gnu: polkit: Fix CVE-2018-19788.
* gnu/packages/patches/polkit-CVE-2018-19788.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it. * gnu/packages/polkit.scm (polkit)[source]: Use it.
This commit is contained in:
Leo Famulari
parent
1f1d6af714
commit
5d3f673db4
|
|
@ -1063,6 +1063,7 @@ dist_patch_DATA = \
|
|||
%D%/packages/patches/plink-endian-detection.patch \
|
||||
%D%/packages/patches/plotutils-libpng-jmpbuf.patch \
|
||||
%D%/packages/patches/podofo-cmake-3.12.patch \
|
||||
%D%/packages/patches/polkit-CVE-2018-19788.patch \
|
||||
%D%/packages/patches/poppler-CVE-2018-19149.patch \
|
||||
%D%/packages/patches/portaudio-audacity-compat.patch \
|
||||
%D%/packages/patches/portmidi-modular-build.patch \
|
||||
|
|
|
|||
|
|
@ -0,0 +1,197 @@
|
|||
Fix CVE-2018-19788:
|
||||
|
||||
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19788
|
||||
https://gitlab.freedesktop.org/polkit/polkit/issues/74
|
||||
|
||||
Patch copied from upstream source repository:
|
||||
|
||||
https://gitlab.freedesktop.org/polkit/polkit/commit/2cb40c4d5feeaa09325522bd7d97910f1b59e379
|
||||
|
||||
From 2cb40c4d5feeaa09325522bd7d97910f1b59e379 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
|
||||
Date: Mon, 3 Dec 2018 10:28:58 +0100
|
||||
Subject: [PATCH] Allow negative uids/gids in PolkitUnixUser and Group objects
|
||||
|
||||
(uid_t) -1 is still used as placeholder to mean "unset". This is OK, since
|
||||
there should be no users with such number, see
|
||||
https://systemd.io/UIDS-GIDS#special-linux-uids.
|
||||
|
||||
(uid_t) -1 is used as the default value in class initialization.
|
||||
|
||||
When a user or group above INT32_MAX is created, the numeric uid or
|
||||
gid wraps around to negative when the value is assigned to gint, and
|
||||
polkit gets confused. Let's accept such gids, except for -1.
|
||||
|
||||
A nicer fix would be to change the underlying type to e.g. uint32 to
|
||||
not have negative values. But this cannot be done without breaking the
|
||||
API, so likely new functions will have to be added (a
|
||||
polkit_unix_user_new variant that takes a unsigned, and the same for
|
||||
_group_new, _set_uid, _get_uid, _set_gid, _get_gid, etc.). This will
|
||||
require a bigger patch.
|
||||
|
||||
Fixes https://gitlab.freedesktop.org/polkit/polkit/issues/74.
|
||||
---
|
||||
src/polkit/polkitunixgroup.c | 15 +++++++++++----
|
||||
src/polkit/polkitunixprocess.c | 12 ++++++++----
|
||||
src/polkit/polkitunixuser.c | 13 ++++++++++---
|
||||
3 files changed, 29 insertions(+), 11 deletions(-)
|
||||
|
||||
diff --git a/src/polkit/polkitunixgroup.c b/src/polkit/polkitunixgroup.c
|
||||
index c57a1aa..309f689 100644
|
||||
--- a/src/polkit/polkitunixgroup.c
|
||||
+++ b/src/polkit/polkitunixgroup.c
|
||||
@@ -71,6 +71,7 @@ G_DEFINE_TYPE_WITH_CODE (PolkitUnixGroup, polkit_unix_group, G_TYPE_OBJECT,
|
||||
static void
|
||||
polkit_unix_group_init (PolkitUnixGroup *unix_group)
|
||||
{
|
||||
+ unix_group->gid = -1; /* (git_t) -1 is not a valid GID under Linux */
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -100,11 +101,14 @@ polkit_unix_group_set_property (GObject *object,
|
||||
GParamSpec *pspec)
|
||||
{
|
||||
PolkitUnixGroup *unix_group = POLKIT_UNIX_GROUP (object);
|
||||
+ gint val;
|
||||
|
||||
switch (prop_id)
|
||||
{
|
||||
case PROP_GID:
|
||||
- unix_group->gid = g_value_get_int (value);
|
||||
+ val = g_value_get_int (value);
|
||||
+ g_return_if_fail (val != -1);
|
||||
+ unix_group->gid = val;
|
||||
break;
|
||||
|
||||
default:
|
||||
@@ -131,9 +135,9 @@ polkit_unix_group_class_init (PolkitUnixGroupClass *klass)
|
||||
g_param_spec_int ("gid",
|
||||
"Group ID",
|
||||
"The UNIX group ID",
|
||||
- 0,
|
||||
+ G_MININT,
|
||||
G_MAXINT,
|
||||
- 0,
|
||||
+ -1,
|
||||
G_PARAM_CONSTRUCT |
|
||||
G_PARAM_READWRITE |
|
||||
G_PARAM_STATIC_NAME |
|
||||
@@ -166,9 +170,10 @@ polkit_unix_group_get_gid (PolkitUnixGroup *group)
|
||||
*/
|
||||
void
|
||||
polkit_unix_group_set_gid (PolkitUnixGroup *group,
|
||||
