diff --git a/0156-socket-fail-the-socket-if-the-service-keeps-dying-on.patch b/0156-socket-fail-the-socket-if-the-service-keeps-dying-on.patch index e76a500..e0fbe51 100644 --- a/0156-socket-fail-the-socket-if-the-service-keeps-dying-on.patch +++ b/0156-socket-fail-the-socket-if-the-service-keeps-dying-on.patch @@ -1,4 +1,4 @@ -From 6af0f4d18a60f01d005410b541eb9a0655bc2a86 Mon Sep 17 00:00:00 2001 +From b57bafa73c2e035c216de8fb7933d751d456a93b Mon Sep 17 00:00:00 2001 From: Michal Schmidt Date: Mon, 5 Mar 2012 22:47:54 +0100 Subject: [PATCH] socket: fail the socket if the service keeps dying on start diff --git a/0157-socket-rename-broken-failure-result-to-failed-perman.patch b/0157-socket-rename-broken-failure-result-to-failed-perman.patch index c9f30fa..b0bb70b 100644 --- a/0157-socket-rename-broken-failure-result-to-failed-perman.patch +++ b/0157-socket-rename-broken-failure-result-to-failed-perman.patch @@ -1,4 +1,4 @@ -From dda7fed7d225da9242c767f2e548a4bf4d5fe022 Mon Sep 17 00:00:00 2001 +From 1289495c06a1c8456f6c5bd1df5738bc5e311d9a Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Tue, 6 Mar 2012 01:29:29 +0100 Subject: [PATCH] socket: rename 'broken' failure result to 'failed-permanent' diff --git a/0158-nspawn-be-less-cryptic-when-clone-fails.patch b/0158-nspawn-be-less-cryptic-when-clone-fails.patch index 5f2b9ef..39f1654 100644 --- a/0158-nspawn-be-less-cryptic-when-clone-fails.patch +++ b/0158-nspawn-be-less-cryptic-when-clone-fails.patch @@ -1,4 +1,4 @@ -From a92d0708fa5755e2c66943c7827c538824473596 Mon Sep 17 00:00:00 2001 +From 68fd1b7fbb33996fd2849acf25bb364a834b5d74 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Tue, 6 Mar 2012 02:06:29 +0100 Subject: [PATCH] nspawn: be less cryptic when clone() fails diff --git a/0159-bash-completion-get-rid-of-awk-sed-and-grep.patch b/0159-bash-completion-get-rid-of-awk-sed-and-grep.patch index 4290748..ece3286 100644 --- a/0159-bash-completion-get-rid-of-awk-sed-and-grep.patch +++ b/0159-bash-completion-get-rid-of-awk-sed-and-grep.patch @@ -1,4 +1,4 @@ -From 79453cbee691a52b48a8cb166a62de5a7dc999b9 Mon Sep 17 00:00:00 2001 +From 8d3ee2c91ab839fe5296ae4f348e38dcc5223a8e Mon Sep 17 00:00:00 2001 From: Harald Hoyer Date: Tue, 21 Feb 2012 15:48:24 +0100 Subject: [PATCH] bash-completion: get rid of awk, sed and grep diff --git a/0160-mount-properly-check-return-for-mount_add_.patch b/0160-mount-properly-check-return-for-mount_add_.patch index ec3093e..d81d3da 100644 --- a/0160-mount-properly-check-return-for-mount_add_.patch +++ b/0160-mount-properly-check-return-for-mount_add_.patch @@ -1,4 +1,4 @@ -From 70cb1063f8588e659c6e0eb6ad544823a5d2cd98 Mon Sep 17 00:00:00 2001 +From 84fefa4d9e1e6ddc9d2ec486181e2afaeb20f1c9 Mon Sep 17 00:00:00 2001 From: Dave Reisner Date: Fri, 17 Feb 2012 12:17:49 -0500 Subject: [PATCH] mount: properly check return for mount_add_* diff --git a/0161-util-never-follow-symlinks-in-rm_rf_children.patch b/0161-util-never-follow-symlinks-in-rm_rf_children.patch new file mode 100644 index 0000000..2c9adf3 --- /dev/null +++ b/0161-util-never-follow-symlinks-in-rm_rf_children.patch @@ -0,0 +1,30 @@ +From 90eb06e8c7da2c10eeccc4915bca577304785664 Mon Sep 17 00:00:00 2001 +From: Michal Schmidt +Date: Fri, 2 Mar 2012 10:39:10 +0100 +Subject: [PATCH] util: never follow symlinks in rm_rf_children() + +The function checks if the entry is a directory before recursing, but +there is a window between the check and the open, during which the +directory could be replaced with a symlink. + +CVE-2012-1174 +https://bugzilla.redhat.com/show_bug.cgi?id=803358 +(cherry picked from commit 5ebff5337594d690b322078c512eb222d34aaa82) +--- + src/util.c | 3 ++- + 1 files changed, 2 insertions(+), 1 deletions(-) + +diff --git a/src/util.c b/src/util.c +index a488289..6a2c61f 100644 +--- a/src/util.c ++++ b/src/util.c +@@ -3483,7 +3483,8 @@ static int rm_rf_children(int fd, bool only_dirs, bool honour_sticky) { + if (is_dir) { + int subdir_fd; + +- if ((subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC)) < 0) { ++ subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW); ++ if (subdir_fd < 0) { + if (ret == 0 && errno != ENOENT) + ret = -errno; + continue; diff --git a/systemd.spec b/systemd.spec index d359b3e..bcc7915 100644 --- a/systemd.spec +++ b/systemd.spec @@ -2,7 +2,7 @@ Name: systemd Url: http://www.freedesktop.org/wiki/Software/systemd BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) Version: 37 -Release: 16%{?dist} +Release: 17%{?dist} License: GPLv2+ Group: System Environment/Base Summary: A System and Service Manager @@ -213,6 +213,7 @@ Patch0157: 0157-socket-rename-broken-failure-result-to-failed-perman.patch Patch0158: 0158-nspawn-be-less-cryptic-when-clone-fails.patch Patch0159: 0159-bash-completion-get-rid-of-awk-sed-and-grep.patch Patch0160: 0160-mount-properly-check-return-for-mount_add_.patch +Patch0161: 0161-util-never-follow-symlinks-in-rm_rf_children.patch # For sysvinit tools Obsoletes: SysVinit < 2.86-24, sysvinit < 2.86-24 @@ -534,6 +535,9 @@ fi %{_bindir}/systemd-sysv-convert %changelog +* Fri Mar 16 2012 Michal Schmidt - 37-17 +- CVE-2012-1174 (#804118) + * Tue Mar 06 2012 Michal Schmidt - 37-16 - From upstream: - avoid socket tarpits when the service keeps failing