Compare commits

...

126 Commits
f16 ... rawhide

Author SHA1 Message Date
Luca BRUNO
9783b6240c polkit: switch 'polkitd' to static UID/GID (rhbz#2104615 - fpc#1189)
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2104615
2023-02-08 15:47:45 +01:00
Fedora Release Engineering
a735065884 Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
2023-01-20 10:02:52 +00:00
František Zatloukal
a3df1021dd Rebuilt for duktape 2.7.0 2022-12-16 19:48:14 +01:00
Vincent Mihalkovic
4263861369 new upstream release 2022-10-26 15:18:27 +02:00
Jan Rybar
efe5a6257b duktape re-enabled 2022-08-15 10:49:30 +02:00
Jan Rybar
95fa2ee242 Switched back to mozjs until problems with duktape are fixed
Related: bz#2109145
2022-08-02 17:17:48 +02:00
Fedora Release Engineering
958f6e34d4 Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
2022-07-22 15:11:02 +00:00
Jan Rybar
d6e5ebe89d new upstream release 2022-07-18 17:04:28 +02:00
František Zatloukal
4635612dc9 switch to mozjs91 2022-02-21 00:33:22 +01:00
Jan Rybar
0a203bd46a file descriptor exhaustion (GHSL-2021-077)
Resolves: CVE-2021-4115
2022-02-16 16:44:32 +01:00
Timothée Ravier
96f4e91c93 Fix for CVE-2021-4034 2022-01-26 14:16:14 +01:00
Fedora Release Engineering
c163eab91e - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
2022-01-21 09:13:57 +00:00
Pete Walter
2aaa4f2251 Update to 0.120 2021-10-06 22:28:43 +01:00
Fedora Release Engineering
fef145dfc2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
2021-07-23 03:47:31 +00:00
Jan Rybar
60e5c5e4c3 CVE-2021-3560 mitigation
Resolves: CVE-2021-3560
2021-06-03 14:07:15 +02:00
Jan Rybar
6467a76032 Rebase to 0.118 2021-04-28 10:56:19 +02:00
Zbigniew Jędrzejewski-Szmek
5b6ca4065d Rebuilt for updated systemd-rpm-macros
See https://pagure.io/fesco/issue/2583.
2021-03-02 16:13:01 +01:00
Fedora Release Engineering
985576bc26 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
2021-01-27 08:23:56 +00:00
Tom Stellard
8af7d47cf6 Add BuildRequires: make
https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot
2021-01-08 19:22:54 +00:00
Jan Rybar
5cf49809fe Update dependency to mozjs78 2020-08-17 11:36:20 +02:00
Jan Rybar
32cbffd8b3 Rebased to polkit-0.117 2020-08-03 16:10:12 +02:00
Fedora Release Engineering
f6ba446930 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
2020-07-28 22:49:02 +00:00
Tom Stellard
6ee79f0a57 Use make macros
https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
2020-07-22 02:19:25 +00:00
Fedora Release Engineering
db7729bed2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
2020-01-30 09:30:12 +00:00
Jan Rybar
05ad8ea7c5 jsauthority memleak fix (authored by klember) 2019-10-28 13:20:50 +01:00
Jan Rybar
4156e66e89 pkttyagent: unread input flushed on terminal restore 2019-09-27 18:50:29 +02:00
Kalev Lember
4366d7b4a5 Rebuilt for mozjs60 s390x fixes 2019-09-08 10:38:25 +02:00
Jan Rybar
107fa92b35 pkttyagent: backport patch, get SIGTTOU in background job 2019-08-02 15:14:56 +02:00
Fedora Release Engineering
5f4fb6e4e8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
2019-07-26 11:05:31 +00:00
Pete Walter
89f969e429 Update to 0.116 2019-05-02 08:08:52 +01:00
Jan Rybar
0695cfb385 pkttyagent: PolkitAgentTextListener leaves echo tty disabled if SIGINT/SIGTERM 2019-03-22 12:13:59 +01:00
Pete Walter
5f90249568 Move to mozjs60 2019-02-08 10:06:06 +00:00
Jan Rybar
90cb77b548 Allow uid=-1 for PolkitUnixProcess
https://gitlab.freedesktop.org/polkit/polkit/commit/c05472b86222a72505
2019-02-05 17:01:12 +01:00
Fedora Release Engineering
ea66fc2c31 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
2019-02-02 04:36:06 +00:00
Igor Gnatenko
102dab7be5 Remove obsolete Group tag
References: https://fedoraproject.org/wiki/Changes/Remove_Group_Tag
2019-01-28 20:24:37 +01:00
Igor Gnatenko
832f301e08
Remove obsolete ldconfig scriptlets
References: https://fedoraproject.org/wiki/Changes/RemoveObsoleteScriptlets
Signed-off-by: Igor Gnatenko <ignatenkobrain@fedoraproject.org>
2019-01-22 18:40:43 +01:00
Colin Walters
e749b503a8 Add security fix for
https://bugs.chromium.org/p/project-zero/issues/detail?id=1692
2019-01-08 21:38:54 +00:00
Jan Rybar
5070a1453e Fix of CVE-2018-19788, priv escalation with high UIDs
Resolves: rhbz#1655926
2018-12-07 15:49:43 +01:00
Owen W. Taylor
98744d97b3 Fix installation with prefix != /usr 2018-09-27 10:57:04 -04:00
Jan Rybar
41ee88b15c Spawned zombie subprocesses not reaped
The child watch source attached to thread context didn't work due to the release of it's main loop and context outside. So we attach the source to the global default main context to make it work and avoid zombies.
2018-08-15 16:54:23 +02:00
Jan Rybar
9ed3759d5b - Warning raised by polkit when disconnected from ssh
- polkitagentlistener: resource leak - pointer to 'server'
- Error message raised on every 'systemctl start' in emergency.target
2018-08-06 18:07:47 +02:00
Fedora Release Engineering
daaab19f4d - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
2018-07-13 22:42:26 +00:00
Miloslav Trmač
d63936ccb6 Update to 0.115 (CVE-2018-1116) 2018-07-10 18:48:26 +02:00
Jason Tibbitts
2464bcc6b9 Remove needless use of %defattr 2018-07-10 02:25:23 -05:00
Pete Walter
cea6506a91 Drop unused patches 2018-04-04 22:39:09 +01:00
Ray Strode
d3f9a6d2ec Update buildrequires to mozjs52 2018-04-03 15:42:20 -04:00
Ray Strode
4b3c72d052 Add sign file to sources 2018-04-03 15:36:47 -04:00
Ray Strode
668cc92428 Update to 0.114 2018-04-03 15:32:28 -04:00
Fedora Release Engineering
0dcd449f06 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
2018-02-09 05:31:30 +00:00
Fedora Release Engineering
28f947c651 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild 2017-08-03 06:15:29 +00:00
Fedora Release Engineering
11176bdb63 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild 2017-07-27 08:53:56 +00:00
Richard Hughes
fa6fd57580 Add the its files from upstream 2017-04-13 18:14:27 +01:00
Miloslav Trmač
fb5b854986 Fix a memory leak in PolkitPermission 2017-04-04 23:00:42 +02:00
Miloslav Trmač
21dddc3a15 Bump Release: and restore reverted %changelog entries 2017-04-04 21:58:38 +02:00
Miloslav Trmač
e81b80a9ee Revert "Use %%license, license needs to be in -libs as it's the only guaranteed installed package, Move to mozjs38, Other upstream fixes, Spec cleanups"
This reverts commit 53c8f9ed7f.

The mozjs38 patch does not work at all,
https://bugzilla.redhat.com/show_bug.cgi?id=1438086 :
> Successfully changed to user polkitd
> 20:58:16.881: <no filename>:0: can't open init.js: No such file or directory

Hence, restoring to a working state.
2017-04-04 21:58:07 +02:00
Miloslav Trmač
b7c4dbbf46 Revert "restore Provides: polkit-desktop-policy polkit-js-engine"
This reverts commit 735585c142.

