added my Recipes
This commit is contained in:
@@ -0,0 +1,8 @@
|
||||
/* give group 'network' rights to change settings */
|
||||
/* taken from https://wiki.archlinux.org/index.php/NetworkManager#Set_up_PolicyKit_permissions */
|
||||
|
||||
polkit.addRule(function(action, subject) {
|
||||
if (action.id.indexOf("org.freedesktop.NetworkManager.") == 0 && subject.isInGroup("network")) {
|
||||
return polkit.Result.YES;
|
||||
}
|
||||
});
|
||||
@@ -0,0 +1,8 @@
|
||||
/* give group 'datetime' rights to change settings */
|
||||
/* based upon http://lists.freedesktop.org/archives/systemd-devel/2013-March/009576.html */
|
||||
|
||||
polkit.addRule(function(action, subject) {
|
||||
if (action.id.indexOf("org.freedesktop.timedate1.") == 0 && subject.isInGroup("datetime")) {
|
||||
return polkit.Result.YES;
|
||||
}
|
||||
});
|
||||
@@ -0,0 +1,24 @@
|
||||
polkit.addRule(function(action, subject) {
|
||||
var YES = polkit.Result.YES;
|
||||
var permission = {
|
||||
// required for udisks1:
|
||||
"org.freedesktop.udisks.filesystem-mount": YES,
|
||||
"org.freedesktop.udisks.luks-unlock": YES,
|
||||
"org.freedesktop.udisks.drive-eject": YES,
|
||||
"org.freedesktop.udisks.drive-detach": YES,
|
||||
// required for udisks2:
|
||||
"org.freedesktop.udisks2.filesystem-mount": YES,
|
||||
"org.freedesktop.udisks2.encrypted-unlock": YES,
|
||||
"org.freedesktop.udisks2.eject-media": YES,
|
||||
"org.freedesktop.udisks2.power-off-drive": YES,
|
||||
// required for udisks2 if using udiskie from another seat (e.g. systemd):
|
||||
"org.freedesktop.udisks2.filesystem-mount-other-seat": YES,
|
||||
"org.freedesktop.udisks2.filesystem-unmount-others": YES,
|
||||
"org.freedesktop.udisks2.encrypted-unlock-other-seat": YES,
|
||||
"org.freedesktop.udisks2.eject-media-other-seat": YES,
|
||||
"org.freedesktop.udisks2.power-off-drive-other-seat": YES
|
||||
};
|
||||
if (subject.isInGroup("plugdev")) {
|
||||
return permission[action.id];
|
||||
}
|
||||
});
|
||||
@@ -0,0 +1,14 @@
|
||||
DESCRIPTION = "Create usergroup datetime. All members off this group are allowed set date/time/timezone via system dbus"
|
||||
LICENSE = "MIT"
|
||||
LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/MIT;md5=0835ade698e0bcf8506ecda2f7b4f302"
|
||||
|
||||
require polkit-group-rule.inc
|
||||
|
||||
SRC_URI = "file://50-org.freedesktop.timedate1.rules"
|
||||
|
||||
do_install() {
|
||||
install -m 0755 ${WORKDIR}/50-org.freedesktop.timedate1.rules ${D}${sysconfdir}/polkit-1/rules.d
|
||||
}
|
||||
|
||||
USERADD_PACKAGES = "${PN}"
|
||||
GROUPADD_PARAM:${PN} = "--system datetime"
|
||||
@@ -0,0 +1,14 @@
|
||||
DESCRIPTION = "Create usergroup network. All members off this group are allowed to modify networkmanager settings"
|
||||
LICENSE = "MIT"
|
||||
LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/MIT;md5=0835ade698e0bcf8506ecda2f7b4f302"
|
||||
|
||||
require polkit-group-rule.inc
|
||||
|
||||
SRC_URI = "file://50-org.freedesktop.NetworkManager.rules"
|
||||
|
||||
do_install() {
|
||||
install -m 0755 ${WORKDIR}/50-org.freedesktop.NetworkManager.rules ${D}${sysconfdir}/polkit-1/rules.d
|
||||
}
|
||||
|
||||
USERADD_PACKAGES = "${PN}"
|
||||
GROUPADD_PARAM:${PN} = "--system network"
|
||||
@@ -0,0 +1,17 @@
|
||||
DESCRIPTION = "Polkit rule to allow non-priviledged users mount/umount block devices via udisks2"
|
||||
LICENSE = "MIT"
|
||||
LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/MIT;md5=0835ade698e0bcf8506ecda2f7b4f302"
|
||||
|
||||
require polkit-group-rule.inc
|
||||
|
||||
# The file originates from https://github.com/coldfix/udiskie/wiki/Permissions
|
||||
SRC_URI = "file://50-org.freedesktop.udiskie.rules"
|
||||
|
||||
RDEPENDS:${PN} += "udisks2"
|
||||
|
||||
do_install() {
|
||||
install -m 0755 ${WORKDIR}/50-org.freedesktop.udiskie.rules ${D}${sysconfdir}/polkit-1/rules.d
|
||||
}
|
||||
|
||||
USERADD_PACKAGES = "${PN}"
|
||||
GROUPADD_PARAM:${PN} = "--system plugdev"
|
||||
@@ -0,0 +1,13 @@
|
||||
# polkit must prepare polkitd group
|
||||
DEPENDS += "polkit"
|
||||
|
||||
inherit features_check
|
||||
REQUIRED_DISTRO_FEATURES = "polkit"
|
||||
|
||||
inherit useradd
|
||||
|
||||
do_install:prepend() {
|
||||
install -m 700 -d ${D}${sysconfdir}/polkit-1/rules.d
|
||||
chown polkitd:root ${D}/${sysconfdir}/polkit-1/rules.d
|
||||
}
|
||||
