wallenstein/void-packages
1
0
Fork 0
mirror of https://github.com/void-linux/void-packages.git synced 2025-06-08 08:03:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

polkit: update to 121.

Browse source 
* switch to meson
* use duktape instead of mozjs
This commit is contained in:
Michal Vasilek 2022-09-10 13:35:19 +02:00
parent ddf5fda555
commit e971fbddc8
5 changed files with 274 additions and 190 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

79
srcpkgs/polkit/patches/CVE-2021-4034.patch
View file

@ -1,79 +0,0 @@
From a2bf5c9c83b6ae46cbd5c779d3055bff81ded683 Mon Sep 17 00:00:00 2001
From: Jan Rybar <jrybar@redhat.com>
Date: Tue, 25 Jan 2022 17:21:46 +0000
Subject: [PATCH] pkexec: local privilege escalation (CVE-2021-4034)
---
src/programs/pkcheck.c | 5 +++++
src/programs/pkexec.c | 23 ++++++++++++++++++++---
2 files changed, 25 insertions(+), 3 deletions(-)
diff --git a/src/programs/pkcheck.c b/src/programs/pkcheck.c
index f1bb4e1..768525c 100644
--- a/src/programs/pkcheck.c
+++ b/src/programs/pkcheck.c
@@ -363,6 +363,11 @@ main (int argc, char *argv[])
local_agent_handle = NULL;
ret = 126;
+ if (argc < 1)
+ {
+ exit(126);
+ }
+
/* Disable remote file access from GIO. */
setenv ("GIO_USE_VFS", "local", 1);
diff --git a/src/programs/pkexec.c b/src/programs/pkexec.c
index 7698c5c..84e5ef6 100644
--- a/src/programs/pkexec.c
+++ b/src/programs/pkexec.c
@@ -488,6 +488,15 @@ main (int argc, char *argv[])
pid_t pid_of_caller;
gpointer local_agent_handle;
+
+ /*
+ * If 'pkexec' is called THIS wrong, someone's probably evil-doing. Don't be nice, just bail out.
+ */
+ if (argc<1)
+ {
+ exit(127);
+ }
+
ret = 127;
authority = NULL;
subject = NULL;
@@ -614,10 +623,10 @@ main (int argc, char *argv[])
path = g_strdup (pwstruct.pw_shell);
if (!path)
- {
+ {
g_printerr ("No shell configured or error retrieving pw_shell\n");
goto out;
- }
+ }
/* If you change this, be sure to change the if (!command_line)
case below too */
command_line = g_strdup (path);
@@ -636,7 +645,15 @@ main (int argc, char *argv[])
goto out;
}
g_free (path);
- argv[n] = path = s;
+ path = s;
+
+ /* argc<2 and pkexec runs just shell, argv is guaranteed to be null-terminated.
+ * /-less shell shouldn't happen, but let's be defensive and don't write to null-termination
+ */
+ if (argv[n] != NULL)
+ {
+ argv[n] = path;
+ }
}
if (access (path, F_OK) != 0)
{
--
GitLab

29
srcpkgs/polkit/patches/fix-elogind.patch
View file

@ -1,29 +0,0 @@
Upstream: Pending, https://bugs.freedesktop.org/show_bug.cgi?id=105989
From 08bb656496cd3d6213bbe9473f63f2d4a110da6e Mon Sep 17 00:00:00 2001
From: Rasmus Thomsen <cogitri@exherbo.org>
Date: Wed, 11 Apr 2018 13:14:14 +0200
Subject: [PATCH] configure: fix elogind support
HAVE_LIBSYSTEMD is used to determine which source files to use.
We have to check if either have_libsystemd or have_libelogind is
true, as both of these need the source files which are used when
HAVE_LIBSYSTEMD is true.
---
configure.ac | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git configure.ac configure.ac
index 36df239..da47ecb 100644
--- a/configure.ac
+++ b/configure.ac
@@ -221,7 +221,7 @@ AS_IF([test "x$cross_compiling" != "xyes" ], [
AC_SUBST(LIBSYSTEMD_CFLAGS)
AC_SUBST(LIBSYSTEMD_LIBS)
-AM_CONDITIONAL(HAVE_LIBSYSTEMD, [test "$have_libsystemd" = "yes"], [Using libsystemd])
+AM_CONDITIONAL(HAVE_LIBSYSTEMD, [test "$have_libsystemd" = "yes" || test "$have_libelogind" = "yes" ], [Using libsystemd])
dnl ---------------------------------------------------------------------------
dnl - systemd unit / service files
--
2.17.0

