %{without networkd}
-  --disable-networkd \
+        --disable-networkd \
 %endif
 %if %{without machined}
-  --disable-machined \
+        --disable-machined \
 %endif
 %if %{without sysvcompat}
-  --with-sysvinit-path= \
-  --with-sysvrcnd-path= \
+        --with-sysvinit-path= \
+        --with-sysvrcnd-path= \
 %endif
 %if %{without resolved}
-  --disable-resolved \
+        --disable-resolved \
 %endif
-  --disable-kdbus
+        --disable-kdbus
 
 make %{?_smp_mflags} V=e
 
@@ -663,24 +664,24 @@ systemctl daemon-reexec  || :
 
 # Try to read default runlevel from the old inittab if it exists
 if [ ! -e /etc/systemd/system/default.target -a -e /etc/inittab ]; then
-  runlevel=$(awk -F ':' '$3 == "initdefault" && $1 !~ "^#" { print $2 }' /etc/inittab)
-  if [ -n "$runlevel" ] ; then
-    ln -sf /usr/lib/systemd/system/runlevel$runlevel.target /etc/systemd/system/default.target || :
-  fi
+        runlevel=$(awk -F ':' '$3 == "initdefault" && $1 !~ "^#" { print $2 }' /etc/inittab)
+        if [ -n "$runlevel" ] ; then
+                ln -sf /usr/lib/systemd/system/runlevel$runlevel.target /etc/systemd/system/default.target || :
+        fi
 fi
 
 # Create default config in /etc at first install.
 # Later package updates should not overwrite these settings.
 if [ $1 -eq 1 ]; then
-  # Enable systemd services according to the distro defaults.
-  # Note: systemctl might abort prematurely if it fails on one
-  # unit.
-  systemctl preset remote-fs.target || :
-  systemctl preset getty@.service   || :
-  systemctl preset systemd-networkd.service || :
-  systemctl preset systemd-networkd-wait-online.service || :
-  systemctl preset systemd-timesyncd.service || :
-  systemctl preset systemd-resolved.service  || :
+        # Enable systemd services according to the distro defaults.
+        # Note: systemctl might abort prematurely if it fails on one
+        # unit.
+        systemctl preset remote-fs.target || :
+        systemctl preset getty@.service   || :
+        systemctl preset systemd-networkd.service || :
+        systemctl preset systemd-networkd-wait-online.service || :
+        systemctl preset systemd-timesyncd.service || :
+        systemctl preset systemd-resolved.service  || :
 fi >/dev/null
 
 # since v207 /etc/sysctl.conf is no longer parsed, however
@@ -691,8 +692,8 @@ fi
 
 # migrate any symlink which may refer to the old path
 for f in $(find /etc/systemd/system -type l -xtype l); do
-  new_target="/usr$(readlink $f)"
-  [ -f "$new_target" ] && ln -s -f $new_target $f || :
+        new_target="/usr$(readlink $f)"
+        [ -f "$new_target" ] && ln -s -f $new_target $f || :
 done
 
 # Keep tmp.mount if it's been enabled explicitly by the user otherwise
@@ -705,6 +706,18 @@ enabled)  ;;
 *)        rm -f %{_prefix}/lib/systemd/system/tmp.mount
 esac
 
+# Same for user lingering created by logind.
+for username in $(ls /var/lib/systemd/linger/* 2>/dev/null); do
+        chmod 0644 $username
+done
+
+# v228 wrongly set world writable suid root permissions on timestamp
+# files used by permanent timers. Fix the timestamps that might have
+# been created by the affected versions of systemd (bsc#1020601).
+for stamp in $(ls /var/lib/systemd/timers/stamp-*.timer 2>/dev/null); do
+        chmod 0644 $stamp
+done
+
 # Convert /var/lib/machines subvolume to make it suitable for
 # rollbacks, if needed. See bsc#992573. The installer has been fixed
 # to create it at installation time.
@@ -733,35 +746,36 @@ if [ $1 -ge 1 ]; then
 fi
 %if ! 0%{?bootstrap}
 if [ $1 -eq 0 ]; then
-  pam-config -d --systemd || :
+        pam-config -d --systemd || :
 fi
 %endif
 
