[arch-commits] Commit in systemd/repos (14 files)
Dave Reisner
dreisner at archlinux.org
Sat Apr 28 17:25:25 UTC 2012
Date: Saturday, April 28, 2012 @ 13:25:24
Author: dreisner
Revision: 157467
archrelease: copy trunk to staging-i686, staging-x86_64
Added:
systemd/repos/staging-i686/
systemd/repos/staging-i686/0001-check-for-proper-return-from-dirent_ensure_type.patch
(from rev 157466, systemd/trunk/0001-check-for-proper-return-from-dirent_ensure_type.patch)
systemd/repos/staging-i686/0001-logind-close-FIFO-before-ending-sessions-cleanly.patch
(from rev 157466, systemd/trunk/0001-logind-close-FIFO-before-ending-sessions-cleanly.patch)
systemd/repos/staging-i686/0001-util-never-follow-symlinks-in-rm_rf_children.patch
(from rev 157466, systemd/trunk/0001-util-never-follow-symlinks-in-rm_rf_children.patch)
systemd/repos/staging-i686/PKGBUILD
(from rev 157466, systemd/trunk/PKGBUILD)
systemd/repos/staging-i686/os-release
(from rev 157466, systemd/trunk/os-release)
systemd/repos/staging-i686/systemd.install
(from rev 157466, systemd/trunk/systemd.install)
systemd/repos/staging-x86_64/
systemd/repos/staging-x86_64/0001-check-for-proper-return-from-dirent_ensure_type.patch
(from rev 157466, systemd/trunk/0001-check-for-proper-return-from-dirent_ensure_type.patch)
systemd/repos/staging-x86_64/0001-logind-close-FIFO-before-ending-sessions-cleanly.patch
(from rev 157466, systemd/trunk/0001-logind-close-FIFO-before-ending-sessions-cleanly.patch)
systemd/repos/staging-x86_64/0001-util-never-follow-symlinks-in-rm_rf_children.patch
(from rev 157466, systemd/trunk/0001-util-never-follow-symlinks-in-rm_rf_children.patch)
systemd/repos/staging-x86_64/PKGBUILD
(from rev 157466, systemd/trunk/PKGBUILD)
systemd/repos/staging-x86_64/os-release
(from rev 157466, systemd/trunk/os-release)
systemd/repos/staging-x86_64/systemd.install
(from rev 157466, systemd/trunk/systemd.install)
----------------------------------------------------------------------------+
staging-i686/0001-check-for-proper-return-from-dirent_ensure_type.patch | 28 +
staging-i686/0001-logind-close-FIFO-before-ending-sessions-cleanly.patch | 156 ++++++++++
staging-i686/0001-util-never-follow-symlinks-in-rm_rf_children.patch | 32 ++
staging-i686/PKGBUILD | 128 ++++++++
staging-i686/os-release | 5
staging-i686/systemd.install | 54 +++
staging-x86_64/0001-check-for-proper-return-from-dirent_ensure_type.patch | 28 +
staging-x86_64/0001-logind-close-FIFO-before-ending-sessions-cleanly.patch | 156 ++++++++++
staging-x86_64/0001-util-never-follow-symlinks-in-rm_rf_children.patch | 32 ++
staging-x86_64/PKGBUILD | 128 ++++++++
staging-x86_64/os-release | 5
staging-x86_64/systemd.install | 54 +++
12 files changed, 806 insertions(+)
Copied: systemd/repos/staging-i686/0001-check-for-proper-return-from-dirent_ensure_type.patch (from rev 157466, systemd/trunk/0001-check-for-proper-return-from-dirent_ensure_type.patch)
===================================================================
--- staging-i686/0001-check-for-proper-return-from-dirent_ensure_type.patch (rev 0)
+++ staging-i686/0001-check-for-proper-return-from-dirent_ensure_type.patch 2012-04-28 17:25:24 UTC (rev 157467)
@@ -0,0 +1,28 @@
+From 7e5d190ccce8dc064d5756225e306e65fa534ae9 Mon Sep 17 00:00:00 2001
+From: Dave Reisner <dreisner at archlinux.org>
+Date: Mon, 2 Apr 2012 08:20:34 -0400
+Subject: [PATCH] check for proper return from dirent_ensure_type
+
+Fixes 'systemctl list-unit-files', which previously returned only:
+
+ Failed to issue method call: No such file or directory
+---
+ src/install.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/install.c b/src/install.c
+index 174d79b..9256116 100644
+--- a/src/install.c
++++ b/src/install.c
+@@ -1853,7 +1853,7 @@ int unit_file_get_list(
+
+ r = dirent_ensure_type(d, de);
+ if (r < 0) {
+- if (errno == ENOENT)
++ if (r == -ENOENT)
+ continue;
+
+ goto finish;
+--
+1.7.9.5
+
Copied: systemd/repos/staging-i686/0001-logind-close-FIFO-before-ending-sessions-cleanly.patch (from rev 157466, systemd/trunk/0001-logind-close-FIFO-before-ending-sessions-cleanly.patch)
===================================================================
--- staging-i686/0001-logind-close-FIFO-before-ending-sessions-cleanly.patch (rev 0)
+++ staging-i686/0001-logind-close-FIFO-before-ending-sessions-cleanly.patch 2012-04-28 17:25:24 UTC (rev 157467)
@@ -0,0 +1,156 @@
+From 75c8e3cffd7da8eede614cf61384957af2c82a29 Mon Sep 17 00:00:00 2001
+From: Lennart Poettering <lennart at poettering.net>
+Date: Thu, 22 Mar 2012 02:06:40 +0100
+Subject: [PATCH] logind: close FIFO before ending sessions cleanly
+
+For clean session endings ask logind explicitly to get rid of the FIFO
+before closing it so that the FIFO logic doesn't result in su/sudo to be
+terminated immediately.