The -7 change will be reverted as well, restoring the original Provides:
by another means.
2017-04-04 21:57:52 +02:00
Miloslav Trmač
e2917226cb Revert "Move to an upstream snapshot, rebase patches"
This reverts commit 85e785c922.

That commit breaks the build with
> configure: error: libsystemd autoconfigured, but system does not appear to use systemd
when running ./autogen.sh, which implicitly runs ./configure.
2017-04-04 21:57:35 +02:00
Miloslav Trmač
45d9d07563 Revert "Update mozjs38 patch"
This reverts commit 52aeecd450.

The updated patch is still not correct enough, namely it processes cases
where the JS .rules do not provide an answer and the “implicit” value
should be returned incorrectly.
2017-04-04 21:56:55 +02:00
Peter Robinson
52aeecd450 Update mozjs38 patch 2017-04-04 20:16:50 +01:00
Peter Robinson
85e785c922 Move to an upstream snapshot, rebase patches 2017-04-04 17:07:08 +01:00
Rex Dieter
735585c142 restore Provides: polkit-desktop-policy polkit-js-engine 2017-03-31 11:09:26 -05:00
Peter Robinson
53c8f9ed7f Use %%license, license needs to be in -libs as it's the only guaranteed installed package, Move to mozjs38, Other upstream fixes, Spec cleanups 2017-03-30 18:50:11 +01:00
Miloslav Trmač
fcbd678dee Fix memory leaks when calling authentication agents 2017-02-13 17:49:35 +01:00
Fedora Release Engineering
b6d2418168 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild 2017-02-11 07:43:27 +00:00
Fedora Release Engineering
72449739ab - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild 2016-02-04 18:19:08 +00:00
Miloslav Trmač
75d6820781 Merge branch 'f22' into f21 2015-07-14 23:14:24 +02:00
Miloslav Trmač
a28dc78bfd Bump the Obsoletes: to < 0.113-3 to account for the non-split 0.113-2.fc21 2015-07-14 23:13:15 +02:00
Rex Dieter
f6926aa221 Obsoletes: polkit < 0.112-8 (handle multilib upgrade path) 2015-07-12 08:35:17 -05:00
Miloslav Trmač
485463067b Add and fix dependencies between subpackages 2015-07-10 19:03:00 +02:00
Miloslav Trmač
8604959986 Revert the -libs split
On multilib systems (with both archs of polkit installed), the -libs
split causes only polkit-libs, not polkit, to be included in the
alternate-arch variant in the repo; so there is nothing to update the
alternate-arch polkit package to.
2015-07-09 19:54:35 +02:00
Miloslav Trmač
88b1a1546d Merge branch 'master' into f21 2015-07-02 21:05:05 +02:00
Miloslav Trmač
0e57360c4e Update to polkit-0.113 (CVE-2015-3218, CVE-2015-3255, CVE-2015-3256, CVE-2015-4625) 2015-07-02 20:37:11 +02:00
Miloslav Trmač
cf8b276464 Ensure %{_unitdir} is defined, to fix the build. 2015-06-19 03:52:49 +02:00
Miloslav Trmač
14fa2ea735 Ignore Eclipse metadata 2015-06-19 02:55:02 +02:00
Dennis Gilmore
3b707439bd - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild 2015-06-18 15:37:11 +00:00
Rex Dieter
8f57407a32 polkit doesn't release reference counters of GVariant data (#1180886) 2015-01-27 09:03:41 -06:00
Rex Dieter
b483a76f38 add awol patch 2015-01-25 18:21:23 -06:00
Rex Dieter
ddfe2e6107 0.112-9
- polkit doesn't release reference counters of GVariant data (#1180886)
- fix ldconfig scriptlets (move to -libs subpkg)
2015-01-25 13:47:21 -06:00
Colin Walters
1224d7b427 Split separate -libs package, so that NetworkManager can just depend on
that, without dragging in the daemon (as well as libmozjs17).  This
  allows the creation of more minimal systems that want programs like NM,
  but do not need the configurability of the daemon; it would be ok if only
  root is authorized.
2014-11-08 15:28:23 -05:00
Peter Robinson
a27b485ff7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild 2014-08-17 19:29:36 +00:00
Kalev Lember
17c9f1773e Rebuilt for gobject-introspection 1.41.4 2014-07-22 20:20:26 +02:00
Dennis Gilmore
996083de2a - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild 2014-06-07 11:43:06 -05:00
Kay Sievers
56a2b8b4c5 Backport upstream D-Bus "user bus" changes 2014-06-05 11:36:59 -04:00
Miloslav Trmač
f3502e1334 Fix a PolkitAgentSession race condition 2014-02-11 11:09:04 +01:00
Miloslav Trmač
5d7095ad13 Always use mozjs-17.0 even if js-devel is installed 2013-12-07 02:36:40 +01:00
Miloslav Trmač
8778af153a Workaround pam_systemd setting broken XDG_RUNTIME_DIR 2013-12-07 02:36:29 +01:00
Miloslav Trmač
ca44eca82e Update to polkit-0.112 2013-09-18 19:39:38 +02:00
Dennis Gilmore
d731968763 - Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild 2013-08-03 23:48:21 -05:00
Tomas Bzatek
576cdfa20a Fix a race on PolkitSubject type registration (#866718) 2013-05-29 16:43:17 +02:00
Miloslav Trmač
8254063f16 Try to preserve timestamps in (make install) 2013-05-15 23:41:18 +02:00
Miloslav Trmač
a32aa347c1 Ship the signature in the srpm 2013-05-15 23:41:05 +02:00
Miloslav Trmač
6585a3fd4d Use SpiderMonkey from mozjs17 instead of js 2013-05-15 23:40:51 +02:00
Miloslav Trmač
8a298159e8 Update to polkit-0.111 2013-05-15 23:40:25 +02:00
Miloslav Trmač
23670d2b6c Fix dates in %changelog 2013-05-15 22:55:51 +02:00
Miloslav Trmač
c4446d1dce Stop removing files that nobody installs any more 2013-05-15 16:36:58 +02:00
Miloslav Trmač
f0ed542725 Shut up rpmlint about Summary:
... and don't use header capitalization for it.
2013-05-11 01:57:18 +02:00
Miloslav Trmač
2fd403e48e Use %{_unitdir} 2013-05-11 01:57:18 +02:00
Miloslav Trmač
d049388b01 Use the new systemd macros
The macros are primarily targeted at services that can be
enabled/disabled, while polkit.service is D-Bus-activated only.
However, they hide/ignore the caused failures while performing the
required daemon reloads, so we can use the same abstraction as every
other unit.
2013-05-11 01:57:18 +02:00
Miloslav Trmač
7177e8ca49 Link to a more detailed bug about not using _hardened_build 2013-05-11 01:55:17 +02:00
Miloslav Trmač
8539d5f074 Build with V=1 2013-05-11 01:55:17 +02:00
Miloslav Trmač
9a3f451f5c Add Requires: polkit-pkla-compat
We want this compatibility, and want polkit behavior to be
unconditionally consistent.
2013-05-11 01:55:17 +02:00
Miloslav Trmač
f2aab851e3 Make the JavaScript engine mandatory
The polkit-js-engine package has been removed, main polkit package
Provides:polkit-js-engine for compatibility.