 %preun
 if [ $1 -eq 0 ]; then
-  systemctl disable remote-fs.target || :
-  systemctl disable getty@.service   || :
-  systemctl disable systemd-networkd.service || :
-  systemctl disable systemd-networkd-wait-online.service || :
-  systemctl disable systemd-timesyncd.service || :
-  systemctl disable systemd-resolved.service  || :
+        systemctl disable remote-fs.target || :
+        systemctl disable getty@.service   || :
+        systemctl disable systemd-networkd.service || :
+        systemctl disable systemd-networkd-wait-online.service || :
+        systemctl disable systemd-timesyncd.service || :
+        systemctl disable systemd-resolved.service  || :
 
-  rm -f /etc/systemd/system/default.target
+        rm -f /etc/systemd/system/default.target
 fi >/dev/null
 
 %pretrans -n udev%{?mini} -p <lua>
 if posix.stat("/lib/udev") and not posix.stat("/usr/lib/udev") then
-  posix.symlink("/lib/udev", "/usr/lib/udev")
+   posix.symlink("/lib/udev", "/usr/lib/udev")
 end
 
 %pre -n udev%{?mini}
- %regenerate_initrd_post
+%regenerate_initrd_post
+
 if test -L /usr/lib/udev -a /lib/udev -ef /usr/lib/udev ; then
-  rm /usr/lib/udev
-  mv /lib/udev /usr/lib
-  ln -s /usr/lib/udev /lib/udev
+        rm /usr/lib/udev
+        mv /lib/udev /usr/lib
+        ln -s /usr/lib/udev /lib/udev
 elif [ ! -e /lib/udev ]; then
-  ln -s /usr/lib/udev /lib/udev
+        ln -s /usr/lib/udev /lib/udev
 fi
 
 # Create "tape"/"input" group which is referenced by some udev rules
@@ -806,8 +820,8 @@ systemctl daemon-reload || :
 %post logger
 systemd-tmpfiles --create --prefix=%{_localstatedir}/log/journal/ || :
 if [ "$1" -eq 1 ]; then
-# tell journal to start logging on disk if directory didn't exist before
-  systemctl --no-block restart systemd-journal-flush.service >/dev/null || :
+        # tell journal to start logging on disk if directory didn't exist before
+        systemctl --no-block restart systemd-journal-flush.service >/dev/null || :
 fi
 
 %post   -n nss-myhostname -p /sbin/ldconfig
diff --git a/systemd.changes b/systemd.changes
index ac7b0364..b7ed294e 100644
--- a/systemd.changes
+++ b/systemd.changes
@@ -1,3 +1,54 @@
+-------------------------------------------------------------------
+Wed Jan 25 15:37:23 UTC 2017 - fbui@suse.com
+
+- Don't ship ldconfig.service anymore
+
+  This service was introduced to support stateless systems that
+  support offline /usr updates properly.
+
+  AFAIK we don't support any such system for now, so disable it. If
+  it's wrong it's easy enough to restore it back.
+
+  Related to bsc#1019470.
+
+-------------------------------------------------------------------
+Wed Jan 25 15:17:06 UTC 2017 - fbui@suse.com
+
+- Be more consistent with indentation (*no* functional changes)
+
+  Indentation should use 8 spaces now (no tabs).
+
+-------------------------------------------------------------------
+Wed Jan 25 14:38:59 UTC 2017 - fbui@suse.com
+
+- Import commit 2559bc0c076b58f0a649056e79ca90fe5f1d556c
+
+  9c4a759ab systemctl: 'show' don't exit with a failure status if the requested property does not exist [SUSE] (bsc#1021062)
+  f9194193b systemctl: remove duplicate entries showed by list-dependencies (#5049) (bsc#1012266)
+  2a6653335 rule: don't automatically online standby memory on s390x (bsc#997682)
+
+-------------------------------------------------------------------
+Wed Jan 25 14:36:34 UTC 2017 - fbui@suse.com
+
+- Fix permission set on /var/lib/systemd/linger/*
+
+  Those files are created by logind which run with umask(0022), so
+  they are not world writable and shouldn't be affected by
+  bsc#1020601. But it's cleaner to not let files forever with their
+  setuid bit set for no good reason.
+
+-------------------------------------------------------------------
+Wed Jan 25 14:33:04 UTC 2017 - fbui@suse.com
+
+- Fix permissions set on permanent timer timestamp files (bsc#1020601) (CVE-2016-10156)
+
+  This change makes sure to fix the permissions of the timestamp files
+  which could have been created by an affected version of systemd.
+
+  Local unprivileged users could have run arbitrary code as root if
+  systemd previously created world writable suid root files such as
+  permanent timer stamp files.
+
 -------------------------------------------------------------------
 Tue Jan 10 10:54:20 UTC 2017 - fbui@suse.com
 
diff --git a/systemd.spec b/systemd.spec
index 5b84fd7a..c1a405c6 100644
--- a/systemd.spec
+++ b/systemd.spec
@@ -421,43 +421,44 @@ systemd_cryptsetup_LDFLAGS =\\\
 
