2.28.2-2: fix CVE-2017-2616

.gitignore

@@ -50,43 +50,3 @@
 /util-linux-2.28.tar.xz
 /util-linux-2.28.1.tar.xz
 /util-linux-2.28.2.tar.xz
-/util-linux-2.29-rc1.tar.xz
-/util-linux-2.29-rc2.tar.xz
-/util-linux-2.29.tar.xz
-/util-linux-2.29.1.tar.xz
-/util-linux-2.29.2.tar.xz
-/util-linux-2.30-rc1.tar.xz
-/util-linux-2.30.tar.xz
-/util-linux-2.30.1.tar.xz
-/util-linux-2.30.2.tar.xz
-/util-linux-2.31-rc1.tar.xz
-/util-linux-2.31-rc2.tar.xz
-/util-linux-2.31.tar.xz
-/util-linux-2.32-rc1.tar.xz
-/util-linux-2.32.tar.xz
-/util-linux-2.32.1.tar.xz
-/util-linux-2.33-rc2.tar.xz
-/util-linux-2.33.1.tar.xz
-/util-linux-2.33.2.tar.xz
-/util-linux-2.34-rc1.tar.xz
-/util-linux-2.34-rc2.tar.xz
-/util-linux-2.34.tar.xz
-/util-linux-2.35-rc1.tar.xz
-/util-linux-2.35-rc1-20-63f8.tar.xz
-/util-linux-2.35-rc2.tar.xz
-/util-linux-2.35.tar.xz
-/util-linux-2.35.1.tar.xz
-/util-linux-2.35.2.tar.xz
-/util-linux-2.36.tar.xz
-/util-linux-2.36.1.tar.xz
-/util-linux-2.36.2.tar.xz
-/util-linux-2.37-rc2.tar.xz
-/util-linux-2.37.tar.xz
-/util-linux-2.37.2.tar.xz
-/util-linux-2.38-rc1.tar.xz
-/util-linux-2.38-rc3.tar.xz
-/util-linux-2.38.tar.xz
-/util-linux-2.38.1.tar.xz
-/util-linux-2.39-rc1.tar.xz
-/util-linux-2.39-rc2.tar.xz
-/util-linux-2.39-rc3.tar.xz

2.27-blkid-zfs-raid.patch

@@ -0,0 +1,13 @@
+diff -up util-linux-2.27.1/libblkid/src/probe.c.kzak util-linux-2.27.1/libblkid/src/probe.c
+diff -up util-linux-2.27.1/libblkid/src/superblocks/zfs.c.kzak util-linux-2.27.1/libblkid/src/superblocks/zfs.c
+--- util-linux-2.27.1/libblkid/src/superblocks/zfs.c.kzak	2015-11-02 10:07:34.567648465 +0100
++++ util-linux-2.27.1/libblkid/src/superblocks/zfs.c	2015-11-18 12:13:32.716188023 +0100
+@@ -258,7 +258,7 @@ static int probe_zfs(blkid_probe pr, con
+ const struct blkid_idinfo zfs_idinfo =
+ {
+ 	.name		= "zfs_member",
+-	.usage		= BLKID_USAGE_RAID,
++	.usage		= BLKID_USAGE_FILESYSTEM,
+ 	.probefunc	= probe_zfs,
+ 	.minsz		= 64 * 1024 * 1024,
+ 	.magics		= BLKID_NONE_MAGIC

