Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=kde5.git;a=commitdiff;h=d00f22f5f67a434ef443a0e1a653b9f7f4ce5414
commit d00f22f5f67a434ef443a0e1a653b9f7f4ce5414 Author: crazy <[email protected]> Date: Sun May 14 12:07:56 2017 +0200 kauth-5.34.0-1-x86_64 * forgot to remove the patch diff --git a/source/kf5/kauth/CVE-2017-8422.patch b/source/kf5/kauth/CVE-2017-8422.patch deleted file mode 100644 index 609bc6e..0000000 --- a/source/kf5/kauth/CVE-2017-8422.patch +++ /dev/null @@ -1,197 +0,0 @@ -From df875f725293af53399f5146362eb158b4f9216a Mon Sep 17 00:00:00 2001 -From: Albert Astals Cid <[email protected]> -Date: Wed, 10 May 2017 10:03:45 +0200 -Subject: Verify that whoever is calling us is actually who he says he is - -CVE-2017-8422 ---- - src/AuthBackend.cpp | 5 +++++ - src/AuthBackend.h | 7 +++++++ - src/backends/dbus/DBusHelperProxy.cpp | 27 +++++++++++++++++++++++++-- - src/backends/dbus/DBusHelperProxy.h | 6 +++++- - src/backends/policykit/PolicyKitBackend.cpp | 5 +++++ - src/backends/policykit/PolicyKitBackend.h | 1 + - src/backends/polkit-1/Polkit1Backend.cpp | 5 +++++ - src/backends/polkit-1/Polkit1Backend.h | 1 + - 8 files changed, 54 insertions(+), 3 deletions(-) - -diff --git a/src/AuthBackend.cpp b/src/AuthBackend.cpp -index a41d4f1..a847494 100644 ---- a/src/AuthBackend.cpp -+++ b/src/AuthBackend.cpp -@@ -54,6 +54,11 @@ void AuthBackend::setCapabilities(AuthBackend::Capabilities capabilities) - d->capabilities = capabilities; - } - -+AuthBackend::ExtraCallerIDVerificationMethod AuthBackend::extraCallerIDVerificationMethod() const -+{ -+ return NoExtraCallerIDVerificationMethod; -+} -+ - bool AuthBackend::actionExists(const QString &action) - { - Q_UNUSED(action); -diff --git a/src/AuthBackend.h b/src/AuthBackend.h -index c67a706..09195ef 100644 ---- a/src/AuthBackend.h -+++ b/src/AuthBackend.h -@@ -43,6 +43,12 @@ public: - }; - Q_DECLARE_FLAGS(Capabilities, Capability) - -+ enum ExtraCallerIDVerificationMethod { -+ NoExtraCallerIDVerificationMethod, -+ VerifyAgainstDBusServiceName, -+ VerifyAgainstDBusServicePid, -+ }; -+ - AuthBackend(); - virtual ~AuthBackend(); - virtual void setupAction(const QString &action) = 0; -@@ -50,6 +56,7 @@ public: - virtual Action::AuthStatus authorizeAction(const QString &action) = 0; - virtual Action::AuthStatus actionStatus(const QString &action) = 0; - virtual QByteArray callerID() const = 0; -+ virtual ExtraCallerIDVerificationMethod extraCallerIDVerificationMethod() const; - virtual bool isCallerAuthorized(const QString &action, QByteArray callerID) = 0; - virtual bool actionExists(const QString &action); - -diff --git a/src/backends/dbus/DBusHelperProxy.cpp b/src/backends/dbus/DBusHelperProxy.cpp -index 9c5cb96..3c1c108 100644 ---- a/src/backends/dbus/DBusHelperProxy.cpp -+++ b/src/backends/dbus/DBusHelperProxy.cpp -@@ -235,6 +235,29 @@ bool DBusHelperProxy::hasToStopAction() - return m_stopRequest; - } - -+bool DBusHelperProxy::isCallerAuthorized(const QString &action, const QByteArray &callerID) -+{ -+ // Check the caller is really who it says it is -+ switch (BackendsManager::authBackend()->extraCallerIDVerificationMethod()) { -+ case AuthBackend::NoExtraCallerIDVerificationMethod: -+ break; -+ -+ case AuthBackend::VerifyAgainstDBusServiceName: -+ if (message().service().toUtf8() != callerID) { -+ return false; -+ } -+ break; -+ -+ case AuthBackend::VerifyAgainstDBusServicePid: -+ if (connection().interface()->servicePid(message().service()).value() != callerID.toUInt()) { -+ return false; -+ } -+ break; -+ } -+ -+ return BackendsManager::authBackend()->isCallerAuthorized(action, callerID); -+} -+ - QByteArray DBusHelperProxy::performAction(const QString &action, const QByteArray &callerID, QByteArray arguments) - { - if (!responder) { -@@ -259,7 +282,7 @@ QByteArray DBusHelperProxy::performAction(const QString &action, const QByteArra - QTimer *timer = responder->property("__KAuth_Helper_Shutdown_Timer").value<QTimer *>(); - timer->stop(); - -- if (BackendsManager::authBackend()->isCallerAuthorized(action, callerID)) { -+ if (isCallerAuthorized(action, callerID)) { - QString slotname = action; - if (slotname.startsWith(m_name + QLatin1Char('.'))) { - slotname = slotname.right(slotname.length() - m_name.length() - 1); -@@ -301,7 +324,7 @@ uint DBusHelperProxy::authorizeAction(const QString &action, const QByteArray &c - QTimer *timer = responder->property("__KAuth_Helper_Shutdown_Timer").value<QTimer *>(); - timer->stop(); - -- if (BackendsManager::authBackend()->isCallerAuthorized(action, callerID)) { -+ if (isCallerAuthorized(action, callerID)) { - retVal = static_cast<uint>(Action::AuthorizedStatus); - } else { - retVal = static_cast<uint>(Action::DeniedStatus); -diff --git a/src/backends/dbus/DBusHelperProxy.h b/src/backends/dbus/DBusHelperProxy.h -index 52b0ac4..82cec5a 100644 ---- a/src/backends/dbus/DBusHelperProxy.h -+++ b/src/backends/dbus/DBusHelperProxy.h -@@ -25,12 +25,13 @@ - #include "kauthactionreply.h" - - #include <QDBusConnection> -+#include <QDBusContext> - #include <QVariant> - - namespace KAuth - { - --class DBusHelperProxy : public HelperProxy -+class DBusHelperProxy : public HelperProxy, protected QDBusContext - { - Q_OBJECT - Q_PLUGIN_METADATA(IID "org.kde.DBusHelperProxy") -@@ -79,6 +80,9 @@ Q_SIGNALS: - - private Q_SLOTS: - void remoteSignalReceived(int type, const QString &action, QByteArray blob); -+ -+private: -+ bool isCallerAuthorized(const QString &action, const QByteArray &callerID); - }; - - } // namespace Auth -diff --git a/src/backends/policykit/PolicyKitBackend.cpp b/src/backends/policykit/PolicyKitBackend.cpp -index c2b4d42..bf038a8 100644 ---- a/src/backends/policykit/PolicyKitBackend.cpp -+++ b/src/backends/policykit/PolicyKitBackend.cpp -@@ -78,6 +78,11 @@ QByteArray PolicyKitBackend::callerID() const - return a; - } - -+AuthBackend::ExtraCallerIDVerificationMethod Polkit1Backend::extraCallerIDVerificationMethod() const -+{ -+ return VerifyAgainstDBusServicePid; -+} -+ - bool PolicyKitBackend::isCallerAuthorized(const QString &action, QByteArray callerID) - { - QDataStream s(&callerID, QIODevice::ReadOnly); -diff --git a/src/backends/policykit/PolicyKitBackend.h b/src/backends/policykit/PolicyKitBackend.h -index eb17a3a..38b0240 100644 ---- a/src/backends/policykit/PolicyKitBackend.h -+++ b/src/backends/policykit/PolicyKitBackend.h -@@ -40,6 +40,7 @@ public: - virtual Action::AuthStatus authorizeAction(const QString &); - virtual Action::AuthStatus actionStatus(const QString &); - virtual QByteArray callerID() const; -+ ExtraCallerIDVerificationMethod extraCallerIDVerificationMethod() const Q_DECL_OVERRIDE; - virtual bool isCallerAuthorized(const QString &action, QByteArray callerID); - - private Q_SLOTS: -diff --git a/src/backends/polkit-1/Polkit1Backend.cpp b/src/backends/polkit-1/Polkit1Backend.cpp -index 78ee5bb..774588c 100644 ---- a/src/backends/polkit-1/Polkit1Backend.cpp -+++ b/src/backends/polkit-1/Polkit1Backend.cpp -@@ -162,6 +162,11 @@ QByteArray Polkit1Backend::callerID() const - return QDBusConnection::systemBus().baseService().toUtf8(); - } - -+AuthBackend::ExtraCallerIDVerificationMethod Polkit1Backend::extraCallerIDVerificationMethod() const -+{ -+ return VerifyAgainstDBusServiceName; -+} -+ - bool Polkit1Backend::isCallerAuthorized(const QString &action, QByteArray callerID) - { - PolkitQt1::SystemBusNameSubject subject(QString::fromUtf8(callerID)); -diff --git a/src/backends/polkit-1/Polkit1Backend.h b/src/backends/polkit-1/Polkit1Backend.h -index d7d1e3a..2357892 100644 ---- a/src/backends/polkit-1/Polkit1Backend.h -+++ b/src/backends/polkit-1/Polkit1Backend.h -@@ -49,6 +49,7 @@ public: - Action::AuthStatus authorizeAction(const QString &) Q_DECL_OVERRIDE; - Action::AuthStatus actionStatus(const QString &) Q_DECL_OVERRIDE; - QByteArray callerID() const Q_DECL_OVERRIDE; -+ ExtraCallerIDVerificationMethod extraCallerIDVerificationMethod() const Q_DECL_OVERRIDE; - bool isCallerAuthorized(const QString &action, QByteArray callerID) Q_DECL_OVERRIDE; - bool actionExists(const QString &action) Q_DECL_OVERRIDE; - --- -cgit v0.11.2 diff --git a/source/kf5/kauth/FrugalBuild b/source/kf5/kauth/FrugalBuild index 0f4c9d4..231b913 100644 --- a/source/kf5/kauth/FrugalBuild +++ b/source/kf5/kauth/FrugalBuild @@ -9,10 +9,8 @@ groups=('kf5') archs=("x86_64") _F_kde_project="frameworks" Finclude kf5 -source+=(CVE-2017-8422.patch) depends=("kcoreaddons>=$_F_kf5_full" 'polkit-qt5-1>=0.112.0-3') makedepends+=("qt5-tools>=$_F_kdever_qt5" "qt5-x11extras>=$_F_kdever_qt5") -sha1sums=('ce0c7e2263c10bb8f74068e683210b25d24d6198' \ - '89a4e3ba4336c1f3e9aebedba0c47a975f347cae') +sha1sums=('ce0c7e2263c10bb8f74068e683210b25d24d6198') # optimization OK _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