 # keep split-usr until all packages have moved their systemd rules to /usr
 %configure \
-  --docdir=%{_docdir}/systemd \
-  --with-pamlibdir=/%{_lib}/security \
-  --with-dbuspolicydir=%{_sysconfdir}/dbus-1/system.d \
-  --with-dbussessionservicedir=%{_datadir}/dbus-1/services \
-  --with-dbussystemservicedir=%{_datadir}/dbus-1/system-services \
-  --with-certificate-root=%{_sysconfdir}/pki/systemd \
+        --docdir=%{_docdir}/systemd \
+        --with-pamlibdir=/%{_lib}/security \
+        --with-dbuspolicydir=%{_sysconfdir}/dbus-1/system.d \
+        --with-dbussessionservicedir=%{_datadir}/dbus-1/services \
+        --with-dbussystemservicedir=%{_datadir}/dbus-1/system-services \
+        --with-certificate-root=%{_sysconfdir}/pki/systemd \
 %if 0%{?bootstrap}
-  --disable-myhostname \
-  --disable-manpages \
+        --disable-myhostname \
+        --disable-manpages \
 %endif
-  --enable-selinux \
-  --enable-split-usr \
-  --disable-static \
-  --disable-lto \
-  --disable-tests \
-  --without-kill-user-processes \
-  --with-rc-local-script-path-start=/etc/init.d/boot.local \
-  --with-rc-local-script-path-stop=/etc/init.d/halt.local \
-  --with-debug-shell=/bin/bash \
-  --disable-smack \
-  --disable-ima \
-  --disable-adm-group \
-  --disable-wheel-group \
+        --enable-selinux \
+        --enable-split-usr \
+        --disable-static \
+        --disable-lto \
+        --disable-tests \
+        --without-kill-user-processes \
+        --with-rc-local-script-path-start=/etc/init.d/boot.local \
+        --with-rc-local-script-path-stop=/etc/init.d/halt.local \
+        --with-debug-shell=/bin/bash \
+        --disable-smack \
+        --disable-ima \
+        --disable-adm-group \
+        --disable-wheel-group \
+        --disable-ldconfig \
 %if %{without networkd}
-  --disable-networkd \
+        --disable-networkd \
 %endif
 %if %{without machined}
-  --disable-machined \
+        --disable-machined \
 %endif
 %if %{without sysvcompat}
-  --with-sysvinit-path= \
-  --with-sysvrcnd-path= \
+        --with-sysvinit-path= \
+        --with-sysvrcnd-path= \
 %endif
 %if %{without resolved}
-  --disable-resolved \
+        --disable-resolved \
 %endif
-  --disable-kdbus
+        --disable-kdbus
 
 make %{?_smp_mflags} V=e
 
@@ -661,24 +662,24 @@ systemctl daemon-reexec  || :
 
 # Try to read default runlevel from the old inittab if it exists
 if [ ! -e /etc/systemd/system/default.target -a -e /etc/inittab ]; then
-  runlevel=$(awk -F ':' '$3 == "initdefault" && $1 !~ "^#" { print $2 }' /etc/inittab)
-  if [ -n "$runlevel" ] ; then
-    ln -sf /usr/lib/systemd/system/runlevel$runlevel.target /etc/systemd/system/default.target || :
-  fi
+        runlevel=$(awk -F ':' '$3 == "initdefault" && $1 !~ "^#" { print $2 }' /etc/inittab)
+        if [ -n "$runlevel" ] ; then
+                ln -sf /usr/lib/systemd/system/runlevel$runlevel.target /etc/systemd/system/default.target || :
+        fi
 fi
 
 # Create default config in /etc at first install.
 # Later package updates should not overwrite these settings.
 if [ $1 -eq 1 ]; then
-  # Enable systemd services according to the distro defaults.
-  # Note: systemctl might abort prematurely if it fails on one
-  # unit.
-  systemctl preset remote-fs.target || :
-  systemctl preset getty@.service   || :
-  systemctl preset systemd-networkd.service || :
-  systemctl preset systemd-networkd-wait-online.service || :
-  systemctl preset systemd-timesyncd.service || :
-  systemctl preset systemd-resolved.service  || :
+        # Enable systemd services according to the distro defaults.
+        # Note: systemctl might abort prematurely if it fails on one
+        # unit.
+        systemctl preset remote-fs.target || :
+        systemctl preset getty@.service   || :
+        systemctl preset systemd-networkd.service || :
+        systemctl preset systemd-networkd-wait-online.service || :
+        systemctl preset systemd-timesyncd.service || :
+        systemctl preset systemd-resolved.service  || :
 fi >/dev/null
 
