diff --git a/SOURCES/polkit-0.112-CVE-2018-19788.patch b/SOURCES/polkit-0.112-CVE-2018-19788.patch new file mode 100644 index 0000000..932975c --- /dev/null +++ b/SOURCES/polkit-0.112-CVE-2018-19788.patch @@ -0,0 +1,291 @@ +diff --git a/src/polkit/polkitunixgroup.c b/src/polkit/polkitunixgroup.c +index c57a1aaacbb13c4e4297dd812cf5904f2f427b03..309f68918895e0f8b547f8c06f89c6fb1326fe20 100644 +--- a/src/polkit/polkitunixgroup.c ++++ b/src/polkit/polkitunixgroup.c +@@ -71,6 +71,7 @@ G_DEFINE_TYPE_WITH_CODE (PolkitUnixGroup, polkit_unix_group, G_TYPE_OBJECT, + static void + polkit_unix_group_init (PolkitUnixGroup *unix_group) + { ++ unix_group->gid = -1; /* (git_t) -1 is not a valid GID under Linux */ + } + + static void +@@ -100,11 +101,14 @@ polkit_unix_group_set_property (GObject *object, + GParamSpec *pspec) + { + PolkitUnixGroup *unix_group = POLKIT_UNIX_GROUP (object); ++ gint val; + + switch (prop_id) + { + case PROP_GID: +- unix_group->gid = g_value_get_int (value); ++ val = g_value_get_int (value); ++ g_return_if_fail (val != -1); ++ unix_group->gid = val; + break; + + default: +@@ -131,9 +135,9 @@ polkit_unix_group_class_init (PolkitUnixGroupClass *klass) + g_param_spec_int ("gid", + "Group ID", + "The UNIX group ID", +- 0, ++ G_MININT, + G_MAXINT, +- 0, ++ -1, + G_PARAM_CONSTRUCT | + G_PARAM_READWRITE | + G_PARAM_STATIC_NAME | +@@ -166,9 +170,10 @@ polkit_unix_group_get_gid (PolkitUnixGroup *group) + */ + void + polkit_unix_group_set_gid (PolkitUnixGroup *group, +- gint gid) ++ gint gid) + { + g_return_if_fail (POLKIT_IS_UNIX_GROUP (group)); ++ g_return_if_fail (gid != -1); + group->gid = gid; + } + +@@ -183,6 +188,8 @@ polkit_unix_group_set_gid (PolkitUnixGroup *group, + PolkitIdentity * + polkit_unix_group_new (gint gid) + { ++ g_return_val_if_fail (gid != -1, NULL); ++ + return POLKIT_IDENTITY (g_object_new (POLKIT_TYPE_UNIX_GROUP, + "gid", gid, + NULL)); +diff --git a/src/polkit/polkitunixprocess.c b/src/polkit/polkitunixprocess.c +index 972b7776825d5ccf677ed12ed620fc0c52352547..b02b25894ad120d88ea21d4c96ac8dca1821fcf2 100644 +--- a/src/polkit/polkitunixprocess.c ++++ b/src/polkit/polkitunixprocess.c +@@ -159,9 +159,14 @@ polkit_unix_process_set_property (GObject *object, + polkit_unix_process_set_pid (unix_process, g_value_get_int (value)); + break; + +- case PROP_UID: +- polkit_unix_process_set_uid (unix_process, g_value_get_int (value)); ++ case PROP_UID: { ++ gint val; ++ ++ val = g_value_get_int (value); ++ g_return_if_fail (val != -1); ++ polkit_unix_process_set_uid (unix_process, val); + break; ++ } + + case PROP_START_TIME: + polkit_unix_process_set_start_time (unix_process, g_value_get_uint64 (value)); +@@ -239,7 +244,7 @@ polkit_unix_process_class_init (PolkitUnixProcessClass *klass) + g_param_spec_int ("uid", + "User ID", + "The UNIX user ID", +- -1, ++ G_MININT, + G_MAXINT, + -1, + G_PARAM_CONSTRUCT | +@@ -303,7 +308,6 @@ polkit_unix_process_set_uid (PolkitUnixProcess *process, + gint uid) + { + g_return_if_fail (POLKIT_IS_UNIX_PROCESS (process)); +- g_return_if_fail (uid >= -1); + process->uid = uid; + } + +diff --git a/src/polkit/polkitunixuser.c b/src/polkit/polkitunixuser.c +index 8bfd3a1fb05ddb56adebd097569a9977b7b922f3..234a6976c573ac65200ee08228cd50111f0c769b 100644 +--- a/src/polkit/polkitunixuser.c ++++ b/src/polkit/polkitunixuser.c +@@ -72,6 +72,7 @@ G_DEFINE_TYPE_WITH_CODE (PolkitUnixUser, polkit_unix_user, G_TYPE_OBJECT, + static void + polkit_unix_user_init (PolkitUnixUser *unix_user) + { ++ unix_user->uid = -1; /* (uid_t) -1 is not a valid UID under Linux */ + unix_user->name = NULL; + } + +@@ -112,11 +113,14 @@ polkit_unix_user_set_property (GObject *object, + GParamSpec *pspec) + { + PolkitUnixUser *unix_user = POLKIT_UNIX_USER (object); ++ gint val; + + switch (prop_id) + { + case PROP_UID: +- unix_user->uid = g_value_get_int (value); ++ val = g_value_get_int (value); ++ g_return_if_fail (val != -1); ++ unix_user->uid = val; + break; + + default: +@@ -144,9 +148,9 @@ polkit_unix_user_class_init (PolkitUnixUserClass *klass) + g_param_spec_int ("uid", + "User ID", + "The UNIX user ID", +- 0, ++ G_MININT, + G_MAXINT, +- 0, ++ -1, + G_PARAM_CONSTRUCT | + G_PARAM_READWRITE | + G_PARAM_STATIC_NAME | +@@ -182,6 +186,7 @@ polkit_unix_user_set_uid (PolkitUnixUser *user, + gint uid) + { + g_return_if_fail (POLKIT_IS_UNIX_USER (user)); ++ g_return_if_fail (uid != -1); + user->uid = uid; + } + +@@ -196,6 +201,8 @@ polkit_unix_user_set_uid (PolkitUnixUser *user, + PolkitIdentity * + polkit_unix_user_new (gint uid) + { ++ g_return_val_if_fail (uid != -1, NULL); ++ + return POLKIT_IDENTITY (g_object_new (POLKIT_TYPE_UNIX_USER, + "uid", uid, + NULL)); +diff --git a/test/data/etc/group b/test/data/etc/group +index 12ef328b21b346ee3828ce3aaf15cca83858bd1d..b9acab97211fdf7db521dc0939b2dcfc2c9e350b 100644 +--- a/test/data/etc/group ++++ b/test/data/etc/group +@@ -5,3 +5,4 @@ john:x:500: + jane:x:501: + sally:x:502: + henry:x:503: ++highuid2:x:4000000000: +diff --git a/test/data/etc/passwd b/test/data/etc/passwd +index 8544febcd8b1720e5577dfb3f0672a6fef29e701..5cf14a5620259f79806192ca935fee84a29ac96d 100644 +--- a/test/data/etc/passwd ++++ b/test/data/etc/passwd +@@ -3,3 +3,5 @@ john:x:500:500:John Done:/home/john:/bin/bash + jane:x:501:501:Jane Smith:/home/jane:/bin/bash + sally:x:502:502:Sally Derp:/home/sally:/bin/bash + henry:x:503:503:Henry Herp:/home/henry:/bin/bash ++highuid1:x:2147483648:2147483648:The first high uid:/home/highuid1:/sbin/nologin ++highuid2:x:4000000000:4000000000:An example high uid:/home/example:/sbin/nologin +diff --git a/test/data/etc/polkit-1/rules.d/10-testing.rules b/test/data/etc/polkit-1/rules.d/10-testing.rules +index 446e62291b7fe4c5bacdceb1045350af1a9dc245..98bf062a08cb11fddb7df95d0bcdec1b1ac3587d 100644 +--- a/test/data/etc/polkit-1/rules.d/10-testing.rules ++++ b/test/data/etc/polkit-1/rules.d/10-testing.rules +@@ -53,6 +53,27 @@ polkit.addRule(function(action, subject) { + } + }); + ++polkit.addRule(function(action, subject) { ++ if (action.id == "net.company.john_action") { ++ if (subject.user == "john") { ++ return polkit.Result.YES; ++ } else { ++ return polkit.Result.NO; ++ } ++ } ++}); ++ ++polkit.addRule(function(action, subject) { ++ if (action.id == "net.company.highuid2_action") { ++ if (subject.user == "highuid2") { ++ return polkit.Result.YES; ++ } else { ++ return polkit.Result.NO; ++ } ++ } ++}); ++ ++ + // --------------------------------------------------------------------- + // variables + +diff --git a/test/polkitbackend/test-polkitbackendjsauthority.c b/test/polkitbackend/test-polkitbackendjsauthority.c +index b484a26600dbde074ee7d8491f88624fdc83c39c..71aad23e2f5d1a7b15e138f23e6581a31498bad6 100644 +--- a/test/polkitbackend/test-polkitbackendjsauthority.c ++++ b/test/polkitbackend/test-polkitbackendjsauthority.c +@@ -330,6 +330,78 @@ static const RulesTestCase rules_test_cases[] = { + NULL, + POLKIT_IMPLICIT_AUTHORIZATION_AUTHORIZED, + }, ++ ++ { ++ /* highuid1 is not a member of group 