Mon Apr 2 00:01:14 UTC 2012

5 files changed, 218 insertions, 0 deletions

diff --git a/staging/systemd/0001-util-never-follow-symlinks-in-rm_rf_children.patch b/staging/systemd/0001-util-never-follow-symlinks-in-rm_rf_children.patch
new file mode 100644
index 000000000..7ac9251b3
--- /dev/null
+++ b/staging/systemd/0001-util-never-follow-symlinks-in-rm_rf_children.patch
@@ -0,0 +1,32 @@
+From 5ebff5337594d690b322078c512eb222d34aaa82 Mon Sep 17 00:00:00 2001
+From: Michal Schmidt <mschmidt@redhat.com>
+Date: Fri, 2 Mar 2012 10:39:10 +0100
+Subject: [PATCH] util: never follow symlinks in rm_rf_children()
+
+The function checks if the entry is a directory before recursing, but
+there is a window between the check and the open, during which the
+directory could be replaced with a symlink.
+
+CVE-2012-1174
+https://bugzilla.redhat.com/show_bug.cgi?id=803358
+---
+ src/util.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/util.c b/src/util.c
+index 20cbc2b..dfc1dc6 100644
+--- a/src/util.c
++++ b/src/util.c
+@@ -3593,7 +3593,8 @@ static int rm_rf_children(int fd, bool only_dirs, bool honour_sticky) {
+                 if (is_dir) {
+                         int subdir_fd;
+ 
+-                        if ((subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC)) < 0) {
++                        subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW);
++                        if (subdir_fd < 0) {
+                                 if (ret == 0 && errno != ENOENT)
+                                         ret = -errno;
+                                 continue;
+-- 
+1.7.9.4
+
diff --git a/staging/systemd/PKGBUILD b/staging/systemd/PKGBUILD
new file mode 100644
index 000000000..38df148a2
--- /dev/null
+++ b/staging/systemd/PKGBUILD
@@ -0,0 +1,108 @@
+# $Id: PKGBUILD 154953 2012-03-31 21:05:37Z tomegun $
+# Maintainer: Dave Reisner <dreisner@archlinux.org>
+
+pkgbase=systemd
+pkgname=('systemd' 'libsystemd')
+pkgver=44
+pkgrel=2
+arch=('i686' 'x86_64')
+url="http://www.freedesktop.org/wiki/Software/systemd"
+license=('GPL2')
+makedepends=('acl' 'cryptsetup' 'dbus-core' 'docbook-xsl' 'gperf' 'intltool'
+             'kmod' 'libcap' 'libxslt' 'linux-api-headers' 'pam' 'udev' 'xz')
+options=('!libtool')
+source=("http://www.freedesktop.org/software/$pkgname/$pkgname-$pkgver.tar.xz"
+        "os-release"
+        0001-util-never-follow-symlinks-in-rm_rf_children.patch)
+md5sums=('11f44ff74c87850064e4351518bcff17'
+         '752636def0db3c03f121f8b4f44a63cd'
+         'b5863d6d4b47e2b5bda8eb57bde0d327')
+
+build() {
+  cd "$pkgname-$pkgver"
+
+  # https://bugzilla.redhat.com/show_bug.cgi?id=803358
+  patch -Np1 <"$srcdir/0001-util-never-follow-symlinks-in-rm_rf_children.patch"
+
+  ./configure --sysconfdir=/etc \
+              --libexecdir=/usr/lib \
+              --with-pamlibdir=/lib/security \
+              --localstatedir=/var \
+              --with-distro=arch \
+              --enable-split-usr
+
+  make
+}
+
+package_systemd() {
+  pkgdesc="system and service manager"
+  depends=('acl' 'dbus' 'dbus-core' 'libsystemd' 'kbd' 'kmod' 'libcap' 'pam' 'util-linux' 'udev' 'xz')
+  optdepends=('cryptsetup: required for encrypted block devices'
+              'dbus-python: systemd-analyze'
+              'initscripts: legacy support for hostname and vconsole setup'
+              'initscripts-systemd: native boot and initialization scripts'
+              'python2-cairo: systemd-analyze'
+              'systemd-arch-units: collection of native unit files for Arch daemon/init scripts'
+              'systemd-sysvcompat: symlink package to provide sysvinit binaries')
+  backup=(etc/dbus-1/system.d/org.freedesktop.systemd1.conf
+          etc/dbus-1/system.d/org.freedesktop.hostname1.conf
+          etc/dbus-1/system.d/org.freedesktop.login1.conf
+          etc/dbus-1/system.d/org.freedesktop.locale1.conf
+          etc/dbus-1/system.d/org.freedesktop.timedate1.conf
+          etc/systemd/system.conf
+          etc/systemd/user.conf
+          etc/systemd/systemd-logind.conf
+          etc/systemd/systemd-journald.conf)
+  install="$pkgname.install"
+
+  cd "$pkgname-$pkgver"
+
+  make DESTDIR="$pkgdir" install
+
+  install -Dm644 "$srcdir/os-release" "$pkgdir/etc/os-release"
+
+  printf "d /run/console 755 root root\n" >"$pkgdir/usr/lib/tmpfiles.d/console.conf"
+  chmod 644 "$pkgdir/usr/lib/tmpfiles.d/console.conf"
+
+  # symlink to /bin/systemd for compat and sanity
+  mkdir -p "$pkgdir/bin"
+  ln -s ../usr/lib/systemd/systemd "$pkgdir/bin/systemd"
+  mkdir -p "$pkgdir/lib/systemd"
+  ln -s ../../usr/lib/systemd/systemd "$pkgdir/lib/systemd/systemd"
+
+  # use python2 for systemd-analyze
+  sed -i '1s/python$/python2/' "$pkgdir/usr/bin/systemd-analyze"
+
+  # didn't build this...
