Fix dbus policy (#2027158, CVE-2021-442255)

.gitignore

@@ -35,3 +35,5 @@
 /keepalived-2.1.5.tar.gz
 /keepalived-2.2.0.tar.gz
 /keepalived-2.2.1.tar.gz
+/keepalived-2.2.2.tar.gz
+/keepalived-2.2.4.tar.gz

bz2027158-fix-dbus-policy.patch

@@ -0,0 +1,41 @@
+From 7977fec0be89ae6fe87405b3f8da2f0b5e415e3d Mon Sep 17 00:00:00 2001
+From: Vincent Bernat <vincent@bernat.ch>
+Date: Tue, 23 Nov 2021 06:50:59 +0100
+Subject: [PATCH] dbus: fix policy to not be overly broad
+
+The DBus policy did not restrict the message destination, allowing any
+user to inspect and manipulate any property.
+
+Signed-off-by: Vincent Bernat <vincent@bernat.ch>
+---
+ keepalived/dbus/org.keepalived.Vrrp1.conf | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/keepalived/dbus/org.keepalived.Vrrp1.conf b/keepalived/dbus/org.keepalived.Vrrp1.conf
+index 2b78a575..b5ced608 100644
+--- a/keepalived/dbus/org.keepalived.Vrrp1.conf
++++ b/keepalived/dbus/org.keepalived.Vrrp1.conf
+@@ -3,12 +3,15 @@
+  "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+ <busconfig>
+ 	<policy user="root">
+-		<allow own="org.keepalived.Vrrp1"/>
+-		<allow send_destination="org.keepalived.Vrrp1"/>
++		<allow own="org.keepalived.Vrrp1" />
++		<allow send_destination="org.keepalived.Vrrp1" />
+ 	</policy>
+ 	<policy context="default">
+-		<allow send_interface="org.freedesktop.DBus.Introspectable" />
+-		<allow send_interface="org.freedesktop.DBus.Peer" />
+-		<allow send_interface="org.freedesktop.DBus.Properties" />
++		<allow send_destination="org.keepalived.Vrrp1"
++		       send_interface="org.freedesktop.DBus.Introspectable" />
++		<allow send_destination="org.keepalived.Vrrp1"
++		       send_interface="org.freedesktop.DBus.Peer" />
++		<allow send_destination="org.keepalived.Vrrp1"
++		       send_interface="org.freedesktop.DBus.Properties" />
+ 	</policy>
+ </busconfig>
+-- 
+2.33.1
+

keepalived.spec

@@ -9,7 +9,7 @@
 
 Name: keepalived
 Summary: High Availability monitor built upon LVS, VRRP and service pollers
-Version: 2.2.1
+Version: 2.2.4
 Release: 2%{?dist}
 License: GPLv2+
 URL: http://www.keepalived.org/
@@ -17,6 +17,8 @@ URL: http://www.keepalived.org/
 Source0: http://www.keepalived.org/software/keepalived-%{version}.tar.gz
 Source1: keepalived.service
 
+Patch1: bz2027158-fix-dbus-policy.patch
+
 Requires(post): systemd
 Requires(preun): systemd
 Requires(postun): systemd
@@ -36,6 +38,7 @@ BuildRequires: systemd-units
 BuildRequires: openssl-devel
 BuildRequires: libnl3-devel
 BuildRequires: libnfnetlink-devel
+BuildRequires: file-devel
 BuildRequires: make
 
 %description
@@ -54,6 +57,7 @@ infrastructures.
 
 %prep
 %setup -q
+%patch1 -p1
 
 %build
 %configure \
@@ -61,7 +65,7 @@ infrastructures.
     %{?with_profile:--enable-profile} \
     %{!?with_vrrp:--disable-vrrp} \
     %{?with_snmp:--enable-snmp --enable-snmp-rfc} \
-    %{?with_nftables:--enable-nftables --disable-iptables --disable-ipset} \
+    %{?with_nftables:--enable-nftables --disable-iptables} \
     %{?with_sha1:--enable-sha1} \
     --with-init=systemd
 %{__make} %{?_smp_mflags} STRIP=/bin/true
@@ -103,6 +107,18 @@ mkdir -p %{buildroot}%{_libexecdir}/keepalived
 %{_mandir}/man8/keepalived.8*
 
 %changelog
+* Tue Dec 14 2021 Ryan O'Hara <rohara@redhat.com> - 2.2.4-2
+- Fix dbus policy (#2027158, CVE-2021-442255)
+
+* Tue Dec 14 2021 Ryan O'Hara <rohara@redhat.com> - 2.2.4-1
+- Update to 2.2.4 (#1996274)
+
+* Mon Apr 12 2021 Ryan O'Hara <rohara@redhat.com> - 2.2.2-2
+- Add BuildRequires for file-devel
+
+* Wed Apr 07 2021 Ryan O'Hara <rohara@redhat.com> - 2.2.2-1
+- Update to 2.2.2 (#1935990)
+
 * Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.2.1-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
 

sources

@@ -1 +1 @@
-SHA512 (keepalived-2.2.1.tar.gz) = 721ac77e641ba53b23b65d278002a7af639c17741405d6bce4fc5f9f069a7f84d2dcae8bf8d08c517326373c113424efdb522cfb31638d23e4ad6c261252ea3c
+SHA512 (keepalived-2.2.4.tar.gz) = b8b0f3e7092b7b7093a9927259928076ee95ed176dd26b3a5c38e8c0dc7b83468433944905618dbc9e4b73b81b0cd3f16c2db4234ed4fcdf30f4fc0e532f9422