From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 0C31213832E for ; Fri, 19 Aug 2016 14:46:45 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 98194E0B08; Fri, 19 Aug 2016 14:46:42 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 32E82E0B08 for ; Fri, 19 Aug 2016 14:46:42 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id F1F1734068A for ; Fri, 19 Aug 2016 14:46:40 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 35B36244C for ; Fri, 19 Aug 2016 14:46:38 +0000 (UTC) From: "Jeroen Roovers" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Jeroen Roovers" Message-ID: <1471617996.6dfb6b69f2527547cd08559811ff921e4da4ea0d.jer@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: x11-misc/slock/files/, x11-misc/slock/ X-VCS-Repository: repo/gentoo X-VCS-Files: x11-misc/slock/files/slock-1.3-CVE-2016-6866.patch x11-misc/slock/slock-1.3-r3.ebuild X-VCS-Directories: x11-misc/slock/ x11-misc/slock/files/ X-VCS-Committer: jer X-VCS-Committer-Name: Jeroen Roovers X-VCS-Revision: 6dfb6b69f2527547cd08559811ff921e4da4ea0d X-VCS-Branch: master Date: Fri, 19 Aug 2016 14:46:38 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 6b7585a2-1894-41a5-956f-5aead8250b84 X-Archives-Hash: e9d588332984e12a61d6e44eb035a21e commit: 6dfb6b69f2527547cd08559811ff921e4da4ea0d Author: Jeroen Roovers gentoo org> AuthorDate: Fri Aug 19 14:46:08 2016 +0000 Commit: Jeroen Roovers gentoo org> CommitDate: Fri Aug 19 14:46:36 2016 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6dfb6b69 x11-misc/slock: Apply patch for CVE-2016-6866 (bug #591664). Package-Manager: portage-2.3.0 x11-misc/slock/files/slock-1.3-CVE-2016-6866.patch | 11 ++++ x11-misc/slock/slock-1.3-r3.ebuild | 63 ++++++++++++++++++++++ 2 files changed, 74 insertions(+) diff --git a/x11-misc/slock/files/slock-1.3-CVE-2016-6866.patch b/x11-misc/slock/files/slock-1.3-CVE-2016-6866.patch new file mode 100644 index 0000000..a5043b9 --- /dev/null +++ b/x11-misc/slock/files/slock-1.3-CVE-2016-6866.patch @@ -0,0 +1,11 @@ +--- a/slock.c ++++ b/slock.c +@@ -310,6 +310,8 @@ + + #ifndef HAVE_BSD_AUTH + pws = getpw(); ++ if(strlen(pws) < 2) ++ die("This user has no password set.\n"); + #endif + + if (!(dpy = XOpenDisplay(0))) diff --git a/x11-misc/slock/slock-1.3-r3.ebuild b/x11-misc/slock/slock-1.3-r3.ebuild new file mode 100644 index 0000000..5a73ccd --- /dev/null +++ b/x11-misc/slock/slock-1.3-r3.ebuild @@ -0,0 +1,63 @@ +# Copyright 1999-2016 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ + +EAPI=6 +inherit fcaps savedconfig toolchain-funcs + +DESCRIPTION="simple X screen locker" +HOMEPAGE="http://tools.suckless.org/slock" +SRC_URI="http://dl.suckless.org/tools/${P}.tar.gz" + +LICENSE="MIT" +SLOT="0" +KEYWORDS="~amd64 ~hppa ~x86 ~x86-fbsd" + +RDEPEND=" + x11-libs/libX11 + x11-libs/libXext + x11-libs/libXrandr +" +DEPEND=" + ${RDEPEND} + x11-proto/randrproto + x11-proto/xproto +" + +src_prepare() { + eapply \ + "${FILESDIR}"/${PN}-1.3-warning.patch \ + "${FILESDIR}"/${PN}-1.3-CVE-2016-6866.patch + + eapply_user + + sed -i \ + -e '/^CFLAGS/{s: -Os::g; s:= :+= :g}' \ + -e '/^CC/d' \ + -e '/^LDFLAGS/{s:-s::g; s:= :+= :g}' \ + config.mk || die + sed -i \ + -e 's|@${CC}|$(CC)|g' \ + Makefile || die + if use elibc_FreeBSD; then + sed -i -e 's/-DHAVE_SHADOW_H//' config.mk || die + fi + restore_config config.h + tc-export CC +} + +src_compile() { emake slock; } + +src_install() { + dobin slock + save_config config.h +} + +pkg_postinst() { + # cap_dac_read_search used to be enough for shadow access + # but now slock wants to write to /proc/self/oom_score_adj + # and for that it needs: + fcaps cap_dac_override,cap_sys_resource /usr/bin/slock + + savedconfig_pkg_postinst +}