68
srcpkgs/polkit/patches/make-innetgr-optional.patch
View file

@ -1,68 +0,0 @@
--- a/configure.ac
+++ b/configure.ac
@@ -99,7 +99,7 @@ AC_CHECK_LIB(expat,XML_ParserCreate,[EXPAT_LIBS="-lexpat"],
[AC_MSG_ERROR([Can't find expat library. Please install expat.])])
AC_SUBST(EXPAT_LIBS)
-AC_CHECK_FUNCS(clearenv fdatasync)
+AC_CHECK_FUNCS(clearenv fdatasync getnetgrent)
if test "x$GCC" = "xyes"; then
LDFLAGS="-Wl,--as-needed $LDFLAGS"
--- a/src/polkitbackend/polkitbackendinteractiveauthority.c
+++ b/src/polkitbackend/polkitbackendinteractiveauthority.c
@@ -2228,6 +2228,7 @@ get_users_in_net_group (PolkitIdentity *group,
ret = NULL;
name = polkit_unix_netgroup_get_name (POLKIT_UNIX_NETGROUP (group));
+#if defined HAVE_GETNETGRENT
#ifdef HAVE_SETNETGRENT_RETURN
if (setnetgrent (name) == 0)
{
@@ -2236,6 +2237,7 @@ get_users_in_net_group (PolkitIdentity *group,
}
#else
setnetgrent (name);
+#endif
#endif
for (;;)
@@ -2248,8 +2250,10 @@ get_users_in_net_group (PolkitIdentity *group,
PolkitIdentity *user;
GError *error = NULL;
+#if defined HAVE_GETNETGRENT
if (getnetgrent (&hostname, &username, &domainname) == 0)
break;
+#endif
/* Skip NULL entries since we never want to make everyone an admin
* Skip "-" entries which mean "no match ever" in netgroup land */
@@ -2274,7 +2278,9 @@ get_users_in_net_group (PolkitIdentity *group,
ret = g_list_reverse (ret);
out:
+#if defined HAVE_GETNETGRENT
endnetgrent ();
+#endif
return ret;
}
--- a/src/polkitbackend/polkitbackendjsauthority.cpp
+++ b/src/polkitbackend/polkitbackendjsauthority.cpp
@@ -1502,6 +1502,7 @@
JS::CallArgs args = JS::CallArgsFromVp (argc, vp);
+#if defined HAVE_GETNETGRENT
JS::RootedString usrstr (authority->priv->cx);
usrstr = args[0].toString();
user = JS_EncodeStringToUTF8 (cx, usrstr);
@@ -1521,6 +1522,7 @@
JS_free (cx, user);
ret = true;
+#endif
args.rval ().setBoolean (is_in_netgroup);

258
srcpkgs/polkit/patches/make-netgroup-support-optional.patch Normal file
View file

@ -0,0 +1,258 @@
From b57deee8178190a7ecc75290fa13cf7daabc2c66 Mon Sep 17 00:00:00 2001
From: "A. Wilcox" <AWilcox@Wilcox-Tech.com>
Date: Sun, 15 May 2022 05:04:10 +0000
Subject: [PATCH] Make netgroup support optional
On at least Linux/musl and Linux/uclibc, netgroup support is not
available. PolKit fails to compile on these systems for that reason.
This change makes netgroup support conditional on the presence of the
setnetgrent(3) function which is required for the support to work. If
that function is not available on the system, an error will be returned
to the administrator if unix-netgroup: is specified in configuration.
(sam: rebased for Meson and Duktape.)
Closes: https://gitlab.freedesktop.org/polkit/polkit/-/issues/14
Closes: https://gitlab.freedesktop.org/polkit/polkit/-/issues/163
Closes: https://gitlab.freedesktop.org/polkit/polkit/-/merge_requests/52
Signed-off-by: A. Wilcox <AWilcox@Wilcox-Tech.com>
---
meson.build | 1 +
src/polkit/polkitidentity.c | 17 +++++++++++++++++
src/polkit/polkitunixnetgroup.c | 3 +++
.../polkitbackendduktapeauthority.c | 4 ++--
.../polkitbackendinteractiveauthority.c | 14 ++++++++------
src/polkitbackend/polkitbackendjsauthority.cpp | 2 ++
test/polkit/polkitidentitytest.c | 8 +++++++-
test/polkit/polkitunixnetgrouptest.c | 2 ++
.../test-polkitbackendjsauthority.c | 2 ++
9 files changed, 44 insertions(+), 9 deletions(-)
diff --git a/meson.build b/meson.build
index 908f0aa..66c4e9b 100644
--- a/meson.build
+++ b/meson.build
@@ -89,6 +89,7 @@ config_h.set('_GNU_SOURCE', true)
check_functions = [
'clearenv',
'fdatasync',
+ 'setnetgrent',
]
foreach func: check_functions
diff --git a/src/polkit/polkitidentity.c b/src/polkit/polkitidentity.c
index 3aa1f7f..793f17d 100644
--- a/src/polkit/polkitidentity.c
+++ b/src/polkit/polkitidentity.c
@@ -182,7 +182,15 @@ polkit_identity_from_string (const gchar *str,
}
else if (g_str_has_prefix (str, "unix-netgroup:"))
{
+#ifndef HAVE_SETNETGRENT
+ g_set_error (error,
+ POLKIT_ERROR,
+ POLKIT_ERROR_FAILED,
+ "Netgroups are not available on this machine ('%s')",
+ str);
+#else
identity = polkit_unix_netgroup_new (str + sizeof "unix-netgroup:" - 1);
+#endif
}
if (identity == NULL && (error != NULL && *error == NULL))
@@ -344,6 +352,14 @@ polkit_identity_new_for_gvariant (GVariant *variant,
GVariant *v;
const char *name;
+#ifndef HAVE_SETNETGRENT
+ g_set_error (error,
+ POLKIT_ERROR,
+ POLKIT_ERROR_FAILED,
+ "Netgroups are not available on this machine");
+ goto out;
+#else
+
v = lookup_asv (details_gvariant, "name", G_VARIANT_TYPE_STRING, error);
if (v == NULL)
{
@@ -353,6 +369,7 @@ polkit_identity_new_for_gvariant (GVariant *variant,
name = g_variant_get_string (v, NULL);
ret = polkit_unix_netgroup_new (name);
g_variant_unref (v);
+#endif
}
else
{
diff --git a/src/polkit/polkitunixnetgroup.c b/src/polkit/polkitunixnetgroup.c
index 8a2b369..83f8d4a 100644
--- a/src/polkit/polkitunixnetgroup.c
+++ b/src/polkit/polkitunixnetgroup.c
@@ -194,6 +194,9 @@ polkit_unix_netgroup_set_name (PolkitUnixNetgroup *group,
PolkitIdentity *
polkit_unix_netgroup_new (const gchar *name)
{
+#ifndef HAVE_SETNETGRENT
+ g_assert_not_reached();
+#endif
g_return_val_if_fail (name != NULL, NULL);
return POLKIT_IDENTITY (g_object_new (POLKIT_TYPE_UNIX_NETGROUP,
"name", name,
diff --git a/src/polkitbackend/polkitbackendduktapeauthority.c b/src/polkitbackend/polkitbackendduktapeauthority.c
index c89dbcf..f4b4304 100644
--- a/src/polkitbackend/polkitbackendduktapeauthority.c
+++ b/src/polkitbackend/polkitbackendduktapeauthority.c
@@ -1035,7 +1035,7 @@ js_polkit_user_is_in_netgroup (duk_context *cx)
user = duk_require_string (cx, 0);
netgroup = duk_require_string (cx, 1);
-
+#ifdef HAVE_SETNETGRENT
if (innetgr (netgroup,
NULL, /* host */
user,
@@ -1043,7 +1043,7 @@ js_polkit_user_is_in_netgroup (duk_context *cx)
{
is_in_netgroup = TRUE;
}
-
+#endif
duk_push_boolean (cx, is_in_netgroup);
return 1;
}
diff --git a/src/polkitbackend/polkitbackendinteractiveauthority.c b/src/polkitbackend/polkitbackendinteractiveauthority.c
