ports/core
4
3
Fork 0
Code Issues Pull Requests Activity

Merge branch '3.3' into 3.4

Browse Source
This commit is contained in:
Juergen Daubert 2018-05-04 11:21:46 +02:00
commit 096975d867
21 changed files with 40 additions and 223 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
dhcpcd/.md5sum
View File

@ -1 +1 @@
45be894597340e255f302c3100dba1c0 dhcpcd-7.0.3.tar.xz
acb9eda23b7afbd92a9db321948643d1 dhcpcd-7.0.4.tar.xz

6
dhcpcd/.signature
View File

@ -1,5 +1,5 @@
untrusted comment: verify with /etc/ports/core.pub
RWRJc1FUaeVeqsxmPpCITBTQ2w8HaAdD8OT9RVhTifc2oKy8WYJlyU76CbTkC5F2buBnEH6jupIHx482PEA5VStVIcYGiNBmsg8=
SHA256 (Pkgfile) = 8552859939ed4454f67c9ce5ad1f005cf1be84c1a033fbedd87bcbd0fb7ed1a6
RWRJc1FUaeVeqt4tZDMEiRLN9OzDUcEMrGnu5EY4K00B4cjb1L4JYlV7pl5k2Lt+LZfk22EsfcZK5MWK83cxhiNgiCwLr5RnZQE=
SHA256 (Pkgfile) = 07375cb8a96e1bf257457ea2e905a31754e9c0b18055d7f9454c38becc069b3e
SHA256 (.footprint) = d9a7aee62c42089e2d24224ba37e4d88502f402e0f94ea92d0a19492ff7afd76
SHA256 (dhcpcd-7.0.3.tar.xz) = a255d9aecceb1c77a9862f1c0d31a48ba37aab5ef2ca5ad76fc7a907b6ea292e
SHA256 (dhcpcd-7.0.4.tar.xz) = 1fa414be34383578e2c343dfc8cdcb95e2da74f62121b394c88d60698c889a78

2
dhcpcd/Pkgfile
View File

@ -4,7 +4,7 @@
# Depends on: eudev
name=dhcpcd
version=7.0.3
version=7.0.4
release=1
source=(http://roy.marples.name/downloads/dhcpcd/$name-$version.tar.xz)

2
man-pages/.md5sum
View File

@ -1,2 +1,2 @@
4298feb3d5feffad8ff46bb87b061a07 man-pages-4.15.tar.xz
ad9f1ff81276fe8d90d077484d6d4b5e man-pages-4.16.tar.xz
825fde78e6fddd02426ecdd50e2cbe0d man-pages-posix-2013-a.tar.xz

6
man-pages/.signature
View File

@ -1,6 +1,6 @@
untrusted comment: verify with /etc/ports/core.pub
RWRJc1FUaeVeqqVbJMnvrIAanO26b21YTVPEB1pD/saBvmjei+rJqnBSfYGqGImIseBUHxhtwW6A/a6+8tloYOm3H5C8RJmABwQ=
SHA256 (Pkgfile) = d6c6b648289c60c73b35fa01b4b329581e3422b5c524e608c04165ea02e54a7c
RWRJc1FUaeVequfkX8XtOg5VfY597nwNYyDDe5tCKK2EPLYrtonuw4EJBzJn2BBynuGjEWQn4R+pjwahKARrNtKzyA2fWQCRTQ8=
SHA256 (Pkgfile) = 60aa268badcfff64f8da23e189f6a65c56355262817c82e7ca93a829588902c3
SHA256 (.footprint) = 121efd38fa2667dc2661949fe94ba981132a8e7b0472f7b26649ec2f270a2ac1
SHA256 (man-pages-4.15.tar.xz) = ce707f2a28ee49496595af163d0cac24a9b7b88ab9aa5e5057abaa3d03cec106
SHA256 (man-pages-4.16.tar.xz) = 47ffcc0d27d50e497e290b27e8d76dbed4550db14c881f25b771bcaf28354db4
SHA256 (man-pages-posix-2013-a.tar.xz) = 19633a5c75ff7deab35b1d2c3d5b7748e7bd4ef4ab598b647bb7e7f60b90a808

2
man-pages/Pkgfile
View File

@ -3,7 +3,7 @@
# Maintainer: CRUX System Team, core-ports at crux dot nu
name=man-pages
version=4.15
version=4.16
release=1
source=(http://www.kernel.org/pub/linux/docs/$name/$name-$version.tar.xz \
http://www.kernel.org/pub/linux/docs/$name/$name-posix/$name-posix-2013-a.tar.xz)

