commit: 40bc6b7f79069264f3cbc918ffae4af4feab2bb5 Author: John Helmert III <jchelmert3 <AT> posteo <DOT> net> AuthorDate: Wed Jul 1 04:33:35 2020 +0000 Commit: Joonas Niilola <juippis <AT> gentoo <DOT> org> CommitDate: Tue Jul 7 13:56:31 2020 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=40bc6b7f
net-misc/hylafaxplus: Add 7.0.2 (security bump) Bug: https://bugs.gentoo.org/730290 Package-Manager: Portage-2.3.103, Repoman-2.3.23 Signed-off-by: John Helmert III <jchelmert3 <AT> posteo.net> Closes: https://github.com/gentoo/gentoo/pull/16541 Signed-off-by: Joonas Niilola <juippis <AT> gentoo.org> net-misc/hylafaxplus/Manifest | 1 + .../files/hylafaxplus-CVE-2020-1539x.patch | 110 ++++++++++++++ net-misc/hylafaxplus/hylafaxplus-7.0.2.ebuild | 160 +++++++++++++++++++++ 3 files changed, 271 insertions(+) diff --git a/net-misc/hylafaxplus/Manifest b/net-misc/hylafaxplus/Manifest index 3e0b1d426ce..51882b7cd3d 100644 --- a/net-misc/hylafaxplus/Manifest +++ b/net-misc/hylafaxplus/Manifest @@ -1,2 +1,3 @@ DIST hylafax-5.5.5.tar.gz 1353495 BLAKE2B e1b41a5cf5502ad28467625495171c085f43f4352b73bfd633da851a1366502aca04a157790ad4a7f3d634a6adbb5dab4c1eeb294283352e9eedaf03c565cb42 SHA512 ee6225ae044c567093103f35c30d848db757636c1d8db78e8f7cb43eb01ea34ab229a81ca4175e2bf30d3c87b598d5b5797b7d92b0dc852bf4b69c697baca8cf DIST hylafax-5.6.1.tar.gz 1370677 BLAKE2B bd93d54f2c3e2c5c4c33617a0d95569c82bcbd32f669fb2ea513b86e112a5743ae6b4ddc8d43f3bd4af6006517e8787392c84bf60e715c104ddb0d819b22985a SHA512 c86c33dc9e8feec4e265156fa3bbda18cf187feeef5c812ff3d3c7857de048a688bb979fcd3494ee8fe58a004a384a2a161d05245c86d0c304311d63f62a9eb1 +DIST hylafax-7.0.2.tar.gz 1393586 BLAKE2B cbf99f91a0aa07783dd30e76ce8416b2933240d4bf829220909000519f9c9e14a324163707c14504848ba71e7c1ee7d98455f06bb040c2c50c1493d0138122aa SHA512 ea68404ad79e798b29450683eaa927e73033e0fa8160b803a3e2c9000df487c81193cc8fc0c1187477f5e1b2e26eec1c065ebc17e0be82e9a3e3758b1b5b5e4e diff --git a/net-misc/hylafaxplus/files/hylafaxplus-CVE-2020-1539x.patch b/net-misc/hylafaxplus/files/hylafaxplus-CVE-2020-1539x.patch new file mode 100644 index 00000000000..6c484590c46 --- /dev/null +++ b/net-misc/hylafaxplus/files/hylafaxplus-CVE-2020-1539x.patch @@ -0,0 +1,110 @@ +commit e8f8196230ae15f6f7d7104ded3e2633002506e4 +Author: faxguy <faxguy@5505949e-d877-4686-9e03-c53b7a51b376> +Date: Sat Jun 13 23:46:33 2020 +0000 + + Johannes Segitz reported two issues: + + 1) faxaddmodem, faxsetup, and probemodem create temporary directories in a way that is not secure due to a race condition. + + 2) The HylaFAX spool directory bin and etc subdirectories are not secure against uucp deleting and recreating scripts that root runs. + + These changes address these two issues. + + + + git-svn-id: https://svn.code.sf.net/p/hylafax/HylaFAX+@2534 5505949e-d877-4686-9e03-c53b7a51b376 + +diff --git a/CONTRIBUTORS b/CONTRIBUTORS +index 057739f..a9d4f21 100644 +--- a/CONTRIBUTORS ++++ b/CONTRIBUTORS +@@ -203,6 +203,7 @@ following for their contributions: + Travis Schafer LogSend and LogRecv modem config options, documentation fixes + Sven Schmidt + Steven Schoch faxrcvd faxinfo text parsing ++ Johannes Segitz code security audit + John Sellens + Chris Severance documentation fixes, scripting improvements + Simon <[email protected]> +diff --git a/Makefile.in b/Makefile.in +index 1ee4d76..ec0cda7 100644 +--- a/Makefile.in ++++ b/Makefile.in +@@ -208,7 +208,10 @@ makeServerDirs:: + -idb hylafax.sw.server -root ${INSTALLROOT} -dir ${SPOOL} + -${INSTALL} -u ${FAXUSER} -g ${FAXGROUP} -m ${DIRMODE} \ + -idb hylafax.sw.server -dir \ +- -root ${INSTALLROOT} -F ${SPOOL} bin client config dev etc info log recvq status ++ -root ${INSTALLROOT} -F ${SPOOL} client config dev info log recvq status ++ -${INSTALL} -u root -g root -m ${DIRMODE} \ ++ -idb hylafax.sw.server -dir \ ++ -root ${INSTALLROOT} -F ${SPOOL} bin etc + -${INSTALL} -u ${FAXUSER} -g ${FAXGROUP} -m 700 \ + -idb hylafax.sw.server -dir \ + -root ${INSTALLROOT} -F ${SPOOL} sendq doneq docq tmp pollq archive +diff --git a/etc/faxaddmodem.sh.in b/etc/faxaddmodem.sh.in +index dc39917..c4d3ff1 100644 +--- a/etc/faxaddmodem.sh.in ++++ b/etc/faxaddmodem.sh.in +@@ -113,12 +113,14 @@ if [ "$euid" != "root" ]; then + fi + + # security ++o="`umask`" ++umask 077 + TMPDIR=`(mktemp -d /tmp/.faxaddmodem.XXXXXX) 2>/dev/null` ++umask "$o" + if test X$TMPDIR = X; then +- TMPDIR=/tmp/.faxaddmodem$$ ++ echo "Failed to create temporary directory. Cannot continue." ++ exit 1 + fi +-@RM@ -rf $TMPDIR +-(umask 077 ; mkdir $TMPDIR) || exit 1 + + SH=$SCRIPT_SH # shell for use below + CPATH=$SPOOL/etc/config # prefix of configuration file +diff --git a/etc/faxsetup.sh.in b/etc/faxsetup.sh.in +index 556eef5..b4aae40 100644 +--- a/etc/faxsetup.sh.in ++++ b/etc/faxsetup.sh.in +@@ -922,12 +922,14 @@ if onServer; then + # + + # Setup TMPDIR before anything can trap and rm it ++ o="`umask`" ++ umask 077 + TMPDIR=`(mktemp -d /tmp/.faxsetup.XXXXXX) 2>/dev/null` ++ umask "$o" + if test x$TMPDIR = x; then +- TMPDIR=/tmp/.faxsetup$$ ++ echo "Failed to create temporary directory. Cannot continue." ++ exit 1 + fi +- $RM -rf $TMPDIR +- (umask 077 ; mkdir $TMPDIR) || exit 1 + + JUNK="etc/setup.tmp" + trap "$RM \$JUNK; $RM -r \$TMPDIR; exit 1" 1 2 15 +diff --git a/etc/probemodem.sh.in b/etc/probemodem.sh.in +index 55b5d9b..c0abf15 100644 +--- a/etc/probemodem.sh.in ++++ b/etc/probemodem.sh.in +@@ -85,12 +85,14 @@ test -f $SPOOL/etc/setup.cache || { + . $SPOOL/etc/setup.cache # common configuration stuff + . $SPOOL/etc/setup.modem # modem-specific stuff + ++o="`umask`" ++umask 077 + TMPDIR=`(mktemp -d /tmp/.probemodem.XXXXXX) 2>/dev/null` ++umask "$o" + if test X$TMPDIR = X; then +- TMPDIR=/tmp/.probemodem$$ ++ echo "Failed to create temporary directory. Cannot continue." ++ exit 1 + fi +-@RM@ -fr $TMPDIR +-(umask 077 ; mkdir $TMPDIR) || exit 1 + + SH=$SCRIPT_SH # shell for use below + OUT=$TMPDIR/probemodem$$ # temp file in which modem output is recorded diff --git a/net-misc/hylafaxplus/hylafaxplus-7.0.2.ebuild b/net-misc/hylafaxplus/hylafaxplus-7.0.2.ebuild new file mode 100644 index 00000000000..2e43871ac72 --- /dev/null +++ b/net-misc/hylafaxplus/hylafaxplus-7.0.2.ebuild @@ -0,0 +1,160 @@ +# Copyright 1999-2020 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 + +inherit pam toolchain-funcs + +MY_PN="${PN/plus/}" +MY_P="${MY_PN}-${PV}" + +DESCRIPTION="Enterprise client-server fax package for class 1 and 2 fax modems" +HOMEPAGE="https://hylafax.sourceforge.net"; +SRC_URI="mirror://sourceforge/hylafax/${MY_P}.tar.gz" + +SLOT="0" +LICENSE="hylafaxplus" +KEYWORDS="~amd64 ~x86" +IUSE="html jbig lcms ldap mgetty pam" + +DEPEND=" + app-text/ghostscript-gpl + media-libs/tiff:0[jbig?] + !net-dialup/mgetty[fax] + >=sys-libs/zlib-1.1.4 + virtual/awk + virtual/jpeg:0 + virtual/mta + jbig? ( media-libs/jbigkit ) + lcms? ( media-libs/lcms ) + ldap? ( net-nds/openldap ) + mgetty? ( net-dialup/mgetty[-fax] ) + pam? ( sys-libs/pam ) +" +RDEPEND="${DEPEND} + !net-dialup/sendpage + net-mail/metamail +" + +S="${WORKDIR}/${MY_P}" + +CONFIG_PROTECT="${CONFIG_PROTECT} /var/spool/fax/etc /usr/lib/fax" +CONFIG_PROTECT_MASK="${CONFIG_PROTECT_MASK} /var/spool/fax/etc/xferfaxlog" + +PATCHES=( + "${FILESDIR}/ldconfig-patch" + "${FILESDIR}/${PN}-CVE-2020-1539x.patch" +) + +src_prepare() { + default + + # force it not to strip binaries + for dir in etc util faxalter faxcover faxd faxmail faxrm faxstat \ + hfaxd sendfax sendpage ; do + sed -i -e "s:-idb:-idb \"nostrip\" -idb:g" \ + "${dir}"/Makefile.in || die "sed on ${dir}/Makefile.in failed" + done + + sed -i -e "s:hostname:hostname -f:g" util/{faxrcvd,pollrcvd}.sh.in || die "sed on hostname failed" + + # Respect LDFLAGS(at least partially) + sed -i -e "/^LDFLAGS/s/LDOPTS}/LDOPTS} ${LDFLAGS}/" defs.in || die "sed on defs.in failed" + + sed -i -e "s|-fpic|-fPIC|g" \ + configure || die +} + +src_configure() { + do_configure() { + echo ./configure --nointeractive ${1} + # eval required for quoting in ${my_conf} to work properly, better way? + eval ./configure --nointeractive ${1} || die "./configure failed" + } + local my_conf=" + --with-DIR_BIN=/usr/bin + --with-DIR_SBIN=/usr/sbin + --with-DIR_LIB=/usr/$(get_libdir) + --with-DIR_LIBEXEC=/usr/sbin + --with-DIR_LIBDATA=/usr/$(get_libdir)/fax + --with-DIR_LOCALE=/usr/share/locale + --with-DIR_LOCKS=/var/lock + --with-DIR_MAN=/usr/share/man + --with-DIR_SPOOL=/var/spool/fax + --with-DIR_HTML=/usr/share/doc/${P}/html + --with-DIR_CGI="${WORKDIR}" + --with-PATH_DPSRIP=/var/spool/fax/bin/ps2fax + --with-PATH_IMPRIP=\"\" + --with-SYSVINIT=no + --with-REGEX=yes + --with-LIBTIFF=\"-ltiff -ljpeg -lz\" + --with-OPTIMIZER=\"${CFLAGS}\" + --with-DSO=auto + --with-HTML=$(usex html)" + + if use mgetty; then + my_conf="${my_conf} \ + --with-PATH_GETTY=/sbin/mgetty \ + --with-PATH_EGETTY=/sbin/mgetty \ + --with-PATH_VGETTY=/usr/sbin/vgetty" + else + # GETTY defaults to /sbin/agetty + my_conf="${my_conf} \ + --with-PATH_EGETTY=/bin/false \ + --with-PATH_VGETTY=/bin/false" + fi + + #--enable-pam isn't valid + use pam || my_conf="${my_conf} $(use_enable pam)" + use lcms || my_conf="${my_conf} $(use_enable lcms)" + use ldap || my_conf="${my_conf} $(use_enable ldap)" + use jbig || my_conf="${my_conf} $(use_enable jbig)" + + tc-export CC CXX AR RANLIB + + do_configure "${my_conf}" +} + +src_compile() { + # Parallel building is borked, bug #???? + emake -j1 +} + +src_install() { + dodir /usr/{bin,sbin} /usr/$(get_libdir)/fax /usr/share/man + dodir /var/spool /var/spool/fax + fowners uucp:uucp /var/spool/fax + fperms 0600 /var/spool/fax + dodir "/usr/share/doc/${P}/samples" + + emake DESTDIR="${D}" \ + BIN="${D}/usr/bin" \ + SBIN="${D}/usr/sbin" \ + LIBDIR="${D}/usr/$(get_libdir)" \ + LIB="${D}/usr/$(get_libdir)" \ + LIBEXEC="${D}/usr/sbin" \ + LIBDATA="${D}/usr/$(get_libdir)/fax" \ + DIR_LOCALE="${D}/usr/share/locale" \ + MAN="${D}/usr/share/man" \ + SPOOL="${D}/var/spool/fax" \ + HTMLDIR="${D}/usr/share/doc/${PF}/html" \ + install + + keepdir /var/spool/fax/{archive,client,etc,pollq,recvq,tmp} + keepdir /var/spool/fax/{status,sendq,log,info,doneq,docq,dev} + + einfo "Adding env.d entry for ${PN}" + newenvd - 99hylafaxplus <<-EOF + PATH="/var/spool/fax/bin" + CONFIG_PROTECT="/var/spool/fax/etc /usr/$(get_libdir)/fax" + CONFIG_PROTECT_MASK="/var/spool/fax/etc/xferfaxlog" + EOF + + newconfd "${FILESDIR}/${PN}-conf" ${PN} + newinitd "${FILESDIR}/${PN}-init" ${PN} + + use pam && pamd_mimic_system ${MY_PN} auth account session + + einstalldocs + docinto samples +}