USERADD_PARAM:${PN}:prepend = "--system --no-create-home --user-group --home-dir ${sysconfdir}/polkit-1 polkitd;"
|
||||
@@ -0,0 +1,84 @@
|
||||
From 85c2dd9275cdfb369f613089f22733c0f1ba2aec Mon Sep 17 00:00:00 2001
|
||||
From: Jan Rybar <jrybar@redhat.com>
|
||||
Date: Tue, 25 Jan 2022 17:21:46 +0000
|
||||
Subject: [PATCH 1/3] pkexec: local privilege escalation (CVE-2021-4034)
|
||||
|
||||
Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de>
|
||||
|
||||
---
|
||||
src/programs/pkcheck.c | 5 +++++
|
||||
src/programs/pkexec.c | 23 ++++++++++++++++++++---
|
||||
2 files changed, 25 insertions(+), 3 deletions(-)
|
||||
|
||||
CVE: CVE-2021-4034
|
||||
Upstream-Status: Backport [a2bf5c9c83b6ae46cbd5c779d3055bff81ded683]
|
||||
|
||||
diff --git a/src/programs/pkcheck.c b/src/programs/pkcheck.c
|
||||
index f1bb4e1..768525c 100644
|
||||
--- a/src/programs/pkcheck.c
|
||||
+++ b/src/programs/pkcheck.c
|
||||
@@ -363,6 +363,11 @@ main (int argc, char *argv[])
|
||||
local_agent_handle = NULL;
|
||||
ret = 126;
|
||||
|
||||
+ if (argc < 1)
|
||||
+ {
|
||||
+ exit(126);
|
||||
+ }
|
||||
+
|
||||
/* Disable remote file access from GIO. */
|
||||
setenv ("GIO_USE_VFS", "local", 1);
|
||||
|
||||
diff --git a/src/programs/pkexec.c b/src/programs/pkexec.c
|
||||
index 7698c5c..84e5ef6 100644
|
||||
--- a/src/programs/pkexec.c
|
||||
+++ b/src/programs/pkexec.c
|
||||
@@ -488,6 +488,15 @@ main (int argc, char *argv[])
|
||||
pid_t pid_of_caller;
|
||||
gpointer local_agent_handle;
|
||||
|
||||
+
|
||||
+ /*
|
||||
+ * If 'pkexec' is called THIS wrong, someone's probably evil-doing. Don't be nice, just bail out.
|
||||
+ */
|
||||
+ if (argc<1)
|
||||
+ {
|
||||
+ exit(127);
|
||||
+ }
|
||||
+
|
||||
ret = 127;
|
||||
authority = NULL;
|
||||
subject = NULL;
|
||||
@@ -614,10 +623,10 @@ main (int argc, char *argv[])
|
||||
|
||||
path = g_strdup (pwstruct.pw_shell);
|
||||
if (!path)
|
||||
- {
|
||||
+ {
|
||||
g_printerr ("No shell configured or error retrieving pw_shell\n");
|
||||
goto out;
|
||||
- }
|
||||
+ }
|
||||
/* If you change this, be sure to change the if (!command_line)
|
||||
case below too */
|
||||
command_line = g_strdup (path);
|
||||
@@ -636,7 +645,15 @@ main (int argc, char *argv[])
|
||||
goto out;
|
||||
}
|
||||
g_free (path);
|
||||
- argv[n] = path = s;
|
||||
+ path = s;
|
||||
+
|
||||
+ /* argc<2 and pkexec runs just shell, argv is guaranteed to be null-terminated.
|
||||
+ * /-less shell shouldn't happen, but let's be defensive and don't write to null-termination
|
||||
+ */
|
||||
+ if (argv[n] != NULL)
|
||||
+ {
|
||||
+ argv[n] = path;
|
||||
+ }
|
||||
}
|
||||
if (access (path, F_OK) != 0)
|
||||
{
|
||||
--
|
||||
2.20.1
|
||||
|
||||
@@ -0,0 +1,88 @@
|
||||
From c86aea01a06ad4d6c428137e9cfe2f74b1ae7f01 Mon Sep 17 00:00:00 2001
|
||||
From: Jan Rybar <jrybar@redhat.com>
|
||||
Date: Mon, 21 Feb 2022 08:29:05 +0000
|
||||
Subject: [PATCH 2/3] CVE-2021-4115 (GHSL-2021-077) fix
|
||||
|
||||
Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de>
|
||||
|
||||
---
|
||||
src/polkit/polkitsystembusname.c | 38 ++++++++++++++++++++++++++++----
|
||||
1 file changed, 34 insertions(+), 4 deletions(-)
|
||||
|
||||
CVE: CVE-2021-4115
|
||||
Upstream-Status: Backport [41cb093f554da8772362654a128a84dd8a5542a7]
|
||||
|
||||
diff --git a/src/polkit/polkitsystembusname.c b/src/polkit/polkitsystembusname.c
|
||||
index 8ed1363..2fbf5f1 100644
|
||||
--- a/src/polkit/polkitsystembusname.c
|
||||
+++ b/src/polkit/polkitsystembusname.c
|
||||
@@ -62,6 +62,10 @@ enum
|
||||
PROP_NAME,
|
||||
};
|
||||
|
||||
+
|
||||
+guint8 dbus_call_respond_fails; // has to be global because of callback
|
||||
+
|
||||
+
|
||||
static void subject_iface_init (PolkitSubjectIface *subject_iface);
|
||||
|
||||
G_DEFINE_TYPE_WITH_CODE (PolkitSystemBusName, polkit_system_bus_name, G_TYPE_OBJECT,
|
||||
@@ -364,6 +368,7 @@ on_retrieved_unix_uid_pid (GObject *src,
|
||||
if (!v)
|
||||
{
|
||||
data->caught_error = TRUE;
|
||||
+ dbus_call_respond_fails += 1;
|
||||
}
|
||||
else
|
||||
{
|
||||
@@ -405,6 +410,8 @@ polkit_system_bus_name_get_creds_sync (PolkitSystemBusName *system_bus
|
||||
tmp_context = g_main_context_new ();
|
||||
g_main_context_push_thread_default (tmp_context);
|
||||
|
||||
+ dbus_call_respond_fails = 0;
|
||||
+
|
||||
/* Do two async calls as it's basically as fast as one sync call.
