Fix a security bug in sandboxing pengines

pl.spec

@@ -3,7 +3,7 @@
 
 Name:       pl
 Version:    7.4.2
-Release:    3%{?dist}
+Release:    4%{?dist}
 Summary:    SWI-Prolog - Edinburgh compatible Prolog compiler
 Group:      Development/Languages
 #LICENSE:                               BSD
@@ -80,6 +80,9 @@ Patch3:     swipl-7.4.1-Fix-JNI.patch
 Patch4:     %{name}-6.2.0-pc.patch
 # Unbundle jquery
 Patch5:     swipl-7.4.1-Unbundle-jquery1.patch
+# Fix a security bug in sandboxing pengines, in upstream after 7.5.11,
+# <http://www.swi-prolog.org/news/4bdf6790-6d90-11e7-aede-00163e986a2a>
+Patch6:     swipl-7.5.11-FIXED-sandbox-handling-of-2.-Vladislav-Zorov-and.patch
 BuildRequires:  coreutils
 BuildRequires:  findutils
 BuildRequires:  gcc
@@ -253,6 +256,7 @@ in Prolog. In both setups it provides a re-entrant bidirectional interface.
 %patch3 -p1 -b .jni
 %patch4 -p1 -b .pc
 %patch5 -p1
+%patch6 -p1
 (
    cd src
    autoconf
@@ -414,6 +418,9 @@ find packages/jpl/examples -name ".cvsignore" | xargs rm -f
 
 
 %changelog
+* Wed Nov 08 2017 Petr Pisar <ppisar@redhat.com> - 7.4.2-4
+- Fix a security bug in sandboxing pengines
+
 * Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 7.4.2-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
 

swipl-7.5.11-FIXED-sandbox-handling-of-2.-Vladislav-Zorov-and.patch

@@ -0,0 +1,54 @@
+From a22442fc82fd468f02abb7a19958bb3007dc585b Mon Sep 17 00:00:00 2001
+From: Jan Wielemaker <J.Wielemaker@cs.vu.nl>
+Date: Sun, 16 Jul 2017 17:40:05 +0200
+Subject: [PATCH] FIXED: sandbox handling of @/2.  Vladislav Zorov and Anne
+ Ogborn.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Petr Písař <ppisar@redhat.com>
+---
+ library/sandbox.pl                    | 5 ++++-
+ src/Tests/unprotected/test_sandbox.pl | 2 ++
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/library/sandbox.pl b/library/sandbox.pl
+index 711210ee1..f20286415 100644
+--- a/library/sandbox.pl
++++ b/library/sandbox.pl
+@@ -229,8 +229,9 @@ rethrow_instantition_error(Parents) :-
+ 
+ safe_clauses(G, M, Parents, Safe0, Safe) :-
+     predicate_property(M:G, interpreted),
+-    !,
+     def_module(M:G, MD:QG),
++    \+ compiled(MD:QG),
++    !,
+     findall(Ref-Body, clause(MD:QG, Body, Ref), Bodies),
+     safe_bodies(Bodies, MD, Parents, Safe0, Safe).
+ safe_clauses(G, M, [_|Parents], _, _) :-
+@@ -242,6 +243,8 @@ safe_clauses(_, _, [G|Parents], _, _) :-
+     throw(error(existence_error(procedure, G),
+                 sandbox(G, Parents))).
+ 
++compiled(system:(@(_,_))).
++
+ %!  safe_bodies(+Bodies, +Module, +Parents, +Safe0, -Safe)
+ %
+ %   Verify the safety of bodies. If  a   clause  was compiled with a
+diff --git a/src/Tests/unprotected/test_sandbox.pl b/src/Tests/unprotected/test_sandbox.pl
+index 2a5495671..f7818a93f 100644
+--- a/src/Tests/unprotected/test_sandbox.pl
++++ b/src/Tests/unprotected/test_sandbox.pl
+@@ -71,5 +71,7 @@ test(aggregate) :-
+ 	safe_goal(aggregate(sum(I), X^between(1,X,I), _Count)).
+ test(dcg, error(permission_error(call, sandboxed, open(_,_,_)))) :-
+ 	safe_goal(my_call(open(_,_,_))).
++test(contexr, error(permission_error(call, sandboxed, @(_,_)))) :-
++	safe_goal(@(open(_,_,_), user)).
+ 
+ :- end_tests(sandbox).
+-- 
+2.13.6
+