Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-current.git;a=commitdiff;h=accb94558fe347d2c98675bb1f15f928c19d5825
commit accb94558fe347d2c98675bb1f15f928c19d5825 Author: kikadf <[email protected]> Date: Wed Dec 10 09:07:56 2014 +0100 dbus-1.8.2-4-x86_64 * Fix CVE-2014-7824 diff --git a/source/base/dbus/CVE-2014-3639-regression.patch b/source/base/dbus/CVE-2014-3639-regression.patch new file mode 100644 index 0000000..9b90a8d --- /dev/null +++ b/source/base/dbus/CVE-2014-3639-regression.patch @@ -0,0 +1,37 @@ +Description: fix authentication timeout on certain slower systems +Bug: https://bugs.freedesktop.org/show_bug.cgi?id=86431 +Origin: upstream, http://cgit.freedesktop.org/dbus/dbus/commit/?h=dbus-1.8&id=29c64424d174a20449846479e7eeaa87821d78be +Origin: upstream, http://cgit.freedesktop.org/dbus/dbus/commit/?h=dbus-1.8&id=02e1ddf91e27405c0b88303bb49f5bf5c56306f8 + +Index: dbus-1.8.8/bus/config-parser.c +=================================================================== +--- dbus-1.8.8.orig/bus/config-parser.c 2014-11-25 14:21:58.896366122 -0500 ++++ dbus-1.8.8/bus/config-parser.c 2014-11-25 14:22:35.516676410 -0500 +@@ -439,7 +439,7 @@ + * and legitimate auth will fail. If interactive auth (ask user for + * password) is allowed, then potentially it has to be quite long. + */ +- parser->limits.auth_timeout = 5000; /* 5 seconds */ ++ parser->limits.auth_timeout = 30000; /* 30 seconds */ + + /* Do not allow a fd to stay forever in dbus-daemon + * https://bugs.freedesktop.org/show_bug.cgi?id=80559 +Index: dbus-1.8.8/bus/connection.c +=================================================================== +--- dbus-1.8.8.orig/bus/connection.c 2014-11-25 14:21:58.948366562 -0500 ++++ dbus-1.8.8/bus/connection.c 2014-11-25 14:22:32.048647012 -0500 +@@ -882,6 +882,14 @@ + + if (elapsed >= (double) auth_timeout) + { ++ /* Unfortunately, we can't identify the connection: it doesn't ++ * have a unique name yet, we don't know its uid/pid yet, ++ * and so on. */ ++ bus_context_log (connections->context, DBUS_SYSTEM_LOG_INFO, ++ "Connection has not authenticated soon enough, closing it " ++ "(auth_timeout=%dms, elapsed: %.0fms)", ++ auth_timeout, elapsed); ++ + _dbus_verbose ("Timing out authentication for connection %p\n", connection); + dbus_connection_close (connection); + } diff --git a/source/base/dbus/CVE-2014-7824.patch b/source/base/dbus/CVE-2014-7824.patch new file mode 100644 index 0000000..e8b5446 --- /dev/null +++ b/source/base/dbus/CVE-2014-7824.patch @@ -0,0 +1,413 @@ +From 4e466446d27f1a3991c22307a47a81c9e93e530d Mon Sep 17 00:00:00 2001 +From: Simon McVittie <[email protected]> +Date: Tue, 4 Nov 2014 14:41:54 +0000 +Subject: CVE-2014-7824: set fd rlimit to 64k for the system dbus-daemon + +This ensures that our rlimit is actually high enough to avoid the +denial of service described in CVE-2014-3636 part A. +CVE-2014-7824 has been allocated for this incomplete fix. + +Restore the original rlimit for activated services, to avoid +them getting undesired higher limits. + +(Thanks to Alban Crequy for various adjustments