Fix bug 315235, local privilege escalation vulnerability

(Portage version: 2.2_rc67/cvs/Linux x86_64)

2 files changed, 427 insertions, 0 deletions

diff --git a/kde-base/kdm/files/kdm-4.3.5-CVE-2010-0436.patch b/kde-base/kdm/files/kdm-4.3.5-CVE-2010-0436.patch
new file mode 100644
index 000000000000..2ca173a10f74
--- /dev/null
+++ b/kde-base/kdm/files/kdm-4.3.5-CVE-2010-0436.patch
@@ -0,0 +1,225 @@
+Index: kdm/ConfigureChecks.cmake
+===================================================================
+--- kdm/ConfigureChecks.cmake	(revision 1114813)
++++ kdm/ConfigureChecks.cmake	(working copy)
+@@ -80,6 +80,38 @@
+ 	define_library(nsl gethostbyname)
+ endif (NOT have_gethostbyname)
+ 
++macro_push_required_vars()
++set(CMAKE_REQUIRED_LIBRARIES ${SOCKET_LIBRARIES})
++check_c_source_runs("
++#include <sys/socket.h>
++#include <sys/un.h>
++#include <sys/stat.h>
++#include <sys/types.h>
++#include <string.h>
++#include <unistd.h>
++#include <errno.h>
++int main()
++{
++    int fd, fd2;
++    struct sockaddr_un sa;
++
++    if ((fd = socket(PF_UNIX, SOCK_STREAM, 0)) < 0)
++        return 2;
++    sa.sun_family = AF_UNIX;
++    strcpy(sa.sun_path, \"testsock\");
++    unlink(sa.sun_path);
++    if (bind(fd, (struct sockaddr *)&sa, sizeof(sa)))
++        return 2;
++    chmod(sa.sun_path, 0);
++    setuid(getuid() + 1000);
++    if ((fd2 = socket(PF_UNIX, SOCK_STREAM, 0)) < 0)
++        return 2;
++    connect(fd2, (struct sockaddr *)&sa, sizeof(sa));
++    return errno != EACCES;
++}
++" HONORS_SOCKET_PERMS)
++macro_pop_required_vars()
++
+ # for genkdmconf; this is TODO
+ #if (EXISTS /etc/ttys)
+ #	set(BSD_INIT 1)
+Index: kdm/config-kdm.h.cmake
+===================================================================
+--- kdm/config-kdm.h.cmake	(revision 1114813)
++++ kdm/config-kdm.h.cmake	(working copy)
+@@ -129,6 +129,9 @@
+ /* Define to 1 if the ck-connector library is found */
+ #cmakedefine HAVE_CKCONNECTOR 1
+ 
++/* Define to 1 if OS honors permission bits on socket inodes */
++#cmakedefine HONORS_SOCKET_PERMS 1
++
+ /* $PATH defaults set by KDM */
+ #cmakedefine KDM_DEF_USER_PATH "${KDM_DEF_USER_PATH}"
+ #cmakedefine KDM_DEF_SYSTEM_PATH "${KDM_DEF_SYSTEM_PATH}"
+Index: kdm/backend/ctrl.c
+===================================================================
+--- kdm/backend/ctrl.c	(revision 1114813)
++++ kdm/backend/ctrl.c	(working copy)
+@@ -78,8 +78,26 @@
+ }
+ 
+ 
++#ifdef HONORS_SOCKET_PERMS
+ static CtrlRec ctrl = { 0, 0, -1, 0 };
++#else
++static CtrlRec ctrl = { 0, 0, 0, -1, 0 };
+ 
++static int mkTempDir( char *dir )
++{
++	int i, l = strlen( dir ) - 6;
++
++	for (i = 0; i < 100; i++) {
++		randomStr( dir + l );
++		if (!mkdir( dir, 0700 ))
++			return True;
++		if (errno != EEXIST)
++			break;
++	}
++	return False;
++}
++#endif
++
+ void
+ openCtrl( struct display *d )
+ {
+@@ -97,7 +115,7 @@
+ 	if (cr->fd < 0) {
+ 		if (mkdir( fifoDir, 0755 )) {
+ 			if (errno != EEXIST) {
+-				logError( "mkdir %\"s failed; no control FiFos will be available\n",
++				logError( "mkdir %\"s failed: %m; no control sockets will be available\n",
+ 				          fifoDir );
+ 				return;
+ 			}
+@@ -110,38 +128,74 @@
+ 			strApp( &cr->path, sockdir, "/socket", (char *)0 );
+ 			if (cr->path) {
+ 				if (strlen( cr->path ) >= sizeof(sa.sun_path))
+-					logError( "path %\"s too long; no control sockets will be available\n",