We want polkit's behavior to be unconditionally consistent.
2013-05-11 01:55:17 +02:00
Miloslav Trmač
6b37bb7853 Don't ship pk-example-frobnicate in the "live" configuration 2013-02-14 14:31:39 +01:00
Miloslav Trmač
bfbf3d20eb Own polkit-js-engine's subdirectory in %{_docdir} 2013-02-09 01:07:23 +01:00
David Zeuthen
1e1164982b Update to upstream release 0.110 2013-01-09 15:11:15 -05:00
Matthias Clasen
7877d139a1 Harden the build the hard way 2013-01-07 19:43:29 -05:00
David Zeuthen
077fefe49f Update to upstream release 0.109
- Drop upstreamed patches
2012-12-19 10:12:09 -05:00
David Zeuthen
75c0e048b8 Attempt to open the correct libmozjs185 library, otherwise polkit
authz rules will not work unless js-devel is installed (fdo #57146)
2012-11-15 10:16:46 -05:00
David Zeuthen
f0e882c5bd Include gmodule-2.0 to avoid build error 2012-11-14 14:34:17 -05:00
David Zeuthen
b0678ca050 Update to upstream release 0.108
- Drop upstreamed patches
- This release dynamically loads the JavaScript interpreter and can
  cope with it not being available. In this case, polkit authorization
  rules are not processed and the defaults for an action - as defined
  in its .policy file - are used for authorization decisions.
- Add new meta-package, polkit-js-engine, that pulls in the required
  JavaScript bits to make polkit authorization rules work. The default
  install - not the minimal install - should include this package
2012-11-14 14:15:33 -05:00
Adam Jackson
b885f75196 Don't crash if initializing the server object fails 2012-10-10 09:35:04 -04:00
David Zeuthen
952de8f0b2 Authenticate as root if e.g. the wheel group is empty (#834494) 2012-09-18 14:56:20 -04:00
Dennis Gilmore
afd4b1dd7d Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild 2012-07-27 01:10:09 -05:00
David Zeuthen
8d393f4039 Update to upstream release 0.107 2012-07-11 13:38:33 -04:00
David Zeuthen
5f25a246a3 Add forgotten Requires(pre): shadow-utils 2012-06-29 17:25:00 -04:00
David Zeuthen
413036b7c7 * Thu Jun 07 2012 David Zeuthen <davidz@redhat.com> 0.106-1.fc18
- Update to upstream release 0.106
- Authorizations are no longer controlled by .pkla files - from now
  on, use the new .rules files described in the polkit(8) man page
2012-06-07 14:05:54 -04:00
David Zeuthen
0fee849c09 Update to upstream release 0.105
- Nuke patches that are now upstream
- Change 'PolicyKit' to 'polkit' in summary and descriptions
2012-04-24 13:01:14 -04:00
Matthias Clasen
7e59d9c3e6 Make docs noarch
(cherry-picked commit b966034 to sync with the f17 branch)
2012-03-19 19:17:08 +02:00
David Zeuthen
fac5a3ac3f Don't leak file descriptors (bgo #671486) 2012-03-08 15:40:59 -05:00
David Zeuthen
7c11f9067d Set error if we cannot obtain a PolkitUnixSession for a given PID (#787222) 2012-02-06 12:44:21 -05:00
Dennis Gilmore
c9ceddfc94 - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild 2012-01-13 19:06:32 -06:00
David Zeuthen
c51db25882 Nuke the ConsoleKit run-time requirement 2012-01-03 12:30:05 -05:00
David Zeuthen
e32bdfd698 Update to upstream release 0.104
Force usage of systemd (instead of ConsoleKit) for session tracking
2012-01-03 12:06:44 -05:00
David Zeuthen
cdaf292035 Update to upstream release 0.103
Drop upstreamed patch
Drop Fedora-specific policy, it is now upstream (fdo #41008)
2011-12-06 11:03:28 -05:00
Dennis Gilmore
a85c68b0b8 - Rebuilt for glibc bug#747377 2011-10-26 19:18:49 -05:00
David Zeuthen
97786661cf Add patch to neuter the annoying systemd behavior where stdout/stderr
is sent to the system logs

Signed-off-by: David Zeuthen <davidz@redhat.com>
2011-10-18 13:38:42 -04:00
7 changed files with 823 additions and 106 deletions

32
.gitignore vendored
View File

@ -1,3 +1,4 @@
/.project
polkit-0.92.tar.gz polkit-0.92.tar.gz
polkit-0.93.tar.gz polkit-0.93.tar.gz
polkit-0.94.tar.gz polkit-0.94.tar.gz
@ -9,3 +10,34 @@ polkit-0.98.tar.gz
/polkit-0.100.tar.gz /polkit-0.100.tar.gz
/polkit-0.101.tar.gz /polkit-0.101.tar.gz
/polkit-0.102.tar.gz /polkit-0.102.tar.gz
/polkit-0.103.tar.gz
/polkit-0.104.tar.gz
/polkit-0.105.tar.gz
/polkit-0.106.tar.gz
/polkit-0.107.tar.gz
/polkit-0.108.tar.gz
/polkit-0.109.tar.gz
/polkit-0.110.tar.gz
/polkit-0.111.tar.gz
/polkit-0.111.tar.gz.sign
/polkit-0.112.tar.gz
/polkit-0.112.tar.gz.sign
/polkit-0.113.tar.gz
/polkit-0.113.tar.gz.sign
/polkit-0.114.tar.gz
/polkit-0.114.tar.gz.sign
/polkit-0.115.tar.gz
/polkit-0.115.tar.gz.sign
/polkit-0.116.tar.gz
/polkit-0.116.tar.gz.sign
/polkit-0.117.tar.gz
/polkit-0.117.tar.gz.sign
/polkit-0.118.tar.gz
/polkit-0.118.tar.gz.sign
/polkit-0.120.tar.gz
/polkit-0.120.tar.gz.sign
/polkit-121.tar.gz
/polkit-121.tar.gz.sign
/polkit-121.tar.xz
/polkit-121.tar.xz.sign
/polkit-122.tar.gz