which have been +included in this commit.) + +Bug: https://bugs.freedesktop.org/show_bug.cgi?id=85105 +Reviewed-by: Alban Crequy <[email protected]> + +Index: dbus-1.8.8/bus/activation.c +=================================================================== +--- dbus-1.8.8.orig/bus/activation.c 2014-11-25 14:21:52.176309216 -0500 ++++ dbus-1.8.8/bus/activation.c 2014-11-25 14:21:52.172309181 -0500 +@@ -1688,6 +1688,31 @@ + return retval; + } + ++static void ++child_setup (void *user_data) ++{ ++#ifdef DBUS_UNIX ++ BusActivation *activation = user_data; ++ DBusRLimit *initial_fd_limit; ++ DBusError error; ++ ++ dbus_error_init (&error); ++ initial_fd_limit = bus_context_get_initial_fd_limit (activation->context); ++ ++ if (initial_fd_limit != NULL && ++ !_dbus_rlimit_restore_fd_limit (initial_fd_limit, &error)) ++ { ++ /* unfortunately we don't actually know the service name here */ ++ bus_context_log (activation->context, ++ DBUS_SYSTEM_LOG_INFO, ++ "Failed to reset fd limit before activating " ++ "service: %s: %s", ++ error.name, error.message); ++ } ++#endif ++} ++ ++ + dbus_bool_t + bus_activation_activate_service (BusActivation *activation, + DBusConnection *connection, +@@ -2121,7 +2146,8 @@ + service_name, + argv, + envp, +- NULL, activation, ++ child_setup, ++ activation, + &tmp_error)) + { + _dbus_verbose ("Failed to spawn child\n"); +Index: dbus-1.8.8/bus/bus.c +=================================================================== +--- dbus-1.8.8.orig/bus/bus.c 2014-11-25 14:21:52.176309216 -0500 ++++ dbus-1.8.8/bus/bus.c 2014-11-25 14:21:52.172309181 -0500 +@@ -65,6 +65,7 @@ + BusPolicy *policy; + BusMatchmaker *matchmaker; + BusLimits limits; ++ DBusRLimit *initial_fd_limit; + unsigned int fork : 1; + unsigned int syslog : 1; + unsigned int keep_umask : 1; +@@ -660,19 +661,38 @@ + static void + raise_file_descriptor_limit (BusContext *context) + { ++#ifdef DBUS_UNIX ++ DBusError error = DBUS_ERROR_INIT; + +- /* I just picked this out of thin air; we need some extra +- * descriptors for things like any internal pipes we create, +- * inotify, connections to SELinux, etc. +- */ +- unsigned int arbitrary_extra_fds = 32; +- unsigned int limit; ++ /* we only do this once */ ++ if (context->initial_fd_limit != NULL) ++ return; + +- limit = context->limits.max_completed_connections + +- context->limits.max_incomplete_connections +- + arbitrary_extra_fds; ++ context->initial_fd_limit = _dbus_rlimit_save_fd_limit (&error); + +- _dbus_request_file_descriptor_limit (limit); ++ if (context->initial_fd_limit == NULL) ++ { ++ bus_context_log (context, DBUS_SYSTEM_LOG_INFO, ++ "%s: %s", error.name, error.message); ++ dbus_error_free (&error); ++ return; ++ } ++ ++ /* We used to compute a suitable rlimit based on the configured number ++ * of connections, but that breaks down as soon as we allow fd-passing, ++ * because each connection is allowed to pass 64 fds to us, and if ++ * they all did, we'd hit kernel limits. We now hard-code 64k as a ++ * good limit, like systemd does: that's enough to avoid DoS from ++ * anything short of multiple uids conspiring against us. ++ */ ++ if (!