+---
+ src/login/logind-dbus.c | 30 ++++++++++++++++++++
+ src/login/pam-module.c | 71 +++++++++++++++++++++++++++++++++++++++++++++--
+ 2 files changed, 98 insertions(+), 3 deletions(-)
+
+diff --git a/src/login/logind-dbus.c b/src/login/logind-dbus.c
+index d8f4d89..ea6b89f 100644
+--- a/src/login/logind-dbus.c
++++ b/src/login/logind-dbus.c
+@@ -80,6 +80,9 @@
+ " <arg name=\"seat\" type=\"s\" direction=\"out\"/>\n" \
+ " <arg name=\"vtnr\" type=\"u\" direction=\"out\"/>\n" \
+ " </method>\n" \
++ " <method name=\"ReleaseSession\">\n" \
++ " <arg name=\"id\" type=\"s\" direction=\"in\"/>\n" \
++ " </method>\n" \
+ " <method name=\"ActivateSession\">\n" \
+ " <arg name=\"id\" type=\"s\" direction=\"in\"/>\n" \
+ " </method>\n" \
+@@ -1075,6 +1078,33 @@ static DBusHandlerResult manager_message_handler(
+ if (r < 0)
+ return bus_send_error_reply(connection, message, &error, r);
+
++ } else if (dbus_message_is_method_call(message, "org.freedesktop.login1.Manager", "ReleaseSession")) {
++ const char *name;
++ Session *session;
++
++ if (!dbus_message_get_args(
++ message,
++ &error,
++ DBUS_TYPE_STRING, &name,
++ DBUS_TYPE_INVALID))
++ return bus_send_error_reply(connection, message, &error, -EINVAL);
++
++ session = hashmap_get(m->sessions, name);
++ if (!session)
++ return bus_send_error_reply(connection, message, &error, -ENOENT);
++
++ /* We use the FIFO to detect stray sessions where the
++ process invoking PAM dies abnormally. We need to make
++ sure that that process is not killed if at the clean
++ end of the session it closes the FIFO. Hence, with
++ this call explicitly turn off the FIFO logic, so that
++ the PAM code can finish clean up on its own */
++ session_remove_fifo(session);
++
++ reply = dbus_message_new_method_return(message);
++ if (!reply)
++ goto oom;
++
+ } else if (dbus_message_is_method_call(message, "org.freedesktop.login1.Manager", "ActivateSession")) {
+ const char *name;
+ Session *session;
+diff --git a/src/login/pam-module.c b/src/login/pam-module.c
+index 8544413..4106d2b 100644
+--- a/src/login/pam-module.c
++++ b/src/login/pam-module.c
+@@ -414,7 +414,6 @@ _public_ PAM_EXTERN int pam_sm_open_session(
+ "/org/freedesktop/login1",
+ "org.freedesktop.login1.Manager",
+ "CreateSession");
+-
+ if (!m) {
+ pam_syslog(handle, LOG_ERR, "Could not allocate create session message.");
+ r = PAM_BUF_ERR;
+@@ -620,11 +619,77 @@ _public_ PAM_EXTERN int pam_sm_close_session(
+ int argc, const char **argv) {
+
+ const void *p = NULL;
++ const char *id;
++ DBusConnection *bus = NULL;
++ DBusMessage *m = NULL, *reply = NULL;
++ DBusError error;
++ int r;
+
+- pam_get_data(handle, "systemd.session-fd", &p);
++ assert(handle);
++
++ dbus_error_init(&error);
++
++ id = pam_getenv(handle, "XDG_SESSION_ID");
++ if (id) {
++
++ /* Before we go and close the FIFO we need to tell
++ * logind that this is a clean session shutdown, so
++ * that it doesn't just go and slaughter us
++ * immediately after closing the fd */
++
++ bus = dbus_bus_get_private(DBUS_BUS_SYSTEM, &error);
++ if (!bus) {
++ pam_syslog(handle, LOG_ERR, "Failed to connect to system bus: %s", bus_error_message(&error));
++ r = PAM_SESSION_ERR;
++ goto finish;
++ }
++
++ m = dbus_message_new_method_call(
++ "org.freedesktop.login1",
++ "/org/freedesktop/login1",
++ "org.freedesktop.login1.Manager",
++ "ReleaseSession");
++ if (!m) {
++ pam_syslog(handle, LOG_ERR, "Could not allocate release session message.");
++ r = PAM_BUF_ERR;
++ goto finish;
++ }
++
++ if (!dbus_message_append_args(m,
++ DBUS_TYPE_STRING, &id,
++ DBUS_TYPE_INVALID)) {
++ pam_syslog(handle, LOG_ERR, "Could not attach parameters to message.");
++ r = PAM_BUF_ERR;
++ goto finish;
++ }
+
++ reply = dbus_connection_send_with_reply_and_block(bus, m, -1, &error);
++ if (!reply) {
++ pam_syslog(handle, LOG_ERR, "Failed to release session: %s", bus_error_message(&error));
++ r = PAM_SESSION_ERR;
++ goto finish;
++ }
++ }
++
