From 2801cc38279830d93870eb77080cc982e88892d2 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Aug 06 2019 10:04:12 +0000 Subject: import gvfs-1.36.2-3.el7 --- diff --git a/SOURCES/admin-Prevent-access-if-any-authentication-agent-isn.patch b/SOURCES/admin-Prevent-access-if-any-authentication-agent-isn.patch new file mode 100644 index 0000000..63b0c74 --- /dev/null +++ b/SOURCES/admin-Prevent-access-if-any-authentication-agent-isn.patch @@ -0,0 +1,42 @@ +From d8d0c8c40049cfd824b2b90d0cd47914052b9811 Mon Sep 17 00:00:00 2001 +From: Ondrej Holy +Date: Wed, 2 Jan 2019 17:13:27 +0100 +Subject: [PATCH] admin: Prevent access if any authentication agent isn't + available + +The backend currently allows to access and modify files without prompting +for password if any polkit authentication agent isn't available. This seems +isn't usually problem, because polkit agents are integral parts of +graphical environments / linux distributions. The agents can't be simply +disabled without root permissions and are automatically respawned. However, +this might be a problem in some non-standard cases. + +This affects only users which belong to wheel group (i.e. those who are +already allowed to use sudo). It doesn't allow privilege escalation for +users, who don't belong to that group. + +Let's return permission denied error also when the subject can't be +authorized by any polkit agent to prevent this behavior. + +Closes: https://gitlab.gnome.org/GNOME/gvfs/issues/355 +--- + daemon/gvfsbackendadmin.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/daemon/gvfsbackendadmin.c b/daemon/gvfsbackendadmin.c +index ec0f2392..0f849008 100644 +--- a/daemon/gvfsbackendadmin.c ++++ b/daemon/gvfsbackendadmin.c +@@ -130,8 +130,7 @@ check_permission (GVfsBackendAdmin *self, + return FALSE; + } + +- is_authorized = polkit_authorization_result_get_is_authorized (result) || +- polkit_authorization_result_get_is_challenge (result); ++ is_authorized = polkit_authorization_result_get_is_authorized (result); + + g_object_unref (result); + +-- +2.20.1 + diff --git a/SOURCES/daemon-Prevent-spawning-new-daemons-if-outgoing-oper.patch b/SOURCES/daemon-Prevent-spawning-new-daemons-if-outgoing-oper.patch new file mode 100644 index 0000000..305c7e5 --- /dev/null +++ b/SOURCES/daemon-Prevent-spawning-new-daemons-if-outgoing-oper.patch @@ -0,0 +1,99 @@ +From 396216f71abf6907efd1383ca0d1a597918cd83d Mon Sep 17 00:00:00 2001 +From: Ondrej Holy +Date: Thu, 11 Oct 2018 17:47:59 +0200 +Subject: [PATCH] daemon: Prevent spawning new daemons if outgoing operation + exists + +A new daemon is always spawned if MountLocation method (or LookupMount for +automounted) is called and the respective mount isn't registered yet. This +is not usually an issue, because the redundant daemons are consequently +terminated. However, this is a problem if mount operations hang for some reason. +This may happen e.g. with trash backend due to stale NFS mounts. Consequently, +new and new daemons are spawned which may lead to system failures due to lack +of system resources. See the following downstream bug report: +https://bugzilla.redhat.com/show_bug.cgi?id=1632960 + +Let's fix that behavior simply by preventing spawning of new daemons if +respective outgoing mount operations exist. + +https://gitlab.gnome.org/GNOME/gvfs/merge_requests/19 +--- + daemon/mount.c | 26 ++++++++++++++++++++++++++ + 