_dbus_rlimit_raise_fd_limit_if_privileged (65536, &error)) ++ { ++ bus_context_log (context, DBUS_SYSTEM_LOG_INFO, ++ "%s: %s", error.name, error.message); ++ dbus_error_free (&error); ++ return; ++ } ++#endif + } + + static dbus_bool_t +@@ -1149,6 +1169,10 @@ + + dbus_free (context->pidfile); + } ++ ++ if (context->initial_fd_limit) ++ _dbus_rlimit_free (context->initial_fd_limit); ++ + dbus_free (context); + + dbus_server_free_data_slot (&server_data_slot); +@@ -1313,6 +1337,12 @@ + return context->limits.reply_timeout; + } + ++DBusRLimit * ++bus_context_get_initial_fd_limit (BusContext *context) ++{ ++ return context->initial_fd_limit; ++} ++ + void + bus_context_log (BusContext *context, DBusSystemLogSeverity severity, const char *msg, ...) _DBUS_GNUC_PRINTF (3, 4); + +Index: dbus-1.8.8/bus/bus.h +=================================================================== +--- dbus-1.8.8.orig/bus/bus.h 2014-11-25 14:21:52.176309216 -0500 ++++ dbus-1.8.8/bus/bus.h 2014-11-25 14:21:52.172309181 -0500 +@@ -117,6 +117,7 @@ + int bus_context_get_max_match_rules_per_connection (BusContext *context); + int bus_context_get_max_replies_per_connection (BusContext *context); + int bus_context_get_reply_timeout (BusContext *context); ++DBusRLimit * bus_context_get_initial_fd_limit (BusContext *context); + void bus_context_log (BusContext *context, + DBusSystemLogSeverity severity, + const char *msg, +Index: dbus-1.8.8/dbus/dbus-sysdeps-util-unix.c +=================================================================== +--- dbus-1.8.8.orig/dbus/dbus-sysdeps-util-unix.c 2014-11-25 14:21:52.176309216 -0500 ++++ dbus-1.8.8/dbus/dbus-sysdeps-util-unix.c 2014-11-25 14:21:52.172309181 -0500 +@@ -378,53 +378,140 @@ + } + #endif /* !HAVE_LIBAUDIT */ + ++#ifdef HAVE_SETRLIMIT + +-/** +- * Attempt to ensure that the current process can open +- * at least @p limit file descriptors. +- * +- * If @p limit is lower than the current, it will not be +- * lowered. No error is returned if the request can +- * not be satisfied. +- * +- * @param limit number of file descriptors ++/* We assume that if we have setrlimit, we also have getrlimit and ++ * struct rlimit. + */ +-void +-_dbus_request_file_descriptor_limit (unsigned int limit) ++ ++struct DBusRLimit { ++ struct rlimit lim; ++}; ++ ++DBusRLimit * ++_dbus_rlimit_save_fd_limit (DBusError *error) ++{ ++ DBusRLimit *self; ++ ++ self = dbus_new0 (DBusRLimit, 1); ++ ++ if (self == NULL) ++ { ++ _DBUS_SET_OOM (error); ++ return NULL; ++ } ++ ++ if (getrlimit (RLIMIT_NOFILE, &self->lim) < 0) ++ { ++ dbus_set_error (error, _dbus_error_from_errno (errno), ++ "Failed to get fd limit: %s", _dbus_strerror (errno)); ++ dbus_free (self); ++ return NULL; ++ } ++ ++ return self; ++} ++ ++dbus_bool_t ++_dbus_rlimit_raise_fd_limit_if_privileged (unsigned int desired, ++ DBusError *error) + { +-#ifdef HAVE_SETRLIMIT + struct rlimit lim; +- struct rlimit target_lim; + + /* No point to doing this practically speaking + * if we're not uid 0. We expect the system + * bus