++ r = PAM_SUCCESS;
++
++finish:
++ pam_get_data(handle, "systemd.session-fd", &p);
+ if (p)
+ close_nointr(PTR_TO_INT(p) - 1);
+
+- return PAM_SUCCESS;
++ dbus_error_free(&error);
++
++ if (bus) {
++ dbus_connection_close(bus);
++ dbus_connection_unref(bus);
++ }
++
++ if (m)
++ dbus_message_unref(m);
++
++ if (reply)
++ dbus_message_unref(reply);
++
++ return r;
+ }
+--
+1.7.9.5
+
Copied: systemd/repos/staging-i686/0001-util-never-follow-symlinks-in-rm_rf_children.patch (from rev 157466, systemd/trunk/0001-util-never-follow-symlinks-in-rm_rf_children.patch)
===================================================================
--- staging-i686/0001-util-never-follow-symlinks-in-rm_rf_children.patch (rev 0)
+++ staging-i686/0001-util-never-follow-symlinks-in-rm_rf_children.patch 2012-04-28 17:25:24 UTC (rev 157467)
@@ -0,0 +1,32 @@
+From 5ebff5337594d690b322078c512eb222d34aaa82 Mon Sep 17 00:00:00 2001
+From: Michal Schmidt <mschmidt at redhat.com>
+Date: Fri, 2 Mar 2012 10:39:10 +0100
+Subject: [PATCH] util: never follow symlinks in rm_rf_children()
+
+The function checks if the entry is a directory before recursing, but
+there is a window between the check and the open, during which the
+directory could be replaced with a symlink.
+
+CVE-2012-1174
+https://bugzilla.redhat.com/show_bug.cgi?id=803358
+---
+ src/util.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/util.c b/src/util.c
+index 20cbc2b..dfc1dc6 100644
+--- a/src/util.c
++++ b/src/util.c
+@@ -3593,7 +3593,8 @@ static int rm_rf_children(int fd, bool only_dirs, bool honour_sticky) {
+ if (is_dir) {
+ int subdir_fd;
+
+- if ((subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC)) < 0) {
++ subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW);
++ if (subdir_fd < 0) {
+ if (ret == 0 && errno != ENOENT)
+ ret = -errno;
+ continue;
+--
+1.7.9.4
+
Copied: systemd/repos/staging-i686/PKGBUILD (from rev 157466, systemd/trunk/PKGBUILD)
===================================================================
--- staging-i686/PKGBUILD (rev 0)
+++ staging-i686/PKGBUILD 2012-04-28 17:25:24 UTC (rev 157467)
@@ -0,0 +1,128 @@
+# $Id$
+# Maintainer: Dave Reisner <dreisner at archlinux.org>
+
+pkgbase=systemd
+pkgname=('systemd' 'libsystemd')
+pkgver=44
+pkgrel=6
+arch=('i686' 'x86_64')
+url="http://www.freedesktop.org/wiki/Software/systemd"
+license=('GPL2' 'LGPL2.1' 'MIT')
+makedepends=('acl' 'cryptsetup' 'dbus-core' 'docbook-xsl' 'gperf' 'intltool'
+ 'kmod' 'libcap' 'libxslt' 'linux-api-headers' 'pam' 'udev' 'xz')
+options=('!libtool')
+source=("http://www.freedesktop.org/software/$pkgname/$pkgname-$pkgver.tar.xz"
+ "os-release"
+ 0001-util-never-follow-symlinks-in-rm_rf_children.patch
+ 0001-logind-close-FIFO-before-ending-sessions-cleanly.patch
+ 0001-check-for-proper-return-from-dirent_ensure_type.patch)
+md5sums=('11f44ff74c87850064e4351518bcff17'
+ '752636def0db3c03f121f8b4f44a63cd'
+ 'b5863d6d4b47e2b5bda8eb57bde0d327'
+ 'd37833358ef6c23fad622ea4a0941d1f'
+ '11f930fd0a3966abc794bf9127a7dde0')
+
+build() {
+ cd "$pkgname-$pkgver"
+
+ # https://bugzilla.redhat.com/show_bug.cgi?id=803358 (upstream 5ebff53375)
+ patch -Np1 <"$srcdir/0001-util-never-follow-symlinks-in-rm_rf_children.patch"
+
+ # https://bugs.archlinux.org/task/28386 (upstream 75c8e3cffd)
+ patch -Np1 <"$srcdir/0001-logind-close-FIFO-before-ending-sessions-cleanly.patch"
+
+ # Fix broken 'systemctl list-unit-files' (upstream fb5ef067c49)
+ patch -Np1 <"$srcdir/0001-check-for-proper-return-from-dirent_ensure_type.patch"
+
+ ./configure --sysconfdir=/etc \
+ --libexecdir=/usr/lib \
+ --with-pamlibdir=/usr/lib/security \
+ --localstatedir=/var \
+ --with-distro=arch \
+ --enable-split-usr \
+ --disable-ima
+
+ make
+}
+
+package_systemd() {
+ pkgdesc="system and service manager"
+ depends=('acl' 'dbus-core' 'libsystemd' 'kbd' 'kmod' 'libcap' 'pam' 'util-linux' 'udev' 'xz')
+ optdepends=('cryptsetup: required for encrypted block devices'