103
92.patch Normal file
View File

@ -0,0 +1,103 @@
From 4910132853ad68dbe8f4e7710dd098120d1b9b95 Mon Sep 17 00:00:00 2001
From: Xi Ruoyao <xry111@mengyan1223.wang>
Date: Tue, 25 Jan 2022 19:19:30 +0800
Subject: [PATCH 1/3] jsauthority: ensure to call JS_Init() and JS_ShutDown()
exactly once
Before this commit, we were calling JS_Init() in
polkit_backend_js_authority_class_init and never called JS_ShutDown.
This is actually a misusage of SpiderMonkey API. Quote from a comment
in js/Initialization.h (both mozjs-78 and mozjs-91):
It is currently not possible to initialize SpiderMonkey multiple
times (that is, calling JS_Init/JSAPI methods/JS_ShutDown in that
order, then doing so again).
This misusage does not cause severe issues with mozjs-78. However, when
we eventually port jsauthority to use mozjs-91, bad thing will happen:
see the test failure mentioned in #150.
This commit is tested with both mozjs-78 and mozjs-91, all tests pass
with it.
---
src/polkitbackend/polkitbackendjsauthority.cpp | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/src/polkitbackend/polkitbackendjsauthority.cpp b/src/polkitbackend/polkitbackendjsauthority.cpp
index ca17108..b22c34e 100644
--- a/src/polkitbackend/polkitbackendjsauthority.cpp
+++ b/src/polkitbackend/polkitbackendjsauthority.cpp
@@ -75,6 +75,13 @@
/* ---------------------------------------------------------------------------------------------------- */
+static class JsInitHelperType
+{
+public:
+ JsInitHelperType() { JS_Init(); }
+ ~JsInitHelperType() { JS_ShutDown(); }
+} JsInitHelper;
+
struct _PolkitBackendJsAuthorityPrivate
{
gchar **rules_dirs;
@@ -589,7 +596,6 @@ polkit_backend_js_authority_finalize (GObject *object)
delete authority->priv->js_polkit;
JS_DestroyContext (authority->priv->cx);
- /* JS_ShutDown (); */
G_OBJECT_CLASS (polkit_backend_js_authority_parent_class)->finalize (object);
}
@@ -666,7 +672,6 @@ polkit_backend_js_authority_class_init (PolkitBackendJsAuthorityClass *klass)
g_type_class_add_private (klass, sizeof (PolkitBackendJsAuthorityPrivate));
- JS_Init ();
}
/* ---------------------------------------------------------------------------------------------------- */
--
GitLab
From 2b5f49a4e4266d2c327ef55e6df121511e23236b Mon Sep 17 00:00:00 2001
From: Xi Ruoyao <xry111@mengyan1223.wang>
Date: Tue, 25 Jan 2022 19:20:58 +0800
Subject: [PATCH 2/3] jsauthority: port to mozjs-91
---
configure.ac | 2 +-
meson.build | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/configure.ac b/configure.ac
index e434ca2..6783ee7 100644
--- a/configure.ac
+++ b/configure.ac
@@ -80,7 +80,7 @@ PKG_CHECK_MODULES(GLIB, [gmodule-2.0 gio-unix-2.0 >= 2.30.0])
AC_SUBST(GLIB_CFLAGS)
AC_SUBST(GLIB_LIBS)
-PKG_CHECK_MODULES(LIBJS, [mozjs-78])
+PKG_CHECK_MODULES(LIBJS, [mozjs-91])
AC_SUBST(LIBJS_CFLAGS)
AC_SUBST(LIBJS_CXXFLAGS)
--
diff --git a/meson.build b/meson.build
index 858078d..09cce0f 100644
--- a/meson.build
+++ b/meson.build
@@ -133,7 +133,7 @@ expat_dep = dependency('expat')
assert(cc.has_header('expat.h', dependencies: expat_dep), 'Can\'t find expat.h. Please install expat.')
assert(cc.has_function('XML_ParserCreate', dependencies: expat_dep), 'Can\'t find expat library. Please install expat.')
-mozjs_dep = dependency('mozjs-78')
+mozjs_dep = dependency('mozjs-91')
dbus_dep = dependency('dbus-1', required: false)
dbus_policydir = pk_prefix / pk_datadir / 'dbus-1/system.d'
--
GitLab

71
CVE-2021-4115.patch Normal file
View File

@ -0,0 +1,71 @@
diff --git a/src/polkit/polkitsystembusname.c b/src/polkit/polkitsystembusname.c
index 8ed1363..2fbf5f1 100644
--- a/src/polkit/polkitsystembusname.c
+++ b/src/polkit/polkitsystembusname.c
@@ -62,6 +62,10 @@ enum
PROP_NAME,
};
+
+guint8 dbus_call_respond_fails; // has to be global because of callback
+
+
static void subject_iface_init (PolkitSubjectIface *subject_iface);
G_DEFINE_TYPE_WITH_CODE (PolkitSystemBusName, polkit_system_bus_name, G_TYPE_OBJECT,
@@ -364,6 +368,7 @@ on_retrieved_unix_uid_pid (GObject *src,
if (!v)
{
data->caught_error = TRUE;
+ dbus_call_respond_fails += 1;
}
else
{
@@ -405,6 +410,8 @@ polkit_system_bus_name_get_creds_sync (PolkitSystemBusName *system_bus
tmp_context = g_main_context_new ();
g_main_context_push_thread_default (tmp_context);
+ dbus_call_respond_fails = 0;
+
/* Do two async calls as it's basically as fast as one sync call.
*/
g_dbus_connection_call (connection,
@@ -432,11 +439,34 @@ polkit_system_bus_name_get_creds_sync (PolkitSystemBusName *system_bus
on_retrieved_unix_uid_pid,
&data);
- while (!((data.retrieved_uid && data.retrieved_pid) || data.caught_error))
- g_main_context_iteration (tmp_context, TRUE);
+ while (TRUE)
+ {
+ /* If one dbus call returns error, we must wait until the other call
+ * calls _call_finish(), otherwise fd leak is possible.
+ * Resolves: GHSL-2021-077
+ */
- if (data.caught_error)
- goto out;
+ if ( (dbus_call_respond_fails > 1) )
+ {
+ // we got two faults, we can leave
+ goto out;
+ }
+
+ if ((data.caught_error && (data.retrieved_pid || data.retrieved_uid)))
+ {
+ // we got one fault and the other call finally finished, we can leave
+ goto out;
+ }
+
+ if ( !(data.retrieved_uid && data.retrieved_pid) )
+ {
+ g_main_context_iteration (tmp_context, TRUE);
+ }
+ else
+ {
+ break;
+ }
+ }
if (out_uid)
*out_uid = data.uid;

View File

@ -0,0 +1,79 @@
From a2bf5c9c83b6ae46cbd5c779d3055bff81ded683 Mon Sep 17 00:00:00 2001
From: Jan Rybar <jrybar@redhat.com>
Date: Tue, 25 Jan 2022 17:21:46 +0000
Subject: [PATCH] pkexec: local privilege escalation (CVE-2021-4034)
---
src/programs/pkcheck.c | 5 +++++
src/programs/pkexec.c | 23 ++++++++++++++++++++---
2 files changed, 25 insertions(+), 3 deletions(-)
diff --git a/src/programs/pkcheck.c b/src/programs/pkcheck.c
index f1bb4e1..768525c 100644
--- a/src/programs/pkcheck.c
+++ b/src/programs/pkcheck.c
@@ -363,6 +363,11 @@ main (int argc, char *argv[])
local_agent_handle = NULL;
ret = 126;
+ if (argc < 1)
+ {
+ exit(126);
+ }
+
/* Disable remote file access from GIO. */
setenv ("GIO_USE_VFS", "local", 1);
diff --git a/src/programs/pkexec.c b/src/programs/pkexec.c
index 7698c5c..84e5ef6 100644
--- a/src/programs/pkexec.c
+++ b/src/programs/pkexec.c
@@ -488,6 +488,15 @@ main (int argc, char *argv[])
pid_t pid_of_caller;
gpointer local_agent_handle;
+
+ /*
+ * If 'pkexec' is called THIS wrong, someone's probably evil-doing. Don't be nice, just bail out.
+ */
+ if (argc<1)
+ {
+ exit(127);
+ }
+
ret = 127;
authority = NULL;
subject = NULL;
@@ -614,10 +623,10 @@ main (int argc, char *argv[])
path = g_strdup (pwstruct.pw_shell);
if (!path)
- {
+ {
g_printerr ("No shell configured or error retrieving pw_shell\n");
goto out;
- }
+ }
/* If you change this, be sure to change the if (!command_line)
case below too */
command_line = g_strdup (path);
@@ -636,7 +645,15 @@ main (int argc, char *argv[])
goto out;
}
g_free (path);
- argv[n] = path = s;
+ path = s;
+
+ /* argc<2 and pkexec runs just shell, argv is guaranteed to be null-terminated.
+ * /-less shell shouldn't happen, but let's be defensive and don't write to null-termination
+ */
+ if (argv[n] != NULL)
+ {
+ argv[n] = path;
+ }
}
if (access (path, F_OK) != 0)
{
--
GitLab