2.28-libblkid-cdrom.patch

@@ -0,0 +1,34 @@
+From 55ad13c26fe5d0e606be5a83937f31b8cf576588 Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Thu, 28 Apr 2016 13:54:01 +0200
+Subject: [PATCH] libblkid: make I/O errors on CDROMs non-fatal
+
+It seems too tricky to get a real size of the data track on hybrid
+disks with audio+data. It seems overkill to analyze all header in
+libblkid and on some disks it's probably possible to get I/O error
+almost everywhere due to crazy copy protection etc.
+
+Signed-off-by: Karel Zak <kzak@redhat.com>
+---
+ libblkid/src/probe.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/libblkid/src/probe.c b/libblkid/src/probe.c
+index 63baed3..5d9f701 100644
+--- a/libblkid/src/probe.c
++++ b/libblkid/src/probe.c
+@@ -615,7 +615,10 @@ static struct blkid_bufinfo *read_buffer(blkid_probe pr, uint64_t real_off, uint
+ 	if (ret != (ssize_t) len) {
+ 		DBG(LOWPROBE, ul_debug("\tread failed: %m"));
+ 		free(bf);
+-		if (ret >= 0)
++
++		/* I/O errors on CDROMs are non-fatal to work with hybrid
++		 * audio+data disks */
++		if (ret >= 0 || blkid_probe_is_cdrom(pr))
+ 			errno = 0;
+ 		return NULL;
+ 	}
+-- 
+2.4.11
+

2.28-login-lastlog-create.patch

@@ -0,0 +1,12 @@
+diff -up util-linux-2.28/login-utils/login.c.kzak util-linux-2.28/login-utils/login.c
+--- util-linux-2.28/login-utils/login.c.kzak	2016-03-08 14:28:16.724156218 +0100
++++ util-linux-2.28/login-utils/login.c	2016-04-26 12:45:29.235326017 +0200
+@@ -510,7 +510,7 @@ static void log_lastlog(struct login_con
+ 	sa.sa_handler = SIG_IGN;
+ 	sigaction(SIGXFSZ, &sa, &oldsa_xfsz);
+ 
+-	fd = open(_PATH_LASTLOG, O_RDWR, 0);
++	fd = open(_PATH_LASTLOG, O_RDWR | O_CREAT, 0);
+ 	if (fd < 0)
+ 		goto done;
+ 

adjtime

@@ -1,2 +0,0 @@
-0.0 0 0.0
-0

libblkid-minix.patch

@@ -0,0 +1,13 @@
+diff -up util-linux-2.27.1/libblkid/src/superblocks/minix.c.kzak util-linux-2.27.1/libblkid/src/superblocks/minix.c
+--- util-linux-2.27.1/libblkid/src/superblocks/minix.c.kzak	2016-01-18 15:02:05.493738910 +0100
++++ util-linux-2.27.1/libblkid/src/superblocks/minix.c	2016-01-18 15:04:20.020773281 +0100
+@@ -90,7 +90,8 @@ static int probe_minix(blkid_probe pr, c
+ 		struct minix_super_block *sb = (struct minix_super_block *) data;
+ 		int zones, ninodes, imaps, zmaps, firstz;
+ 
+-		if (sb->s_imap_blocks == 0 || sb->s_zmap_blocks == 0)
++		if (sb->s_imap_blocks == 0 || sb->s_zmap_blocks == 0 ||
++		    sb->s_log_zone_size != 0)
+ 			return 1;
+ 
+ 		zones = version == 2 ? minix_swab32(swabme, sb->s_zones) :

login-default-motd-file.patch

@@ -1,13 +0,0 @@
-diff --git a/include/pathnames.h b/include/pathnames.h
-index 3845d4c33..fac3a0783 100644
---- a/include/pathnames.h
-+++ b/include/pathnames.h
-@@ -41,7 +41,7 @@
- #ifndef _PATH_MAILDIR
- # define _PATH_MAILDIR		"/var/spool/mail"
- #endif
--#define	_PATH_MOTDFILE		"/usr/share/misc/motd:/run/motd:/etc/motd"
-+#define	_PATH_MOTDFILE		"/usr/share/misc/motd:/run/motd:/run/motd.d:/etc/motd:/etc/motd.d"
- #ifndef _PATH_NOLOGIN
- # define _PATH_NOLOGIN		"/etc/nologin"
- #endif