3
shadow/.md5sum
View File

@ -1,4 +1,3 @@
aad42ace9b3d450717355010b9344c56 CVE-2018-7169.patch
80756b2d5b3351b3757f48ae69fe866d login.defs
be8f69c2701118093af3d7f3bc02af16 pwck
c350da50c2120de6bb29177699d89fe3 shadow-4.5.tar.xz
b491fecbf1232632c32ff8f1437fd60e shadow-4.6.tar.xz

7
shadow/.signature
View File

@ -1,8 +1,7 @@
untrusted comment: verify with /etc/ports/core.pub
RWRJc1FUaeVeqqLpIS3LGM3rjoF0kUdbtuIDL1UilPze46/DVrHdo27qHiHPLOaN8GLLukQJFkQRq8XV9obslWlWtguLSW/uTwo=
SHA256 (Pkgfile) = 4647cbfe01446ff33de8393e0a6d9dff1a4ac199acd417e66e6623cf6a705507
RWRJc1FUaeVeqpdbafEtEvgpRhYNzcGr9mzcyuw3nNoO7EawXtg05K/XdcDqIzBEs3WOrB5Vfcv/TmOkj/Q6uTF5sw+1FzJ9ZQQ=
SHA256 (Pkgfile) = 2a6884a5a14315e85f82c1cea46d43d5b9d61bd24f70fe64c9a4630d499ac2ed
SHA256 (.footprint) = 196891826eef19be5e249380bc5c9560b10051556be4a3be5d33e099a56f23ae
SHA256 (shadow-4.5.tar.xz) = fc8c858381ad577a5c25ff5beb6ee60a34f8719c73e4e7c61e74188b4e54b741
SHA256 (CVE-2018-7169.patch) = 3b8896d8ac400692af1e2da17b9b8a447aa668c09fe16c1b9cee55e923b64820
SHA256 (shadow-4.6.tar.xz) = 0998c8d84242a231ab0acb7f8613927ff5bcff095f8aa6b79478893a03f05583
SHA256 (pwck) = c62f1bf5785c2bb93bb269156bfa02b06728a01ff5d6c2e09cf6285701a1fda0
SHA256 (login.defs) = a5c63da222b9dd921b60a21be8fc888726b557fd3fde9f60c8899376d0311b0b