90
mozjs78.patch Normal file
View File

@ -0,0 +1,90 @@
diff --git a/configure.ac b/configure.ac
index eea70fc..c4569f1 100644
--- a/configure.ac
+++ b/configure.ac
@@ -34,7 +34,7 @@ AC_PROG_LN_S
AC_SYS_LARGEFILE
AM_PROG_CC_C_O
AC_PROG_CXX
-AX_CXX_COMPILE_STDCXX([14], [], [mandatory])
+AX_CXX_COMPILE_STDCXX([17], [], [mandatory])
# Taken from dbus
AC_ARG_ENABLE(ansi, [ --enable-ansi enable -ansi -pedantic gcc flags],enable_ansi=$enableval,enable_ansi=no)
@@ -80,7 +80,7 @@ PKG_CHECK_MODULES(GLIB, [gmodule-2.0 gio-unix-2.0 >= 2.30.0])
AC_SUBST(GLIB_CFLAGS)
AC_SUBST(GLIB_LIBS)
-PKG_CHECK_MODULES(LIBJS, [mozjs-68])
+PKG_CHECK_MODULES(LIBJS, [mozjs-78])
AC_SUBST(LIBJS_CFLAGS)
AC_SUBST(LIBJS_CXXFLAGS)
diff --git a/src/polkitbackend/polkitbackendjsauthority.cpp b/src/polkitbackend/polkitbackendjsauthority.cpp
index 25bd1f9..ca17108 100644
--- a/src/polkitbackend/polkitbackendjsauthority.cpp
+++ b/src/polkitbackend/polkitbackendjsauthority.cpp
@@ -49,6 +49,7 @@
#include <js/Realm.h>
#include <js/SourceText.h>
#include <js/Warnings.h>
+#include <js/Array.h>
#include <jsapi.h>
#include "initjs.h" /* init.js */
@@ -367,7 +368,7 @@ load_scripts (PolkitBackendJsAuthority *authority)
static void
reload_scripts (PolkitBackendJsAuthority *authority)
{
- JS::AutoValueArray<1> args(authority->priv->cx);
+ JS::RootedValueArray<1> args(authority->priv->cx);
JS::RootedValue rval(authority->priv->cx);
JS::RootedObject js_polkit(authority->priv->cx, authority->priv->js_polkit->get ());
@@ -482,10 +483,6 @@ polkit_backend_js_authority_constructed (GObject *object)
if (!JS::InitSelfHostedCode (authority->priv->cx))
goto fail;
- JS::ContextOptionsRef (authority->priv->cx)
- .setIon (TRUE)
- .setBaseline (TRUE)
- .setAsmJS (TRUE);
JS::SetWarningReporter(authority->priv->cx, report_error);
JS_SetContextPrivate (authority->priv->cx, authority);
@@ -720,7 +717,7 @@ set_property_strv (PolkitBackendJsAuthority *authority,
elems[n].setNull ();
}
- JS::RootedObject array_object(authority->priv->cx, JS_NewArrayObject (authority->priv->cx, elems));
+ JS::RootedObject array_object(authority->priv->cx, JS::NewArrayObject (authority->priv->cx, elems));
value_jsval = JS::ObjectValue (*array_object);
JS_SetProperty (authority->priv->cx, obj, name, value_jsval);
@@ -1114,7 +1111,7 @@ polkit_backend_js_authority_get_admin_auth_identities (PolkitBackendInteractiveA
{
PolkitBackendJsAuthority *authority = POLKIT_BACKEND_JS_AUTHORITY (_authority);
GList *ret = NULL;
- JS::AutoValueArray<2> args(authority->priv->cx);
+ JS::RootedValueArray<2> args(authority->priv->cx);
JS::RootedValue rval(authority->priv->cx);
guint n;
GError *error = NULL;
@@ -1218,7 +1215,7 @@ polkit_backend_js_authority_check_authorization_sync (PolkitBackendInteractiveAu
{
PolkitBackendJsAuthority *authority = POLKIT_BACKEND_JS_AUTHORITY (_authority);
PolkitImplicitAuthorization ret = implicit;
- JS::AutoValueArray<2> args(authority->priv->cx);
+ JS::RootedValueArray<2> args(authority->priv->cx);
JS::RootedValue rval(authority->priv->cx);
GError *error = NULL;
JS::RootedString ret_jsstr (authority->priv->cx);
@@ -1409,7 +1406,7 @@ js_polkit_spawn (JSContext *cx,
JS::CallArgs args = JS::CallArgsFromVp (js_argc, vp);
array_object = &args[0].toObject();
- if (!JS_GetArrayLength (cx, array_object, &array_len))
+ if (!JS::GetArrayLength (cx, array_object, &array_len))
{
JS_ReportErrorUTF8 (cx, "Failed to get array length");
goto out;

