Pisilinux/core
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

polkit-0.120

Browse Source
This commit is contained in:
Rmys
2022-07-05 10:02:49 +03:00
committed by GitHub
parent 72131b536a
commit f7dcaa0f62
5 changed files with 169 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
system/base/polkit/actions.py
+2 -1
View File
@@ -21,8 +21,9 @@ def setup():
--with-dbus \ --with-dbus \
--enable-examples \ --enable-examples \
--enable-introspection \ --enable-introspection \
--disable-libsystemd-login \
--with-systemdsystemunitdir=no \ --with-systemdsystemunitdir=no \
--enable-libsystemd-login=no \
--enable-libelogind=yes \
--disable-man-pages \ --disable-man-pages \
--disable-gtk-doc \ --disable-gtk-doc \
--disable-static") --disable-static")
system/base/polkit/files/CVE-2021-4034.patch
+79
View File
@@ -0,0 +1,79 @@
From a2bf5c9c83b6ae46cbd5c779d3055bff81ded683 Mon Sep 17 00:00:00 2001
From: Jan Rybar <jrybar@redhat.com>
Date: Tue, 25 Jan 2022 17:21:46 +0000
Subject: [PATCH] pkexec: local privilege escalation (CVE-2021-4034)
---
src/programs/pkcheck.c | 5 +++++
src/programs/pkexec.c | 23 ++++++++++++++++++++---
2 files changed, 25 insertions(+), 3 deletions(-)
diff --git a/src/programs/pkcheck.c b/src/programs/pkcheck.c
index f1bb4e1..768525c 100644
--- a/src/programs/pkcheck.c
+++ b/src/programs/pkcheck.c
@@ -363,6 +363,11 @@ main (int argc, char *argv[])
local_agent_handle = NULL;
ret = 126;
+ if (argc < 1)
+ {
+ exit(126);
+ }
+
/* Disable remote file access from GIO. */
setenv ("GIO_USE_VFS", "local", 1);
diff --git a/src/programs/pkexec.c b/src/programs/pkexec.c
index 7698c5c..84e5ef6 100644
--- a/src/programs/pkexec.c
+++ b/src/programs/pkexec.c
@@ -488,6 +488,15 @@ main (int argc, char *argv[])
pid_t pid_of_caller;
gpointer local_agent_handle;
+
+ /*
+ * If 'pkexec' is called THIS wrong, someone's probably evil-doing. Don't be nice, just bail out.
+ */
+ if (argc<1)
+ {
+ exit(127);
+ }
+
ret = 127;
authority = NULL;
subject = NULL;
@@ -614,10 +623,10 @@ main (int argc, char *argv[])
path = g_strdup (pwstruct.pw_shell);
if (!path)
- {
+ {
g_printerr ("No shell configured or error retrieving pw_shell\n");
goto out;
- }
+ }
/* If you change this, be sure to change the if (!command_line)
case below too */
command_line = g_strdup (path);
@@ -636,7 +645,15 @@ main (int argc, char *argv[])
goto out;
}
g_free (path);
- argv[n] = path = s;
+ path = s;
+
+ /* argc<2 and pkexec runs just shell, argv is guaranteed to be null-terminated.
+ * /-less shell shouldn't happen, but let's be defensive and don't write to null-termination
+ */
+ if (argv[n] != NULL)
+ {
+ argv[n] = path;
+ }
}
if (access (path, F_OK) != 0)
{
--
GitLab
system/base/polkit/files/CVE-2021-4115.patch
+71
View File
@@ -0,0 +1,71 @@
diff --git a/src/polkit/polkitsystembusname.c b/src/polkit/polkitsystembusname.c
index 8ed1363..2fbf5f1 100644
--- a/src/polkit/polkitsystembusname.c
+++ b/src/polkit/polkitsystembusname.c
@@ -62,6 +62,10 @@ enum
PROP_NAME,
};
+
+guint8 dbus_call_respond_fails; // has to be global because of callback
+
+
static void subject_iface_init (PolkitSubjectIface *subject_iface);
G_DEFINE_TYPE_WITH_CODE (PolkitSystemBusName, polkit_system_bus_name, G_TYPE_OBJECT,
@@ -364,6 +368,7 @@ on_retrieved_unix_uid_pid (GObject *src,
if (!v)
{
data->caught_error = TRUE;
+ dbus_call_respond_fails += 1;
}
else
{
@@ -405,6 +410,8 @@ polkit_system_bus_name_get_creds_sync (PolkitSystemBusName *system_bus
tmp_context = g_main_context_new ();
g_main_context_push_thread_default (tmp_context);
+ dbus_call_respond_fails = 0;
+
/* Do two async calls as it's basically as fast as one sync call.