180
shadow/CVE-2018-7169.patch
View File

@ -1,180 +0,0 @@
From fb28c99b8a66ff2605c5cb96abc0a4d975f92de0 Mon Sep 17 00:00:00 2001
From: Aleksa Sarai <asarai@suse.de>
Date: Thu, 15 Feb 2018 23:49:40 +1100
Subject: [PATCH] newgidmap: enforce setgroups=deny if self-mapping a group
This is necessary to match the kernel-side policy of "self-mapping in a
user namespace is fine, but you cannot drop groups" -- a policy that was
created in order to stop user namespaces from allowing trivial privilege
escalation by dropping supplementary groups that were "blacklisted" from
certain paths.
This is the simplest fix for the underlying issue, and effectively makes
it so that unless a user has a valid mapping set in /etc/subgid (which
only administrators can modify) -- and they are currently trying to use
that mapping -- then /proc/$pid/setgroups will be set to deny. This
workaround is only partial, because ideally it should be possible to set
an "allow_setgroups" or "deny_setgroups" flag in /etc/subgid to allow
administrators to further restrict newgidmap(1).
We also don't write anything in the "allow" case because "allow" is the
default, and users may have already written "deny" even if they
technically are allowed to use setgroups. And we don't write anything if
the setgroups policy is already "deny".
Ref: https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357
Fixes: CVE-2018-7169
Reported-by: Craig Furman <craig.furman89@gmail.com>
Signed-off-by: Aleksa Sarai <asarai@suse.de>
---
src/newgidmap.c | 89 +++++++++++++++++++++++++++++++++++++++++++++++++++------
1 file changed, 80 insertions(+), 9 deletions(-)
diff --git a/src/newgidmap.c b/src/newgidmap.c
index b1e33513..59a2e75c 100644
--- a/src/newgidmap.c
+++ b/src/newgidmap.c
@@ -46,32 +46,37 @@
*/
const char *Prog;
-static bool verify_range(struct passwd *pw, struct map_range *range)
+
+static bool verify_range(struct passwd *pw, struct map_range *range, bool *allow_setgroups)
{
/* An empty range is invalid */
if (range->count == 0)
return false;
- /* Test /etc/subgid */
- if (have_sub_gids(pw->pw_name, range->lower, range->count))
+ /* Test /etc/subgid. If the mapping is valid then we allow setgroups. */
+ if (have_sub_gids(pw->pw_name, range->lower, range->count)) {
+ *allow_setgroups = true;
return true;
+ }
- /* Allow a process to map its own gid */
- if ((range->count == 1) && (pw->pw_gid == range->lower))
+ /* Allow a process to map its own gid. */
+ if ((range->count == 1) && (pw->pw_gid == range->lower)) {
+ /* noop -- if setgroups is enabled already we won't disable it. */
return true;
+ }
return false;
}
static void verify_ranges(struct passwd *pw, int ranges,
- struct map_range *mappings)
+ struct map_range *mappings, bool *allow_setgroups)
{
struct map_range *mapping;
int idx;
mapping = mappings;
for (idx = 0; idx < ranges; idx++, mapping++) {
- if (!verify_range(pw, mapping)) {
+ if (!verify_range(pw, mapping, allow_setgroups)) {
fprintf(stderr, _( "%s: gid range [%lu-%lu) -> [%lu-%lu) not allowed\n"),
Prog,
mapping->upper,
@@ -89,6 +94,70 @@ static void usage(void)
exit(EXIT_FAILURE);
}
+void write_setgroups(int proc_dir_fd, bool allow_setgroups)
+{
+ int setgroups_fd;
+ char *policy, policy_buffer[4096];
+
+ /*
+ * Default is "deny", and any "allow" will out-rank a "deny". We don't
+ * forcefully write an "allow" here because the process we are writing
+ * mappings for may have already set themselves to "deny" (and "allow"
+ * is the default anyway). So allow_setgroups == true is a noop.
+ */
+ policy = "deny\n";
+ if (allow_setgroups)
+ return;
+
+ setgroups_fd = openat(proc_dir_fd, "setgroups", O_RDWR|O_CLOEXEC);
+ if (setgroups_fd < 0) {
+ /*
+ * If it's an ENOENT then we are on too old a kernel for the setgroups
+ * code to exist. Emit a warning and bail on this.
+ */
+ if (ENOENT == errno) {
+ fprintf(stderr, _("%s: kernel doesn't support setgroups restrictions\n"), Prog);
+ goto out;
+ }
+ fprintf(stderr, _("%s: couldn't open process setgroups: %s\n"),
+ Prog,
+ strerror(errno));
+ exit(EXIT_FAILURE);
+ }
+
+ /*
+ * Check whether the policy is already what we want. /proc/self/setgroups
+ * is write-once, so attempting to write after it's already written to will
+ * fail.
+ */
+ if (read(setgroups_fd, policy_buffer, sizeof(policy_buffer)) < 0) {
+ fprintf(stderr, _("%s: failed to read setgroups: %s\n"),
+ Prog,
+ strerror(errno));
+ exit(EXIT_FAILURE);
+ }
+ if (!strncmp(policy_buffer, policy, strlen(policy)))
+ goto out;
+
+ /* Write the policy. */
+ if (lseek(setgroups_fd, 0, SEEK_SET) < 0) {
+ fprintf(stderr, _("%s: failed to seek setgroups: %s\n"),
+ Prog,
+ strerror(errno));
+ exit(EXIT_FAILURE);
+ }
+ if (dprintf(setgroups_fd, "%s", policy) < 0) {
+ fprintf(stderr, _("%s: failed to setgroups %s policy: %s\n"),
+ Prog,
+ policy,
+ strerror(errno));
+ exit(EXIT_FAILURE);
+ }
+
+out:
+ close(setgroups_fd);
+}
+
/*
* newgidmap - Set the gid_map for the specified process
*/
@@ -103,6 +172,7 @@ int main(int argc, char **argv)
struct stat st;
struct passwd *pw;
int written;
+ bool allow_setgroups = false;
Prog = Basename (argv[0]);
@@ -145,7 +215,7 @@ int main(int argc, char **argv)
(unsigned long) getuid ()));
return EXIT_FAILURE;
}
-
+
/* Get the effective uid and effective gid of the target process */
if (fstat(proc_dir_fd, &st) < 0) {
fprintf(stderr, _("%s: Could not stat directory for target %u\n"),
@@ -177,8 +247,9 @@ int main(int argc, char **argv)
if (!mappings)
usage();
- verify_ranges(pw, ranges, mappings);
+ verify_ranges(pw, ranges, mappings, &allow_setgroups);
+ write_setgroups(proc_dir_fd, allow_setgroups);
write_mapping(proc_dir_fd, ranges, mappings, "gid_map");
sub_gid_close();