1 file changed, 26 insertions(+) + +diff --git a/daemon/mount.c b/daemon/mount.c +index e242666d..33cae597 100644 +--- a/daemon/mount.c ++++ b/daemon/mount.c +@@ -73,6 +73,7 @@ typedef void (*MountCallback) (VfsMountable *mountable, + + static GList *mountables = NULL; + static GList *mounts = NULL; ++static GList *ongoing = NULL; + + static gboolean fuse_available; + +@@ -253,6 +254,7 @@ typedef struct { + char *obj_path; + gboolean spawned; + GVfsDBusSpawner *spawner; ++ GList *pending; /* MountData */ + } MountData; + + static void spawn_mount (MountData *data); +@@ -264,6 +266,7 @@ mount_data_free (MountData *data) + g_mount_spec_unref (data->mount_spec); + g_free (data->obj_path); + g_clear_object (&data->spawner); ++ g_list_free_full (data->pending, (GDestroyNotify) mount_data_free); + + g_free (data); + } +@@ -271,7 +274,17 @@ mount_data_free (MountData *data) + static void + mount_finish (MountData *data, GError *error) + { ++ GList *l; ++ ++ ongoing = g_list_remove (ongoing, data); ++ + data->callback (data->mountable, error, data->user_data); ++ for (l = data->pending; l != NULL; l = l->next) ++ { ++ MountData *pending_data = l->data; ++ pending_data->callback (pending_data->mountable, error, pending_data->user_data); ++ } ++ + mount_data_free (data); + } + +@@ -493,6 +506,7 @@ mountable_mount (VfsMountable *mountable, + gpointer user_data) + { + MountData *data; ++ GList *l; + + data = g_new0 (MountData, 1); + data->automount = automount; +@@ -502,6 +516,18 @@ mountable_mount (VfsMountable *mountable, + data->callback = callback; + data->user_data = user_data; + ++ for (l = ongoing; l != NULL; l = l->next) ++ { ++ MountData *ongoing_data = l->data; ++ if (g_mount_spec_equal (ongoing_data->mount_spec, mount_spec)) ++ { ++ ongoing_data->pending = g_list_append (ongoing_data->pending, data); ++ return; ++ } ++ } ++ ++ ongoing = g_list_append (ongoing, data); ++ + if (mountable->dbus_name == NULL) + spawn_mount (data); + else +-- +2.20.1 + diff --git a/SOURCES/smbbrowse-Force-NT1-protocol-version-for-workgroup-s.patch b/SOURCES/smbbrowse-Force-NT1-protocol-version-for-workgroup-s.patch new file mode 100644 index 0000000..4bf9934 --- /dev/null +++ b/SOURCES/smbbrowse-Force-NT1-protocol-version-for-workgroup-s.patch @@ -0,0 +1,89 @@ +diff --git a/configure.ac b/configure.ac +index 3b5836ff..daeee728 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -546,6 +546,11 @@ if test "x$enable_samba" != "xno"; then + if test "x$msg_samba" = "xyes"; then + PKG_CHECK_MODULES([SAMBA], [smbclient]) + AC_DEFINE([HAVE_SAMBA], 1, [Define to 1 if you have the samba libraries]) ++ ++ AC_CHECK_LIB(smbclient, smbc_setOptionProtocols, ++ AC_DEFINE(HAVE_SMBC_SETOPTIONPROTOCOLS, 1, [Define to 1 if smbc_setOptionProtocols() is available]), ++ [] ++ ) + fi + fi + +diff --git a/daemon/gvfsbackendsmbbrowse.c b/daemon/gvfsbackendsmbbrowse.c +index f08d2988..3b11883e 100644 +--- a/daemon/gvfsbackendsmbbrowse.c ++++ b/daemon/gvfsbackendsmbbrowse.c +@@ -45,6 +45,7 @@ + #include "gvfskeyring.h" + #include "gmounttracker.h" + #include "gvfsbackendsmbprivate.h" ++#include "gvfsutils.h" + + #include + +@@ -847,6 +848,47 @@ do_mount (GVfsBackend *backend, + else + op_backend->server = g_strdup (op_backend->mounted_server); + ++#ifdef HAVE_SMBC_SETOPTIONPROTOCOLS ++ /* Force NT1 protocol version if server can't be resolved (i.e. is not ++ * hostname, nor