+  rm -f "$pkgdir/usr/share/man/man1/systemadm.1"
+
+  # fix .so links in manpage stubs
+  find "$pkgdir/usr/share/man" -type f -name '*.[[:digit:]]' \
+      -exec sed -i '1s|^\.so \(.*\)\.\([[:digit:]]\+\)|.so man\2/\1.\2|' {} +
+
+  # rename man pages to avoid conflicts with sysvinit and initscripts
+  manpages=(man8/{telinit,halt,reboot,poweroff,runlevel,shutdown}.8
+            man5/{hostname,{vconsole,locale}.conf}.5)
+  cd "$pkgdir/usr/share/man"
+  for manpage in "${manpages[@]}"; do
+    IFS='/' read section page <<< "$manpage"
+    mv "$manpage" "$section/systemd.$page"
+  done
+
+  ### split off libsystemd (libs, includes, pkgconfig, man3)
+  install -dm755 "$srcdir"/libsystemd/usr/{include,lib/pkgconfig}
+
+  cd "$srcdir"/libsystemd
+  mv "$pkgdir/usr/lib"/libsystemd-*.so* usr/lib
+  mv "$pkgdir/usr/include/systemd" usr/include
+  mv "$pkgdir/usr/lib/pkgconfig"/libsystemd-*.pc usr/lib/pkgconfig
+}
+
+package_libsystemd() {
+  pkgdesc="systemd client libraries"
+  depends=('libcap' 'xz')
+
+  mv "$srcdir/libsystemd"/* "$pkgdir"
+}
+
+# vim: ft=sh syn=sh et
diff --git a/staging/systemd/cpp-compat.patch b/staging/systemd/cpp-compat.patch
new file mode 100644
index 000000000..346c353bc
--- /dev/null
+++ b/staging/systemd/cpp-compat.patch
@@ -0,0 +1,19 @@
+commit e09a9a35a1fdb4e849e63bdaf47d936c272b5e82
+Author: Lennart Poettering <lennart@poettering.net>
+Date:   2012-03-05 15:16:10 +0100
+
+    sd-login: c++ compatibility
+
+diff --git a/src/systemd/sd-login.h b/src/systemd/sd-login.h
+index 2f3c90c..6e99cfc 100644
+--- a/src/systemd/sd-login.h
++++ b/src/systemd/sd-login.h
+@@ -94,7 +94,7 @@ int sd_session_get_service(const char *session, char **service);
+ int sd_session_get_type(const char *session, char **type);
+ 
+ /* Determine the class of this session, i.e. one of "user", "greeter" or "lock-screen". */
+-int sd_session_get_class(const char *session, char **class);
++int sd_session_get_class(const char *session, char **clazz);
+ 
+ /* Determine the X11 display of this session. */
+ int sd_session_get_display(const char *session, char **display);
diff --git a/staging/systemd/os-release b/staging/systemd/os-release
new file mode 100644
index 000000000..5e24a6031
--- /dev/null
+++ b/staging/systemd/os-release
@@ -0,0 +1,5 @@
+NAME="Arch Linux"
+ID=arch
+PRETTY_NAME="Arch Linux"
+ANSI_COLOR="1;36"
+
diff --git a/staging/systemd/systemd.install b/staging/systemd/systemd.install
new file mode 100644
index 000000000..11004222a
--- /dev/null
+++ b/staging/systemd/systemd.install
@@ -0,0 +1,54 @@
+#!/bin/sh
+
+checkgroups() {
+  if ! getent group lock >/dev/null; then
+    groupadd -g 54 lock
+  fi
+}
+
+sd_booted() {
+  [ -e sys/fs/cgroups/systemd ]
+}
+
+post_install() {
+  checkgroups
+
+  if [ ! -f etc/machine-id ]; then
+    systemd-machine-id-setup
+  fi
+
+  echo "systemd has been installed to /bin/systemd. Please ensure you append"
+  echo "init=/bin/systemd to your kernel command line in your bootloader."
+}
+
+post_upgrade() {
+  checkgroups
+
+  if [ ! -f etc/machine-id ]; then
+    systemd-machine-id-setup
+  fi
+
+  if sd_booted; then
+    systemctl daemon-reexec >/dev/null
+    systemctl daemon-reload >/dev/null
+  fi
+
+  newpkgver=${1%-*}
+  oldpkgver=${2%-*}
+
+  # catch v31 need for restarting systemd-logind.service
+  if [ "$newpkgver" -ge 31 ] && [ "$oldpkgver" -lt 31 ]; then
+    # but only if systemd is running
+    if sd_booted; then
+      systemctl try-restart systemd-logind.service
+    fi
+  fi
+}
+
+post_remove() {
+  if getent group lock >/dev/null; then
+    groupdel lock
+  fi
+}
+
+# vim:set ts=2 sw=2 et: