From 8ebbe4e4befac1396a153b356fc9793655dde4ff Mon Sep 17 00:00:00 2001 From: root Date: Mon, 2 Apr 2012 00:01:14 +0000 Subject: Mon Apr 2 00:01:14 UTC 2012 --- ...l-never-follow-symlinks-in-rm_rf_children.patch | 32 ++++++ staging/systemd/PKGBUILD | 108 +++++++++++++++++++++ staging/systemd/cpp-compat.patch | 19 ++++ staging/systemd/os-release | 5 + staging/systemd/systemd.install | 54 +++++++++++ 5 files changed, 218 insertions(+) create mode 100644 staging/systemd/0001-util-never-follow-symlinks-in-rm_rf_children.patch create mode 100644 staging/systemd/PKGBUILD create mode 100644 staging/systemd/cpp-compat.patch create mode 100644 staging/systemd/os-release create mode 100644 staging/systemd/systemd.install (limited to 'staging/systemd') diff --git a/staging/systemd/0001-util-never-follow-symlinks-in-rm_rf_children.patch b/staging/systemd/0001-util-never-follow-symlinks-in-rm_rf_children.patch new file mode 100644 index 000000000..7ac9251b3 --- /dev/null +++ b/staging/systemd/0001-util-never-follow-symlinks-in-rm_rf_children.patch @@ -0,0 +1,32 @@ +From 5ebff5337594d690b322078c512eb222d34aaa82 Mon Sep 17 00:00:00 2001 +From: Michal Schmidt +Date: Fri, 2 Mar 2012 10:39:10 +0100 +Subject: [PATCH] util: never follow symlinks in rm_rf_children() + +The function checks if the entry is a directory before recursing, but +there is a window between the check and the open, during which the +directory could be replaced with a symlink. + +CVE-2012-1174 +https://bugzilla.redhat.com/show_bug.cgi?id=803358 +--- + src/util.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/util.c b/src/util.c +index 20cbc2b..dfc1dc6 100644 +--- a/src/util.c ++++ b/src/util.c +@@ -3593,7 +3593,8 @@ static int rm_rf_children(int fd, bool only_dirs, bool honour_sticky) { + if (is_dir) { + int subdir_fd; + +- if ((subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC)) < 0) { ++ subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW); ++ if (subdir_fd < 0) { + if (ret == 0 && errno != ENOENT) + ret = -errno; + continue; +-- +1.7.9.4 + diff --git a/staging/systemd/PKGBUILD b/staging/systemd/PKGBUILD new file mode 100644 index 000000000..38df148a2 --- /dev/null +++ b/staging/systemd/PKGBUILD @@ -0,0 +1,108 @@ +# $Id: PKGBUILD 154953 2012-03-31 21:05:37Z tomegun $ +# Maintainer: Dave Reisner + +pkgbase=systemd +pkgname=('systemd' 'libsystemd') +pkgver=44 +pkgrel=2 +arch=('i686' 'x86_64') +url="http://www.freedesktop.org/wiki/Software/systemd" +license=('GPL2') +makedepends=('acl' 'cryptsetup' 'dbus-core' 'docbook-xsl' 'gperf' 'intltool' + 'kmod' 'libcap' 'libxslt' 'linux-api-headers' 'pam' 'udev' 'xz') +options=('!libtool') +source=("http://www.freedesktop.org/software/$pkgname/$pkgname-$pkgver.tar.xz" + "os-release" + 0001-util-never-follow-symlinks-in-rm_rf_children.patch) +md5sums=('11f44ff74c87850064e4351518bcff17' + '752636def0db3c03f121f8b4f44a63cd' + 'b5863d6d4b47e2b5bda8eb57bde0d327') + +build() { + cd "$pkgname-$pkgver" + + # https://bugzilla.redhat.com/show_bug.cgi?id=803358 + patch -Np1 <"$srcdir/0001-util-never-follow-symlinks-in-rm_rf_children.patch" + + ./configure --sysconfdir=/etc \ + --libexecdir=/usr/lib \ + --with-pamlibdir=/lib/security \ + --localstatedir=/var \ + --with-distro=arch \ + --enable-split-usr + + make +} + +package_systemd() { + pkgdesc="system and service manager" + depends=('acl' 'dbus' 'dbus-core' 'libsystemd' 'kbd' 'kmod' 'libcap' 'pam' 'util-linux' 'udev' 'xz') + optdepends=('cryptsetup: required for encrypted block devices' + 'dbus-python: systemd-analyze' + 'initscripts: legacy support for hostname and vconsole setup' + 'initscripts-systemd: native boot and initialization scripts' + 'python2-cairo: systemd-analyze' + 'systemd-arch-units: collection of native unit files for Arch daemon/init scripts' + 'systemd-sysvcompat: symlink package to provide sysvinit binaries') + backup=(etc/dbus-1/system.d/org.freedesktop.systemd1.conf + etc/dbus-1/system.d/org.freedesktop.hostname1.conf + etc/dbus-1/system.d/org.freedesktop.login1.conf + etc/dbus-1/system.d/org.freedesktop.locale1.conf + etc/dbus-1/system.d/org.freedesktop.timedate1.conf + etc/systemd/system.conf + etc/systemd/user.conf + etc/systemd/systemd-logind.conf + etc/systemd/systemd-journald.conf) + install="$pkgname.install" + + cd "$pkgname-$pkgver" + + make DESTDIR="$pkgdir" install + + install -Dm644 "$srcdir/os-release" "$pkgdir/etc/os-release" + + printf "d /run/console 755 root root\n" >"$pkgdir/usr/lib/tmpfiles.d/console.conf" + chmod 644 "$pkgdir/usr/lib/tmpfiles.d/console.conf" + + # symlink to /bin/systemd for compat and sanity + mkdir -p "$pkgdir/bin" + ln -s ../usr/lib/systemd/systemd "$pkgdir/bin/systemd" + mkdir -p "$pkgdir/lib/systemd" + ln -s ../../usr/lib/systemd/systemd "$pkgdir/lib/systemd/systemd" + + # use python2 for systemd-analyze + sed -i '1s/python$/python2/' "$pkgdir/usr/bin/systemd-analyze" + + # didn't build this... + rm -f "$pkgdir/usr/share/man/man1/systemadm.1" + + # fix .so links in manpage stubs + find "$pkgdir/usr/share/man" -type f -name '*.[[:digit:]]' \ + -exec sed -i '1s|^\.so \(.*\)\.\([[:digit:]]\+\)|.so man\2/\1.\2|' {} + + + # rename man pages to avoid conflicts with sysvinit and initscripts + manpages=(man8/{telinit,halt,reboot,poweroff,runlevel,shutdown}.8 + man5/{hostname,{vconsole,locale}.conf}.5) + cd "$pkgdir/usr/share/man" + for manpage in "${manpages[@]}"; do + IFS='/' read section page <<< "$manpage" + mv "$manpage" "$section/systemd.$page" + done + + ### split off libsystemd (libs, includes, pkgconfig, man3) + install -dm755 "$srcdir"/libsystemd/usr/{include,lib/pkgconfig} + + cd "$srcdir"/libsystemd + mv "$pkgdir/usr/lib"/libsystemd-*.so* usr/lib + mv "$pkgdir/usr/include/systemd" usr/include + mv "$pkgdir/usr/lib/pkgconfig"/libsystemd-*.pc usr/lib/pkgconfig +} + +package_libsystemd() { + pkgdesc="systemd client libraries" + depends=('libcap' 'xz') + + mv "$srcdir/libsystemd"/* "$pkgdir" +} + +# vim: ft=sh syn=sh et diff --git a/staging/systemd/cpp-compat.patch b/staging/systemd/cpp-compat.patch new file mode 100644 index 000000000..346c353bc --- /dev/null +++ b/staging/systemd/cpp-compat.patch @@ -0,0 +1,19 @@ +commit e09a9a35a1fdb4e849e63bdaf47d936c272b5e82 +Author: Lennart Poettering +Date: 2012-03-05 15:16:10 +0100 + + sd-login: c++ compatibility + +diff --git a/src/systemd/sd-login.h b/src/systemd/sd-login.h +index 2f3c90c..6e99cfc 100644 +--- a/src/systemd/sd-login.h ++++ b/src/systemd/sd-login.h +@@ -94,7 +94,7 @@ int sd_session_get_service(const char *session, char **service); + int sd_session_get_type(const char *session, char **type); + + /* Determine the class of this session, i.e. one of "user", "greeter" or "lock-screen". */ +-int sd_session_get_class(const char *session, char **class); ++int sd_session_get_class(const char *session, char **clazz); + + /* Determine the X11 display of this session. */ + int sd_session_get_display(const char *session, char **display); diff --git a/staging/systemd/os-release b/staging/systemd/os-release new file mode 100644 index 000000000..5e24a6031 --- /dev/null +++ b/staging/systemd/os-release @@ -0,0 +1,5 @@ +NAME="Arch Linux" +ID=arch +PRETTY_NAME="Arch Linux" +ANSI_COLOR="1;36" + diff --git a/staging/systemd/systemd.install b/staging/systemd/systemd.install new file mode 100644 index 000000000..11004222a --- /dev/null +++ b/staging/systemd/systemd.install @@ -0,0 +1,54 @@ +#!/bin/sh + +checkgroups() { + if ! getent group lock >/dev/null; then + groupadd -g 54 lock + fi +} + +sd_booted() { + [ -e sys/fs/cgroups/systemd ] +} + +post_install() { + checkgroups + + if [ ! -f etc/machine-id ]; then + systemd-machine-id-setup + fi + + echo "systemd has been installed to /bin/systemd. Please ensure you append" + echo "init=/bin/systemd to your kernel command line in your bootloader." +} + +post_upgrade() { + checkgroups + + if [ ! -f etc/machine-id ]; then + systemd-machine-id-setup + fi + + if sd_booted; then + systemctl daemon-reexec >/dev/null + systemctl daemon-reload >/dev/null + fi + + newpkgver=${1%-*} + oldpkgver=${2%-*} + + # catch v31 need for restarting systemd-logind.service + if [ "$newpkgver" -ge 31 ] && [ "$oldpkgver" -lt 31 ]; then + # but only if systemd is running + if sd_booted; then + systemctl try-restart systemd-logind.service + fi + fi +} + +post_remove() { + if getent group lock >/dev/null; then + groupdel lock + fi +} + +# vim:set ts=2 sw=2 et: -- cgit v1.2.3-54-g00ecf