index d935a7a..1cfc88e 100644
--- a/src/polkitbackend/polkitbackendinteractiveauthority.c
+++ b/src/polkitbackend/polkitbackendinteractiveauthority.c
@@ -2248,25 +2248,26 @@ get_users_in_net_group (PolkitIdentity *group,
GList *ret;
ret = NULL;
+#ifdef HAVE_SETNETGRENT
name = polkit_unix_netgroup_get_name (POLKIT_UNIX_NETGROUP (group));
-#ifdef HAVE_SETNETGRENT_RETURN
+# ifdef HAVE_SETNETGRENT_RETURN
if (setnetgrent (name) == 0)
{
g_warning ("Error looking up net group with name %s: %s", name, g_strerror (errno));
goto out;
}
-#else
+# else
setnetgrent (name);
-#endif
+# endif /* HAVE_SETNETGRENT_RETURN */
for (;;)
{
-#if defined(HAVE_NETBSD) || defined(HAVE_OPENBSD)
+# if defined(HAVE_NETBSD) || defined(HAVE_OPENBSD)
const char *hostname, *username, *domainname;
-#else
+# else
char *hostname, *username, *domainname;
-#endif
+# endif /* defined(HAVE_NETBSD) || defined(HAVE_OPENBSD) */
PolkitIdentity *user;
GError *error = NULL;
@@ -2297,6 +2298,7 @@ get_users_in_net_group (PolkitIdentity *group,
out:
endnetgrent ();
+#endif /* HAVE_SETNETGRENT */
return ret;
}
diff --git a/src/polkitbackend/polkitbackendjsauthority.cpp b/src/polkitbackend/polkitbackendjsauthority.cpp
index 2568e8e..999269b 100644
--- a/src/polkitbackend/polkitbackendjsauthority.cpp
+++ b/src/polkitbackend/polkitbackendjsauthority.cpp
@@ -1271,6 +1271,7 @@ js_polkit_user_is_in_netgroup (JSContext *cx,
JS::CallArgs args = JS::CallArgsFromVp (argc, vp);
+#ifdef HAVE_SETNETGRENT
JS::RootedString usrstr (authority->priv->cx);
usrstr = args[0].toString();
user = JS_EncodeStringToUTF8 (cx, usrstr);
@@ -1285,6 +1286,7 @@ js_polkit_user_is_in_netgroup (JSContext *cx,
{
is_in_netgroup = true;
}
+#endif
ret = true;
diff --git a/test/polkit/polkitidentitytest.c b/test/polkit/polkitidentitytest.c
index e91967b..2635c4c 100644
--- a/test/polkit/polkitidentitytest.c
+++ b/test/polkit/polkitidentitytest.c
@@ -145,11 +145,15 @@ struct ComparisonTestData comparison_test_data [] = {
{"unix-group:root", "unix-group:jane", FALSE},
{"unix-group:jane", "unix-group:jane", TRUE},
+#ifdef HAVE_SETNETGRENT
{"unix-netgroup:foo", "unix-netgroup:foo", TRUE},
{"unix-netgroup:foo", "unix-netgroup:bar", FALSE},
+#endif
{"unix-user:root", "unix-group:root", FALSE},
+#ifdef HAVE_SETNETGRENT
{"unix-user:jane", "unix-netgroup:foo", FALSE},
+#endif
{NULL},
};
@@ -181,11 +185,13 @@ main (int argc, char *argv[])
g_test_add_data_func ("/PolkitIdentity/group_string_2", "unix-group:jane", test_string);
g_test_add_data_func ("/PolkitIdentity/group_string_3", "unix-group:users", test_string);
+#ifdef HAVE_SETNETGRENT
g_test_add_data_func ("/PolkitIdentity/netgroup_string", "unix-netgroup:foo", test_string);
+ g_test_add_data_func ("/PolkitIdentity/netgroup_gvariant", "unix-netgroup:foo", test_gvariant);
+#endif
g_test_add_data_func ("/PolkitIdentity/user_gvariant", "unix-user:root", test_gvariant);
g_test_add_data_func ("/PolkitIdentity/group_gvariant", "unix-group:root", test_gvariant);
- g_test_add_data_func ("/PolkitIdentity/netgroup_gvariant", "unix-netgroup:foo", test_gvariant);
add_comparison_tests ();
diff --git a/test/polkit/polkitunixnetgrouptest.c b/test/polkit/polkitunixnetgrouptest.c
index 3701ba1..e1d211e 100644
--- a/test/polkit/polkitunixnetgrouptest.c
+++ b/test/polkit/polkitunixnetgrouptest.c
@@ -69,7 +69,9 @@ int
main (int argc, char *argv[])
{
g_test_init (&argc, &argv, NULL);
+#ifdef HAVE_SETNETGRENT
g_test_add_func ("/PolkitUnixNetgroup/new", test_new);
g_test_add_func ("/PolkitUnixNetgroup/set_name", test_set_name);
+#endif
return g_test_run ();
}
diff --git a/test/polkitbackend/test-polkitbackendjsauthority.c b/test/polkitbackend/test-polkitbackendjsauthority.c
index 2103b17..b187a2f 100644
--- a/test/polkitbackend/test-polkitbackendjsauthority.c
+++ b/test/polkitbackend/test-polkitbackendjsauthority.c
@@ -137,12 +137,14 @@ test_get_admin_identities (void)
"unix-group:users"
}
},
+#ifdef HAVE_SETNETGRENT
{
"net.company.action3",
{
"unix-netgroup:foo"
}
},
+#endif
};
guint n;
--
GitLab