IP address). This is needed for workgroup support, because ++ * "client max protocol" has been changed from NT1 to SMB3 in recent samba ++ * versions. ++ */ ++ ++ if (op_backend->server != NULL) ++ { ++ GResolver *resolver; ++ GList *addresses; ++ GError *error = NULL; ++ gchar *server; ++ ++ resolver = g_resolver_get_default (); ++ ++ /* IPv6 server includes brackets in GMountSpec, GResolver doesn't */ ++ if (gvfs_is_ipv6 (op_backend->server)) ++ server = g_strndup (op_backend->server + 1, strlen (op_backend->server) - 2); ++ else ++ server = g_strdup (op_backend->server); ++ ++ addresses = g_resolver_lookup_by_name (resolver, server, NULL, &error); ++ if (addresses == NULL) ++ { ++ if (error != NULL) ++ { ++ g_debug ("%s\n", error->message); ++ g_error_free (error); ++ } ++ ++ g_debug ("Forcing NT1 protocol version\n"); ++ smbc_setOptionProtocols (smb_context, "NT1", "NT1"); ++ } ++ ++ g_resolver_free_addresses (addresses); ++ g_object_unref (resolver); ++ g_free (server); ++ } ++#endif ++ + icon = NULL; + symbolic_icon = NULL; + if (op_backend->server == NULL) +diff --git a/meson.build b/meson.build +index 34600188..3a876172 100644 +--- a/meson.build ++++ b/meson.build +@@ -416,6 +416,8 @@ config_h.set10('HAVE_LIBUSB', enable_libusb) + enable_samba = get_option('smb') + if enable_samba + smbclient_dep = dependency('smbclient') ++ ++ config_h.set('HAVE_SMBC_SETOPTIONPROTOCOLS', cc.has_function('smbc_setOptionProtocols', dependencies: smbclient_dep)) + endif + + # *** Check for libarchive *** diff --git a/SPECS/gvfs.spec b/SPECS/gvfs.spec index dad76c9..e525e88 100644 --- a/SPECS/gvfs.spec +++ b/SPECS/gvfs.spec @@ -24,7 +24,7 @@ Name: gvfs Version: 1.36.2 -Release: 1%{?dist} +Release: 3%{?dist} Summary: Backends for the gio framework in GLib License: GPLv3 and LGPLv2+ and BSD and MPLv2.0 @@ -34,6 +34,15 @@ Source0: https://download.gnome.org/sources/gvfs/1.36/gvfs-%{version}.tar.xz # http://bugzilla.gnome.org/show_bug.cgi?id=567235 Patch0: gvfs-archive-integration.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=1632960 +Patch1: daemon-Prevent-spawning-new-daemons-if-outgoing-oper.patch + +# https://bugzilla.redhat.com/show_bug.cgi?id=1673887 +Patch2: admin-Prevent-access-if-any-authentication-agent-isn.patch + +# https://bugzilla.redhat.com/show_bug.cgi?id=1619719 +Patch3: smbbrowse-Force-NT1-protocol-version-for-workgroup-s.patch + BuildRequires: pkgconfig BuildRequires: pkgconfig(glib-2.0) >= %{glib2_version} BuildRequires: pkgconfig(dbus-glib-1) @@ -217,6 +226,9 @@ the functionality of the installed gvfs package. %prep %setup -q %patch0 -p1 -b .archive-integration +%patch1 -p1 -b .daemon-Prevent-spawning-new-daemons-if-outgoing-oper +%patch2 -p1 -b .admin-Prevent-access-if-any-authentication-agent-isn +%patch3 -p1 -b .smbbrowse-Force-NT1-protocol-version-for-workgroup-s # Needed for gvfs-0.2.1-archive-integration.patch autoreconf -fi @@ -433,6 +445,13 @@ killall -USR1 gvfsd >&/dev/null || : %{_datadir}/installed-tests %changelog +* Fri Feb 15 2019 Ondrej Holy - 1.36.2-3 +- Force NT1 protocol version for workgroup support (#1619719) + +* Thu Jan 31 2019 Ondrej Holy - 1.36.2-2 +- Prevent spawning new daemons if outgoing operation exists (#1632960) +- CVE-2019-3827: Prevent access if any authentication agent isn't available (#1673887) + * Tue May 08 2018 Kalev Lember - 1.36.2-1 - Update to 1.36.2 - Resolves: #1569268