|
||||
*/
|
||||
g_dbus_connection_call (connection,
|
||||
@@ -432,11 +439,34 @@ polkit_system_bus_name_get_creds_sync (PolkitSystemBusName *system_bus
|
||||
on_retrieved_unix_uid_pid,
|
||||
&data);
|
||||
|
||||
- while (!((data.retrieved_uid && data.retrieved_pid) || data.caught_error))
|
||||
- g_main_context_iteration (tmp_context, TRUE);
|
||||
+ while (TRUE)
|
||||
+ {
|
||||
+ /* If one dbus call returns error, we must wait until the other call
|
||||
+ * calls _call_finish(), otherwise fd leak is possible.
|
||||
+ * Resolves: GHSL-2021-077
|
||||
+ */
|
||||
|
||||
- if (data.caught_error)
|
||||
- goto out;
|
||||
+ if ( (dbus_call_respond_fails > 1) )
|
||||
+ {
|
||||
+ // we got two faults, we can leave
|
||||
+ goto out;
|
||||
+ }
|
||||
+
|
||||
+ if ((data.caught_error && (data.retrieved_pid || data.retrieved_uid)))
|
||||
+ {
|
||||
+ // we got one fault and the other call finally finished, we can leave
|
||||
+ goto out;
|
||||
+ }
|
||||
+
|
||||
+ if ( !(data.retrieved_uid && data.retrieved_pid) )
|
||||
+ {
|
||||
+ g_main_context_iteration (tmp_context, TRUE);
|
||||
+ }
|
||||
+ else
|
||||
+ {
|
||||
+ break;
|
||||
+ }
|
||||
+ }
|
||||
|
||||
if (out_uid)
|
||||
*out_uid = data.uid;
|
||||
--
|
||||
2.20.1
|
||||
|
||||
@@ -0,0 +1,38 @@
|
||||
From 4ce27b66bb07b72cb96d3d43a75108a5a6e7e156 Mon Sep 17 00:00:00 2001
|
||||
From: Xi Ruoyao <xry111@mengyan1223.wang>
|
||||
Date: Tue, 10 Aug 2021 19:09:42 +0800
|
||||
Subject: [PATCH] jsauthority: port to mozjs-91
|
||||
|
||||
Upstream-Status: Submitted [https://gitlab.freedesktop.org/polkit/polkit/-/merge_requests/92]
|
||||
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
|
||||
---
|
||||
configure.ac | 2 +-
|
||||
meson.build | 2 +-
|
||||
2 files changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/configure.ac b/configure.ac
|
||||
index d807086..5a7fc11 100644
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -80,7 +80,7 @@ PKG_CHECK_MODULES(GLIB, [gmodule-2.0 gio-unix-2.0 >= 2.30.0])
|
||||
AC_SUBST(GLIB_CFLAGS)
|
||||
AC_SUBST(GLIB_LIBS)
|
||||
|
||||
-PKG_CHECK_MODULES(LIBJS, [mozjs-78])
|
||||
+PKG_CHECK_MODULES(LIBJS, [mozjs-91])
|
||||
|
||||
AC_SUBST(LIBJS_CFLAGS)
|
||||
AC_SUBST(LIBJS_CXXFLAGS)
|
||||
diff --git a/meson.build b/meson.build
|
||||
index b3702be..733bbff 100644
|
||||
--- a/meson.build
|
||||
+++ b/meson.build
|
||||
@@ -126,7 +126,7 @@ expat_dep = dependency('expat')
|
||||
assert(cc.has_header('expat.h', dependencies: expat_dep), 'Can\'t find expat.h. Please install expat.')
|
||||
assert(cc.has_function('XML_ParserCreate', dependencies: expat_dep), 'Can\'t find expat library. Please install expat.')
|
||||
|
||||
-mozjs_dep = dependency('mozjs-78')
|
||||
+mozjs_dep = dependency('mozjs-91')
|
||||
|
||||
dbus_dep = dependency('dbus-1')
|
||||
dbus_confdir = dbus_dep.get_pkgconfig_variable('datadir', define_variable: ['datadir', pk_prefix / pk_datadir]) #changed from sysconfdir with respect to commit#8eada3836465838
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,63 @@
|
||||
From 7799441b9aa55324160deefbc65f9d918b8c94c1 Mon Sep 17 00:00:00 2001
|
||||
From: Xi Ruoyao <xry111@mengyan1223.wang>
|
||||
Date: Tue, 10 Aug 2021 18:52:56 +0800
|
||||
Subject: [PATCH] jsauthority: ensure to call JS_Init() and JS_ShutDown()
|
||||
exactly once
|
||||
|
||||
Before this commit, we were calling JS_Init() in
|
||||
polkit_backend_js_authority_class_init and never called JS_ShutDown.
|
||||
This is actually a misusage of SpiderMonkey API. Quote from a comment
|
||||
in js/Initialization.h (both mozjs-78 and mozjs-91):
|
||||
|
||||
It is currently not possible to initialize SpiderMonkey multiple
|
||||
times (that is, calling JS_Init/JSAPI methods/JS_ShutDown in that
|
||||
order, then doing so again).
|
||||
|
||||
This misusage does not cause severe issues with mozjs-78. However, when
|
||||
we eventually port jsauthority to use mozjs-91, bad thing will happen:
|
||||
see the test failure mentioned in #150.