login-lastlog-create.patch

@@ -1,12 +0,0 @@
-diff -up util-linux-2.36/login-utils/login.c.kzak util-linux-2.36/login-utils/login.c
---- util-linux-2.36/login-utils/login.c.kzak	2020-07-23 14:13:26.777030764 +0200
-+++ util-linux-2.36/login-utils/login.c	2020-07-23 14:11:22.793686983 +0200
-@@ -585,7 +585,7 @@ static void log_lastlog(struct login_con
- 	sa.sa_handler = SIG_IGN;
- 	sigaction(SIGXFSZ, &sa, &oldsa_xfsz);
- 
--	fd = open(_PATH_LASTLOG, O_RDWR, 0);
-+	fd = open(_PATH_LASTLOG, O_RDWR | O_CREAT, 0);
- 	if (fd < 0)
- 		goto done;
- 	offset = cxt->pwd->pw_uid * sizeof(ll);

sources

@@ -1 +1 @@
-SHA512 (util-linux-2.39-rc3.tar.xz) = 8a93d32a5ceb38d50a4b2c8bfa48bcab7ec9b758c89b5a1a4f7fd74558dce37385bd7ea203345148d4389de4ea60ec42058f9d7889a8075d3e616773d085427e
+46a232a37bce45371a86d19300edc47a  util-linux-2.28.2.tar.xz

su-properly-clear-child-PID.patch

@@ -0,0 +1,56 @@
+From dffab154d29a288aa171ff50263ecc8f2e14a891 Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Wed, 1 Feb 2017 11:58:09 +0100
+Subject: [PATCH] su: properly clear child PID
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported-by: Tobias Stöckmann <tobias@stoeckmann.org>
+Signed-off-by: Karel Zak <kzak@redhat.com>
+---
+ login-utils/su-common.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/login-utils/su-common.c b/login-utils/su-common.c
+index 5aefd3f..696adc8 100644
+--- a/login-utils/su-common.c
++++ b/login-utils/su-common.c
+@@ -368,6 +368,9 @@ create_watching_parent (void)
+             }
+           else
+             status = WEXITSTATUS (status);
++
++	  /* child is gone, don't use the PID anymore */
++	  child = (pid_t) -1;
+         }
+       else if (caught_signal)
+         status = caught_signal + 128;
+@@ -377,7 +380,7 @@ create_watching_parent (void)
+   else
+     status = 1;
+ 
+-  if (caught_signal)
++  if (caught_signal && child != (pid_t)-1)
+     {
+       fprintf (stderr, _("\nSession terminated, killing shell..."));
+       kill (child, SIGTERM);
+@@ -387,9 +390,12 @@ create_watching_parent (void)
+ 
+   if (caught_signal)
+     {
+-      sleep (2);
+-      kill (child, SIGKILL);
+-      fprintf (stderr, _(" ...killed.\n"));
++      if (child != (pid_t)-1)
++	{
++	  sleep (2);
++	  kill (child, SIGKILL);
++	  fprintf (stderr, _(" ...killed.\n"));
++	}
+ 
+       /* Let's terminate itself with the received signal.
+        *
+-- 
+2.9.3
+

tests/tests.yml

@@ -1,13 +0,0 @@
-# Test which run in classic and docker environemnt
-- hosts: localhost
-  tags:
-  - classic
-  - container
-  - atomic
-  roles:
-  - role: standard-test-beakerlib
-    tests:
-    - various
-    required_packages:
-    - util-linux
-    - util-linux-user

