From 83c7eb0760f060817f738c20ae74760bf85e6d0f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= Date: Wed, 8 Nov 2017 14:00:25 +0100 Subject: [PATCH] Fix a security bug in sandboxing pengines --- pl.spec | 9 ++- ...x-handling-of-2.-Vladislav-Zorov-and.patch | 57 +++++++++++++++++++ 2 files changed, 65 insertions(+), 1 deletion(-) create mode 100644 swipl-7.2.3-FIXED-sandbox-handling-of-2.-Vladislav-Zorov-and.patch diff --git a/pl.spec b/pl.spec index 9a0a389..8127802 100644 --- a/pl.spec +++ b/pl.spec @@ -3,7 +3,7 @@ Name: pl Version: 7.2.3 -Release: 5%{?dist} +Release: 6%{?dist} Summary: SWI-Prolog - Edinburgh compatible Prolog compiler Group: Development/Languages #library/dialect/iso/iso_predicates.pl GPLv2+ with SWI-Prolog extra clause @@ -83,6 +83,9 @@ Patch6: swipl-7.2.1-Unbundle-jquery1.patch # , # fixed in upstream after 7.13.19 Patch7: swipl-7.3.19-FIXED-swipl-ld-enlarge-buffer-for-processing-the-Pro.patch +# Fix a security bug in sandboxing pengines, in upstream after 7.5.11, +# +Patch8: swipl-7.2.3-FIXED-sandbox-handling-of-2.-Vladislav-Zorov-and.patch BuildRequires: coreutils BuildRequires: findutils BuildRequires: gcc @@ -259,6 +262,7 @@ cd packages/xpce ) %patch6 -p1 %patch7 -p1 +%patch8 -p1 ( cd src autoconf @@ -419,6 +423,9 @@ find packages/jpl/examples -name ".cvsignore" | xargs rm -f %changelog +* Wed Nov 08 2017 Petr Pisar - 7.2.3-6 +- Fix a security bug in sandboxing pengines + * Sat Feb 11 2017 Fedora Release Engineering - 7.2.3-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild diff --git a/swipl-7.2.3-FIXED-sandbox-handling-of-2.-Vladislav-Zorov-and.patch b/swipl-7.2.3-FIXED-sandbox-handling-of-2.-Vladislav-Zorov-and.patch new file mode 100644 index 0000000..83e03c7 --- /dev/null +++ b/swipl-7.2.3-FIXED-sandbox-handling-of-2.-Vladislav-Zorov-and.patch @@ -0,0 +1,57 @@ +From 649ccc9e494cfb121cd20fad0c7bdd9121ddcace Mon Sep 17 00:00:00 2001 +From: Jan Wielemaker +Date: Sun, 16 Jul 2017 17:40:05 +0200 +Subject: [PATCH] FIXED: sandbox handling of @/2. Vladislav Zorov and Anne + Ogborn. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Petr Písař: Ported to 7.2.3. + +Signed-off-by: Petr Písař +--- + library/sandbox.pl | 6 +++++- + src/Tests/library/test_sandbox.pl | 2 ++ + 2 files changed, 7 insertions(+), 1 deletion(-) + +diff --git a/library/sandbox.pl b/library/sandbox.pl +index f84b8d3..bb970cb 100644 +--- a/library/sandbox.pl ++++ b/library/sandbox.pl +@@ -198,8 +198,10 @@ safe(G, M, Parents, _, _) :- + fail. + + safe_clauses(G, M, Parents, Safe0, Safe) :- +- predicate_property(M:G, interpreted), !, ++ predicate_property(M:G, interpreted), + def_module(M:G, MD:QG), ++ \+ compiled(MD:QG), ++ !, + findall(Ref-Body, clause(MD:QG, Body, Ref), Bodies), + safe_bodies(Bodies, MD, Parents, Safe0, Safe). + safe_clauses(G, M, [_|Parents], _, _) :- +@@ -210,6 +212,8 @@ safe_clauses(_, _, [G|Parents], _, _) :- + throw(error(existence_error(procedure, G), + sandbox(G, Parents))). + ++compiled(system:(@(_,_))). ++ + %% safe_bodies(+Bodies, +Module, +Parents, +Safe0, -Safe) + % + % Verify the safety of bodies. If a clause was compiled with a +diff --git a/src/Tests/library/test_sandbox.pl b/src/Tests/library/test_sandbox.pl +index 4c737e8..1e14e85 100644 +--- a/src/Tests/library/test_sandbox.pl ++++ b/src/Tests/library/test_sandbox.pl +@@ -66,5 +66,7 @@ test(aggregate) :- + safe_goal(aggregate(sum(I), X^between(1,X,I), _Count)). + test(dcg, error(permission_error(call, sandboxed, open(_,_,_)))) :- + safe_goal(my_call(open(_,_,_))). ++test(contexr, error(permission_error(call, sandboxed, @(_,_)))) :- ++ safe_goal(@(open(_,_,_), user)). + + :- end_tests(sandbox). +-- +2.13.6 +