diff -Nru policykit-1-0.105/debian/changelog policykit-1-0.105/debian/changelog --- policykit-1-0.105/debian/changelog 2012-12-20 17:55:31.000000000 +0000 +++ policykit-1-0.105/debian/changelog 2013-10-14 00:33:31.000000000 +0000 @@ -1,3 +1,10 @@ +policykit-1 (0.105-3+nmu1) unstable; urgency=high + + * Non-maintainer upload by the Security Team. + * Fix cve-2013-4288: race condition in pkcheck.c (closes: #723717). + + -- Michael Gilbert Mon, 14 Oct 2013 00:08:43 +0000 + policykit-1 (0.105-3) unstable; urgency=low * 07_set-XAUTHORITY-environment-variable-if-unset.patch: Set XAUTHORITY diff -Nru policykit-1-0.105/debian/patches/cve-2013-4288.patch policykit-1-0.105/debian/patches/cve-2013-4288.patch --- policykit-1-0.105/debian/patches/cve-2013-4288.patch 1970-01-01 00:00:00.000000000 +0000 +++ policykit-1-0.105/debian/patches/cve-2013-4288.patch 2013-10-14 00:33:15.000000000 +0000 @@ -0,0 +1,115 @@ +From 52c927893a2ab135462b616c2e00fec377da9885 Mon Sep 17 00:00:00 2001 +From: Colin Walters +Date: Mon, 19 Aug 2013 12:16:11 -0400 +Subject: [PATCH 2/4] pkcheck: Support --process=pid,start-time,uid syntax too + +The uid is a new addition; this allows callers such as libvirt to +close a race condition in reading the uid of the process talking to +them. They can read it via getsockopt(SO_PEERCRED) or equivalent, +rather than having pkcheck look at /proc later after the fact. + +Programs which invoke pkcheck but need to know beforehand (i.e. at +compile time) whether or not it supports passing the uid can +use: + +pkcheck_supports_uid=$($PKG_CONFIG --variable pkcheck_supports_uid polkit-gobject-1) +test x$pkcheck_supports_uid = xyes +--- + data/polkit-gobject-1.pc.in | 3 +++ + docs/man/pkcheck.xml | 29 ++++++++++++++++++++--------- + src/programs/pkcheck.c | 9 +++++++-- + 3 files changed, 30 insertions(+), 11 deletions(-) + +Index: policykit-1-0.105/data/polkit-gobject-1.pc.in +=================================================================== +--- policykit-1-0.105.orig/data/polkit-gobject-1.pc.in 2013-09-11 09:40:56.604225567 -0400 ++++ policykit-1-0.105/data/polkit-gobject-1.pc.in 2013-09-11 09:40:56.596225567 -0400 +@@ -11,3 +11,6 @@ + Libs: -L${libdir} -lpolkit-gobject-1 + Cflags: -I${includedir}/polkit-1 + Requires: gio-2.0 >= 2.18 glib-2.0 >= 2.18 ++# Programs using pkcheck can use this to determine ++# whether or not it can be passed a uid. ++pkcheck_supports_uid=true +Index: policykit-1-0.105/docs/man/pkcheck.xml +=================================================================== +--- policykit-1-0.105.orig/docs/man/pkcheck.xml 2013-09-11 09:40:56.604225567 -0400 ++++ policykit-1-0.105/docs/man/pkcheck.xml 2013-09-11 09:42:28.272223569 -0400 +@@ -55,6 +55,9 @@ + + pid,pid-start-time + ++ ++ pid,pid-start-time,uid ++ + + + +@@ -90,7 +93,7 @@ + DESCRIPTION + + pkcheck is used to check whether a process, specified by +- either or , ++ either (see below) or , + is authorized for action. The + option can be used zero or more times to pass details about action. + If is passed, pkcheck blocks +@@ -160,17 +163,25 @@ + + NOTES + +- Since process identifiers can be recycled, the caller should always use +- pid,pid-start-time to specify the process +- to check for authorization when using the option. +- The value of pid-start-time +- can be determined by consulting e.g. the ++ Do not use either the bare pid or ++ pid,start-time syntax forms for ++ . There are race conditions in both. ++ New code should always use ++ pid,pid-start-time,uid. The value of ++ start-time can be determined by ++ consulting e.g. the + + proc5 + +- file system depending on the operating system. If only pid +- is passed to the option, then pkcheck +- will look up the start time itself but note that this may be racy. ++ file system depending on the operating system. If fewer than 3 ++ arguments are passed, pkcheck will attempt to ++ look up them up internally, but note that this may be racy. ++ ++ ++ If your program is a daemon with e.g. a custom Unix domain ++ socket, you should determine the uid ++ parameter via operating system mechanisms such as ++ PEERCRED. + + + +Index: policykit-1-0.105/src/programs/pkcheck.c +=================================================================== +--- policykit-1-0.105.orig/src/programs/pkcheck.c 2013-09-11 09:40:56.604225567 -0400 ++++ policykit-1-0.105/src/programs/pkcheck.c 2013-09-11 09:40:56.600225567 -0400 +@@ -372,6 +372,7 @@ + else if (g_strcmp0 (argv[n], "--process") == 0 || g_strcmp0 (argv[n], "-p") == 0) + { + gint pid; ++ guint uid; + guint64 pid_start_time; + + n++; +@@ -381,7 +382,11 @@ + goto out; + } + +- if (sscanf (argv[n], "%i,%" G_GUINT64_FORMAT, &pid, &pid_start_time) == 2) ++ if (sscanf (argv[n], "%i,%" G_GUINT64_FORMAT ",%u", &pid, &pid_start_time, &uid) == 3) ++ { ++ subject = polkit_unix_process_new_for_owner (pid, pid_start_time, uid); ++ } ++ else if (sscanf (argv[n], "%i,%" G_GUINT64_FORMAT, &pid, &pid_start_time) == 2) + { + subject = polkit_unix_process_new_full (pid, pid_start_time); + } diff -Nru policykit-1-0.105/debian/patches/series policykit-1-0.105/debian/patches/series --- policykit-1-0.105/debian/patches/series 2012-12-20 17:55:31.000000000 +0000 +++ policykit-1-0.105/debian/patches/series 2013-10-14 00:33:07.000000000 +0000 @@ -5,3 +5,4 @@ 05_revert-admin-identities-unix-group-wheel.patch 06_systemd-service.patch 07_set-XAUTHORITY-environment-variable-if-unset.patch +cve-2013-4288.patch