From 9023504857d3c44b76b2335012ea4f47ca8684b1 Mon Sep 17 00:00:00 2001 From: Jesse Keating Date: Tue, 22 Apr 2008 00:17:59 +0000 Subject: [PATCH 1/6] Initialize branch F-9 for util-linux-ng --- branch | 1 + 1 file changed, 1 insertion(+) create mode 100644 branch diff --git a/branch b/branch new file mode 100644 index 0000000..1c26f78 --- /dev/null +++ b/branch @@ -0,0 +1 @@ +F-9 From a38a9746039a92ed102797ba5a6563670d4b60fd Mon Sep 17 00:00:00 2001 From: kzak Date: Tue, 22 Apr 2008 19:38:16 +0000 Subject: [PATCH 2/6] - fix audit log injection attack via login --- util-linux-ng-2.13-login-audit.patch | 51 ++++++++++++++++++++++++++++ util-linux-ng.spec | 8 ++++- 2 files changed, 58 insertions(+), 1 deletion(-) create mode 100644 util-linux-ng-2.13-login-audit.patch diff --git a/util-linux-ng-2.13-login-audit.patch b/util-linux-ng-2.13-login-audit.patch new file mode 100644 index 0000000..d564577 --- /dev/null +++ b/util-linux-ng-2.13-login-audit.patch @@ -0,0 +1,51 @@ +From 8ccf0b253ac0f4f58d64bc9674de18bff5a88782 Mon Sep 17 00:00:00 2001 +From: Steve Grubb +Date: Sat, 19 Apr 2008 11:49:02 -0400 +Subject: [PATCH] login: audit log injection attack via login + +A while back I found a couple audit log injection attacks which became +CVE-2007-3102. I forgot to look at login to see if its vulnerable and Mirek +found that it is. To verify the problem, type: + +root addr=xyz.com + +for the account name while logging in. It will look like root logged in with +an address of xyz.com. + +Signed-off-by: Steve Grubb +--- + login-utils/login.c | 10 +++------- + 1 files changed, 3 insertions(+), 7 deletions(-) + +diff --git a/login-utils/login.c b/login-utils/login.c +index aad2779..2301213 100644 +--- a/login-utils/login.c ++++ b/login-utils/login.c +@@ -324,7 +324,6 @@ static void + logaudit(const char *tty, const char *username, const char *hostname, + struct passwd *pwd, int status) + { +- char buf[64]; + int audit_fd; + + audit_fd = audit_open(); +@@ -332,13 +331,10 @@ logaudit(const char *tty, const char *username, const char *hostname, + return; + if (!pwd && username) + pwd = getpwnam(username); +- if (pwd) +- snprintf(buf, sizeof(buf), "uid=%d", pwd->pw_uid); +- else +- snprintf(buf, sizeof(buf), "acct=%s", username ? username : "(unknown)"); + +- audit_log_user_message(audit_fd, AUDIT_USER_LOGIN, +- buf, hostname, NULL, tty, status); ++ audit_log_acct_message(audit_fd, AUDIT_USER_LOGIN, ++ NULL, "login", username ? username : "(unknown)", ++ pwd ? pwd->pw_uid : -1, hostname, NULL, tty, status); + + close(audit_fd); + } +-- +1.5.4.1 + diff --git a/util-linux-ng.spec b/util-linux-ng.spec index 7ed5e22..b09c9d7 100644 --- a/util-linux-ng.spec +++ b/util-linux-ng.spec @@ -2,7 +2,7 @@ Summary: A collection of basic system utilities Name: util-linux-ng Version: 2.13.1 -Release: 8%{?dist} +Release: 8.1%{?dist} License: GPLv2 and GPLv2+ and BSD with advertising and Public Domain Group: System Environment/Base URL: ftp://ftp.kernel.org/pub/linux/utils/util-linux-ng @@ -106,6 +106,8 @@ Patch11: util-linux-ng-2.13-floppy-locale.patch Patch12: util-linux-ng-2.13-blockdev-rmpart.patch # 439984 - backport mkswap -U Patch13: util-linux-ng-2.13-mkswap-uuid.patch +# CVE-2007-3102 +Patch14: util-linux-ng-2.13-login-audit.patch %description The util-linux-ng package contains a large variety of low-level system @@ -131,6 +133,7 @@ cp %{SOURCE8} %{SOURCE9} . %patch11 -p1 %patch12 -p1 %patch13 -p1 +%patch14 -p1 %build unset LINGUAS || : @@ -524,6 +527,9 @@ exit 0 /sbin/losetup %changelog +* Tue Apr 22 2008 Karel Zak 2.13.1-8.1 +- fix audit log injection attack via login + * Thu Apr 17 2008 Karel Zak 2.13.1-8 - fix location of the command raw(8) From 05c92a9c3ff1ce126c49a3240abfa1569ec5e99a Mon Sep 17 00:00:00 2001 From: kzak Date: Mon, 28 Apr 2008 10:40:39 +0000 Subject: [PATCH 3/6] - fix #443823 - ionice.1 doesn't to reflect idle class changes in 2.6.25 --- util-linux-ng-2.13-ionice-man-idle.patch | 33 ++++++++++++++++++++++++ util-linux-ng.spec | 8 +++++- 2 files changed, 40 insertions(+), 1 deletion(-) create mode 100644 util-linux-ng-2.13-ionice-man-idle.patch diff --git a/util-linux-ng-2.13-ionice-man-idle.patch b/util-linux-ng-2.13-ionice-man-idle.patch new file mode 100644 index 0000000..81b0537 --- /dev/null +++ b/util-linux-ng-2.13-ionice-man-idle.patch @@ -0,0 +1,33 @@ +From 776452cbfcfc2dfe81088e29ae13a681bee64e75 Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Mon, 28 Apr 2008 12:23:40 +0200 +Subject: [PATCH] ionice: update man page to reflect IDLE class change in 2.6.25 + +The idle class is safe for non-root users since 2.6.25. +http://lwn.net/Articles/266256/ + +Addresses-Red-Hat-Bugzilla: #443823 +Signed-off-by: Karel Zak +--- + schedutils/ionice.1 | 5 +++-- + 1 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/schedutils/ionice.1 b/schedutils/ionice.1 +index 8203a5e..93aabe8 100644 +--- a/schedutils/ionice.1 ++++ b/schedutils/ionice.1 +@@ -13,8 +13,9 @@ this writing, Linux supports 3 scheduling classes: + A program running with idle io priority will only get disk time when no other + program has asked for disk io for a defined grace period. The impact of idle + io processes on normal system activity should be zero. This scheduling +-class does not take a priority argument. This scheduling class is not +-permitted for an ordinary (i.e., non-root) user. ++class does not take a priority argument. Presently, this scheduling class ++is permitted for an ordinary user (since kernel 2.6.25). ++ + + \fBBest effort\fR. + This is the default scheduling class for any process that hasn't asked for +-- +1.5.4.1 + diff --git a/util-linux-ng.spec b/util-linux-ng.spec index b09c9d7..03d44bf 100644 --- a/util-linux-ng.spec +++ b/util-linux-ng.spec @@ -2,7 +2,7 @@ Summary: A collection of basic system utilities Name: util-linux-ng Version: 2.13.1 -Release: 8.1%{?dist} +Release: 8.2%{?dist} License: GPLv2 and GPLv2+ and BSD with advertising and Public Domain Group: System Environment/Base URL: ftp://ftp.kernel.org/pub/linux/utils/util-linux-ng @@ -108,6 +108,8 @@ Patch12: util-linux-ng-2.13-blockdev-rmpart.patch Patch13: util-linux-ng-2.13-mkswap-uuid.patch # CVE-2007-3102 Patch14: util-linux-ng-2.13-login-audit.patch +# 443823 - ionice.1 doesn't to reflect idle class changes in 2.6.25 +Patch15: util-linux-ng-2.13-ionice-man-idle.patch %description The