- gint gid)
|
||||
+ gint gid)
|
||||
{
|
||||
g_return_if_fail (POLKIT_IS_UNIX_GROUP (group));
|
||||
+ g_return_if_fail (gid != -1);
|
||||
group->gid = gid;
|
||||
}
|
||||
|
||||
@@ -183,6 +188,8 @@ polkit_unix_group_set_gid (PolkitUnixGroup *group,
|
||||
PolkitIdentity *
|
||||
polkit_unix_group_new (gint gid)
|
||||
{
|
||||
+ g_return_val_if_fail (gid != -1, NULL);
|
||||
+
|
||||
return POLKIT_IDENTITY (g_object_new (POLKIT_TYPE_UNIX_GROUP,
|
||||
"gid", gid,
|
||||
NULL));
|
||||
diff --git a/src/polkit/polkitunixprocess.c b/src/polkit/polkitunixprocess.c
|
||||
index 972b777..b02b258 100644
|
||||
--- a/src/polkit/polkitunixprocess.c
|
||||
+++ b/src/polkit/polkitunixprocess.c
|
||||
@@ -159,9 +159,14 @@ polkit_unix_process_set_property (GObject *object,
|
||||
polkit_unix_process_set_pid (unix_process, g_value_get_int (value));
|
||||
break;
|
||||
|
||||
- case PROP_UID:
|
||||
- polkit_unix_process_set_uid (unix_process, g_value_get_int (value));
|
||||
+ case PROP_UID: {
|
||||
+ gint val;
|
||||
+
|
||||
+ val = g_value_get_int (value);
|
||||
+ g_return_if_fail (val != -1);
|
||||
+ polkit_unix_process_set_uid (unix_process, val);
|
||||
break;
|
||||
+ }
|
||||
|
||||
case PROP_START_TIME:
|
||||
polkit_unix_process_set_start_time (unix_process, g_value_get_uint64 (value));
|
||||
@@ -239,7 +244,7 @@ polkit_unix_process_class_init (PolkitUnixProcessClass *klass)
|
||||
g_param_spec_int ("uid",
|
||||
"User ID",
|
||||
"The UNIX user ID",
|
||||
- -1,
|
||||
+ G_MININT,
|
||||
G_MAXINT,
|
||||
-1,
|
||||
G_PARAM_CONSTRUCT |
|
||||
@@ -303,7 +308,6 @@ polkit_unix_process_set_uid (PolkitUnixProcess *process,
|
||||
gint uid)
|
||||
{
|
||||
g_return_if_fail (POLKIT_IS_UNIX_PROCESS (process));
|
||||
- g_return_if_fail (uid >= -1);
|
||||
process->uid = uid;
|
||||
}
|
||||
|
||||
diff --git a/src/polkit/polkitunixuser.c b/src/polkit/polkitunixuser.c
|
||||
index 8bfd3a1..234a697 100644
|
||||
--- a/src/polkit/polkitunixuser.c
|
||||
+++ b/src/polkit/polkitunixuser.c
|
||||
@@ -72,6 +72,7 @@ G_DEFINE_TYPE_WITH_CODE (PolkitUnixUser, polkit_unix_user, G_TYPE_OBJECT,
|
||||
static void
|
||||
polkit_unix_user_init (PolkitUnixUser *unix_user)
|
||||
{
|
||||
+ unix_user->uid = -1; /* (uid_t) -1 is not a valid UID under Linux */
|
||||
unix_user->name = NULL;
|
||||
}
|
||||
|
||||
@@ -112,11 +113,14 @@ polkit_unix_user_set_property (GObject *object,
|
||||
GParamSpec *pspec)
|
||||
{
|
||||
PolkitUnixUser *unix_user = POLKIT_UNIX_USER (object);
|
||||
+ gint val;
|
||||
|
||||
switch (prop_id)
|
||||
{
|
||||
case PROP_UID:
|
||||
- unix_user->uid = g_value_get_int (value);
|
||||
+ val = g_value_get_int (value);
|
||||
+ g_return_if_fail (val != -1);
|
||||
+ unix_user->uid = val;
|
||||
break;
|
||||
|
||||
default:
|
||||
@@ -144,9 +148,9 @@ polkit_unix_user_class_init (PolkitUnixUserClass *klass)
|
||||
g_param_spec_int ("uid",
|
||||
"User ID",
|
||||
"The UNIX user ID",
|
||||
- 0,
|
||||
+ G_MININT,
|
||||
G_MAXINT,
|
||||
- 0,
|
||||
+ -1,
|
||||
G_PARAM_CONSTRUCT |
|
||||
G_PARAM_READWRITE |
|
||||
G_PARAM_STATIC_NAME |
|
||||
@@ -182,6 +186,7 @@ polkit_unix_user_set_uid (PolkitUnixUser *user,
|
||||
gint uid)
|
||||
{
|
||||
g_return_if_fail (POLKIT_IS_UNIX_USER (user));
|
||||
+ g_return_if_fail (uid != -1);
|
||||
user->uid = uid;
|
||||
}
|
||||
|
||||
@@ -196,6 +201,8 @@ polkit_unix_user_set_uid (PolkitUnixUser *user,
|
||||
PolkitIdentity *
|
||||
polkit_unix_user_new (gint uid)
|
||||
{
|
||||
+ g_return_val_if_fail (uid != -1, NULL);
|
||||
+
|
||||
return POLKIT_IDENTITY (g_object_new (POLKIT_TYPE_UNIX_USER,
|
||||
"uid", uid,
|
||||
NULL));
|
||||
--
|
||||
2.18.1
|
||||
|
||||
|
|
@ -49,6 +49,7 @@
|
|||
(uri (string-append
|
||||
"https://www.freedesktop.org/software/polkit/releases/"
|
||||
name "-" version ".tar.gz"))
|
||||
(patches (search-patches "polkit-CVE-2018-19788.patch"))
|
||||
(sha256
|
||||
(base32
|
||||
"0c91y61y4gy6p91cwbzg32dhavw4b7fflg370rimqhdxpzdfr1rg"))
|
||||
|
|
|
|||
Loading…
Reference in New Issue