|
||||
|
||||
This commit is tested with both mozjs-78 and mozjs-91, all tests pass
|
||||
with it.
|
||||
|
||||
Upstream-Status: Submitted [https://gitlab.freedesktop.org/polkit/polkit/-/merge_requests/91]
|
||||
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
|
||||
---
|
||||
src/polkitbackend/polkitbackendjsauthority.cpp | 10 +++++++---
|
||||
1 file changed, 7 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/src/polkitbackend/polkitbackendjsauthority.cpp b/src/polkitbackend/polkitbackendjsauthority.cpp
|
||||
index 41d8d5c..38dc001 100644
|
||||
--- a/src/polkitbackend/polkitbackendjsauthority.cpp
|
||||
+++ b/src/polkitbackend/polkitbackendjsauthority.cpp
|
||||
@@ -75,6 +75,13 @@
|
||||
|
||||
/* ---------------------------------------------------------------------------------------------------- */
|
||||
|
||||
+static class JsInitHelperType
|
||||
+{
|
||||
+public:
|
||||
+ JsInitHelperType() { JS_Init(); }
|
||||
+ ~JsInitHelperType() { JS_ShutDown(); }
|
||||
+} JsInitHelper;
|
||||
+
|
||||
struct _PolkitBackendJsAuthorityPrivate
|
||||
{
|
||||
gchar **rules_dirs;
|
||||
@@ -589,7 +596,6 @@ polkit_backend_js_authority_finalize (GObject *object)
|
||||
delete authority->priv->js_polkit;
|
||||
|
||||
JS_DestroyContext (authority->priv->cx);
|
||||
- /* JS_ShutDown (); */
|
||||
|
||||
G_OBJECT_CLASS (polkit_backend_js_authority_parent_class)->finalize (object);
|
||||
}
|
||||
@@ -665,8 +671,6 @@ polkit_backend_js_authority_class_init (PolkitBackendJsAuthorityClass *klass)
|
||||
|
||||
|
||||
g_type_class_add_private (klass, sizeof (PolkitBackendJsAuthorityPrivate));
|
||||
-
|
||||
- JS_Init ();
|
||||
}
|
||||
|
||||
/* ---------------------------------------------------------------------------------------------------- */
|
||||
@@ -0,0 +1,253 @@
|
||||
From a334fac72112c01cd322f7c97ef7ca21457ab52f Mon Sep 17 00:00:00 2001
|
||||
From: "A. Wilcox" <AWilcox@Wilcox-Tech.com>
|
||||
Date: Sun, 15 May 2022 05:04:10 +0000
|
||||
Subject: [PATCH] Make netgroup support optional
|
||||
|
||||
On at least Linux/musl and Linux/uclibc, netgroup support is not
|
||||
available. PolKit fails to compile on these systems for that reason.
|
||||
|
||||
This change makes netgroup support conditional on the presence of the
|
||||
setnetgrent(3) function which is required for the support to work. If
|
||||
that function is not available on the system, an error will be returned
|
||||
to the administrator if unix-netgroup: is specified in configuration.
|
||||
|
||||
(sam: rebased for Meson and Duktape.)
|
||||
|
||||
Closes: https://gitlab.freedesktop.org/polkit/polkit/-/issues/14
|
||||
Closes: https://gitlab.freedesktop.org/polkit/polkit/-/issues/163
|
||||
Closes: https://gitlab.freedesktop.org/polkit/polkit/-/merge_requests/52
|
||||
Signed-off-by: A. Wilcox <AWilcox@Wilcox-Tech.com>
|
||||
|
||||
Ported back the change in configure.ac (upstream removed autotools
|
||||
support).
|
||||
|
||||
Upstream-Status: Backport [https://gitlab.freedesktop.org/polkit/polkit/-/commit/b57deee8178190a7ecc75290fa13cf7daabc2c66]
|
||||
Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com>
|
||||
|
||||
---
|
||||
configure.ac | 2 +-
|
||||
meson.build | 1 +
|
||||
src/polkit/polkitidentity.c | 17 +++++++++++++++++
|
||||
src/polkit/polkitunixnetgroup.c | 3 +++
|
||||
.../polkitbackendinteractiveauthority.c | 14 ++++++++------
|
||||
src/polkitbackend/polkitbackendjsauthority.cpp | 2 ++
|
||||
test/polkit/polkitidentitytest.c | 8 +++++++-
|
||||
test/polkit/polkitunixnetgrouptest.c | 2 ++
|
||||
.../test-polkitbackendjsauthority.c | 2 ++
|
||||
9 files changed, 43 insertions(+), 8 deletions(-)
|
||||
|
||||
diff --git a/configure.ac b/configure.ac
|
||||
index ca4b9f2..4c5d596 100644
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -100,7 +100,7 @@ AC_CHECK_LIB(expat,XML_ParserCreate,[EXPAT_LIBS="-lexpat"],
|
||||
[AC_MSG_ERROR([Can't find expat library. Please install expat.])])