util-linux-ng package contains a large variety of low-level system @@ -134,6 +136,7 @@ cp %{SOURCE8} %{SOURCE9} . %patch12 -p1 %patch13 -p1 %patch14 -p1 +%patch15 -p1 %build unset LINGUAS || : @@ -527,6 +530,9 @@ exit 0 /sbin/losetup %changelog +* Mon Apr 28 2008 Karel Zak 2.13.1-8.2 +- fix #443823 - ionice.1 doesn't to reflect idle class changes in 2.6.25 + * Tue Apr 22 2008 Karel Zak 2.13.1-8.1 - fix audit log injection attack via login From 0e29548e09aa61d4657b1b144f5c05e7349ed511 Mon Sep 17 00:00:00 2001 From: kzak Date: Tue, 12 Aug 2008 14:03:21 +0000 Subject: [PATCH 4/6] - fix #454252 - Problem with who,write and tty permissions - fix #449738 - Wakeup on RTC alarm does not work anymore [rebase to rtcwake(8) from util-linux-ng 2.14.1] - fix #454354 - FAT filesystem mount option utf8=0 is not documented --- mount-add-docs-about-utf8-0-for-vfat.patch | 17 ++ rtcwake-rebase-2.14.1.patch | 301 +++++++++++++++++++++ util-linux-ng.spec | 18 +- write-doesn-t-check-for-tty-group.patch | 78 ++++++ 4 files changed, 413 insertions(+), 1 deletion(-) create mode 100644 mount-add-docs-about-utf8-0-for-vfat.patch create mode 100644 rtcwake-rebase-2.14.1.patch create mode 100644 write-doesn-t-check-for-tty-group.patch diff --git a/mount-add-docs-about-utf8-0-for-vfat.patch b/mount-add-docs-about-utf8-0-for-vfat.patch new file mode 100644 index 0000000..34dd1ca --- /dev/null +++ b/mount-add-docs-about-utf8-0-for-vfat.patch @@ -0,0 +1,17 @@ +diff -up util-linux-ng-2.13.1/mount/mount.8.kzak util-linux-ng-2.13.1/mount/mount.8 +--- util-linux-ng-2.13.1/mount/mount.8.kzak 2008-08-12 15:34:29.000000000 +0200 ++++ util-linux-ng-2.13.1/mount/mount.8 2008-08-12 15:34:32.000000000 +0200 +@@ -1729,9 +1729,10 @@ before trying + .IR name~num.ext . + .TP + .B utf8 +-UTF8 is the filesystem safe 8-bit encoding of Unicode that is used +-by the console. It can be be enabled for the filesystem with this option. +-If `uni_xlate' gets set, UTF8 gets disabled. ++UTF8 is the filesystem safe 8-bit encoding of Unicode that is used by the ++console. It can be be enabled for the filesystem with this option or disabled ++with utf8=0, utf8=no or utf8=false. If `uni_xlate' gets set, UTF8 gets ++disabled. + .TP + .B shortname=[lower|win95|winnt|mixed] + diff --git a/rtcwake-rebase-2.14.1.patch b/rtcwake-rebase-2.14.1.patch new file mode 100644 index 0000000..2b84721 --- /dev/null +++ b/rtcwake-rebase-2.14.1.patch @@ -0,0 +1,301 @@ +diff -up util-linux-ng-2.13.1/sys-utils/rtcwake.8.kzak util-linux-ng-2.13.1/sys-utils/rtcwake.8 +--- util-linux-ng-2.13.1/sys-utils/rtcwake.8.kzak 2008-08-12 15:26:02.000000000 +0200 ++++ util-linux-ng-2.13.1/sys-utils/rtcwake.8 2008-08-12 15:26:02.000000000 +0200 +@@ -76,15 +76,20 @@ is the time in seconds since 1970-01-01, + Use standby state \fImode\fP. Valid values are \fIstandby\fP, + \fImem\fP, \fIdisk\fP and \fIon\fP (no suspend). The default is + \fIstandby\fP. ++.SH NOTES ++Some PC systems can't currently exit sleep states such as \fImem\fP ++using only the kernel code accessed by this driver. ++They need help from userspace code to make the framebuffer work again. + .SH HISTORY +-The program first appeared as kernel commit