to use this before we change UID, and +- * the session bus takes the Linux default +- * of 1024 for both cur and max. ++ * the session bus takes the Linux default, ++ * currently 1024 for cur and 4096 for max. + */ + if (getuid () != 0) +- return; ++ { ++ /* not an error, we're probably the session bus */ ++ return TRUE; ++ } + + if (getrlimit (RLIMIT_NOFILE, &lim) < 0) +- return; +- +- if (lim.rlim_cur >= limit) +- return; ++ { ++ dbus_set_error (error, _dbus_error_from_errno (errno), ++ "Failed to get fd limit: %s", _dbus_strerror (errno)); ++ return FALSE; ++ } ++ ++ if (lim.rlim_cur == RLIM_INFINITY || lim.rlim_cur >= desired) ++ { ++ /* not an error, everything is fine */ ++ return TRUE; ++ } + + /* Ignore "maximum limit", assume we have the "superuser" + * privileges. On Linux this is CAP_SYS_RESOURCE. + */ +- target_lim.rlim_cur = target_lim.rlim_max = limit; +- /* Also ignore errors; if we fail, we will at least work +- * up to whatever limit we had, which seems better than +- * just outright aborting. +- * +- * However, in the future we should probably log this so OS builders +- * have a chance to notice any misconfiguration like dbus-daemon +- * being started without CAP_SYS_RESOURCE. +- */ +- setrlimit (RLIMIT_NOFILE, &target_lim); ++ lim.rlim_cur = lim.rlim_max = desired; ++ ++ if (setrlimit (RLIMIT_NOFILE, &lim) < 0) ++ { ++ dbus_set_error (error, _dbus_error_from_errno (errno), ++ "Failed to set fd limit to %u: %s", ++ desired, _dbus_strerror (errno)); ++ return FALSE; ++ } ++ ++ return TRUE; ++} ++ ++dbus_bool_t ++_dbus_rlimit_restore_fd_limit (DBusRLimit *saved, ++ DBusError *error) ++{ ++ if (setrlimit (RLIMIT_NOFILE, &saved->lim) < 0) ++ { ++ dbus_set_error (error, _dbus_error_from_errno (errno), ++ "Failed to restore old fd limit: %s", ++ _dbus_strerror (errno)); ++ return FALSE; ++ } ++ ++ return TRUE; ++} ++ ++#else /* !HAVE_SETRLIMIT */ ++ ++static void ++fd_limit_not_supported (DBusError *error) ++{ ++ dbus_set_error (error, DBUS_ERROR_NOT_SUPPORTED, ++ "cannot change fd limit on this platform"); ++} ++ ++DBusRLimit * ++_dbus_rlimit_save_fd_limit (DBusError *error) ++{ ++ fd_limit_not_supported (error); ++ return NULL; ++} ++ ++dbus_bool_t ++_dbus_rlimit_raise_fd_limit_if_privileged (unsigned int desired, ++ DBusError *error) ++{ ++ fd_limit_not_supported (error); ++ return FALSE; ++} ++ ++dbus_bool_t ++_dbus_rlimit_restore_fd_limit (DBusRLimit *saved, ++ DBusError *error) ++{ ++ fd_limit_not_supported (error); ++ return FALSE; ++} ++ + #endif ++ ++void ++_dbus_rlimit_free (DBusRLimit *lim) ++{ ++ dbus_free (lim); + } + + void +Index: dbus-1.8.8/dbus/dbus-sysdeps-util-win.c +=================================================================== +--- dbus-1.8.8.orig/dbus/dbus-sysdeps-util-win.c 2014-11-25 14:21:52.176309216 -0500 ++++ dbus-1.8.8/dbus/dbus-sysdeps-util-win.c 2014-11-25 14:21:52.172309181 -0500 +@@ -258,9 +258,42 @@ + return TRUE; + } + ++static void ++fd_limit_not_supported (DBusError *error) ++{ ++ dbus_set_error (error, DBUS_ERROR_NOT_SUPPORTED, ++ "cannot change fd limit on this