|
||||
AC_SUBST(EXPAT_LIBS)
|
||||
|
||||
-AC_CHECK_FUNCS(clearenv fdatasync)
|
||||
+AC_CHECK_FUNCS(clearenv fdatasync setnetgrent)
|
||||
|
||||
if test "x$GCC" = "xyes"; then
|
||||
LDFLAGS="-Wl,--as-needed $LDFLAGS"
|
||||
diff --git a/meson.build b/meson.build
|
||||
index 733bbff..d840926 100644
|
||||
--- a/meson.build
|
||||
+++ b/meson.build
|
||||
@@ -82,6 +82,7 @@ config_h.set('_GNU_SOURCE', true)
|
||||
check_functions = [
|
||||
'clearenv',
|
||||
'fdatasync',
|
||||
+ 'setnetgrent',
|
||||
]
|
||||
|
||||
foreach func: check_functions
|
||||
diff --git a/src/polkit/polkitidentity.c b/src/polkit/polkitidentity.c
|
||||
index 3aa1f7f..793f17d 100644
|
||||
--- a/src/polkit/polkitidentity.c
|
||||
+++ b/src/polkit/polkitidentity.c
|
||||
@@ -182,7 +182,15 @@ polkit_identity_from_string (const gchar *str,
|
||||
}
|
||||
else if (g_str_has_prefix (str, "unix-netgroup:"))
|
||||
{
|
||||
+#ifndef HAVE_SETNETGRENT
|
||||
+ g_set_error (error,
|
||||
+ POLKIT_ERROR,
|
||||
+ POLKIT_ERROR_FAILED,
|
||||
+ "Netgroups are not available on this machine ('%s')",
|
||||
+ str);
|
||||
+#else
|
||||
identity = polkit_unix_netgroup_new (str + sizeof "unix-netgroup:" - 1);
|
||||
+#endif
|
||||
}
|
||||
|
||||
if (identity == NULL && (error != NULL && *error == NULL))
|
||||
@@ -344,6 +352,14 @@ polkit_identity_new_for_gvariant (GVariant *variant,
|
||||
GVariant *v;
|
||||
const char *name;
|
||||
|
||||
+#ifndef HAVE_SETNETGRENT
|
||||
+ g_set_error (error,
|
||||
+ POLKIT_ERROR,
|
||||
+ POLKIT_ERROR_FAILED,
|
||||
+ "Netgroups are not available on this machine");
|
||||
+ goto out;
|
||||
+#else
|
||||
+
|
||||
v = lookup_asv (details_gvariant, "name", G_VARIANT_TYPE_STRING, error);
|
||||
if (v == NULL)
|
||||
{
|
||||
@@ -353,6 +369,7 @@ polkit_identity_new_for_gvariant (GVariant *variant,
|
||||
name = g_variant_get_string (v, NULL);
|
||||
ret = polkit_unix_netgroup_new (name);
|
||||
g_variant_unref (v);
|
||||
+#endif
|
||||
}
|
||||
else
|
||||
{
|
||||
diff --git a/src/polkit/polkitunixnetgroup.c b/src/polkit/polkitunixnetgroup.c
|
||||
index 8a2b369..83f8d4a 100644
|
||||
--- a/src/polkit/polkitunixnetgroup.c
|
||||
+++ b/src/polkit/polkitunixnetgroup.c
|
||||
@@ -194,6 +194,9 @@ polkit_unix_netgroup_set_name (PolkitUnixNetgroup *group,
|
||||
PolkitIdentity *
|
||||
polkit_unix_netgroup_new (const gchar *name)
|
||||
{
|
||||
+#ifndef HAVE_SETNETGRENT
|
||||
+ g_assert_not_reached();
|
||||
+#endif
|
||||
g_return_val_if_fail (name != NULL, NULL);
|
||||
return POLKIT_IDENTITY (g_object_new (POLKIT_TYPE_UNIX_NETGROUP,
|
||||
"name", name,
|
||||
diff --git a/src/polkitbackend/polkitbackendinteractiveauthority.c b/src/polkitbackend/polkitbackendinteractiveauthority.c
|
||||
index 056d9a8..36c2f3d 100644
|
||||
--- a/src/polkitbackend/polkitbackendinteractiveauthority.c
|
||||
+++ b/src/polkitbackend/polkitbackendinteractiveauthority.c
|
||||
@@ -2233,25 +2233,26 @@ get_users_in_net_group (PolkitIdentity *group,
|
||||
GList *ret;
|
||||
|
||||
ret = NULL;
|
||||
+#ifdef HAVE_SETNETGRENT
|
||||
name = polkit_unix_netgroup_get_name (POLKIT_UNIX_NETGROUP (group));
|
||||
|
||||
-#ifdef HAVE_SETNETGRENT_RETURN
|
||||
+# ifdef HAVE_SETNETGRENT_RETURN
|
||||
if (setnetgrent (name) == 0)
|
||||
{
|
||||
g_warning ("Error looking up net group with name %s: %s", name, g_strerror (errno));
|
||||
goto out;
|
||||
}
|
||||
-#else
|
||||
+# else
|
||||
setnetgrent (name);
|
||||
-#endif
|
||||
+# endif /* HAVE_SETNETGRENT_RETURN */
|
||||
|
||||
for (;;)
|
||||
{
|
||||
-#if defined(HAVE_NETBSD) || defined(HAVE_OPENBSD)
|
||||
+# if defined(HAVE_NETBSD) || defined(HAVE_OPENBSD)
|
||||
const char *hostname, *username, *domainname;
|
||||
-#else
|
||||
+# else
|
||||
char *hostname, *username, *domainname;
|
||||
-#endif
|
||||
+# endif /* defined(HAVE_NETBSD) || defined(HAVE_OPENBSD) */
|
||||
PolkitIdentity *user;
|
||||
GError *error = NULL;
|
||||
|
||||
@@ -2282,6 +2283,7 @@ get_users_in_net_group (PolkitIdentity *group,
|
||||
|
||||
out:
|
||||
