From a0cc98a963e63ff1061d82c54412c9860dc43dfb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= Date: Wed, 8 Nov 2017 14:00:25 +0100 Subject: [PATCH] Fix a security bug in sandboxing pengines --- pl.spec | 9 +++- ...x-handling-of-2.-Vladislav-Zorov-and.patch | 54 +++++++++++++++++++ 2 files changed, 62 insertions(+), 1 deletion(-) create mode 100644 swipl-7.5.11-FIXED-sandbox-handling-of-2.-Vladislav-Zorov-and.patch diff --git a/pl.spec b/pl.spec index b9050c9..347ec8b 100644 --- a/pl.spec +++ b/pl.spec @@ -3,7 +3,7 @@ Name: pl Version: 7.4.2 -Release: 3%{?dist} +Release: 4%{?dist} Summary: SWI-Prolog - Edinburgh compatible Prolog compiler Group: Development/Languages #LICENSE: BSD @@ -80,6 +80,9 @@ Patch3: swipl-7.4.1-Fix-JNI.patch Patch4: %{name}-6.2.0-pc.patch # Unbundle jquery Patch5: swipl-7.4.1-Unbundle-jquery1.patch +# Fix a security bug in sandboxing pengines, in upstream after 7.5.11, +# +Patch6: swipl-7.5.11-FIXED-sandbox-handling-of-2.-Vladislav-Zorov-and.patch BuildRequires: coreutils BuildRequires: findutils BuildRequires: gcc @@ -253,6 +256,7 @@ in Prolog. In both setups it provides a re-entrant bidirectional interface. %patch3 -p1 -b .jni %patch4 -p1 -b .pc %patch5 -p1 +%patch6 -p1 ( cd src autoconf @@ -414,6 +418,9 @@ find packages/jpl/examples -name ".cvsignore" | xargs rm -f %changelog +* Wed Nov 08 2017 Petr Pisar - 7.4.2-4 +- Fix a security bug in sandboxing pengines + * Thu Aug 03 2017 Fedora Release Engineering - 7.4.2-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild diff --git a/swipl-7.5.11-FIXED-sandbox-handling-of-2.-Vladislav-Zorov-and.patch b/swipl-7.5.11-FIXED-sandbox-handling-of-2.-Vladislav-Zorov-and.patch new file mode 100644 index 0000000..28807ba --- /dev/null +++ b/swipl-7.5.11-FIXED-sandbox-handling-of-2.-Vladislav-Zorov-and.patch @@ -0,0 +1,54 @@ +From a22442fc82fd468f02abb7a19958bb3007dc585b Mon Sep 17 00:00:00 2001 +From: Jan Wielemaker +Date: Sun, 16 Jul 2017 17:40:05 +0200 +Subject: [PATCH] FIXED: sandbox handling of @/2. Vladislav Zorov and Anne + Ogborn. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Petr Písař +--- + library/sandbox.pl | 5 ++++- + src/Tests/unprotected/test_sandbox.pl | 2 ++ + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/library/sandbox.pl b/library/sandbox.pl +index 711210ee1..f20286415 100644 +--- a/library/sandbox.pl ++++ b/library/sandbox.pl +@@ -229,8 +229,9 @@ rethrow_instantition_error(Parents) :- + + safe_clauses(G, M, Parents, Safe0, Safe) :- + predicate_property(M:G, interpreted), +- !, + def_module(M:G, MD:QG), ++ \+ compiled(MD:QG), ++ !, + findall(Ref-Body, clause(MD:QG, Body, Ref), Bodies), + safe_bodies(Bodies, MD, Parents, Safe0, Safe). + safe_clauses(G, M, [_|Parents], _, _) :- +@@ -242,6 +243,8 @@ safe_clauses(_, _, [G|Parents], _, _) :- + throw(error(existence_error(procedure, G), + sandbox(G, Parents))). + ++compiled(system:(@(_,_))). ++ + %! safe_bodies(+Bodies, +Module, +Parents, +Safe0, -Safe) + % + % Verify the safety of bodies. If a clause was compiled with a +diff --git a/src/Tests/unprotected/test_sandbox.pl b/src/Tests/unprotected/test_sandbox.pl +index 2a5495671..f7818a93f 100644 +--- a/src/Tests/unprotected/test_sandbox.pl ++++ b/src/Tests/unprotected/test_sandbox.pl +@@ -71,5 +71,7 @@ test(aggregate) :- + safe_goal(aggregate(sum(I), X^between(1,X,I), _Count)). + test(dcg, error(permission_error(call, sandboxed, open(_,_,_)))) :- + safe_goal(my_call(open(_,_,_))). ++test(contexr, error(permission_error(call, sandboxed, @(_,_)))) :- ++ safe_goal(@(open(_,_,_), user)). + + :- end_tests(sandbox). +-- +2.13.6 +