8
shadow/Pkgfile
View File

@ -4,18 +4,14 @@
# Depends on: acl
name=shadow
version=4.5
release=2
version=4.6
release=1
source=(https://github.com/shadow-maint/shadow/releases/download/$version/shadow-$version.tar.xz
CVE-2018-7169.patch
pwck login.defs)
build() {
cd $name-$version
# https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357
patch -p1 -i $SRC/CVE-2018-7169.patch
./configure --prefix=/usr \
--sysconfdir=/etc \
--disable-shared \

3
sudo/.footprint
View File

@ -4,6 +4,7 @@ drwxr-x--- root/root etc/sudoers.d/
-r--r----- root/root etc/sudoers.dist
drwxr-xr-x root/root usr/
drwxr-xr-x root/root usr/bin/
-rwxr-xr-x root/root usr/bin/cvtsudoers
-rwsr-xr-x root/root usr/bin/sudo
lrwxrwxrwx root/root usr/bin/sudoedit -> sudo
-rwxr-xr-x root/root usr/bin/sudoreplay
@ -27,6 +28,8 @@ drwxr-xr-x root/root usr/sbin/
-rwxr-xr-x root/root usr/sbin/visudo
drwxr-xr-x root/root usr/share/
drwxr-xr-x root/root usr/share/man/
drwxr-xr-x root/root usr/share/man/man1/
-rw-r--r-- root/root usr/share/man/man1/cvtsudoers.1.gz
drwxr-xr-x root/root usr/share/man/man5/
-rw-r--r-- root/root usr/share/man/man5/sudo.conf.5.gz
-rw-r--r-- root/root usr/share/man/man5/sudoers.5.gz

2
sudo/.md5sum
View File

@ -1 +1 @@
24abdea48db4c5abcd410167c801cc8c sudo-1.8.22.tar.gz
ea444d747feb1decfebdffd0b38b0739 sudo-1.8.23.tar.gz

8
sudo/.signature
View File

@ -1,5 +1,5 @@
untrusted comment: verify with /etc/ports/core.pub
RWRJc1FUaeVeqoJItXfsnxHccYe6mqPUSsoQzcGZ0USYjzkH8PIMNrsT2905dAxPjNOdCO6VY+1utZ7qDPoHUcn5z67+AqnyOQ4=
SHA256 (Pkgfile) = 06dd6adc5b09c73f95f69909e2704a30b27da97a6d6a85b464e7fccc45da6f27
SHA256 (.footprint) = 559564852fa188cb5de235db0c4c1b3d58299a224bbaf77664a2e0939e19ddbd
SHA256 (sudo-1.8.22.tar.gz) = 7256cb27c20883b14360eddbd17f98922073d104b214cf65aeacf1d9c9b9fd02
RWRJc1FUaeVeqgh5xW4U2tMWz3GPWGPVAe0z+0Y/8ibMu34xrR4I+qWdSfXrqX+gf8XdV6lNG40+ntbdJznj8C9B3aGdTHw/VAU=
SHA256 (Pkgfile) = a12596e61e4d558d6241148588db74169ef73e74fc12ed98485aecd264e3dfa0
SHA256 (.footprint) = d7fecfbf06f8d91c409a6d87301fb2c91ef0f8278f30a8fe9a28b0172088ac74
SHA256 (sudo-1.8.23.tar.gz) = d863d29b6fc87bc784a3223350e2b28a2ff2c4738f0fb8f1c92bb38c3017e679

2
sudo/Pkgfile
View File

@ -4,7 +4,7 @@
# Depends on: zlib
name=sudo
version=1.8.22
version=1.8.23
release=1
source=(http://www.sudo.ws/$name/dist/$name-$version.tar.gz)

2
tzdata/.md5sum
View File

@ -1 +1 @@
5fad1137cbddaa08d81c41264a09e6bf tzdb-2018d.tar.lz
049c15682e68c33489eec118042af930 tzdb-2018e.tar.lz