View File

@ -1,20 +1,34 @@
Summary: PolicyKit Authorization Framework # Only enable if using patches that touches configure.ac,
# Makefile.am or other build system related files
#
Summary: An authorization framework
Name: polkit Name: polkit
Version: 0.102 Version: 122
Release: 1%{?dist} Release: 4%{?dist}
License: LGPLv2+ License: LGPLv2+
URL: http://www.freedesktop.org/wiki/Software/PolicyKit URL: http://www.freedesktop.org/wiki/Software/polkit
Source0: http://hal.freedesktop.org/releases/%{name}-%{version}.tar.gz Source0: https://gitlab.freedesktop.org/polkit/polkit/-/archive/%{version}/%{name}-%{version}.tar.gz
Group: System Environment/Libraries
BuildRequires: glib2-devel >= 2.28.0 BuildRequires: gcc-c++
BuildRequires: glib2-devel >= 2.30.0
BuildRequires: expat-devel BuildRequires: expat-devel
BuildRequires: pam-devel BuildRequires: pam-devel
BuildRequires: gtk-doc BuildRequires: gtk-doc
BuildRequires: intltool BuildRequires: gettext-devel
BuildRequires: gobject-introspection-devel BuildRequires: gobject-introspection-devel
BuildRequires: systemd, systemd-devel
BuildRequires: dbus-devel
BuildRequires: pkgconfig(duktape)
BuildRequires: meson
BuildRequires: git
Requires: ConsoleKit Requires: dbus, polkit-pkla-compat
Requires: dbus Requires: %{name}-libs%{?_isa} = %{version}-%{release}
Requires(pre): shadow-utils
Requires(post): systemd
Requires(preun): systemd
Requires(postun): systemd
Obsoletes: PolicyKit <= 0.10 Obsoletes: PolicyKit <= 0.10
Provides: PolicyKit = 0.11 Provides: PolicyKit = 0.11
@ -23,156 +37,484 @@ Provides: PolicyKit = 0.11
# sufficiently new polkit-gnome package # sufficiently new polkit-gnome package
Conflicts: polkit-gnome < 0.97 Conflicts: polkit-gnome < 0.97
Obsoletes: polkit-desktop-policy < 0.103
Provides: polkit-desktop-policy = 0.103
Obsoletes: polkit-js-engine < 0.120-5
Provides: polkit-js-engine = %{version}-%{release}
# when -libs was split out, handle multilib upgrade path -- rex
Obsoletes: polkit < 0.113-3
%description %description
PolicyKit is a toolkit for defining and handling authorizations. polkit is a toolkit for defining and handling authorizations. It is
It is used for allowing unprivileged processes to speak to privileged used for allowing unprivileged processes to speak to privileged
processes. processes.
%package devel %package devel
Summary: Development files for PolicyKit Summary: Development files for polkit
Group: Development/Libraries Requires: %{name}-libs%{?_isa} = %{version}-%{release}
Requires: %name = %{version}-%{release}
Requires: %name-docs = %{version}-%{release} Requires: %name-docs = %{version}-%{release}
Requires: glib2-devel Requires: glib2-devel
Obsoletes: PolicyKit-devel <= 0.10 Obsoletes: PolicyKit-devel <= 0.10
Provides: PolicyKit-devel = 0.11 Provides: PolicyKit-devel = 0.11
%description devel %description devel
Development files for PolicyKit. Development files for polkit.
%package docs %package docs
Summary: Development documentation for PolicyKit Summary: Development documentation for polkit
Group: Development/Libraries
Requires: %name-devel = %{version}-%{release} Requires: %name-devel = %{version}-%{release}
Obsoletes: PolicyKit-docs <= 0.10 Obsoletes: PolicyKit-docs <= 0.10
Provides: PolicyKit-docs = 0.11 Provides: PolicyKit-docs = 0.11
%description docs
Development documentation for PolicyKit.
%package desktop-policy
Summary: PolicyKit policy for desktop users
Group: Development/Libraries
#Requires: %name = %{version}-%{release}
BuildArch: noarch BuildArch: noarch
%description desktop-policy %description docs
This package contains configuration directives to make PolicyKit use Development documentation for polkit.
members of the wheel group when administrator authentication is
required. Additionally, the package also contain configuration %package libs
directives to allow users in the wheel group to do certain actions Summary: Libraries for polkit
without being interrupted by password dialogs
%description libs
Libraries files for polkit.
%prep %prep
%setup -q %autosetup -S git
%build %build
%configure --enable-gtk-doc \ %meson -D authfw=pam \
--disable-static \ -D examples=false \
--libexecdir=%{_libexecdir}/polkit-1 \ -D gtk_doc=true \
--enable-introspection \ -D introspection=true \
--enable-examples -D man=true \
make -D session_tracking=libsystemd-login \
-D tests=false
%meson_build
%install %install
make install DESTDIR=$RPM_BUILD_ROOT %meson_install
rm -f $RPM_BUILD_ROOT%{_libdir}/*.la rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
rm -f $RPM_BUILD_ROOT%{_libdir}/polkit-1/extensions/*.la
%find_lang polkit-1 %find_lang polkit-1
### %pre
### BEGIN DESKTOP POLICY CONFIGURATION ### getent group polkitd >/dev/null || groupadd -r -g 114 polkitd
### getent passwd polkitd >/dev/null || useradd -r -u 114 -g polkitd -d / -s /sbin/nologin -c "User for polkitd" polkitd
exit 0
cat > $RPM_BUILD_ROOT%{_sysconfdir}/polkit-1/localauthority.conf.d/60-desktop-policy.conf << EOF %post
# This allows users in the wheel group to authenticate as the # The implied (systemctl preset) will fail and complain, but the macro hides
# administrator. # and ignores the fact. This is in fact what we want, polkit.service does not
# # have an [Install] section and it is always started on demand.
# DO NOT EDIT THIS FILE, it will be overwritten on update. %systemd_post polkit.service
[Configuration] %preun
AdminIdentities=unix-group:wheel %systemd_preun polkit.service
EOF
cat > $RPM_BUILD_ROOT%{_localstatedir}/lib/polkit-1/localauthority/10-vendor.d/10-desktop-policy.pkla << EOF %postun
# Authorizations/policy for the wheel group. %systemd_postun_with_restart polkit.service
#
# DO NOT EDIT THIS FILE, it will be overwritten on update.
#
# Allow users in the wheel group to do certain actions without being
# interrupted by password dialogs
#
[Wheel Group Permissions]
Identity=unix-group:wheel
Action=org.gnome.settingsdaemon.datetimemechanism.*;org.kde.kcontrol.kcmclock.save;org.freedesktop.RealtimeKit1.*;org.freedesktop.udisks.filesystem-mount-system-internal;org.freedesktop.hostname1.set-static-hostname
ResultAny=auth_admin
ResultInactive=auth_admin
ResultActive=yes
EOF
###
### END DESKTOP POLICY CONFIGURATION
###
%post -p /sbin/ldconfig
%postun -p /sbin/ldconfig
%files desktop-policy
%{_sysconfdir}/polkit-1/localauthority.conf.d/60-desktop-policy.conf
%{_localstatedir}/lib/polkit-1/localauthority/10-vendor.d/10-desktop-policy.pkla
%files -f polkit-1.lang %files -f polkit-1.lang
%defattr(-,root,root,-) %doc COPYING NEWS.md README.md
%doc COPYING
%{_libdir}/lib*.so.*
%dir %{_libdir}/polkit-1
%dir %{_libdir}/polkit-1/extensions
%{_libdir}/polkit-1/extensions/*.so
%{_datadir}/man/man1/* %{_datadir}/man/man1/*
%{_datadir}/man/man8/* %{_datadir}/man/man8/*
%{_datadir}/dbus-1/system.d/org.freedesktop.PolicyKit1.conf
%{_datadir}/dbus-1/system-services/* %{_datadir}/dbus-1/system-services/*
%{_unitdir}/polkit.service
%dir %{_datadir}/polkit-1/ %dir %{_datadir}/polkit-1/
%dir %{_datadir}/polkit-1/actions %dir %{_datadir}/polkit-1/actions
%attr(0700,polkitd,root) %dir %{_datadir}/polkit-1/rules.d
%{_datadir}/polkit-1/actions/org.freedesktop.policykit.policy %{_datadir}/polkit-1/actions/org.freedesktop.policykit.policy
%{_sysconfdir}/dbus-1/system.d/org.freedesktop.PolicyKit1.conf %{_datadir}/polkit-1/policyconfig-1.dtd
%dir %{_sysconfdir}/polkit-1
%{_datadir}/polkit-1/rules.d/50-default.rules
%attr(0700,polkitd,root) %dir %{_sysconfdir}/polkit-1/rules.d
%{_sysconfdir}/pam.d/polkit-1 %{_sysconfdir}/pam.d/polkit-1
%{_sysconfdir}/polkit-1
%{_bindir}/pkaction %{_bindir}/pkaction
%{_bindir}/pkcheck %{_bindir}/pkcheck
%dir %{_libexecdir}/polkit-1 %{_bindir}/pkttyagent
%{_libexecdir}/polkit-1/polkitd %dir %{_prefix}/lib/polkit-1
%{_libdir}/girepository-1.0/*.typelib %{_prefix}/lib/polkit-1/polkitd
