PR#39: nonsystemd/polkit: CVE-2021-4034 - abslibre

abslibre

#39 nonsystemd/polkit: CVE-2021-4034

Merged 2 years ago by billauger. Opened 2 years ago by commodorecrunch.

Unknown source polkit-cve into pull-requests

CVE-2021-4034

Tyler Swagar • 2 years ago

72e7a61

nonsystemd/polkit/PKGBUILD

file modified

+29 -26

		`@@ -2,63 +2,66 @@`
		`# Maintainer (Arch): Jan de Groot <jgc@archlinux.org>`

		`pkgname=polkit`
		`- pkgver=0.118`
		`- pkgrel=1`
		`+ pkgver=0.120`
		`+ pkgrel=4`
		`pkgrel+=.nonsystemd1`
		`pkgdesc="Application development toolkit for controlling system-wide privileges"`
		`arch=(x86_64 i686 armv7h)`
		`license=(LGPL)`
		`url="https://www.freedesktop.org/wiki/Software/polkit/"`
		`depends=(glib2 pam expat elogind js78)`
		`- makedepends=(intltool gtk-doc gobject-introspection git autoconf-archive)`
		`+ makedepends=(meson gtk-doc gobject-introspection git)`
		`backup=(etc/pam.d/polkit-1)`
		`provides=(polkit-elogind)`
		`replaces=(polkit-elogind polkit-consolekit)`
		`- _commit=ff4c2144f0fb1325275887d9e254117fcd8a1b52 # git tag 0.118`
		`+ _commit=92b910ce2273daf6a76038f6bd764fa6958d4e8e # tags/0.120`
		`source=("git+https://gitlab.freedesktop.org/polkit/polkit.git#commit=$_commit"`
		`'99-parabola.rules'`
		`- 'elogind-configure-fix.patch')`
		`+ 'elogind-configure-fix.patch'`
		`+ 'meson-0.61.diff')`
		`sha256sums=('SKIP'`
		`'d28d6ecaf7682860e2b3768bb266bd94313546b7cd0ef3c2eace7b1576c47adb'`
		`- 'd90b2a95aa3e9e1ebf9369c038c144e04900e095c5405bc4ba4901c31bf3f59b')`
		`+ 'd90b2a95aa3e9e1ebf9369c038c144e04900e095c5405bc4ba4901c31bf3f59b'`
		`+ '45d08bbb76e1e22ca8e698df04652b7aceaded34f9b76ce6b68152fb26b0de8d')`

		`pkgver() {`
		`- cd $pkgname`
		`+ cd polkit`
		`git describe --tags \| sed 's/-/+/g'`
		`}`

		`prepare() {`
		`- cd $pkgname`
		`+ cd polkit`
		`patch -Np 1 -i ${srcdir}/elogind-configure-fix.patch`
		`- NOCONFIGURE=1 ./autogen.sh`
		`- }`
		`-`
		`- build() {`
		`- cd $pkgname`

		`- ./configure --prefix=/usr --sysconfdir=/etc \`
		`- --localstatedir=/var --libexecdir=/usr/lib \`
		`- --enable-libsystemd-login=no --disable-static \`
		`- --enable-libelogind=yes --with-systemdsystemunitdir=no \`
		`- --enable-gtk-doc --with-os-type=redhat`
		`+ # CVE-2021-4034`
		`+ git cherry-pick -n a2bf5c9c83b6ae46cbd5c779d3055bff81ded683`

		`- sed -i -e 's/ -shared / -Wl,-O1,--as-needed\0/g' libtool`
		`+ # Fix build with Meson 0.61.0`
		`+ git apply -3 ../meson-0.61.diff`
		`+ }`

		`- make`
		`+ build() {`
		`+ arch-meson polkit build \`
		`+ --prefix=/usr \`
		`+ -D session_tracking=libelogind \`
		`+ -D systemdsystemunitdir=no \`
		`+ -D os_type=redhat \`
		`+ -D examples=true \`
		`+ -D tests=true \`
		`+ -D gtk_doc=true \`
		`+ -D man=true`
		`+ meson compile -C build`
		`}`

		`check() {`
		`- cd $pkgname`
		`- make -k check \|\| :`
		`+ meson test -C build --print-errorlogs -t 3`
		`}`

		`package() {`
		`- cd $pkgname`
		`- make DESTDIR="$pkgdir" install \`
		`- dbusconfdir=/usr/share/dbus-1/system.d \`
		`- rulesdir=/usr/share/polkit-1/rules.d`
		`+ meson install -C build --destdir "$pkgdir"`

		`install -d -o root -g 102 -m 750 "$pkgdir"/{etc,usr/share}/polkit-1/rules.d`
		`+ mv "$pkgdir"/{etc,usr/share}/polkit-1/rules.d/50-default.rules`

		`install -Dm644 /dev/stdin "$pkgdir/usr/lib/sysusers.d/$pkgname.conf" <<END`
		`u polkitd 102 "PolicyKit daemon"`

nonsystemd/polkit/meson-0.61.diff

file added

+24

		`@@ -0,0 +1,24 @@`
		`+ diff --git i/actions/meson.build w/actions/meson.build`
		`+ index 2abaaf3..1e3f370 100644`
		`+ --- i/actions/meson.build`
		`+ +++ w/actions/meson.build`
		`+ @@ -1,7 +1,6 @@`
		`+ policy = 'org.freedesktop.policykit.policy'`
		`+`
		`+ i18n.merge_file(`
		`+ - policy,`
		`+ input: policy + '.in',`
		`+ output: '@BASENAME@',`
		`+ po_dir: po_dir,`
		`+ diff --git i/src/examples/meson.build w/src/examples/meson.build`
		`+ index c6305ab..8c18de5 100644`
		`+ --- i/src/examples/meson.build`
		`+ +++ w/src/examples/meson.build`
		`+ @@ -1,7 +1,6 @@`
		`+ policy = 'org.freedesktop.policykit.examples.pkexec.policy'`
		`+`
		`+ i18n.merge_file(`
		`+ - policy,`
		`+ input: policy + '.in',`
		`+ output: '@BASENAME@',`
		`+ po_dir: po_dir,`