tests/various/Makefile

@@ -1,64 +0,0 @@
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Makefile of /CoreOS/util-linux/various
-#   Description: This test groups small sanity and regression tests for util-linux
-#   Author: Miroslav Vadkerti <mvadkert@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2013 Red Hat, Inc. All rights reserved.
-#
-#   This copyrighted material is made available to anyone wishing
-#   to use, modify, copy, or redistribute it subject to the terms
-#   and conditions of the GNU General Public License version 2.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE. See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public
-#   License along with this program; if not, write to the Free
-#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#   Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-export TEST=/CoreOS/util-linux/Sanity/various
-export TESTVERSION=1.0
-
-BUILT_FILES=
-
-FILES=$(METADATA) runtest.sh Makefile PURPOSE
-
-.PHONY: all install download clean
-
-run: $(FILES) build
-	./runtest.sh
-
-build: $(BUILT_FILES)
-	test -x runtest.sh || chmod a+x runtest.sh
-
-clean:
-	rm -f *~ $(BUILT_FILES)
-
-
-include /usr/share/rhts/lib/rhts-make.include
-
-$(METADATA): Makefile
-	@echo "Owner:           Miroslav Vadkerti <mvadkert@redhat.com>" > $(METADATA)
-	@echo "Name:            $(TEST)" >> $(METADATA)
-	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
-	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
-	@echo "Description:     This test groups small sanity and regression tests for util-linux" >> $(METADATA)
-	@echo "Type:            Sanity" >> $(METADATA)
-	@echo "TestTime:        10m" >> $(METADATA)
-	@echo "RunFor:          util-linux" >> $(METADATA)
-	@echo "Requires:        util-linux util-linux-user" >> $(METADATA)
-	@echo "Priority:        Normal" >> $(METADATA)
-	@echo "License:         GPLv2" >> $(METADATA)
-	@echo "Confidential:    no" >> $(METADATA)
-	@echo "Destructive:     no" >> $(METADATA)
-	@echo "Releases:        -RHEL3 -RHEL4 -RHEL5Server -RHEL5Client -RHEL6" >> $(METADATA)
-
-	rhts-lint $(METADATA)

tests/various/PURPOSE

@@ -1,3 +0,0 @@
-PURPOSE of /CoreOS/util-linux/various
-Description: This test groups small sanity and regression tests for util-linux
-Author: Miroslav Vadkerti <mvadkert@redhat.com>

tests/various/runtest.sh

@@ -1,52 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   runtest.sh of /CoreOS/util-linux/various
-#   Description: This test groups small sanity and regression tests for util-linux
-#   Author: Miroslav Vadkerti <mvadkert@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2013 Red Hat, Inc. All rights reserved.
-#
-#   This copyrighted material is made available to anyone wishing
-#   to use, modify, copy, or redistribute it subject to the terms
-#   and conditions of the GNU General Public License version 2.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE. See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public
-#   License along with this program; if not, write to the Free
-#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#   Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-# Include Beaker environment
-#. /usr/bin/rhts-environment.sh || exit 1
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-PACKAGE="util-linux"
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
-    rlPhaseEnd
-
-    rlPhaseStartTest "return code of chfn should be always 1 in case failure"
-        rlRun "chfn -f a:b" 1
-        rlRun "chfn -o a:b" 1
-        rlRun "chfn -p a:b" 1
-        rlRun "chfn -h a:b" 1
-        rlRun "chfn -x a:b" 1
-        rlRun "chfn -f a -o b -p c -h d unknown-user" 1
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd

util-linux-60-raw.rules

@@ -0,0 +1,8 @@
+#
+# Enter raw device bindings here.
+#
+# An example would be:
+#   ACTION=="add", KERNEL=="sda", RUN+="/usr/bin/raw /dev/raw/raw1 %N"
+# to bind /dev/raw/raw1 to /dev/sda, or
+#   ACTION=="add", ENV{MAJOR}=="8", ENV{MINOR}=="1", RUN+="/usr/bin/raw /dev/raw/raw2 %M %m"
+# to bind /dev/raw/raw2 to the device with major 8, minor 1.

util-linux-login.pamd

@@ -7,6 +7,7 @@ password   include      system-auth
 # pam_selinux.so close should be the first session rule
 session    required     pam_selinux.so close
 session    required     pam_loginuid.so
+session    optional     pam_console.so
 # pam_selinux.so open should only be followed by sessions to be executed in the user context
 session    required     pam_selinux.so open
 session    required     pam_namespace.so

uuidd-tmpfiles.conf

@@ -1 +0,0 @@
-d /run/uuidd 2775 uuidd uuidd