# see upstream docs for why these permissions are necessary # see upstream docs for why these permissions are necessary
%attr(4755,root,root) %{_bindir}/pkexec %attr(4755,root,root) %{_bindir}/pkexec
%attr(4755,root,root) %{_libexecdir}/polkit-1/polkit-agent-helper-1 %attr(4755,root,root) %{_prefix}/lib/polkit-1/polkit-agent-helper-1
%attr(0700,root,root) %dir %{_localstatedir}/lib/polkit-1/
%dir %{_localstatedir}/lib/polkit-1/localauthority
%dir %{_localstatedir}/lib/polkit-1/localauthority/10-vendor.d
%dir %{_localstatedir}/lib/polkit-1/localauthority/20-org.d
%dir %{_localstatedir}/lib/polkit-1/localauthority/30-site.d
%dir %{_localstatedir}/lib/polkit-1/localauthority/50-local.d
%dir %{_localstatedir}/lib/polkit-1/localauthority/90-mandatory.d
%files devel %files devel
%defattr(-,root,root,-)
%{_libdir}/lib*.so %{_libdir}/lib*.so
%{_libdir}/pkgconfig/*.pc %{_libdir}/pkgconfig/*.pc
%{_datadir}/gir-1.0/*.gir %{_datadir}/gir-1.0/*.gir
%{_includedir}/* %{_includedir}/*
%{_bindir}/pk-example-frobnicate %{_datadir}/gettext/its/polkit.its
%{_datadir}/polkit-1/actions/org.freedesktop.policykit.examples.pkexec.policy %{_datadir}/gettext/its/polkit.loc
%files docs %files docs
%defattr(-,root,root,-)
%{_datadir}/gtk-doc %{_datadir}/gtk-doc
%ldconfig_scriptlets libs
%files libs
%{_libdir}/lib*.so.*
%{_libdir}/girepository-1.0/*.typelib
%changelog %changelog
* Fri Aug 04 2011 David Zeuthen <davidz@redhat.com> 0.102-1 * Wed Feb 08 2023 Jan Rybar <jrybar@redhat.com> - 122-4
- Switch 'polkitd' to static UID/GID (fpc#1189) (on behalf of lucab)
- Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2104615
* Fri Jan 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 122-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
* Fri Dec 16 2022 František Zatloukal <fzatlouk@redhat.com> - 122-2
- Rebuilt for duktape 2.7.0
* Wed Oct 26 2022 Vincent Mihalkovic <vmihalko@redhat.com> - 122-1
- rebase to 122
* Mon Aug 15 2022 Jan Rybar <jrybar@redhat.com> - 121-4
- duktape re-enabled
* Tue Aug 02 2022 Jan Rybar <jrybar@redhat.com> - 121-3
- switched back to mozjs until problems with duktape are fixed
- Related: bz#2109145
* Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 121-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
* Tue Jul 12 2022 Jan Rybar <jrybar@redhat.com> - 121-1
- Rebase to v.121
* Sun Feb 20 2022 Frantisek Zatloukal <fzatlouk@redhat.com> - 0.120-5
- switch to mozjs91
* Wed Feb 16 2022 Jan Rybar <jrybar@redhat.com> - 0.120-4
- file descriptor exhaustion (GHSL-2021-077)
- Resolves: CVE-2021-4115
* Wed Jan 26 2022 Timothée Ravier <tim@siosm.fr> - 0.120-3
- Fix for CVE-2021-4034
* Fri Jan 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 0.120-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
* Wed Oct 06 2021 Pete Walter <pwalter@fedoraproject.org> - 0.120-1
- Update to 0.120
* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.118-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
* Thu May 20 2021 Jan Rybar <jrybar@redhat.com> - 0.118-2
- CVE-2021-3560 mitigation
- Resolves: CVE-2021-3560
* Mon Apr 26 2021 Jan Rybar <jrybar@redhat.com> - 0.118-1
- rebase to 0.118
* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.117-4
- Rebuilt for updated systemd-rpm-macros
See https://pagure.io/fesco/issue/2583.
* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.117-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Wed Aug 12 2020 Jan Rybar <jrybar@redhat.com> - 0.117-2
- update dependency to mozjs78
* Fri Jul 31 2020 Jan Rybar <jrybar@redhat.com> - 0.117-1
- Rebased to polkit-0.117
* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.116-9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Wed Jul 22 2020 Tom Stellard <tstellar@redhat.com> - 0.116-8
- Use make macros
- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
* Thu Jan 30 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.116-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Fri Oct 25 2019 Jan Rybar <jrybar@redhat.com> - 0.116-6
- jsauthority memleak fix
* Fri Sep 27 2019 Jan Rybar <jrybar@redhat.com> - 0.116-5
- pkttyagent: unread input flushed on terminal restore
* Sun Sep 08 2019 Kalev Lember <klember@redhat.com> - 0.116-4
- Rebuilt for mozjs60 s390x fixes
* Fri Aug 02 2019 Jan Rybar <jrybar@redhat.com> - 0.116-3
- pkttyagent: backport patch, get SIGTTOU in background job
* Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.116-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Thu May 02 2019 Pete Walter <pwalter@fedoraproject.org> - 0.116-1
- Update to 0.116
* Thu Feb 14 2019 Jan Rybar <jrybar@redhat.com> - 0.115-11
- pkttyagent: PolkitAgentTextListener leaves echo tty disabled if SIGINT/SIGTERM
* Fri Feb 08 2019 Pete Walter <pwalter@fedoraproject.org> - 0.115-10
- Move to mozjs60
* Tue Feb 05 2019 Jan Rybar <jrybar@redhat.com> - 0.115-9
- Allow uid=-1 for PolkitUnixProcess
* Sat Feb 02 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.115-8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Tue Jan 08 2019 Colin Walters <walters@verbum.org> - 0.115-7
- Add security fix for
https://bugs.chromium.org/p/project-zero/issues/detail?id=1692
* Fri Dec 07 2018 Jan Rybar <jrybar@redhat.com> - 0.115-6
- Fix of CVE-2018-19788, priv escalation with high UIDs
- Resolves: rhbz#1655926
* Thu Sep 27 2018 Owen Taylor <otaylor@redhat.com> - 0.115-5
- Fix installation with prefix != /usr
* Mon Aug 13 2018 Jan Rybar <jrybar@redhat.com> - 0.115-4
- Leaking zombie processess started by rules
* Fri Jul 20 2018 Jan Rybar <jrybar@redhat.com> - 0.115-3
- Warning raised by polkit when disconnected from ssh
- polkitagentlistener: resource leak - pointer to 'server'
- Error message raised on every 'systemctl start' in emergency.target
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.115-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Tue Jul 10 2018 Miloslav Trmač <mitr@redhat.com> - 0.115-1
- Update to 0.115 (CVE-2018-1116)
* Tue Apr 03 2018 Ray Strode <rstrode@redhat.com> - 0.114-1
- Update to 0.114
* Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.113-16
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.113-15
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.113-14
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
* Thu Apr 13 2017 Richard Hughes <rhughes@redhat.com> - 0.113-13
- Add the its files from upstream.
* Tue Apr 4 2017 Miloslav Trmač <mitr@redhat.com> - 0.113-12
- Fix a memory leak in PolkitPermission.
Patch by Rui Matos <tiagomatos@gmail.com>
Resolves: #1433915
* Tue Apr 4 2017 Miloslav Trmač <mitr@redhat.com> - 0.113-11
- Revert back to the state in 0.113-7, undoing the untested changes.
* Tue Apr 4 2017 Peter Robinson <pbrobinson@fedoraproject.org> 0.113-10
- Move to an upstream snapshot, rebase patches
* Fri Mar 31 2017 Rex Dieter <rdieter@fedoraproject.org> - 0.113-9
- restore Provides: polkit-desktop-policy polkit-js-engine
* Thu Mar 30 2017 Peter Robinson <pbrobinson@fedoraproject.org> 0.113-8
- Use %%license, license needs to be in -libs as it's the only guaranteed installed package
- Move to mozjs38
- Other upstream fixes
- Spec cleanups
* Mon Feb 13 2017 Miloslav Trmač <mitr@redhat.com> - 0.113-7
- Fix memory leaks when calling authentication agents
Resolves: #1380166
* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.113-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 0.113-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
* Tue Jul 14 2015 Miloslav Trmač <mitr@redhat.com> - 0.113-4
- Bump the Obsoletes: to < 0.113-3 to account for the non-split 0.113-2.fc21
Resolves: #1243004
* Sun Jul 12 2015 Rex Dieter <rdieter@fedoraproject.org> 0.113-3
- Obsoletes: polkit < 0.112-8 (handle multilib upgrade path)
* Fri Jul 10 2015 Miloslav Trmač <mitr@redhat.com> - 0.113-2