'users', see test/data/etc/group */ ++ "group_membership_with_non_member(highuid22)", ++ "net.company.group.only_group_users", ++ "unix-user:highuid2", ++ NULL, ++ POLKIT_IMPLICIT_AUTHORIZATION_NOT_AUTHORIZED, ++ }, ++ ++ { ++ /* highuid2 is not a member of group 'users', see test/data/etc/group */ ++ "group_membership_with_non_member(highuid21)", ++ "net.company.group.only_group_users", ++ "unix-user:highuid2", ++ NULL, ++ POLKIT_IMPLICIT_AUTHORIZATION_NOT_AUTHORIZED, ++ }, ++ ++ { ++ /* highuid1 is not a member of group 'users', see test/data/etc/group */ ++ "group_membership_with_non_member(highuid24)", ++ "net.company.group.only_group_users", ++ "unix-user:2147483648", ++ NULL, ++ POLKIT_IMPLICIT_AUTHORIZATION_NOT_AUTHORIZED, ++ }, ++ ++ { ++ /* highuid2 is not a member of group 'users', see test/data/etc/group */ ++ "group_membership_with_non_member(highuid23)", ++ "net.company.group.only_group_users", ++ "unix-user:4000000000", ++ NULL, ++ POLKIT_IMPLICIT_AUTHORIZATION_NOT_AUTHORIZED, ++ }, ++ ++ { ++ /* john is authorized to do this, see 10-testing.rules */ ++ "john_action", ++ "net.company.john_action", ++ "unix-user:john", ++ NULL, ++ POLKIT_IMPLICIT_AUTHORIZATION_AUTHORIZED, ++ }, ++ ++ { ++ /* only john is authorized to do this, see 10-testing.rules */ ++ "jane_action", ++ "net.company.john_action", ++ "unix-user:jane", ++ NULL, ++ POLKIT_IMPLICIT_AUTHORIZATION_NOT_AUTHORIZED, ++ }, ++ ++ { ++ /* highuid2 is authorized to do this, see 10-testing.rules */ ++ "highuid2_action", ++ "net.company.highuid2_action", ++ "unix-user:highuid2", ++ NULL, ++ POLKIT_IMPLICIT_AUTHORIZATION_AUTHORIZED, ++ }, ++ ++ { ++ /* only highuid2 is authorized to do this, see 10-testing.rules */ ++ "highuid1_action", ++ "net.company.highuid2_action", ++ "unix-user:highuid1", ++ NULL, ++ POLKIT_IMPLICIT_AUTHORIZATION_NOT_AUTHORIZED, ++ }, + }; + + /* ---------------------------------------------------------------------------------------------------- */ + diff --git a/SOURCES/polkit-0.112-allow-uid-of-1.patch b/SOURCES/polkit-0.112-allow-uid-of-1.patch new file mode 100644 index 0000000..9500a5d --- /dev/null +++ b/SOURCES/polkit-0.112-allow-uid-of-1.patch @@ -0,0 +1,20 @@ +diff -up ./src/polkit/polkitunixprocess.c.ori ./src/polkit/polkitunixprocess.c +--- ./src/polkit/polkitunixprocess.c.ori 2019-02-06 16:47:23.460666237 +0100 ++++ ./src/polkit/polkitunixprocess.c 2019-02-06 16:47:43.846573792 +0100 +@@ -211,14 +211,9 @@ polkit_unix_process_set_property (GObjec + polkit_unix_process_set_pid (unix_process, g_value_get_int (value)); + break; + +- case PROP_UID: { +- gint val; +- +- val = g_value_get_int (value); +- g_return_if_fail (val != -1); +- polkit_unix_process_set_uid (unix_process, val); ++ case PROP_UID: ++ polkit_unix_process_set_uid (unix_process, g_value_get_int (value)); + break; +- } + + case PROP_START_TIME: + polkit_unix_process_set_start_time (unix_process, g_value_get_uint64 (value)); diff --git a/SOURCES/polkit-0.112-pkttyagent-tty-echo-off-on-fail.patch b/SOURCES/polkit-0.112-pkttyagent-tty-echo-off-on-fail.patch new file mode 100644 index 0000000..dbedc7f --- /dev/null +++ b/SOURCES/polkit-0.112-pkttyagent-tty-echo-off-on-fail.patch @@ -0,0 +1,85 @@ +diff -up ./src/programs/pkttyagent.c.ori ./src/programs/pkttyagent.c +--- ./src/programs/pkttyagent.c.ori 2019-03-21 15:28:00.058408349 +0100 ++++ ./src/programs/pkttyagent.c 2019-03-21 15:32:55.499744167 +0100 +@@ -24,11 +24,44 @@ + #endif + + #include ++#include ++#include + #include + #include + #define POLKIT_AGENT_I_KNOW_API_IS_SUBJECT_TO_CHANGE + #include + ++ ++static volatile sig_atomic_t tty_flags_saved; ++struct termios ts; ++FILE *tty = NULL; ++struct sigaction savesigterm, savesigint, savesigtstp; ++ ++ ++static void tty_handler(int signal) ++{ ++ switch (signal) ++ { ++ case SIGTERM: ++ sigaction (SIGTERM, &savesigterm, NULL); ++ break; ++ case SIGINT: ++ sigaction (SIGINT, &savesigint, NULL); ++ break; ++ case SIGTSTP: ++ sigaction (SIGTSTP, &savesigtstp, NULL); ++ break; ++ } ++ ++ if (tty_flags_saved) ++ { ++ tcsetattr (fileno (tty), TCSAFLUSH, &ts); ++ } ++ ++ kill(getpid(), signal); ++} ++ ++ + int + main (int argc, char *argv[]) + { +@@ -73,6 +106,8 @@ main (int argc, char *argv[]) + GMainLoop *loop = NULL; + guint ret = 126; + GVariantBuilder builder; ++ struct sigaction sa; ++ const char *tty_name = NULL; + + g_type_init (); + +@@ -202,6 +237,27 @@ main (int argc, char *argv[]) + } + } + ++/* Bash leaves tty echo disabled if SIGINT/SIGTERM comes to polkitagenttextlistener.c::on_request(), ++ but due to threading the handlers cannot take care of the signal there. ++ Though if controlling terminal cannot be found, the world won't stop spinning. ++*/ ++ tty_name = ctermid(NULL); ++ if (tty_name != NULL) ++ { ++ tty = fopen(tty_name, "r+"); ++ } ++ ++ if (tty != NULL && !tcgetattr (fileno (tty), &ts)) ++ { ++ tty_flags_saved = TRUE; ++ } ++ ++ memset (&sa, 0, sizeof (sa)); ++ sa.sa_handler = &tty_handler; ++ sigaction (SIGTERM, &sa, &savesigterm); ++ sigaction (SIGINT, &sa, &savesigint); ++ sigaction (SIGTSTP, &sa, &savesigtstp); ++ + loop = g_main_loop_new (NULL, FALSE); + g_main_loop_run (loop); + diff --git a/SPECS/polkit.spec b/SPECS/polkit.spec index 79afcaa..3c458ef 100644 --- a/SPECS/polkit.spec +++ b/SPECS/polkit.spec @@ -6,7 +6,7 @@ Summary: An authorization framework Name: polkit Version: 0.112 -Release: 18%{?dist}.1 +Release: 22%{?dist} License: LGPLv2+ URL: http://www.freedesktop.org/wiki/Software/polkit Source0: http://www.freedesktop.org/software/polkit/releases/%{name}-%{version}.tar.gz @@ -29,7 +29,10 @@ Patch7: polkit-0.112-add-its-files.patch Patch8: polkit-0.112-spawning-zombie-processes.patch Patch9: polkit-0.112-bus-conn-msg-ssh.patch Patch10: polkit-0.112-pkttyagent-auth-errmsg-debug.patch -Patch11: polkit-0.112-CVE-2019-6133.patch +Patch11: polkit-0.112-CVE-2018-19788.patch +Patch12: polkit-0.112-CVE-2019-6133.patch +Patch13: polkit-0.112-allow-uid-of-1.patch +Patch14: polkit-0.112-pkttyagent-tty-echo-off-on-fail.patch Group: System Environment/Libraries BuildRequires: glib2-devel >= 2.30.0 @@ -109,6 +112,9 @@ Development documentation for polkit. %patch9 -p1 %patch10 -p1 %patch11 -p1 +%patch12 -p1 +%patch13 -p1 +%patch14 -p1 %build %if 0%{?enable_autoreconf} @@ -199,9 +205,21 @@ fi %{_datadir}/gtk-doc %changelog -* Tue Jan 22 2019 Jan Rybar - 0.112-18.el7_6.1 +* Thu Mar 21 2019 Jan Rybar - 0.112-22 +- pkttyagent: polkit-agent-helper-1 timeout leaves tty echo disabled +- Resolves: rhbz#1325512 + +* Wed Feb 06 2019 Jan Rybar - 0.112-21 +- Mitigation of regression caused by fix of CVE-2018-19788 +- Resolves: rhbz#1656377 + +* Mon Jan 21 2019 Jan Rybar - 0.112-20 - Fix of CVE-2019-6133, PID reuse via slow fork -- Resolves: rhbz#1667311 +- Resolves: rhbz#1667312 + +* Thu Dec 06 2018 Jan Rybar - 0.112-19 +- Fix of CVE-2018-19788, priv escalation with high UIDs +- Resolves: rhbz#1656377 * Wed Aug 01 2018 Jan Rybar - 0.112-18 - Error message about getting authority is too elaborate