+ 'dbus-python: systemd-analyze'
+ 'initscripts: legacy support for hostname and vconsole setup'
+ 'initscripts-systemd: native boot and initialization scripts'
+ 'python2-cairo: systemd-analyze'
+ 'systemd-arch-units: collection of native unit files for Arch daemon/init scripts'
+ 'systemd-sysvcompat: symlink package to provide sysvinit binaries')
+ backup=(etc/dbus-1/system.d/org.freedesktop.systemd1.conf
+ etc/dbus-1/system.d/org.freedesktop.hostname1.conf
+ etc/dbus-1/system.d/org.freedesktop.login1.conf
+ etc/dbus-1/system.d/org.freedesktop.locale1.conf
+ etc/dbus-1/system.d/org.freedesktop.timedate1.conf
+ etc/systemd/system.conf
+ etc/systemd/user.conf
+ etc/systemd/systemd-logind.conf
+ etc/systemd/systemd-journald.conf)
+ install="$pkgname.install"
+
+ cd "$pkgname-$pkgver"
+
+ make DESTDIR="$pkgdir" install
+
+ install -Dm644 "$srcdir/os-release" "$pkgdir/etc/os-release"
+
+ printf "d /run/console 755 root root\n" >"$pkgdir/usr/lib/tmpfiles.d/console.conf"
+ chmod 644 "$pkgdir/usr/lib/tmpfiles.d/console.conf"
+
+ # symlink to /bin/systemd for compat and sanity
+ install -dm755 "$pkgdir/bin" "$pkgdir/lib/systemd"
+ ln -s ../usr/lib/systemd/systemd "$pkgdir/bin/systemd"
+ ln -s ../../usr/lib/systemd/systemd "$pkgdir/lib/systemd/systemd"
+
+ # use python2 for systemd-analyze
+ sed -i '1s/python$/python2/' "$pkgdir/usr/bin/systemd-analyze"
+
+ # didn't build this...
+ rm -f "$pkgdir/usr/share/man/man1/systemadm.1"
+
+ # fix .so links in manpage stubs
+ find "$pkgdir/usr/share/man" -type f -name '*.[[:digit:]]' \
+ -exec sed -i '1s|^\.so \(.*\)\.\([[:digit:]]\+\)|.so man\2/\1.\2|' {} +
+
+ # rename man pages to avoid conflicts with sysvinit and initscripts
+ manpages=(man8/{telinit,halt,reboot,poweroff,runlevel,shutdown}.8
+ man5/{hostname,{vconsole,locale}.conf}.5)
+ cd "$pkgdir/usr/share/man"
+ for manpage in "${manpages[@]}"; do
+ IFS='/' read section page <<< "$manpage"
+ mv "$manpage" "$section/systemd.$page"
+ done
+
+ # move bash-completion and symlink for loginctl
+ install -Dm644 "$pkgdir/etc/bash_completion.d/systemd-bash-completion.sh" \
+ "$pkgdir/usr/share/bash-completion/completions/systemctl"
+ ln -s systemctl "$pkgdir/usr/share/bash-completion/completions/loginctl"
+ rm -rf "$pkgdir/etc/bash_completion.d"
+
+ # fix systemctl where
+ find "$pkgdir" -type f -name '*.service' -exec \
+ sed -i 's@\([=-]\)/bin/systemctl@\1/usr/bin/systemctl at g' {} +
+
+ ### split off libsystemd (libs, includes, pkgconfig, man3)
+ install -dm755 "$srcdir"/libsystemd/usr/{include,lib/pkgconfig}
+
+ cd "$srcdir"/libsystemd
+ mv "$pkgdir/usr/lib"/libsystemd-*.so* usr/lib
+ mv "$pkgdir/usr/include/systemd" usr/include
+ mv "$pkgdir/usr/lib/pkgconfig"/libsystemd-*.pc usr/lib/pkgconfig
+}
+
+package_libsystemd() {
+ pkgdesc="systemd client libraries"
+ depends=('libcap' 'xz')
+
+ mv "$srcdir/libsystemd"/* "$pkgdir"
+}
+
+# vim: ft=sh syn=sh et
Copied: systemd/repos/staging-i686/os-release (from rev 157466, systemd/trunk/os-release)
===================================================================
--- staging-i686/os-release (rev 0)
+++ staging-i686/os-release 2012-04-28 17:25:24 UTC (rev 157467)
@@ -0,0 +1,5 @@
+NAME="Arch Linux"
+ID=arch
+PRETTY_NAME="Arch Linux"
+ANSI_COLOR="1;36"
+
Copied: systemd/repos/staging-i686/systemd.install (from rev 157466, systemd/trunk/systemd.install)
===================================================================
--- staging-i686/systemd.install (rev 0)
+++ staging-i686/systemd.install 2012-04-28 17:25:24 UTC (rev 157467)
@@ -0,0 +1,54 @@
+#!/bin/sh
+
+checkgroups() {
+ if ! getent group lock >/dev/null; then
+ groupadd -g 54 lock
+ fi
+}
+
+sd_booted() {
+ [ -e sys/fs/cgroup/systemd ]
+}
+
+post_install() {
+ checkgroups
+
+ if [ ! -f etc/machine-id ]; then
+ systemd-machine-id-setup
+ fi
+
+ echo "systemd has been installed to /bin/systemd. Please ensure you append"
+ echo "init=/bin/systemd to your kernel command line in your bootloader."