++					logError( "path %\"s too long; control socket will not be available\n",
+ 					          cr->path );
+-				else if (mkdir( sockdir, 0755 ) && errno != EEXIST)
+-					logError( "mkdir %\"s failed; no control sockets will be available\n",
++#ifdef HONORS_SOCKET_PERMS
++				else if (mkdir( sockdir, 0700 ) && errno != EEXIST)
++					logError( "mkdir %\"s failed: %m; control socket will not be available\n",
+ 					          sockdir );
++				else if (unlink( cr->path ) && errno != ENOENT)
++					logError( "unlink %\"s failed: %m; control socket will not be available\n",
++					          cr->path );
+ 				else {
+-					if (!d)
+-						chown( sockdir, -1, fifoGroup );
++#else
++				else if (unlink( sockdir ) && errno != ENOENT)
++					logError( "unlink %\"s failed: %m; control socket will not be available\n",
++					          sockdir );
++				else if (!strApp( &cr->realdir, sockdir, "-XXXXXX", (char *)0))
++					;
++				else if (!mkTempDir( cr->realdir )) {
++					logError( "mkdir %\"s failed: %m; control socket will not be available\n",
++					          cr->realdir );
++					free( cr->realdir );
++					cr->realdir = 0;
++				} else if (symlink( cr->realdir, sockdir )) {
++					logError( "symlink %\"s => %\"s failed: %m; control socket will not be available\n",
++					          sockdir, cr->realdir );
++					rmdir( cr->realdir );
++					free( cr->realdir );
++					cr->realdir = 0;
++				} else {
++					chown( sockdir, 0, d ? 0 : fifoGroup );
+ 					chmod( sockdir, 0750 );
++#endif
+ 					if ((cr->fd = socket( PF_UNIX, SOCK_STREAM, 0 )) < 0)
+-						logError( "Cannot create control socket\n" );
++						logError( "Cannot create control socket: %m\n" );
+ 					else {
+-						unlink( cr->path );
+ 						sa.sun_family = AF_UNIX;
+ 						strcpy( sa.sun_path, cr->path );
+ 						if (!bind( cr->fd, (struct sockaddr *)&sa, sizeof(sa) )) {
+ 							if (!listen( cr->fd, 5 )) {
++#ifdef HONORS_SOCKET_PERMS
++								chmod( cr->path, 0660 );
++								if (!d)
++									chown( cr->path, -1, fifoGroup );
++								chmod( sockdir, 0755 );
++#else
+ 								chmod( cr->path, 0666 );
++#endif
+ 								registerCloseOnFork( cr->fd );
+ 								registerInput( cr->fd );
+ 								free( sockdir );
+ 								return;
+ 							}
+ 							unlink( cr->path );
+-							logError( "Cannot listen on control socket %\"s\n",
++							logError( "Cannot listen on control socket %\"s: %m\n",
+ 							          cr->path );
+ 						} else
+-							logError( "Cannot bind control socket %\"s\n",
++							logError( "Cannot bind control socket %\"s: %m\n",
+ 							          cr->path );
+ 						close( cr->fd );
+ 						cr->fd = -1;
+ 					}
++#ifdef HONORS_SOCKET_PERMS
++					rmdir( sockdir );
++#else
++					unlink( sockdir );
++					rmdir( cr->realdir );
++					free( cr->realdir );
++					cr->realdir = 0;
++#endif
+ 				}
+ 				free( cr->path );
+ 				cr->path = 0;
+@@ -162,7 +216,14 @@
+ 		cr->fd = -1;
+ 		unlink( cr->path );
+ 		*strrchr( cr->path, '/' ) = 0;
++#ifdef HONORS_SOCKET_PERMS
+ 		rmdir( cr->path );
++#else
++		rmdir( cr->realdir );
++		free( cr->realdir );
++		cr->realdir = 0;
++		unlink( cr->path );
++#endif
+ 		free( cr->path );
+ 		cr->path = 0;
+ 		while (cr->css) {
+@@ -177,10 +238,11 @@
+ chownCtrl( CtrlRec *cr, int uid )
+ {
+ 	if (cr->path) {
+-		char *ptr = strrchr( cr->path, '/' );
+-		*ptr = 0;
++#ifdef HONORS_SOCKET_PERMS
+ 		chown( cr->path, uid, -1 );
+-		*ptr = '/';
++#else
++		chown( cr->realdir, uid, -1 );