endnetgrent ();
|
||||
+#endif /* HAVE_SETNETGRENT */
|
||||
return ret;
|
||||
}
|
||||
|
||||
diff --git a/src/polkitbackend/polkitbackendjsauthority.cpp b/src/polkitbackend/polkitbackendjsauthority.cpp
|
||||
index 5027815..bcb040c 100644
|
||||
--- a/src/polkitbackend/polkitbackendjsauthority.cpp
|
||||
+++ b/src/polkitbackend/polkitbackendjsauthority.cpp
|
||||
@@ -1524,6 +1524,7 @@ js_polkit_user_is_in_netgroup (JSContext *cx,
|
||||
|
||||
JS::CallArgs args = JS::CallArgsFromVp (argc, vp);
|
||||
|
||||
+#ifdef HAVE_SETNETGRENT
|
||||
JS::RootedString usrstr (authority->priv->cx);
|
||||
usrstr = args[0].toString();
|
||||
user = JS_EncodeStringToUTF8 (cx, usrstr);
|
||||
@@ -1538,6 +1539,7 @@ js_polkit_user_is_in_netgroup (JSContext *cx,
|
||||
{
|
||||
is_in_netgroup = true;
|
||||
}
|
||||
+#endif
|
||||
|
||||
ret = true;
|
||||
|
||||
diff --git a/test/polkit/polkitidentitytest.c b/test/polkit/polkitidentitytest.c
|
||||
index e91967b..2635c4c 100644
|
||||
--- a/test/polkit/polkitidentitytest.c
|
||||
+++ b/test/polkit/polkitidentitytest.c
|
||||
@@ -145,11 +145,15 @@ struct ComparisonTestData comparison_test_data [] = {
|
||||
{"unix-group:root", "unix-group:jane", FALSE},
|
||||
{"unix-group:jane", "unix-group:jane", TRUE},
|
||||
|
||||
+#ifdef HAVE_SETNETGRENT
|
||||
{"unix-netgroup:foo", "unix-netgroup:foo", TRUE},
|
||||
{"unix-netgroup:foo", "unix-netgroup:bar", FALSE},
|
||||
+#endif
|
||||
|
||||
{"unix-user:root", "unix-group:root", FALSE},
|
||||
+#ifdef HAVE_SETNETGRENT
|
||||
{"unix-user:jane", "unix-netgroup:foo", FALSE},
|
||||
+#endif
|
||||
|
||||
{NULL},
|
||||
};
|
||||
@@ -181,11 +185,13 @@ main (int argc, char *argv[])
|
||||
g_test_add_data_func ("/PolkitIdentity/group_string_2", "unix-group:jane", test_string);
|
||||
g_test_add_data_func ("/PolkitIdentity/group_string_3", "unix-group:users", test_string);
|
||||
|
||||
+#ifdef HAVE_SETNETGRENT
|
||||
g_test_add_data_func ("/PolkitIdentity/netgroup_string", "unix-netgroup:foo", test_string);
|
||||
+ g_test_add_data_func ("/PolkitIdentity/netgroup_gvariant", "unix-netgroup:foo", test_gvariant);
|
||||
+#endif
|
||||
|
||||
g_test_add_data_func ("/PolkitIdentity/user_gvariant", "unix-user:root", test_gvariant);
|
||||
g_test_add_data_func ("/PolkitIdentity/group_gvariant", "unix-group:root", test_gvariant);
|
||||
- g_test_add_data_func ("/PolkitIdentity/netgroup_gvariant", "unix-netgroup:foo", test_gvariant);
|
||||
|
||||
add_comparison_tests ();
|
||||
|
||||
diff --git a/test/polkit/polkitunixnetgrouptest.c b/test/polkit/polkitunixnetgrouptest.c
|
||||
index 3701ba1..e1d211e 100644
|
||||
--- a/test/polkit/polkitunixnetgrouptest.c
|
||||
+++ b/test/polkit/polkitunixnetgrouptest.c
|
||||
@@ -69,7 +69,9 @@ int
|
||||
main (int argc, char *argv[])
|
||||
{
|
||||
g_test_init (&argc, &argv, NULL);
|
||||
+#ifdef HAVE_SETNETGRENT
|
||||
g_test_add_func ("/PolkitUnixNetgroup/new", test_new);
|
||||
g_test_add_func ("/PolkitUnixNetgroup/set_name", test_set_name);
|
||||
+#endif
|
||||
return g_test_run ();
|
||||
}
|
||||
diff --git a/test/polkitbackend/test-polkitbackendjsauthority.c b/test/polkitbackend/test-polkitbackendjsauthority.c
|
||||
index f97e0e0..fc52149 100644
|
||||
--- a/test/polkitbackend/test-polkitbackendjsauthority.c
|
||||
+++ b/test/polkitbackend/test-polkitbackendjsauthority.c
|
||||
@@ -137,12 +137,14 @@ test_get_admin_identities (void)
|
||||
"unix-group:users"
|
||||
}
|
||||
},
|
||||
+#ifdef HAVE_SETNETGRENT
|
||||
{
|
||||
"net.company.action3",
|
||||
{
|
||||
"unix-netgroup:foo"
|
||||
}
|
||||
},
|
||||
+#endif
|
||||
};
|
||||
guint n;
|
||||
|
||||
@@ -0,0 +1,34 @@
|
||||
From 792f8e2151c120ec51b50a4098e4f9642409cbec Mon Sep 17 00:00:00 2001
|
||||
From: Marta Rybczynska <rybczynska@gmail.com>
|
||||
Date: Fri, 29 Jul 2022 11:52:59 +0200
|
||||
Subject: [PATCH] Make netgroup support optional
|
||||
|
||||
This patch adds a fragment of the netgroup patch to apply on the duktape-related
|
||||
code. This change is needed to compile with duktape+musl.