+}
+
+post_upgrade() {
+ checkgroups
+
+ if [ ! -f etc/machine-id ]; then
+ systemd-machine-id-setup
+ fi
+
+ if sd_booted; then
+ systemctl daemon-reload
+ systemctl daemon-reexec
+ fi
+
+ newpkgver=${1%-*}
+ oldpkgver=${2%-*}
+
+ # catch v31 need for restarting systemd-logind.service
+ if [ "$newpkgver" -ge 31 ] && [ "$oldpkgver" -lt 31 ]; then
+ # but only if systemd is running
+ if sd_booted; then
+ systemctl try-restart systemd-logind.service
+ fi
+ fi
+}
+
+post_remove() {
+ if getent group lock >/dev/null; then
+ groupdel lock
+ fi
+}
+
+# vim:set ts=2 sw=2 et:
Copied: systemd/repos/staging-x86_64/0001-check-for-proper-return-from-dirent_ensure_type.patch (from rev 157466, systemd/trunk/0001-check-for-proper-return-from-dirent_ensure_type.patch)
===================================================================
--- staging-x86_64/0001-check-for-proper-return-from-dirent_ensure_type.patch (rev 0)
+++ staging-x86_64/0001-check-for-proper-return-from-dirent_ensure_type.patch 2012-04-28 17:25:24 UTC (rev 157467)
@@ -0,0 +1,28 @@
+From 7e5d190ccce8dc064d5756225e306e65fa534ae9 Mon Sep 17 00:00:00 2001
+From: Dave Reisner <dreisner at archlinux.org>
+Date: Mon, 2 Apr 2012 08:20:34 -0400
+Subject: [PATCH] check for proper return from dirent_ensure_type
+
+Fixes 'systemctl list-unit-files', which previously returned only:
+
+ Failed to issue method call: No such file or directory
+---
+ src/install.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/install.c b/src/install.c
+index 174d79b..9256116 100644
+--- a/src/install.c
++++ b/src/install.c
+@@ -1853,7 +1853,7 @@ int unit_file_get_list(
+
+ r = dirent_ensure_type(d, de);
+ if (r < 0) {
+- if (errno == ENOENT)
++ if (r == -ENOENT)
+ continue;
+
+ goto finish;
+--
+1.7.9.5
+
Copied: systemd/repos/staging-x86_64/0001-logind-close-FIFO-before-ending-sessions-cleanly.patch (from rev 157466, systemd/trunk/0001-logind-close-FIFO-before-ending-sessions-cleanly.patch)
===================================================================
--- staging-x86_64/0001-logind-close-FIFO-before-ending-sessions-cleanly.patch (rev 0)
+++ staging-x86_64/0001-logind-close-FIFO-before-ending-sessions-cleanly.patch 2012-04-28 17:25:24 UTC (rev 157467)
@@ -0,0 +1,156 @@
+From 75c8e3cffd7da8eede614cf61384957af2c82a29 Mon Sep 17 00:00:00 2001
+From: Lennart Poettering <lennart at poettering.net>
+Date: Thu, 22 Mar 2012 02:06:40 +0100
+Subject: [PATCH] logind: close FIFO before ending sessions cleanly
+
+For clean session endings ask logind explicitly to get rid of the FIFO
+before closing it so that the FIFO logic doesn't result in su/sudo to be
+terminated immediately.