++#endif
+ 	}
+ }
+ 
+Index: kdm/backend/dm.h
+===================================================================
+--- kdm/backend/dm.h	(revision 1114813)
++++ kdm/backend/dm.h	(working copy)
+@@ -232,6 +232,9 @@
+ 	struct cmdsock *css;  /* open connections */
+ 
+ 	char *path;           /* filename of the socket */
++#ifndef HONORS_SOCKET_PERMS
++	char *realdir;        /* real dirname of the socket */
++#endif
+ 	int fd;               /* fd of the socket */
+ 	int gid;              /* owner group of the socket */
+ } CtrlRec;
diff --git a/kde-base/kdm/files/kdm-4.4.2-CVE-2010-0436.patch b/kde-base/kdm/files/kdm-4.4.2-CVE-2010-0436.patch
new file mode 100644
index 000000000000..b6363bfac521
--- /dev/null
+++ b/kde-base/kdm/files/kdm-4.4.2-CVE-2010-0436.patch
@@ -0,0 +1,202 @@
+Index: kdm/ConfigureChecks.cmake
+===================================================================
+--- kdm/ConfigureChecks.cmake	(revision 1114416)
++++ kdm/ConfigureChecks.cmake	(revision 1114417)
+@@ -80,6 +80,38 @@
+ 	define_library(nsl gethostbyname)
+ endif (NOT have_gethostbyname)
+ 
++macro_push_required_vars()
++set(CMAKE_REQUIRED_LIBRARIES ${SOCKET_LIBRARIES})
++check_c_source_runs("
++#include <sys/socket.h>
++#include <sys/un.h>
++#include <sys/stat.h>
++#include <sys/types.h>
++#include <string.h>
++#include <unistd.h>
++#include <errno.h>
++int main()
++{
++    int fd, fd2;
++    struct sockaddr_un sa;
++
++    if ((fd = socket(PF_UNIX, SOCK_STREAM, 0)) < 0)
++        return 2;
++    sa.sun_family = AF_UNIX;
++    strcpy(sa.sun_path, \"testsock\");
++    unlink(sa.sun_path);
++    if (bind(fd, (struct sockaddr *)&sa, sizeof(sa)))
++        return 2;
++    chmod(sa.sun_path, 0);
++    setuid(getuid() + 1000);
++    if ((fd2 = socket(PF_UNIX, SOCK_STREAM, 0)) < 0)
++        return 2;
++    connect(fd2, (struct sockaddr *)&sa, sizeof(sa));
++    return errno != EACCES;
++}
++" HONORS_SOCKET_PERMS)
++macro_pop_required_vars()
++
+ # for genkdmconf; this is TODO
+ #if (EXISTS /etc/ttys)
+ #	set(BSD_INIT 1)
+Index: kdm/config-kdm.h.cmake
+===================================================================
+--- kdm/config-kdm.h.cmake	(revision 1114416)
++++ kdm/config-kdm.h.cmake	(revision 1114417)
+@@ -129,6 +129,9 @@
+ /* Define to 1 if the ck-connector library is found */
+ #cmakedefine HAVE_CKCONNECTOR 1
+ 
++/* Define to 1 if OS honors permission bits on socket inodes */
++#cmakedefine HONORS_SOCKET_PERMS 1
++
+ /* $PATH defaults set by KDM */
+ #cmakedefine KDM_DEF_USER_PATH "${KDM_DEF_USER_PATH}"
+ #cmakedefine KDM_DEF_SYSTEM_PATH "${KDM_DEF_SYSTEM_PATH}"
+Index: kdm/backend/ctrl.c
+===================================================================
+--- kdm/backend/ctrl.c	(revision 1114416)
++++ kdm/backend/ctrl.c	(revision 1114417)
+@@ -79,8 +79,26 @@
+ }
+ 
+ 
++#ifdef HONORS_SOCKET_PERMS
+ static CtrlRec ctrl = { 0, 0, -1, 0 };
++#else
++static CtrlRec ctrl = { 0, 0, 0, -1, 0 };
+ 
++static int mkTempDir( char *dir )
++{
++	int i, l = strlen( dir ) - 6;
++
++	for (i = 0; i < 100; i++) {
++		randomStr( dir + l );
++		if (!mkdir( dir, 0700 ))
++			return True;
++		if (errno != EEXIST)
++			break;
++	}
++	return False;
++}
++#endif
++
+ void
+ openCtrl( struct display *d )
+ {
+@@ -113,22 +131,50 @@
+ 				if (strlen( cr->path ) >= sizeof(sa.sun_path))
+ 					logError( "path %\"s too long; control socket will not be available\n",
+ 					          cr->path );