|
||||
|
||||
Upstream-Status: Backport [https://gitlab.freedesktop.org/polkit/polkit/-/commit/b57deee8178190a7ecc75290fa13cf7daabc2c66]
|
||||
Signed-off-by: Marta Rybczynska <martarybczynska@huawei.com>
|
||||
---
|
||||
src/polkitbackend/polkitbackendduktapeauthority.c | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
diff --git a/src/polkitbackend/polkitbackendduktapeauthority.c b/src/polkitbackend/polkitbackendduktapeauthority.c
|
||||
index c89dbcf..58a5936 100644
|
||||
--- a/src/polkitbackend/polkitbackendduktapeauthority.c
|
||||
+++ b/src/polkitbackend/polkitbackendduktapeauthority.c
|
||||
@@ -1036,6 +1036,7 @@ js_polkit_user_is_in_netgroup (duk_context *cx)
|
||||
user = duk_require_string (cx, 0);
|
||||
netgroup = duk_require_string (cx, 1);
|
||||
|
||||
+#ifdef HAVE_SETNETGRENT
|
||||
if (innetgr (netgroup,
|
||||
NULL, /* host */
|
||||
user,
|
||||
@@ -1043,6 +1044,7 @@ js_polkit_user_is_in_netgroup (duk_context *cx)
|
||||
{
|
||||
is_in_netgroup = TRUE;
|
||||
}
|
||||
+#endif
|
||||
|
||||
duk_push_boolean (cx, is_in_netgroup);
|
||||
return 1;
|
||||
@@ -0,0 +1,35 @@
|
||||
polkit: No system-auth in OE-Core, we can use common-* in place of it.
|
||||
|
||||
Upstream-Status:Inappropriate [configuration]
|
||||
|
||||
Signed-off-by: Xiaofeng Yan <xiaofeng.yan@windriver.com>
|
||||
|
||||
Upstream-Status: Inappropriate [oe specific]
|
||||
Rebase to 0.115
|
||||
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
|
||||
---
|
||||
configure.ac | 8 ++++----
|
||||
1 file changed, 4 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/configure.ac b/configure.ac
|
||||
index 36df239..8b3e1b1 100644
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -471,10 +471,10 @@ elif test x$with_os_type = xfreebsd -o x$with_os_type = xnetbsd; then
|
||||
PAM_FILE_INCLUDE_PASSWORD=system
|
||||
PAM_FILE_INCLUDE_SESSION=system
|
||||
else
|
||||
- PAM_FILE_INCLUDE_AUTH=system-auth
|
||||
- PAM_FILE_INCLUDE_ACCOUNT=system-auth
|
||||
- PAM_FILE_INCLUDE_PASSWORD=system-auth
|
||||
- PAM_FILE_INCLUDE_SESSION=system-auth
|
||||
+ PAM_FILE_INCLUDE_AUTH=common-auth
|
||||
+ PAM_FILE_INCLUDE_ACCOUNT=common-account
|
||||
+ PAM_FILE_INCLUDE_PASSWORD=common-password
|
||||
+ PAM_FILE_INCLUDE_SESSION=common-session
|
||||
fi
|
||||
|
||||
AC_SUBST(PAM_FILE_INCLUDE_AUTH)
|
||||
--
|
||||
2.7.4
|
||||
|
||||
@@ -0,0 +1,79 @@
|
||||
SUMMARY = "PolicyKit Authorization Framework"
|
||||
DESCRIPTION = "The polkit package is an application-level toolkit for defining and handling the policy that allows unprivileged processes to speak to privileged processes."
|
||||
HOMEPAGE = "http://www.freedesktop.org/wiki/Software/polkit"
|
||||
LICENSE = "LGPL-2.0-or-later"
|
||||
LIC_FILES_CHKSUM = "file://COPYING;md5=155db86cdbafa7532b41f390409283eb \
|
||||
file://src/polkit/polkit.h;beginline=1;endline=20;md5=0a8630b0133176d0504c87a0ded39db4"
|
||||
|
||||
DEPENDS = "expat glib-2.0 intltool-native"
|
||||
|
||||
inherit autotools gtk-doc pkgconfig useradd systemd gobject-introspection features_check
|
||||
|
||||
REQUIRED_DISTRO_FEATURES = "polkit"
|
||||
|
||||
PACKAGECONFIG = "${@bb.utils.filter('DISTRO_FEATURES', 'pam', d)} \
|
||||
${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'systemd', \
|
||||
bb.utils.contains('DISTRO_FEATURES', 'x11', 'consolekit', '', d), d)} \
|
||||
mozjs \
|
||||
"
|
||||
|
||||
PACKAGECONFIG[pam] = "--with-authfw=pam,--with-authfw=shadow,libpam,libpam"
|
||||
PACKAGECONFIG[systemd] = "--enable-libsystemd-login=yes --with-systemdsystemunitdir=${systemd_unitdir}/system/,--enable-libsystemd-login=no --with-systemdsystemunitdir=,systemd"
|
||||
# there is no --enable/--disable option for consolekit and it's not picked by shlibs, so add it to RDEPENDS
|
||||
PACKAGECONFIG[consolekit] = ",,,consolekit"
|
||||
|
||||
# Default to mozjs javascript library
|
||||
PACKAGECONFIG[mozjs] = ",,mozjs-91,,,duktape"