- Add a fully versioned dependency from polkit to polkit-libs
Resolves: #1241759
- Require polkit-libs, not polkit, in polkit-devel
* Thu Jul 2 2015 Miloslav Trmač <mitr@redhat.com> - 0.113-1
- Update to polkit-0.113 (CVE-2015-3218, CVE-2015-3255, CVE-2015-3256,
CVE-2015-4625)
Resolves: #910262, #1175061, #1177930, #1194391, #1228739, #1233810
* Fri Jun 19 2015 Miloslav Trmač <mitr@redhat.com> - 0.112-11
- Add BuildRequires: systemd so that %%{_unitdir} is defined, to fix the build.
* Thu Jun 18 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.112-10
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
* Sun Jan 25 2015 Rex Dieter <rdieter@fedoraproject.org> - 0.112-9
- polkit doesn't release reference counters of GVariant data (#1180886)
- fix ldconfig scriptlets (move to -libs subpkg)
* Sat Nov 08 2014 Colin Walters <walters@redhat.com> - 0.112-8
- Split separate -libs package, so that NetworkManager can just depend on
that, without dragging in the daemon (as well as libmozjs17). This
allows the creation of more minimal systems that want programs like NM,
but do not need the configurability of the daemon; it would be ok if only
root is authorized.
* Sun Aug 17 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.112-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
* Tue Jul 22 2014 Kalev Lember <kalevlember@gmail.com> - 0.112-6
- Rebuilt for gobject-introspection 1.41.4
* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.112-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
* Thu Jun 5 2014 Kay Sievers <kay@redhat.com> - 0.112-4
- backport upstream D-Bus "user bus" changes
* Mon Feb 10 2014 Miloslav Trmač <mitr@redhat.com> - 0.112-3
- Fix a PolkitAgentSession race condition
Resolves: #1063193
* Sat Dec 7 2013 Miloslav Trmač <mitr@redhat.com> - 0.112-2
- Workaround pam_systemd setting broken XDG_RUNTIME_DIR
Resolves: #1033774
- Always use mozjs-17.0 even if js-devel is installed
* Wed Sep 18 2013 Miloslav Trmač <mitr@redhat.com> - 0.112-1
- Update to polkit-0.112
- Resolves: #1009538, CVE-2013-4288
* Sun Aug 04 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.111-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
* Wed May 29 2013 Tomas Bzatek <tbzatek@redhat.com> - 0.111-2
- Fix a race on PolkitSubject type registration (#866718)
* Wed May 15 2013 Miloslav Trmač <mitr@redhat.com> - 0.111-1
- Update to polkit-0.111
Resolves: #917888
- Use SpiderMonkey from mozjs17 instead of js
- Ship the signature in the srpm
- Try to preserve timestamps in (make install)
* Fri May 10 2013 Miloslav Trmač <mitr@redhat.com> - 0.110-4
- Shut up rpmlint about Summary:
- Build with V=1
- Use %%{_unitdir} instead of hard-coding the path
- Use the new systemd macros, primarily to run (systemctl daemon-reload)
Resolves: #857382
* Fri May 10 2013 Miloslav Trmač <mitr@redhat.com> - 0.110-4
- Make the JavaScript engine mandatory. The polkit-js-engine package has been
removed, main polkit package Provides:polkit-js-engine for compatibility.
- Add Requires: polkit-pkla-compat
Resolves: #908808
* Wed Feb 13 2013 Miloslav Trmač <mitr@redhat.com> - 0.110-3
- Don't ship pk-example-frobnicate in the "live" configuration
Resolves: #878112
* Fri Feb 8 2013 Miloslav Trmač <mitr@redhat.com> - 0.110-2
- Own %%{_docdir}/polkit-js-engine-*
Resolves: #907668
* Wed Jan 9 2013 David Zeuthen <davidz@redhat.com> - 0.110-1%{?dist}
- Update to upstream release 0.110
* Mon Jan 7 2013 Matthias Clasen <mclasen@redhat.com> - 0.109-2%{?dist}
- Build with pie and stuff
* Wed Dec 19 2012 David Zeuthen <davidz@redhat.com> 0.109-1%{?dist}
- Update to upstream release 0.109
- Drop upstreamed patches
* Thu Nov 15 2012 David Zeuthen <davidz@redhat.com> 0.108-3%{?dist}
- Attempt to open the correct libmozjs185 library, otherwise polkit
authz rules will not work unless js-devel is installed (fdo #57146)
* Wed Nov 14 2012 David Zeuthen <davidz@redhat.com> 0.108-2%{?dist}
- Include gmodule-2.0 to avoid build error
* Wed Nov 14 2012 David Zeuthen <davidz@redhat.com> 0.108-1%{?dist}
- Update to upstream release 0.108
- Drop upstreamed patches
- This release dynamically loads the JavaScript interpreter and can
cope with it not being available. In this case, polkit authorization
rules are not processed and the defaults for an action - as defined
in its .policy file - are used for authorization decisions.
- Add new meta-package, polkit-js-engine, that pulls in the required
JavaScript bits to make polkit authorization rules work. The default
install - not the minimal install - should include this package
* Wed Oct 10 2012 Adam Jackson <ajax@redhat.com> 0.107-4
- Don't crash if initializing the server object fails
* Tue Sep 18 2012 David Zeuthen <davidz@redhat.com> 0.107-3%{?dist}
- Authenticate as root if e.g. the wheel group is empty (#834494)
* Fri Jul 27 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.107-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
* Wed Jul 11 2012 David Zeuthen <davidz@redhat.com> 0.107-1%{?dist}
- Update to upstream release 0.107
* Fri Jun 29 2012 David Zeuthen <davidz@redhat.com> 0.106-2%{?dist}
- Add forgotten Requires(pre): shadow-utils
* Thu Jun 07 2012 David Zeuthen <davidz@redhat.com> 0.106-1%{?dist}
- Update to upstream release 0.106
- Authorizations are no longer controlled by .pkla files - from now
on, use the new .rules files described in the polkit(8) man page
* Tue Apr 24 2012 David Zeuthen <davidz@redhat.com> 0.105-1%{?dist}
- Update to upstream release 0.105
- Nuke patches that are now upstream
- Change 'PolicyKit' to 'polkit' in summary and descriptions
* Thu Mar 08 2012 David Zeuthen <davidz@redhat.com> 0.104-6%{?dist}
- Don't leak file descriptors (bgo #671486)
* Mon Feb 13 2012 Matthias Clasen <mclasen@redhat.com> - 0.104-5%{?dist}
- Make the -docs subpackage noarch
* Mon Feb 06 2012 David Zeuthen <davidz@redhat.com> 0.104-4%{?dist}
- Set error if we cannot obtain a PolkitUnixSession for a given PID (#787222)
* Sat Jan 14 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.104-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
* Tue Jan 03 2012 David Zeuthen <davidz@redhat.com> 0.104-2%{?dist}
- Nuke the ConsoleKit run-time requirement
* Tue Jan 03 2012 David Zeuthen <davidz@redhat.com> 0.104-1%{?dist}
- Update to upstream release 0.104
- Force usage of systemd (instead of ConsoleKit) for session tracking
* Tue Dec 06 2011 David Zeuthen <davidz@redhat.com> 0.103-1%{?dist}
- Update to upstream release 0.103
- Drop upstreamed patch
- Drop Fedora-specific policy, it is now upstream (fdo #41008)
* Wed Oct 26 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.102-3
- Rebuilt for glibc bug#747377
* Tue Oct 18 2011 David Zeuthen <davidz@redhat.com> 0.102-2%{?dist}
- Add patch to neuter the annoying systemd behavior where stdout/stderr
is sent to the system logs
* Thu Aug 04 2011 David Zeuthen <davidz@redhat.com> 0.102-1
- Update to 0.102 release - Update to 0.102 release
* Fri May 13 2011 Bastien Nocera <bnocera@redhat.com> 0.101-7 * Fri May 13 2011 Bastien Nocera <bnocera@redhat.com> 0.101-7
@ -209,7 +551,7 @@ EOF
* Fri Jan 28 2011 Matthias Clasen <mclasen@redhat.com> - 0.98-6 * Fri Jan 28 2011 Matthias Clasen <mclasen@redhat.com> - 0.98-6
- Own /usr/libexec/polkit-1 - Own /usr/libexec/polkit-1
* Fri Nov 14 2010 Matthias Clasen <mclasen@redhat.com> - 0.98-5 * Fri Nov 12 2010 Matthias Clasen <mclasen@redhat.com> - 0.98-5
- Enable introspection - Enable introspection
* Thu Sep 02 2010 David Zeuthen <davidz@redhat.com> - 0.98-4 * Thu Sep 02 2010 David Zeuthen <davidz@redhat.com> - 0.98-4

View File

@ -1 +1 @@
a3726bdb9728c103e58f62131e26693a polkit-0.102.tar.gz SHA512 (polkit-122.tar.gz) = 6f537b218133777c1a9ef6b38296b4e17263d86b783acce4ce895ef3b507bb1b482d4b88bc410ab8846ce7cc7b84e82c4109f80f535190a351d7d2683b8608f3