platform"); ++} ++ ++DBusRLimit * ++_dbus_rlimit_save_fd_limit (DBusError *error) ++{ ++ fd_limit_not_supported (error); ++ return NULL; ++} ++ ++dbus_bool_t ++_dbus_rlimit_raise_fd_limit_if_privileged (unsigned int desired, ++ DBusError *error) ++{ ++ fd_limit_not_supported (error); ++ return FALSE; ++} ++ ++dbus_bool_t ++_dbus_rlimit_restore_fd_limit (DBusRLimit *saved, ++ DBusError *error) ++{ ++ fd_limit_not_supported (error); ++ return FALSE; ++} ++ + void +-_dbus_request_file_descriptor_limit (unsigned int limit) ++_dbus_rlimit_free (DBusRLimit *lim) + { ++ /* _dbus_rlimit_save_fd_limit() cannot return non-NULL on Windows ++ * so there cannot be anything to free */ ++ _dbus_assert (lim == NULL); + } + + void +Index: dbus-1.8.8/dbus/dbus-sysdeps.h +=================================================================== +--- dbus-1.8.8.orig/dbus/dbus-sysdeps.h 2014-11-25 14:21:52.176309216 -0500 ++++ dbus-1.8.8/dbus/dbus-sysdeps.h 2014-11-25 14:21:52.172309181 -0500 +@@ -546,8 +546,6 @@ + + void _dbus_flush_caches (void); + +-void _dbus_request_file_descriptor_limit (unsigned int limit); +- + /* + * replaces the term DBUS_PREFIX in configure_time_path by the + * current dbus installation directory. On unix this function is a noop +@@ -566,6 +564,15 @@ + */ + #define DBUS_DEFAULT_MESSAGE_UNIX_FDS 16 + ++typedef struct DBusRLimit DBusRLimit; ++ ++DBusRLimit *_dbus_rlimit_save_fd_limit (DBusError *error); ++dbus_bool_t _dbus_rlimit_raise_fd_limit_if_privileged (unsigned int desired, ++ DBusError *error); ++dbus_bool_t _dbus_rlimit_restore_fd_limit (DBusRLimit *saved, ++ DBusError *error); ++void _dbus_rlimit_free (DBusRLimit *lim); ++ + /** @} */ + + DBUS_END_DECLS diff --git a/source/base/dbus/FrugalBuild b/source/base/dbus/FrugalBuild index 8825d78..a85135c 100644 --- a/source/base/dbus/FrugalBuild +++ b/source/base/dbus/FrugalBuild @@ -3,7 +3,7 @@ pkgname=dbus pkgver=1.8.2 -pkgrel=3 +pkgrel=4 pkgdesc="A message bus system" url="http://freedesktop.org/wiki/Software/dbus"; rodepends=('scriptlet-core') @@ -37,7 +37,8 @@ subarchs=('i686 x86_64 arm') source=(${source[@]} CVE-2014-3477.patch CVE-2014-3532.patch CVE-2014-3533.patch CVE-2014-3635.patch CVE-2014-3637-1.patch CVE-2014-3637-2.patch CVE-2014-3637-3.patch CVE-2014-3637-4.patch CVE-2014-3638.patch - CVE-2014-3639-1.patch CVE-2014-3639-2.patch) + CVE-2014-3639-1.patch CVE-2014-3639-2.patch + CVE-2014-3639-regression.patch CVE-2014-7824.patch) sha1sums=(${sha1sums[@]} '8d9f647f539eb8405a235dc77545c7247d735241' \ '91bafc248fcbd41dc45b98adfbb9db203cf20573' \ 'c7646224e9fc057e969e301cf955bb21d3e70c2a' \ @@ -48,7 +49,9 @@ sha1sums=(${sha1sums[@]} '8d9f647f539eb8405a235dc77545c7247d735241' \ '9222a5699bdd59a27387472df841b47a7c3c7937' \ 'd3651f2f837d87f2e7bf96d2a4824b5a5ec434b9' \ '652845ce0fdb5dac68c833c16e6c3b4c4903ec58' \ - '045986f987fde2b1d995ecd3f7fe5ed63c62bb47') + '045986f987fde2b1d995ecd3f7fe5ed63c62bb47' \ + '50e268d5c021de0be507b3e3658388cc2a01951c' \ + '40d2e595b48416d704eadaf8623f4b9057545758') # *********** build() _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
