Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-2.0.git;a=commitdiff;h=11f4882220a1d8982bbfd91a8f943183993c6ee6
commit 11f4882220a1d8982bbfd91a8f943183993c6ee6 Author: kikadf <[email protected]> Date: Sat Feb 28 08:33:40 2015 +0100 dbus-1.8.2-5rigel1-x86_64 * Fix CVE-2015-0245 diff --git a/source/base/dbus/CVE-2015-0245.patch b/source/base/dbus/CVE-2015-0245.patch new file mode 100644 index 0000000..062d143 --- /dev/null +++ b/source/base/dbus/CVE-2015-0245.patch @@ -0,0 +1,43 @@ +From f9697e04f1c9871cb54a99f087e97e4bb9e41e06 Mon Sep 17 00:00:00 2001 +From: Simon McVittie <[email protected]> +Date: Mon, 26 Jan 2015 20:09:56 +0000 +Subject: [PATCH] CVE-2015-0245: prevent forged ActivationFailure from non-root + processes + +Without either this rule or better checking in dbus-daemon, non-systemd +processes can make dbus-daemon think systemd failed to activate a system +service, resulting in an error reply back to the requester. + +This is redundant with the fix in the C code (which I consider to be +the real solution), but is likely to be easier to backport. + +Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88811 +Reviewed-by: Alban Crequy +Reviewed-by: David King +Reviewed-by: Philip Withnall +--- + bus/system.conf.in | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/bus/system.conf.in b/bus/system.conf.in +index 92f4cc4..851b9e6 100644 +--- a/bus/system.conf.in ++++ b/bus/system.conf.in +@@ -68,6 +68,14 @@ + <deny send_destination="org.freedesktop.DBus" + send_interface="org.freedesktop.DBus" + send_member="UpdateActivationEnvironment"/> ++ <deny send_destination="org.freedesktop.DBus" ++ send_interface="org.freedesktop.systemd1.Activator"/> ++ </policy> ++ ++ <!-- Only systemd, which runs as root, may report activation failures. --> ++ <policy user="root"> ++ <allow send_destination="org.freedesktop.DBus" ++ send_interface="org.freedesktop.systemd1.Activator"/> + </policy> + + <!-- Config files are placed here that among other things, punch +-- +2.1.4 + diff --git a/source/base/dbus/FrugalBuild b/source/base/dbus/FrugalBuild index a85135c..4f1a431 100644 --- a/source/base/dbus/FrugalBuild +++ b/source/base/dbus/FrugalBuild @@ -3,7 +3,7 @@ pkgname=dbus pkgver=1.8.2 -pkgrel=4 +pkgrel=5rigel1 pkgdesc="A message bus system" url="http://freedesktop.org/wiki/Software/dbus"; rodepends=('scriptlet-core') @@ -37,8 +37,8 @@ subarchs=('i686 x86_64 arm') source=(${source[@]} CVE-2014-3477.patch CVE-2014-3532.patch CVE-2014-3533.patch CVE-2014-3635.patch CVE-2014-3637-1.patch CVE-2014-3637-2.patch CVE-2014-3637-3.patch CVE-2014-3637-4.patch CVE-2014-3638.patch - CVE-2014-3639-1.patch CVE-2014-3639-2.patch - CVE-2014-3639-regression.patch CVE-2014-7824.patch) + CVE-2014-3639-1.patch CVE-2014-3639-2.patch CVE-2014-3639-regression.patch + CVE-2014-7824.patch CVE-2015-0245.patch) sha1sums=(${sha1sums[@]} '8d9f647f539eb8405a235dc77545c7247d735241' \ '91bafc248fcbd41dc45b98adfbb9db203cf20573' \ 'c7646224e9fc057e969e301cf955bb21d3e70c2a' \ @@ -51,7 +51,8 @@ sha1sums=(${sha1sums[@]} '8d9f647f539eb8405a235dc77545c7247d735241' \ '652845ce0fdb5dac68c833c16e6c3b4c4903ec58' \ '045986f987fde2b1d995ecd3f7fe5ed63c62bb47' \ '50e268d5c021de0be507b3e3658388cc2a01951c' \ - '40d2e595b48416d704eadaf8623f4b9057545758') + '40d2e595b48416d704eadaf8623f4b9057545758' \ + '7991b8c7d5036a1893c00e2f3585eaef9b673e09') # *********** build() _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
