diff options
author | Tudor Florea <tudor.florea@enea.com> | 2015-10-09 22:59:03 +0200 |
---|---|---|
committer | Tudor Florea <tudor.florea@enea.com> | 2015-10-09 22:59:03 +0200 |
commit | 972dcfcdbfe75dcfeb777150c136576cf1a71e99 (patch) | |
tree | 97a61cd7e293d7ae9d56ef7ed0f81253365bb026 /meta/recipes-core/dbus/dbus/CVE-2015-0245-prevent-forged-ActivationFailure.patch | |
download | poky-972dcfcdbfe75dcfeb777150c136576cf1a71e99.tar.gz |
initial commit for Enea Linux 5.0 arm
Signed-off-by: Tudor Florea <tudor.florea@enea.com>
Diffstat (limited to 'meta/recipes-core/dbus/dbus/CVE-2015-0245-prevent-forged-ActivationFailure.patch')
-rw-r--r-- | meta/recipes-core/dbus/dbus/CVE-2015-0245-prevent-forged-ActivationFailure.patch | 48 |
1 files changed, 48 insertions, 0 deletions
diff --git a/meta/recipes-core/dbus/dbus/CVE-2015-0245-prevent-forged-ActivationFailure.patch b/meta/recipes-core/dbus/dbus/CVE-2015-0245-prevent-forged-ActivationFailure.patch new file mode 100644 index 0000000000..59363b3e76 --- /dev/null +++ b/meta/recipes-core/dbus/dbus/CVE-2015-0245-prevent-forged-ActivationFailure.patch | |||
@@ -0,0 +1,48 @@ | |||
1 | CVE-2015-0245: prevent forged ActivationFailure from non-root processes | ||
2 | |||
3 | Upstream has fixed this in code but suggests using this as a easily | ||
4 | backportable fix: https://bugs.freedesktop.org/show_bug.cgi?id=88811 | ||
5 | |||
6 | Upstream-Status: Inappropriate | ||
7 | Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> | ||
8 | |||
9 | |||
10 | |||
11 | From 91eb2ea3362630190e08c1c777c47bae065ac828 Mon Sep 17 00:00:00 2001 | ||
12 | From: Simon McVittie <simon.mcvittie@collabora.co.uk> | ||
13 | Date: Mon, 26 Jan 2015 20:09:56 +0000 | ||
14 | Subject: [PATCH 1/3] CVE-2015-0245: prevent forged ActivationFailure from | ||
15 | non-root processes | ||
16 | |||
17 | Without either this rule or better checking in dbus-daemon, non-systemd | ||
18 | processes can make dbus-daemon think systemd failed to activate a system | ||
19 | service, resulting in an error reply back to the requester. | ||
20 | |||
21 | This is redundant with the fix in the C code (which I consider to be | ||
22 | the real solution), but is likely to be easier to backport. | ||
23 | --- | ||
24 | bus/system.conf.in | 8 ++++++++ | ||
25 | 1 file changed, 8 insertions(+) | ||
26 | |||
27 | diff --git a/bus/system.conf.in b/bus/system.conf.in | ||
28 | index 92f4cc4..851b9e6 100644 | ||
29 | --- a/bus/system.conf.in | ||
30 | +++ b/bus/system.conf.in | ||
31 | @@ -68,6 +68,14 @@ | ||
32 | <deny send_destination="org.freedesktop.DBus" | ||
33 | send_interface="org.freedesktop.DBus" | ||
34 | send_member="UpdateActivationEnvironment"/> | ||
35 | + <deny send_destination="org.freedesktop.DBus" | ||
36 | + send_interface="org.freedesktop.systemd1.Activator"/> | ||
37 | + </policy> | ||
38 | + | ||
39 | + <!-- Only systemd, which runs as root, may report activation failures. --> | ||
40 | + <policy user="root"> | ||
41 | + <allow send_destination="org.freedesktop.DBus" | ||
42 | + send_interface="org.freedesktop.systemd1.Activator"/> | ||
43 | </policy> | ||
44 | |||
45 | <!-- Config files are placed here that among other things, punch | ||
46 | -- | ||
47 | 2.1.4 | ||
48 | |||