+---
+ src/login/logind-dbus.c | 30 ++++++++++++++++++++
+ src/login/pam-module.c | 71 +++++++++++++++++++++++++++++++++++++++++++++--
+ 2 files changed, 98 insertions(+), 3 deletions(-)
+
+diff --git a/src/login/logind-dbus.c b/src/login/logind-dbus.c
+index d8f4d89..ea6b89f 100644
+--- a/src/login/logind-dbus.c
++++ b/src/login/logind-dbus.c
+@@ -80,6 +80,9 @@
+ " <arg name=\"seat\" type=\"s\" direction=\"out\"/>\n" \
+ " <arg name=\"vtnr\" type=\"u\" direction=\"out\"/>\n" \
+ " </method>\n" \
++ " <method name=\"ReleaseSession\">\n" \
++ " <arg name=\"id\" type=\"s\" direction=\"in\"/>\n" \
++ " </method>\n" \
+ " <method name=\"ActivateSession\">\n" \
+ " <arg name=\"id\" type=\"s\" direction=\"in\"/>\n" \
+ " </method>\n" \
+@@ -1075,6 +1078,33 @@ static DBusHandlerResult manager_message_handler(
+ if (r < 0)
+ return bus_send_error_reply(connection, message, &error, r);
+
++ } else if (dbus_message_is_method_call(message, "org.freedesktop.login1.Manager", "ReleaseSession")) {
++ const char *name;
++ Session *session;
++
++ if (!dbus_message_get_args(
++ message,
++ &error,
++ DBUS_TYPE_STRING, &name,
++ DBUS_TYPE_INVALID))
++ return bus_send_error_reply(connection, message, &error, -EINVAL);
++
++ session = hashmap_get(m->sessions, name);
++ if (!session)
++ return bus_send_error_reply(connection, message, &error, -ENOENT);
++
++ /* We use the FIFO to detect stray sessions where the
++ process invoking PAM dies abnormally. We need to make
++ sure that that process is not killed if at the clean
++ end of the session it closes the FIFO. Hence, with
++ this call explicitly turn off the FIFO logic, so that
++ the PAM code can finish clean up on its own */
++ session_remove_fifo(session);
++
++ reply = dbus_message_new_method_return(message);
++ if (!reply)
++ goto oom;
++
+ } else if (dbus_message_is_method_call(message, "org.freedesktop.login1.Manager", "ActivateSession")) {
+ const char *name;
+ Session *session;
+diff --git a/src/login/pam-module.c b/src/login/pam-module.c
+index 8544413..4106d2b 100644
+--- a/src/login/pam-module.c
++++ b/src/login/pam-module.c
+@@ -414,7 +414,6 @@ _public_ PAM_EXTERN int pam_sm_open_session(
+ "/org/freedesktop/login1",
+ "org.freedesktop.login1.Manager",
+ "CreateSession");
+-
+ if (!m) {
+ pam_syslog(handle, LOG_ERR, "Could not allocate create session message.");
+ r = PAM_BUF_ERR;
+@@ -620,11 +619,77 @@ _public_ PAM_EXTERN int pam_sm_close_session(
+ int argc, const char **argv) {
+
+ const void *p = NULL;
++ const char *id;
++ DBusConnection *bus = NULL;
++ DBusMessage *m = NULL, *reply = NULL;
++ DBusError error;
++ int r;
+
+- pam_get_data(handle, "systemd.session-fd", &p);
++ assert(handle);
++
++ dbus_error_init(&error);
++
++ id = pam_getenv(handle, "XDG_SESSION_ID");
++ if (id) {
++
++ /* Before we go and close the FIFO we need to tell
++ * logind that this is a clean session shutdown, so
++ * that it doesn't just go and slaughter us
++ * immediately after closing the fd */
++
++ bus = dbus_bus_get_private(DBUS_BUS_SYSTEM, &error);
++ if (!bus) {
++ pam_syslog(handle, LOG_ERR, "Failed to connect to system bus: %s", bus_error_message(&error));
++ r = PAM_SESSION_ERR;
++ goto finish;
++ }
++
++ m = dbus_message_new_method_call(
++ "org.freedesktop.login1",
++ "/org/freedesktop/login1",
++ "org.freedesktop.login1.Manager",
++ "ReleaseSession");
++ if (!m) {
++ pam_syslog(handle, LOG_ERR, "Could not allocate release session message.");
++ r = PAM_BUF_ERR;
++ goto finish;
++ }
++
++ if (!dbus_message_append_args(m,
++ DBUS_TYPE_STRING, &id,
++ DBUS_TYPE_INVALID)) {
++ pam_syslog(handle, LOG_ERR, "Could not attach parameters to message.");
++ r = PAM_BUF_ERR;
++ goto finish;
++ }
+
++ reply = dbus_connection_send_with_reply_and_block(bus, m, -1, &error);
++ if (!reply) {
++ pam_syslog(handle, LOG_ERR, "Failed to release session: %s", bus_error_message(&error));
++ r = PAM_SESSION_ERR;
++ goto finish;
++ }
++ }
++
++ r = PAM_SUCCESS;
++
++finish:
++ pam_get_data(handle, "systemd.session-fd", &p);
+ if (p)
+ close_nointr(PTR_TO_INT(p) - 1);
+
+- return PAM_SUCCESS;
++ dbus_error_free(&error);
++
++ if (bus) {
++ dbus_connection_close(bus);
++ dbus_connection_unref(bus);
++ }
++
++ if (m)
++ dbus_message_unref(m);
++
++ if (reply)
++ dbus_message_unref(reply);
++
++ return r;
+ }
+--
+1.7.9.5
+
Copied: systemd/repos/staging-x86_64/0001-util-never-follow-symlinks-in-rm_rf_children.patch (from rev 157466, systemd/trunk/0001-util-never-follow-symlinks-in-rm_rf_children.patch)
===================================================================
--- staging-x86_64/0001-util-never-follow-symlinks-in-rm_rf_children.patch (rev 0)
+++ staging-x86_64/0001-util-never-follow-symlinks-in-rm_rf_children.patch 2012-04-28 17:25:24 UTC (rev 157467)
@@ -0,0 +1,32 @@
+From 5ebff5337594d690b322078c512eb222d34aaa82 Mon Sep 17 00:00:00 2001
+From: Michal Schmidt <mschmidt at redhat.com>
+Date: Fri, 2 Mar 2012 10:39:10 +0100
+Subject: [PATCH] util: never follow symlinks in rm_rf_children()
+
+The function checks if the entry is a directory before recursing, but
+there is a window between the check and the open, during which the
+directory could be replaced with a symlink.