*/
g_dbus_connection_call (connection,
@@ -432,11 +439,34 @@ polkit_system_bus_name_get_creds_sync (PolkitSystemBusName *system_bus
on_retrieved_unix_uid_pid,
&data);
- while (!((data.retrieved_uid && data.retrieved_pid) || data.caught_error))
- g_main_context_iteration (tmp_context, TRUE);
+ while (TRUE)
+ {
+ /* If one dbus call returns error, we must wait until the other call
+ * calls _call_finish(), otherwise fd leak is possible.
+ * Resolves: GHSL-2021-077
+ */
- if (data.caught_error)
- goto out;
+ if ( (dbus_call_respond_fails > 1) )
+ {
+ // we got two faults, we can leave
+ goto out;
+ }
+
+ if ((data.caught_error && (data.retrieved_pid || data.retrieved_uid)))
+ {
+ // we got one fault and the other call finally finished, we can leave
+ goto out;
+ }
+
+ if ( !(data.retrieved_uid && data.retrieved_pid) )
+ {
+ g_main_context_iteration (tmp_context, TRUE);
+ }
+ else
+ {
+ break;
+ }
+ }
if (out_uid)
*out_uid = data.uid;
system/base/polkit/files/polkit-0.118-duktape.patch
+4 -4
View File
@@ -64,9 +64,9 @@ index e48b739cc0a4e7606be0271ba4b4e3bd33b08545..9572b067effdf6f0dcd1c6b17b2e8c59
- $(LIBJS_CFLAGS) \ - $(LIBJS_CFLAGS) \
+ $(LIBJS_CFLAGS) \ + $(LIBJS_CFLAGS) \
$(NULL) $(NULL)
libpolkit_backend_1_la_CXXFLAGS = $(libpolkit_backend_1_la_CFLAGS) libpolkit_backend_1_la_CXXFLAGS = $(libpolkit_backend_1_la_CFLAGS)
libpolkit_backend_1_la_LIBADD = \ libpolkit_backend_1_la_LIBADD = \
$(GLIB_LIBS) \ $(GLIB_LIBS) \
+ $(DUKTAPE_LIBS) \ + $(DUKTAPE_LIBS) \
@@ -76,7 +76,7 @@ index e48b739cc0a4e7606be0271ba4b4e3bd33b08545..9572b067effdf6f0dcd1c6b17b2e8c59
- $(LIBJS_LIBS) \ - $(LIBJS_LIBS) \
+ $(LIBJS_LIBS) \ + $(LIBJS_LIBS) \
$(NULL) $(NULL)
+if USE_DUKTAPE +if USE_DUKTAPE
+libpolkit_backend_1_la_SOURCES += polkitbackendduktapeauthority.c +libpolkit_backend_1_la_SOURCES += polkitbackendduktapeauthority.c
+libpolkit_backend_1_la_LIBADD += -lm +libpolkit_backend_1_la_LIBADD += -lm
@@ -86,7 +86,7 @@ index e48b739cc0a4e7606be0271ba4b4e3bd33b08545..9572b067effdf6f0dcd1c6b17b2e8c59
+ +
rulesdir = $(sysconfdir)/polkit-1/rules.d rulesdir = $(sysconfdir)/polkit-1/rules.d
rules_DATA = 50-default.rules rules_DATA = 50-default.rules
diff --git a/src/polkitbackend/polkitbackendduktapeauthority.c b/src/polkitbackend/polkitbackendduktapeauthority.c diff --git a/src/polkitbackend/polkitbackendduktapeauthority.c b/src/polkitbackend/polkitbackendduktapeauthority.c
new file mode 100644 new file mode 100644
index 0000000000000000000000000000000000000000..ae984535ed88003ab1b0965e3e109a848479c047 index 0000000000000000000000000000000000000000..ae984535ed88003ab1b0965e3e109a848479c047
system/base/polkit/pspec.xml
+13 -4
View File
@@ -14,7 +14,7 @@
<IsA>app:console</IsA> <IsA>app:console</IsA>
<Summary>PolicyKit Authorization Framework</Summary> <Summary>PolicyKit Authorization Framework</Summary>
