From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 282F9138359 for ; Sat, 15 Aug 2020 00:57:43 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 59C3DE08CE; Sat, 15 Aug 2020 00:57:42 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 1D560E08CE for ; Sat, 15 Aug 2020 00:57:42 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 06BE634F3B6 for ; Sat, 15 Aug 2020 00:57:41 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 874E12EE for ; Sat, 15 Aug 2020 00:57:39 +0000 (UTC) From: "Sam James" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sam James" Message-ID: <1597452957.52ec8c626ac6ebec40685ef69c09a41f135b0897.sam@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: app-crypt/trousers/files/, app-crypt/trousers/ X-VCS-Repository: repo/gentoo X-VCS-Files: app-crypt/trousers/files/trousers-0.3.14-tcsd-fixes.patch app-crypt/trousers/trousers-0.3.14-r3.ebuild X-VCS-Directories: app-crypt/trousers/files/ app-crypt/trousers/ X-VCS-Committer: sam X-VCS-Committer-Name: Sam James X-VCS-Revision: 52ec8c626ac6ebec40685ef69c09a41f135b0897 X-VCS-Branch: master Date: Sat, 15 Aug 2020 00:57:39 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: 5f0828e0-468b-4a30-9953-369172e36747 X-Archives-Hash: 3ac5f0e135bc6119f4824750a9273063 commit: 52ec8c626ac6ebec40685ef69c09a41f135b0897 Author: Salah Coronya gmail com> AuthorDate: Fri Aug 14 02:46:33 2020 +0000 Commit: Sam James gentoo org> CommitDate: Sat Aug 15 00:55:57 2020 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=52ec8c62 app-crypt/trousers: Add patch for CVE-2020-244{30,31,32} Bug: https://bugs.gentoo.org/737022 Package-Manager: Portage-2.3.103, Repoman-2.3.23 Signed-off-by: Salah Coronya gmail.com> Closes: https://github.com/gentoo/gentoo/pull/17118 Signed-off-by: Sam James gentoo.org> .../files/trousers-0.3.14-tcsd-fixes.patch | 58 ++++++++++++++++++ app-crypt/trousers/trousers-0.3.14-r3.ebuild | 69 ++++++++++++++++++++++ 2 files changed, 127 insertions(+) diff --git a/app-crypt/trousers/files/trousers-0.3.14-tcsd-fixes.patch b/app-crypt/trousers/files/trousers-0.3.14-tcsd-fixes.patch new file mode 100644 index 00000000000..10031e08829 --- /dev/null +++ b/app-crypt/trousers/files/trousers-0.3.14-tcsd-fixes.patch @@ -0,0 +1,58 @@ +Index: trousers-0.3.14/src/tcs/ps/tcsps.c +=================================================================== +--- trousers-0.3.14.orig/src/tcs/ps/tcsps.c ++++ trousers-0.3.14/src/tcs/ps/tcsps.c +@@ -72,7 +72,7 @@ get_file() + } + + /* open and lock the file */ +- system_ps_fd = open(tcsd_options.system_ps_file, O_CREAT|O_RDWR, 0600); ++ system_ps_fd = open(tcsd_options.system_ps_file, O_CREAT|O_RDWR|O_NOFOLLOW, 0600); + if (system_ps_fd < 0) { + LogError("system PS: open() of %s failed: %s", + tcsd_options.system_ps_file, strerror(errno)); +Index: trousers-0.3.14/src/tcsd/svrside.c +=================================================================== +--- trousers-0.3.14.orig/src/tcsd/svrside.c ++++ trousers-0.3.14/src/tcsd/svrside.c +@@ -473,6 +473,7 @@ main(int argc, char **argv) + } + return TCSERR(TSS_E_INTERNAL_ERROR); + } ++ setgid(pwd->pw_gid); + setuid(pwd->pw_uid); + #endif + #endif +Index: trousers-0.3.14/src/tcsd/tcsd_conf.c +=================================================================== +--- trousers-0.3.14.orig/src/tcsd/tcsd_conf.c ++++ trousers-0.3.14/src/tcsd/tcsd_conf.c +@@ -743,7 +743,7 @@ conf_file_init(struct tcsd_config *conf) + #ifndef SOLARIS + struct group *grp; + struct passwd *pw; +- mode_t mode = (S_IRUSR|S_IWUSR); ++ mode_t mode = (S_IRUSR|S_IWUSR|S_IRGRP); + #endif /* SOLARIS */ + TSS_RESULT result; + +@@ -798,15 +798,15 @@ conf_file_init(struct tcsd_config *conf) + } + + /* make sure user/group TSS owns the conf file */ +- if (pw->pw_uid != stat_buf.st_uid || grp->gr_gid != stat_buf.st_gid) { ++ if (stat_buf.st_uid != 0 || grp->gr_gid != stat_buf.st_gid) { + LogError("TCSD config file (%s) must be user/group %s/%s", tcsd_config_file, +- TSS_USER_NAME, TSS_GROUP_NAME); ++ "root", TSS_GROUP_NAME); + return TCSERR(TSS_E_INTERNAL_ERROR); + } + +- /* make sure only the tss user can manipulate the config file */ ++ /* make sure only the tss user can read (but not manipulate) the config file */ + if (((stat_buf.st_mode & 0777) ^ mode) != 0) { +- LogError("TCSD config file (%s) must be mode 0600", tcsd_config_file); ++ LogError("TCSD config file (%s) must be mode 0640", tcsd_config_file); + return TCSERR(TSS_E_INTERNAL_ERROR); + } + #endif /* SOLARIS */ diff --git a/app-crypt/trousers/trousers-0.3.14-r3.ebuild b/app-crypt/trousers/trousers-0.3.14-r3.ebuild new file mode 100644 index 00000000000..c9d9cece1f9 --- /dev/null +++ b/app-crypt/trousers/trousers-0.3.14-r3.ebuild @@ -0,0 +1,69 @@ +# Copyright 1999-2020 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 + +inherit autotools linux-info readme.gentoo-r1 systemd udev + +DESCRIPTION="An open-source TCG Software Stack (TSS) v1.1 implementation" +HOMEPAGE="http://trousers.sf.net" +SRC_URI="mirror://sourceforge/trousers/${PN}/${P}.tar.gz" + +LICENSE="CPL-1.0 GPL-2" +SLOT="0" +KEYWORDS="~amd64 ~arm ~arm64 ~m68k ~ppc ~ppc64 ~s390 ~x86" +IUSE="doc libressl selinux" # gtk + +# gtk support presently does NOT compile. +# gtk? ( >=x11-libs/gtk+-2 ) + +DEPEND="acct-group/tss + acct-user/tss + >=dev-libs/glib-2 + !libressl? ( >=dev-libs/openssl-0.9.7:0= ) + libressl? ( dev-libs/libressl:0= )" +RDEPEND="${DEPEND} + selinux? ( sec-policy/selinux-tcsd )" +BDEPEND="virtual/pkgconfig" + +PATCHES=( + "${FILESDIR}/${PN}-0.3.13-nouseradd.patch" + "${FILESDIR}/${P}-libressl.patch" + "${FILESDIR}/${P}-fno-common.patch" + "${FILESDIR}/${P}-Makefile.am-Mark-tddl.a-nodist.patch" + "${FILESDIR}/${P}-tcsd-fixes.patch" +) + +DOCS="AUTHORS ChangeLog NICETOHAVES README TODO" + +DOC_CONTENTS=" + If you have problems starting tcsd, please check permissions and + ownership on /dev/tpm* and ~tss/system.data +" +S="${WORKDIR}" + +CONFIG_CHECK="~TCG_TPM" + +src_prepare() { + default + eautoreconf +} + +src_configure() { + # econf --with-gui=$(usex gtk gtk openssl) + econf --with-gui=openssl +} + +src_install() { + default + find "${D}" -name '*.la' -delete || die + + keepdir /var/lib/tpm + use doc && dodoc doc/* + newinitd "${FILESDIR}"/tcsd.initd tcsd + newconfd "${FILESDIR}"/tcsd.confd tcsd + systemd_dounit "${FILESDIR}"/tcsd.service + udev_dorules "${FILESDIR}"/61-trousers.rules + fowners tss:tss /var/lib/tpm + readme.gentoo_create_doc +}