+
+CVE-2012-1174
+https://bugzilla.redhat.com/show_bug.cgi?id=803358
+---
+ src/util.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/util.c b/src/util.c
+index 20cbc2b..dfc1dc6 100644
+--- a/src/util.c
++++ b/src/util.c
+@@ -3593,7 +3593,8 @@ static int rm_rf_children(int fd, bool only_dirs, bool honour_sticky) {
+ if (is_dir) {
+ int subdir_fd;
+
+- if ((subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC)) < 0) {
++ subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW);
++ if (subdir_fd < 0) {
+ if (ret == 0 && errno != ENOENT)
+ ret = -errno;
+ continue;
+--
+1.7.9.4
+
Copied: systemd/repos/staging-x86_64/PKGBUILD (from rev 157466, systemd/trunk/PKGBUILD)
===================================================================
--- staging-x86_64/PKGBUILD (rev 0)
+++ staging-x86_64/PKGBUILD 2012-04-28 17:25:24 UTC (rev 157467)
@@ -0,0 +1,128 @@
+# $Id$
+# Maintainer: Dave Reisner <dreisner at archlinux.org>
+
+pkgbase=systemd
+pkgname=('systemd' 'libsystemd')
+pkgver=44
+pkgrel=6
+arch=('i686' 'x86_64')
+url="http://www.freedesktop.org/wiki/Software/systemd"
+license=('GPL2' 'LGPL2.1' 'MIT')
+makedepends=('acl' 'cryptsetup' 'dbus-core' 'docbook-xsl' 'gperf' 'intltool'
+ 'kmod' 'libcap' 'libxslt' 'linux-api-headers' 'pam' 'udev' 'xz')
+options=('!libtool')
+source=("http://www.freedesktop.org/software/$pkgname/$pkgname-$pkgver.tar.xz"
+ "os-release"
+ 0001-util-never-follow-symlinks-in-rm_rf_children.patch
+ 0001-logind-close-FIFO-before-ending-sessions-cleanly.patch
+ 0001-check-for-proper-return-from-dirent_ensure_type.patch)
+md5sums=('11f44ff74c87850064e4351518bcff17'
+ '752636def0db3c03f121f8b4f44a63cd'
+ 'b5863d6d4b47e2b5bda8eb57bde0d327'
+ 'd37833358ef6c23fad622ea4a0941d1f'
+ '11f930fd0a3966abc794bf9127a7dde0')
+
+build() {
+ cd "$pkgname-$pkgver"
+
+ # https://bugzilla.redhat.com/show_bug.cgi?id=803358 (upstream 5ebff53375)
+ patch -Np1 <"$srcdir/0001-util-never-follow-symlinks-in-rm_rf_children.patch"
+
+ # https://bugs.archlinux.org/task/28386 (upstream 75c8e3cffd)
+ patch -Np1 <"$srcdir/0001-logind-close-FIFO-before-ending-sessions-cleanly.patch"
+
+ # Fix broken 'systemctl list-unit-files' (upstream fb5ef067c49)
+ patch -Np1 <"$srcdir/0001-check-for-proper-return-from-dirent_ensure_type.patch"
+
+ ./configure --sysconfdir=/etc \
+ --libexecdir=/usr/lib \
+ --with-pamlibdir=/usr/lib/security \
+ --localstatedir=/var \
+ --with-distro=arch \
+ --enable-split-usr \
+ --disable-ima
+
+ make
+}
+
+package_systemd() {
+ pkgdesc="system and service manager"
+ depends=('acl' 'dbus-core' 'libsystemd' 'kbd' 'kmod' 'libcap' 'pam' 'util-linux' 'udev' 'xz')
+ optdepends=('cryptsetup: required for encrypted block devices'
+ 'dbus-python: systemd-analyze'
+ 'initscripts: legacy support for hostname and vconsole setup'
+ 'initscripts-systemd: native boot and initialization scripts'
+ 'python2-cairo: systemd-analyze'
+ 'systemd-arch-units: collection of native unit files for Arch daemon/init scripts'
+ 'systemd-sysvcompat: symlink package to provide sysvinit binaries')
+ backup=(etc/dbus-1/system.d/org.freedesktop.systemd1.conf
+ etc/dbus-1/system.d/org.freedesktop.hostname1.conf
+ etc/dbus-1/system.d/org.freedesktop.login1.conf
+ etc/dbus-1/system.d/org.freedesktop.locale1.conf
+ etc/dbus-1/system.d/org.freedesktop.timedate1.conf
+ etc/systemd/system.conf
+ etc/systemd/user.conf
+ etc/systemd/systemd-logind.conf
+ etc/systemd/systemd-journald.conf)
+ install="$pkgname.install"
+
+ cd "$pkgname-$pkgver"
+
+ make DESTDIR="$pkgdir" install
+
+ install -Dm644 "$srcdir/os-release" "$pkgdir/etc/os-release"
+
+ printf "d /run/console 755 root root\n" >"$pkgdir/usr/lib/tmpfiles.d/console.conf"
+ chmod 644 "$pkgdir/usr/lib/tmpfiles.d/console.conf"
+
+ # symlink to /bin/systemd for compat and sanity
+ install -dm755 "$pkgdir/bin" "$pkgdir/lib/systemd"
+ ln -s ../usr/lib/systemd/systemd "$pkgdir/bin/systemd"
+ ln -s ../../usr/lib/systemd/systemd "$pkgdir/lib/systemd/systemd"
+
+ # use python2 for systemd-analyze
+ sed -i '1s/python$/python2/' "$pkgdir/usr/bin/systemd-analyze"
+
+ # didn't build this...