+-				else if (mkdir( sockdir, 0755 ) && errno != EEXIST)
++#ifdef HONORS_SOCKET_PERMS
++				else if (mkdir( sockdir, 0700 ) && errno != EEXIST)
+ 					logError( "mkdir %\"s failed: %m; control socket will not be available\n",
+ 					          sockdir );
++				else if (unlink( cr->path ) && errno != ENOENT)
++					logError( "unlink %\"s failed: %m; control socket will not be available\n",
++					          cr->path );
+ 				else {
+-					if (!d)
+-						chown( sockdir, -1, fifoGroup );
++#else
++				else if (unlink( sockdir ) && errno != ENOENT)
++					logError( "unlink %\"s failed: %m; control socket will not be available\n",
++					          sockdir );
++				else if (!strApp( &cr->realdir, sockdir, "-XXXXXX", (char *)0))
++					;
++				else if (!mkTempDir( cr->realdir )) {
++					logError( "mkdir %\"s failed: %m; control socket will not be available\n",
++					          cr->realdir );
++					free( cr->realdir );
++					cr->realdir = 0;
++				} else if (symlink( cr->realdir, sockdir )) {
++					logError( "symlink %\"s => %\"s failed: %m; control socket will not be available\n",
++					          sockdir, cr->realdir );
++					rmdir( cr->realdir );
++					free( cr->realdir );
++					cr->realdir = 0;
++				} else {
++					chown( sockdir, 0, d ? 0 : fifoGroup );
+ 					chmod( sockdir, 0750 );
++#endif
+ 					if ((cr->fd = socket( PF_UNIX, SOCK_STREAM, 0 )) < 0)
+ 						logError( "Cannot create control socket: %m\n" );
+ 					else {
+-						unlink( cr->path );
+ 						sa.sun_family = AF_UNIX;
+ 						strcpy( sa.sun_path, cr->path );
+ 						if (!bind( cr->fd, (struct sockaddr *)&sa, sizeof(sa) )) {
+ 							if (!listen( cr->fd, 5 )) {
++#ifdef HONORS_SOCKET_PERMS
++								chmod( cr->path, 0660 );
++								if (!d)
++									chown( cr->path, -1, fifoGroup );
++								chmod( sockdir, 0755 );
++#else
+ 								chmod( cr->path, 0666 );
++#endif
+ 								registerCloseOnFork( cr->fd );
+ 								registerInput( cr->fd );
+ 								free( sockdir );
+@@ -143,6 +189,14 @@
+ 						close( cr->fd );
+ 						cr->fd = -1;
+ 					}
++#ifdef HONORS_SOCKET_PERMS
++					rmdir( sockdir );
++#else
++					unlink( sockdir );
++					rmdir( cr->realdir );
++					free( cr->realdir );
++					cr->realdir = 0;
++#endif
+ 				}
+ 				free( cr->path );
+ 				cr->path = 0;
+@@ -163,7 +217,14 @@
+ 		cr->fd = -1;
+ 		unlink( cr->path );
+ 		*strrchr( cr->path, '/' ) = 0;
++#ifdef HONORS_SOCKET_PERMS
+ 		rmdir( cr->path );
++#else
++		rmdir( cr->realdir );
++		free( cr->realdir );
++		cr->realdir = 0;
++		unlink( cr->path );
++#endif
+ 		free( cr->path );
+ 		cr->path = 0;
+ 		while (cr->css) {
+@@ -178,10 +239,11 @@
+ chownCtrl( CtrlRec *cr, int uid )
+ {
+ 	if (cr->path) {
+-		char *ptr = strrchr( cr->path, '/' );
+-		*ptr = 0;
++#ifdef HONORS_SOCKET_PERMS
+ 		chown( cr->path, uid, -1 );
+-		*ptr = '/';
++#else
++		chown( cr->realdir, uid, -1 );
++#endif
+ 	}
+ }
+ 
+Index: kdm/backend/dm.h
+===================================================================
+--- kdm/backend/dm.h	(revision 1114416)
++++ kdm/backend/dm.h	(revision 1114417)
+@@ -232,6 +232,9 @@
+ 	struct cmdsock *css;  /* open connections */
+ 
+ 	char *path;           /* filename of the socket */
++#ifndef HONORS_SOCKET_PERMS
++	char *realdir;        /* real dirname of the socket */
++#endif
+ 	int fd;               /* fd of the socket */
+ 	int gid;              /* owner group of the socket */
+ } CtrlRec;