6
tzdata/.signature
View File

@ -1,5 +1,5 @@
untrusted comment: verify with /etc/ports/core.pub
RWRJc1FUaeVequEYmFfkuUsU0gaZMepUqJnSuwzHPdruzVaMLGEd/vnYI3ke0kz6BZqoAqzydsu3BX8Ax4y9VnabKKbOBwiDbgs=
SHA256 (Pkgfile) = 83a7564527ddedc29a8bf38c2962e04d8afbeda94ecefa6e367e867c16d0e1fb
RWRJc1FUaeVeqrdFyBUhEyMu+7tPZyPEW7DMWHNcHj0iAvKb30eSHYDsA6lAmknvIvktqnJHiUbeJjdR6EFFRIDaP/e7s+GH2ww=
SHA256 (Pkgfile) = 49b5a22cc88cea16aed48b08dedb0e91711c5044bfdac8f2a0907fbc80a7c007
SHA256 (.footprint) = e67070821dab31530ca47dd0072385f94d88a25f7b26a55c2183f0d35e30bbdb
SHA256 (tzdb-2018d.tar.lz) = 7a96f575c0ffee9fa3e1927ce3b8c7ea906eec24ba8e43f086cc2b948e8398b6
SHA256 (tzdb-2018e.tar.lz) = b1c23c7825f5f842e6e1ddb702efe85b1c22bdf0e41815b927cfc04a28372962

2
tzdata/Pkgfile
View File

@ -3,7 +3,7 @@
# Maintainer: CRUX System Team, core-ports at crux dot nu
name=tzdata
version=2018d
version=2018e
release=1
source=(https://data.iana.org/time-zones/releases/tzdb-$version.tar.lz)

6
xz/.footprint
View File

@ -43,9 +43,9 @@ drwxr-xr-x root/root usr/include/lzma/
drwxr-xr-x root/root usr/lib/
-rw-r--r-- root/root usr/lib/liblzma.a
-rwxr-xr-x root/root usr/lib/liblzma.la
lrwxrwxrwx root/root usr/lib/liblzma.so -> liblzma.so.5.2.3
lrwxrwxrwx root/root usr/lib/liblzma.so.5 -> liblzma.so.5.2.3
-rwxr-xr-x root/root usr/lib/liblzma.so.5.2.3
lrwxrwxrwx root/root usr/lib/liblzma.so -> liblzma.so.5.2.4
lrwxrwxrwx root/root usr/lib/liblzma.so.5 -> liblzma.so.5.2.4
-rwxr-xr-x root/root usr/lib/liblzma.so.5.2.4
drwxr-xr-x root/root usr/lib/pkgconfig/
-rw-r--r-- root/root usr/lib/pkgconfig/liblzma.pc
drwxr-xr-x root/root usr/share/

2
xz/.md5sum
View File

@ -1 +1 @@
1592e7ca3eece099b03b35f4d9179e7c xz-5.2.3.tar.bz2
003e4d0b1b1899fc6e3000b24feddf7c xz-5.2.4.tar.xz

8
xz/.signature
View File

@ -1,5 +1,5 @@
untrusted comment: verify with /etc/ports/core.pub
RWRJc1FUaeVeqqUn6Ojt5YbFSOJxh/IBKVfKpYUT1bjdPOKGzKYWmT8f6JlPo1Hqk4855n1D0UvwVU9CfljhOeiT+7jSXOI5kg8=
SHA256 (Pkgfile) = c80c64c8a7d4328b779bb607238b6442a362d643745500593010c1c367d8a723
SHA256 (.footprint) = f66de66c49ed575b561137e935d21449a3de71987aaa0c39673c9b3634cac5af
SHA256 (xz-5.2.3.tar.bz2) = fd9ca16de1052aac899ad3495ad20dfa906c27b4a5070102a2ec35ca3a4740c1
RWRJc1FUaeVequcIfAd7kYVyoF7/FMj54UT7ciX2dq/8laAPNoyOPk6b3BpZyjEY3taOAe9D6u9zpZMihFJ5F/z74lsLNdDzRAQ=
SHA256 (Pkgfile) = ef34b149c7b5fba04e389f1d456b05286d83777437f7bcda281feef86e112814
SHA256 (.footprint) = 72ff08502a127608385126cfca98b7f8f1d895139b2e00bf79ca989e6caedad7
SHA256 (xz-5.2.4.tar.xz) = 9717ae363760dedf573dad241420c5fea86256b65bc21d2cf71b2b12f0544f4b

4
xz/Pkgfile
View File

@ -3,9 +3,9 @@
# Maintainer: CRUX System Team, core-ports at crux dot nu
name=xz
version=5.2.3
version=5.2.4
release=1
source=(http://tukaani.org/xz/$name-$version.tar.bz2)
source=(http://tukaani.org/xz/$name-$version.tar.xz)
build() {
cd $name-$version