30
srcpkgs/polkit/template
View file

@ -1,17 +1,18 @@
# Template file for 'polkit'
pkgname=polkit
version=0.120
version=121
revision=1
build_style=gnu-configure
wrksrc="polkit-v.${version}"
build_style=meson
build_helper=gir
configure_args="$(vopt_enable gir introspection) -disable-static
--with-authfw=pam --with-os-type=void"
configure_args="$(vopt_bool gir introspection) -Dman=true
-Dsession_tracking=libelogind -Dsystemdsystemunitdir=/usr/lib/systemd/user"
make_dirs="
/etc/polkit-1/rules.d 0700 polkitd polkitd
/usr/share/polkit-1/rules.d 0700 polkitd polkitd"
hostmakedepends="autoconf-archive automake gettext-devel glib-devel
gobject-introspection gtk-doc intltool libtool pkg-config"
makedepends="elogind-devel mozjs78-devel pam-devel"
hostmakedepends="pkg-config gettext glib-devel perl
libxslt docbook-xsl"
makedepends="libglib-devel elogind-devel duktape-devel pam-devel"
checkdepends="python3-dbus python3-dbusmock"
short_desc="Authorization Toolkit"
maintainer="Enno Boland <gottox@voidlinux.org>"
@ -19,7 +20,7 @@ license="GPL-2.0-or-later"
homepage="https://www.freedesktop.org/wiki/Software/polkit"
changelog="https://gitlab.freedesktop.org/polkit/polkit/-/raw/master/NEWS"
distfiles="${FREEDESKTOP_SITE}/${pkgname}/releases/${pkgname}-${version}.tar.gz"
checksum=ee7a599a853117bf273548725719fa92fabd2f136915c7a4906cee98567aee03
checksum=9dc7ae341a797c994a5a36da21963f0c5c8e3e5a1780ccc2a5f52e7be01affaa
system_accounts="polkitd"
#replaces="polkit-elogind>=0"
#provides="polkit-elogind-${version}_${revision}"
@ -33,19 +34,20 @@ if [ "$XBPS_TARGET_LIBC" = "musl" ]; then
make_check=no
fi
pre_configure() {
autoreconf -fi
# Drop requirement of /sys/fs/cgroup/systemd test in configure... WTF.
vsed -e 's,/sys/fs/cgroup/systemd/,/sys/fs/cgroup,g' -i configure
}
if [ "$XBPS_CHECK_PKGS" ]; then
configure_args+=" -Dtests=true"
fi
post_install() {
vinstall ${FILESDIR}/polkit-1.pam 644 etc/pam.d polkit-1
vsv polkitd
# the build doesn't set setuid bits when not installing as root
chmod u+s ${DESTDIR}/usr/bin/pkexec
chmod u+s ${DESTDIR}/usr/lib/polkit-1/polkit-agent-helper-1
}
polkit-devel_package() {
depends="libglib-devel polkit>=${version}_${revision}"
depends="libglib-devel ${sourcepkg}>=${version}_${revision}"
short_desc+=" - development files"
pkg_install() {
vmove usr/include