|
||||
# duktape javascript engine is much smaller and faster but is not compatible with
|
||||
# same javascript standards as mozjs. For example array.includes() function is not
|
||||
# supported. Test rule compatibility when switching to duktape.
|
||||
PACKAGECONFIG[duktape] = "--with-duktape,,duktape,,,mozjs"
|
||||
|
||||
MOZJS_PATCHES = "\
|
||||
file://0002-jsauthority-port-to-mozjs-91.patch \
|
||||
file://0003-jsauthority-ensure-to-call-JS_Init-and-JS_ShutDown-e.patch \
|
||||
"
|
||||
DUKTAPE_PATCHES = "file://0003-Added-support-for-duktape-as-JS-engine.patch"
|
||||
DUKTAPE_NG_PATCHES = "file://0005-Make-netgroup-support-optional-duktape.patch"
|
||||
PAM_SRC_URI = "file://polkit-1_pam.patch"
|
||||
SRC_URI = "http://www.freedesktop.org/software/polkit/releases/polkit-${PV}.tar.gz \
|
||||
${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} \
|
||||
${@bb.utils.contains('PACKAGECONFIG', 'mozjs', '${MOZJS_PATCHES}', '', d)} \
|
||||
${@bb.utils.contains('PACKAGECONFIG', 'duktape', '${DUKTAPE_PATCHES}', '', d)} \
|
||||
file://0001-pkexec-local-privilege-escalation-CVE-2021-4034.patch \
|
||||
file://0002-CVE-2021-4115-GHSL-2021-077-fix.patch \
|
||||
file://0004-Make-netgroup-support-optional.patch \
|
||||
${@bb.utils.contains('PACKAGECONFIG', 'duktape', '${DUKTAPE_NG_PATCHES}', '', d)} \
|
||||
"
|
||||
SRC_URI[sha256sum] = "c8579fdb86e94295404211285fee0722ad04893f0213e571bd75c00972fd1f5c"
|
||||
|
||||
EXTRA_OECONF = "--with-os-type=moblin \
|
||||
--disable-man-pages \
|
||||
--disable-libelogind \
|
||||
"
|
||||
|
||||
do_configure:prepend () {
|
||||
rm -f ${S}/buildutil/lt*.m4 ${S}/buildutil/libtool.m4
|
||||
}
|
||||
|
||||
do_compile:prepend () {
|
||||
export GIR_EXTRA_LIBS_PATH="${B}/src/polkit/.libs"
|
||||
}
|
||||
|
||||
PACKAGES =+ "${PN}-examples"
|
||||
|
||||
FILES:${PN}:append = " \
|
||||
${libdir}/${BPN}-1 \
|
||||
${nonarch_libdir}/${BPN}-1 \
|
||||
${datadir}/dbus-1 \
|
||||
${datadir}/${BPN}-1 \
|
||||
${datadir}/gettext \
|
||||
"
|
||||
|
||||
FILES:${PN}-examples = "${bindir}/*example*"
|
||||
|
||||
USERADD_PACKAGES = "${PN}"
|
||||
USERADD_PARAM:${PN} = "--system --no-create-home --user-group --home-dir ${sysconfdir}/${BPN}-1 --shell /bin/nologin polkitd"
|
||||
|
||||
SYSTEMD_SERVICE:${PN} = "${BPN}.service"
|
||||
SYSTEMD_AUTO_ENABLE = "disable"
|
||||
@@ -0,0 +1,49 @@
|
||||
SUMMARY = "PolicyKit Authorization Framework"
|
||||
DESCRIPTION = "The polkit package is an application-level toolkit for defining and handling the policy that allows unprivileged processes to speak to privileged processes."
|
||||
HOMEPAGE = "http://www.freedesktop.org/wiki/Software/polkit"
|
||||
LICENSE = "LGPL-2.0-or-later"
|
||||
LIC_FILES_CHKSUM = "file://COPYING;md5=155db86cdbafa7532b41f390409283eb"
|
||||
|
||||
SRC_URI = "git://gitlab.freedesktop.org/polkit/polkit.git;protocol=https;branch=master"
|
||||
|
||||
S = "${WORKDIR}/git"
|
||||
SRCREV = "da87c5698019897dd731bb2cbb54ebd9c9481f52"
|
||||
|
||||
DEPENDS = "expat glib-2.0"
|
||||
|
||||
inherit meson pkgconfig useradd systemd gettext gobject-introspection features_check
|
||||
|
||||
REQUIRED_DISTRO_FEATURES = "polkit"
|
||||
|
||||
PACKAGECONFIG = " \
|
||||
${@bb.utils.filter('DISTRO_FEATURES', 'pam', d)} \
|
||||
${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'systemd', 'consolekit', d)} \
|
||||
dbus \
|
||||
mozjs \
|
||||
"
|
||||
PACKAGECONFIG[dbus] = ",,dbus"
|
||||
PACKAGECONFIG[gtk-doc] = "-Dgtk_doc=true,-Dgtk_doc=false,gtk-doc-native"
|
||||
PACKAGECONFIG[pam] = "-Dauthfw=pam,-Dauthfw=shadow,libpam,libpam"
|
||||
PACKAGECONFIG[systemd] = "-Dsession_tracking=libsystemd-login,-Dsession_tracking=ConsoleKit,systemd"
|
||||
PACKAGECONFIG[consolekit] = ",,,consolekit"
|
||||
|
||||
# Default to mozjs javascript library
|
||||
PACKAGECONFIG[mozjs] = "-Djs_engine=mozjs,,mozjs-102,,,duktape"
|
||||
# duktape javascript engine is much smaller and faster but is not compatible with
|
||||
# same javascript standards as mozjs. For example array.includes() function is not
|
||||
# supported. Test rule compatibility when switching to duktape.
|
||||
PACKAGECONFIG[duktape] = "-Djs_engine=duktape,,duktape,,,mozjs"
|
||||
|
||||
USERADD_PACKAGES = "${PN}"
|
||||
USERADD_PARAM:${PN} = "--system --no-create-home --user-group --home-dir ${sysconfdir}/${BPN}-1 --shell /bin/nologin polkitd"
|
||||
|
||||
SYSTEMD_SERVICE:${PN} = "${BPN}.service"
|
||||
SYSTEMD_AUTO_ENABLE = "disable"
|
||||
|
||||
do_install:append() {
|
||||
#Fix up permissions on polkit rules.d to work with rpm4 constraints
|
||||
chmod 700 ${D}/${datadir}/polkit-1/rules.d
|
||||
chown polkitd:root ${D}/${datadir}/polkit-1/rules.d
|
||||
}
|
||||
|
||||
FILES:${PN} += "${libdir}/polkit-1 ${nonarch_libdir}/polkit-1 ${datadir}"
|
||||
Reference in New Issue
Block a user