+ rm -f "$pkgdir/usr/share/man/man1/systemadm.1"
+
+ # fix .so links in manpage stubs
+ find "$pkgdir/usr/share/man" -type f -name '*.[[:digit:]]' \
+ -exec sed -i '1s|^\.so \(.*\)\.\([[:digit:]]\+\)|.so man\2/\1.\2|' {} +
+
+ # rename man pages to avoid conflicts with sysvinit and initscripts
+ manpages=(man8/{telinit,halt,reboot,poweroff,runlevel,shutdown}.8
+ man5/{hostname,{vconsole,locale}.conf}.5)
+ cd "$pkgdir/usr/share/man"
+ for manpage in "${manpages[@]}"; do
+ IFS='/' read section page <<< "$manpage"
+ mv "$manpage" "$section/systemd.$page"
+ done
+
+ # move bash-completion and symlink for loginctl
+ install -Dm644 "$pkgdir/etc/bash_completion.d/systemd-bash-completion.sh" \
+ "$pkgdir/usr/share/bash-completion/completions/systemctl"
+ ln -s systemctl "$pkgdir/usr/share/bash-completion/completions/loginctl"
+ rm -rf "$pkgdir/etc/bash_completion.d"
+
+ # fix systemctl where
+ find "$pkgdir" -type f -name '*.service' -exec \
+ sed -i 's@\([=-]\)/bin/systemctl@\1/usr/bin/systemctl at g' {} +
+
+ ### split off libsystemd (libs, includes, pkgconfig, man3)
+ install -dm755 "$srcdir"/libsystemd/usr/{include,lib/pkgconfig}
+
+ cd "$srcdir"/libsystemd
+ mv "$pkgdir/usr/lib"/libsystemd-*.so* usr/lib
+ mv "$pkgdir/usr/include/systemd" usr/include
+ mv "$pkgdir/usr/lib/pkgconfig"/libsystemd-*.pc usr/lib/pkgconfig
+}
+
+package_libsystemd() {
+ pkgdesc="systemd client libraries"
+ depends=('libcap' 'xz')
+
+ mv "$srcdir/libsystemd"/* "$pkgdir"
+}
+
+# vim: ft=sh syn=sh et
Copied: systemd/repos/staging-x86_64/os-release (from rev 157466, systemd/trunk/os-release)
===================================================================
--- staging-x86_64/os-release (rev 0)
+++ staging-x86_64/os-release 2012-04-28 17:25:24 UTC (rev 157467)
@@ -0,0 +1,5 @@
+NAME="Arch Linux"
+ID=arch
+PRETTY_NAME="Arch Linux"
+ANSI_COLOR="1;36"
+
Copied: systemd/repos/staging-x86_64/systemd.install (from rev 157466, systemd/trunk/systemd.install)
===================================================================
--- staging-x86_64/systemd.install (rev 0)
+++ staging-x86_64/systemd.install 2012-04-28 17:25:24 UTC (rev 157467)
@@ -0,0 +1,54 @@
+#!/bin/sh
+
+checkgroups() {
+ if ! getent group lock >/dev/null; then
+ groupadd -g 54 lock
+ fi
+}
+
+sd_booted() {
+ [ -e sys/fs/cgroup/systemd ]
+}
+
+post_install() {
+ checkgroups
+
+ if [ ! -f etc/machine-id ]; then
+ systemd-machine-id-setup
+ fi
+
+ echo "systemd has been installed to /bin/systemd. Please ensure you append"
+ echo "init=/bin/systemd to your kernel command line in your bootloader."
+}
+
+post_upgrade() {
+ checkgroups
+
+ if [ ! -f etc/machine-id ]; then
+ systemd-machine-id-setup
+ fi
+
+ if sd_booted; then
+ systemctl daemon-reload
+ systemctl daemon-reexec
+ fi
+
+ newpkgver=${1%-*}
+ oldpkgver=${2%-*}
+
+ # catch v31 need for restarting systemd-logind.service
+ if [ "$newpkgver" -ge 31 ] && [ "$oldpkgver" -lt 31 ]; then
+ # but only if systemd is running
+ if sd_booted; then
+ systemctl try-restart systemd-logind.service
+ fi
+ fi
+}
+
+post_remove() {
+ if getent group lock >/dev/null; then
+ groupdel lock
+ fi
+}
+
+# vim:set ts=2 sw=2 et:
More information about the arch-commits
mailing list