Fix dbus policy (#2027158, CVE-2021-44225)

.gitignore

@@ -36,3 +36,5 @@
 /keepalived-2.2.0.tar.gz
 /keepalived-2.2.1.tar.gz
 /keepalived-2.2.2.tar.gz
+/keepalived-2.2.3.tar.gz
+/keepalived-2.2.4.tar.gz

bz1987620-fix-build-errors.patch

@@ -1,32 +0,0 @@
-From d9c99ffe43d9848579a472c7c5ec5515e6599cb9 Mon Sep 17 00:00:00 2001
-From: Ryan O'Hara <rohara@redhat.com>
-Date: Mon, 7 Jun 2021 16:58:23 -0500
-Subject: [PATCH] Fix build errors
-
----
- keepalived/core/layer4.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/keepalived/core/layer4.c b/keepalived/core/layer4.c
-index d2cc971a..fdca0491 100644
---- a/keepalived/core/layer4.c
-+++ b/keepalived/core/layer4.c
-@@ -27,13 +27,14 @@
- #include <errno.h>
- #include <unistd.h>
- #include <fcntl.h>
-+#include <netinet/in.h>
-+#include <net/if.h>
- #include <linux/icmp.h>
- #include <linux/icmpv6.h>
- #ifdef ERRQUEUE_NEEDS_SYS_TIME
- #include <sys/time.h>
- #endif
- #include <linux/errqueue.h>
--#include <netinet/in.h>
- 
- #include "layer4.h"
- #include "logger.h"
--- 
-2.31.1
-

bz2027158-fix-dbus-policy.patch

@@ -0,0 +1,41 @@
+From 7977fec0be89ae6fe87405b3f8da2f0b5e415e3d Mon Sep 17 00:00:00 2001
+From: Vincent Bernat <vincent@bernat.ch>
+Date: Tue, 23 Nov 2021 06:50:59 +0100
+Subject: [PATCH] dbus: fix policy to not be overly broad
+
+The DBus policy did not restrict the message destination, allowing any
+user to inspect and manipulate any property.
+
+Signed-off-by: Vincent Bernat <vincent@bernat.ch>
+---
+ keepalived/dbus/org.keepalived.Vrrp1.conf | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/keepalived/dbus/org.keepalived.Vrrp1.conf b/keepalived/dbus/org.keepalived.Vrrp1.conf
+index 2b78a575..b5ced608 100644
+--- a/keepalived/dbus/org.keepalived.Vrrp1.conf
++++ b/keepalived/dbus/org.keepalived.Vrrp1.conf
+@@ -3,12 +3,15 @@
+  "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+ <busconfig>
+ 	<policy user="root">
+-		<allow own="org.keepalived.Vrrp1"/>
+-		<allow send_destination="org.keepalived.Vrrp1"/>
++		<allow own="org.keepalived.Vrrp1" />
++		<allow send_destination="org.keepalived.Vrrp1" />
+ 	</policy>
+ 	<policy context="default">
+-		<allow send_interface="org.freedesktop.DBus.Introspectable" />
+-		<allow send_interface="org.freedesktop.DBus.Peer" />
+-		<allow send_interface="org.freedesktop.DBus.Properties" />
++		<allow send_destination="org.keepalived.Vrrp1"
++		       send_interface="org.freedesktop.DBus.Introspectable" />
++		<allow send_destination="org.keepalived.Vrrp1"
++		       send_interface="org.freedesktop.DBus.Peer" />
++		<allow send_destination="org.keepalived.Vrrp1"
++		       send_interface="org.freedesktop.DBus.Properties" />
+ 	</policy>
+ </busconfig>
+-- 
+2.33.1
+

keepalived.spec

@@ -9,15 +9,15 @@
 
 Name: keepalived
 Summary: High Availability monitor built upon LVS, VRRP and service pollers
-Version: 2.2.2
-Release: 5%{?dist}
+Version: 2.2.4
+Release: 2%{?dist}
 License: GPLv2+
 URL: http://www.keepalived.org/
 
 Source0: http://www.keepalived.org/software/keepalived-%{version}.tar.gz
 Source1: keepalived.service
 
-Patch1: bz1987620-fix-build-errors.patch
+Patch1: bz2027158-fix-dbus-policy.patch
 
 Requires(post): systemd
 Requires(preun): systemd
@@ -108,6 +108,15 @@ mkdir -p %{buildroot}%{_libexecdir}/keepalived
 %{_mandir}/man8/keepalived.8*
 
 %changelog
+* Tue Dec 14 2021 Ryan O'Hara <rohara@redhat.com> - 2.2.4-2
+- Fix dbus policy (#2027158, CVE-2021-44225)
+
+* Mon Aug 23 2021 Ryan O'Hara <rohara@redhat.com> - 2.2.4-1
+- Update to 2.2.4 (#1996274)
+
+* Sat Aug 14 2021 Ryan O'Hara <rohara@redhat.com> - 2.2.3-1
+- Update to 2.2.3 (#1993601)
+
 * Tue Aug 03 2021 Ryan O'Hara <rohara@redhat.com> - 2.2.2-5
 - Add systemd notify support
 

sources

@@ -1 +1 @@
-SHA512 (keepalived-2.2.2.tar.gz) = 05bb589c76faa4d3f734ecb1a3e5ac40af006fe5dce962bcd9617f192e59bb5336a911b148c1530fb864333da87c3d42a6fbf7d0ef074f6a53ce5a71db8ec706
+SHA512 (keepalived-2.2.4.tar.gz) = b8b0f3e7092b7b7093a9927259928076ee95ed176dd26b3a5c38e8c0dc7b83468433944905618dbc9e4b73b81b0cd3f16c2db4234ed4fcdf30f4fc0e532f9422