<Description>polkit is a toolkit for defining and handling authorizations. It is used for allowing unprivileged processes to speak to privileged processes.</Description> <Description>polkit is a toolkit for defining and handling authorizations. It is used for allowing unprivileged processes to speak to privileged processes.</Description>
<Archive sha1sum="0794825e31a0a6e4859f93596d3f475b9d08f9e1" type="targz">http://www.freedesktop.org/software/polkit/releases/polkit-0.119.tar.gz</Archive> <Archive sha1sum="75d5885251eef36b28851e095120bc1f60714160" type="targz">http://www.freedesktop.org/software/polkit/releases/polkit-0.120.tar.gz</Archive>
<BuildDependencies> <BuildDependencies>
<Dependency>python3</Dependency> <Dependency>python3</Dependency>
<Dependency>dbus-devel</Dependency> <Dependency>dbus-devel</Dependency>
@@ -23,7 +23,7 @@
<Dependency>expat-devel</Dependency> <Dependency>expat-devel</Dependency>
<Dependency>duktape-devel</Dependency> <Dependency>duktape-devel</Dependency>
<Dependency>gettext-devel</Dependency> <Dependency>gettext-devel</Dependency>
<Dependency>elogind-devel</Dependency> <!-- <Dependency>elogind-devel</Dependency> -->
<!--Dependency versionFrom="68.12.0">spidermonkey-devel</Dependency--> <!--Dependency versionFrom="68.12.0">spidermonkey-devel</Dependency-->
<Dependency>gobject-introspection-devel</Dependency> <Dependency>gobject-introspection-devel</Dependency>
<Dependency>intltool</Dependency> <Dependency>intltool</Dependency>
@@ -33,6 +33,8 @@
<Patch level="1">polkit-0.118-duktape.patch</Patch> <Patch level="1">polkit-0.118-duktape.patch</Patch>
<Patch level="1">polkit-0.118-elogind.patch</Patch> <Patch level="1">polkit-0.118-elogind.patch</Patch>
<Patch level="1">use-system-locale-in-gobject-api.diff</Patch> <Patch level="1">use-system-locale-in-gobject-api.diff</Patch>
<Patch level="1">CVE-2021-4034.patch</Patch>
<Patch level="1">CVE-2021-4115.patch</Patch>
</Patches> </Patches>
</Source> </Source>
@@ -92,6 +94,13 @@
</Package> </Package>
<History> <History>
<Update release="15">
<Date>2022-07-05</Date>
<Version>0.120</Version>
<Comment>Version bump.</Comment>
<Name>Mustafa Cinasal</Name>
<Email>muscnsl@gmail.com</Email>
</Update>
<Update release="14"> <Update release="14">
<Date>2021-09-22</Date> <Date>2021-09-22</Date>
<Version>0.119</Version> <Version>0.119</Version>
@@ -99,14 +108,14 @@
<Name>Mustafa Cinasal</Name> <Name>Mustafa Cinasal</Name>
<Email>muscnsl@gmail.com</Email> <Email>muscnsl@gmail.com</Email>
</Update> </Update>
<Update release="13"> <Update release="13">
<Date>2021-07-08</Date> <Date>2021-07-08</Date>
<Version>0.118</Version> <Version>0.118</Version>
<Comment>Rebuild.</Comment> <Comment>Rebuild.</Comment>
<Name>Mustafa Cinasal</Name> <Name>Mustafa Cinasal</Name>
<Email>muscnsl@gmail.com</Email> <Email>muscnsl@gmail.com</Email>
</Update> </Update>
<Update release="12"> <Update release="12">
<Date>2021-06-08</Date> <Date>2021-06-08</Date>
<Version>0.118</Version> <Version>0.118</Version>
<Comment>Rebuild.</Comment> <Comment>Rebuild.</Comment>