 # since v207 /etc/sysctl.conf is no longer parsed, however
@@ -689,8 +690,8 @@ fi
 
 # migrate any symlink which may refer to the old path
 for f in $(find /etc/systemd/system -type l -xtype l); do
-  new_target="/usr$(readlink $f)"
-  [ -f "$new_target" ] && ln -s -f $new_target $f || :
+        new_target="/usr$(readlink $f)"
+        [ -f "$new_target" ] && ln -s -f $new_target $f || :
 done
 
 # Keep tmp.mount if it's been enabled explicitly by the user otherwise
@@ -703,6 +704,18 @@ enabled)  ;;
 *)        rm -f %{_prefix}/lib/systemd/system/tmp.mount
 esac
 
+# Same for user lingering created by logind.
+for username in $(ls /var/lib/systemd/linger/* 2>/dev/null); do
+        chmod 0644 $username
+done
+
+# v228 wrongly set world writable suid root permissions on timestamp
+# files used by permanent timers. Fix the timestamps that might have
+# been created by the affected versions of systemd (bsc#1020601).
+for stamp in $(ls /var/lib/systemd/timers/stamp-*.timer 2>/dev/null); do
+        chmod 0644 $stamp
+done
+
 # Convert /var/lib/machines subvolume to make it suitable for
 # rollbacks, if needed. See bsc#992573. The installer has been fixed
 # to create it at installation time.
@@ -731,35 +744,36 @@ if [ $1 -ge 1 ]; then
 fi
 %if ! 0%{?bootstrap}
 if [ $1 -eq 0 ]; then
-  pam-config -d --systemd || :
+        pam-config -d --systemd || :
 fi
 %endif
 
 %preun
 if [ $1 -eq 0 ]; then
-  systemctl disable remote-fs.target || :
-  systemctl disable getty@.service   || :
-  systemctl disable systemd-networkd.service || :
-  systemctl disable systemd-networkd-wait-online.service || :
-  systemctl disable systemd-timesyncd.service || :
-  systemctl disable systemd-resolved.service  || :
+        systemctl disable remote-fs.target || :
+        systemctl disable getty@.service   || :
+        systemctl disable systemd-networkd.service || :
+        systemctl disable systemd-networkd-wait-online.service || :
+        systemctl disable systemd-timesyncd.service || :
+        systemctl disable systemd-resolved.service  || :
 
-  rm -f /etc/systemd/system/default.target
+        rm -f /etc/systemd/system/default.target
 fi >/dev/null
 
 %pretrans -n udev%{?mini} -p <lua>
 if posix.stat("/lib/udev") and not posix.stat("/usr/lib/udev") then
-  posix.symlink("/lib/udev", "/usr/lib/udev")
+   posix.symlink("/lib/udev", "/usr/lib/udev")
 end
 
 %pre -n udev%{?mini}
- %regenerate_initrd_post
+%regenerate_initrd_post
+
 if test -L /usr/lib/udev -a /lib/udev -ef /usr/lib/udev ; then
-  rm /usr/lib/udev
-  mv /lib/udev /usr/lib
-  ln -s /usr/lib/udev /lib/udev
+        rm /usr/lib/udev
+        mv /lib/udev /usr/lib
+        ln -s /usr/lib/udev /lib/udev
 elif [ ! -e /lib/udev ]; then
-  ln -s /usr/lib/udev /lib/udev
+        ln -s /usr/lib/udev /lib/udev
 fi
 
 # Create "tape"/"input" group which is referenced by some udev rules
@@ -804,8 +818,8 @@ systemctl daemon-reload || :
 %post logger
 systemd-tmpfiles --create --prefix=%{_localstatedir}/log/journal/ || :
 if [ "$1" -eq 1 ]; then
-# tell journal to start logging on disk if directory didn't exist before
-  systemctl --no-block restart systemd-journal-flush.service >/dev/null || :
+        # tell journal to start logging on disk if directory didn't exist before
+        systemctl --no-block restart systemd-journal-flush.service >/dev/null || :
 fi
 
 %post   -n nss-myhostname -p /sbin/ldconfig