message for Linux 2.6 in the GIT ++The program was posted several times on LKML and other lists ++before appearing in kernel commit message for Linux 2.6 in the GIT + commit 87ac84f42a7a580d0dd72ae31d6a5eb4bfe04c6d. + .SH AVAILABILITY + The rtcwake command is part of the util-linux-ng package and is available from + ftp://ftp.kernel.org/pub/linux/utils/util-linux-ng/. + .SH AUTHOR +-The program was written by David Brownell and improved by +-Bernhard Walle . ++The program was written by David Brownell ++and improved by Bernhard Walle . + .SH COPYRIGHT + This is free software. You may redistribute copies of it under the terms + of the GNU General Public License . +diff -up util-linux-ng-2.13.1/sys-utils/rtcwake.c.kzak util-linux-ng-2.13.1/sys-utils/rtcwake.c +--- util-linux-ng-2.13.1/sys-utils/rtcwake.c.kzak 2008-08-12 15:17:56.000000000 +0200 ++++ util-linux-ng-2.13.1/sys-utils/rtcwake.c 2008-08-12 15:25:35.000000000 +0200 +@@ -16,11 +16,13 @@ + * The best way to set the system's RTC is so that it holds the current + * time in UTC. Use the "-l" flag to tell this program that the system + * RTC uses a local timezone instead (maybe you dual-boot MS-Windows). ++ * That flag should not be needed on systems with adjtime support. + */ + + #include + #include + #include ++#include + #include + #include + #include +@@ -46,10 +48,10 @@ static char *progname; + + #define VERSION_STRING "rtcwake from " PACKAGE_STRING + #define RTC_PATH "/sys/class/rtc/%s/device/power/wakeup" +-#define SYS_POWER_SATE_PATH "/sys/power/state" ++#define SYS_POWER_STATE_PATH "/sys/power/state" + #define ADJTIME_PATH "/etc/adjtime" + #define DEFAULT_DEVICE "/dev/rtc0" +-#define DEFAULT_MODE "suspend" ++#define DEFAULT_MODE "standby" + + enum ClockMode { + CM_AUTO, +@@ -89,7 +91,7 @@ static void usage(int retval) + exit(retval); + } + +-static int may_wakeup(const char *devname) ++static int is_wakeup_enabled(const char *devname) + { + char buf[128], *s; + FILE *f; +@@ -136,12 +138,12 @@ static int get_basetimes(int fd) + */ + if (ioctl(fd, RTC_RD_TIME, &rtc) < 0) { + perror(_("read rtc time")); +- return 0; ++ return -1; + } + sys_time = time(0); + if (sys_time == (time_t)-1) { + perror(_("read system time")); +- return 0; ++ return -1; + } + + /* convert rtc_time to normal arithmetic-friendly form, +@@ -159,22 +161,26 @@ static int get_basetimes(int fd) + + if (rtc_time == (time_t)-1) { + perror(_("convert rtc time")); +- return 0; ++ return -1; + } + + if (verbose) { +- if (clock_mode == CM_LOCAL) { +- printf("\ttzone = %ld\n", timezone); +- printf("\ttzname = %s\n", tzname[daylight]); +- gmtime_r(&rtc_time, &tm); +- } +- printf("\tsystime = %ld, (UTC) %s\n", ++ /* Unless the system uses UTC, either delta or tzone ++ * reflects a seconds offset from UTC. The value can ++ * help sort out problems like bugs in your C library. ++ */ ++ printf("\tdelta = %ld\n", sys_time - rtc_time); ++ printf("\ttzone = %ld\n", timezone); ++ ++ printf("\ttzname = %s\n", tzname[daylight]); ++ gmtime_r(&rtc_time, &tm); ++ printf("\tsystime = %ld, (UTC) %s", + (long) sys_time, asctime(gmtime(&sys_time))); +- printf("\trtctime = %ld, (UTC) %s\n", ++ printf("\trtctime = %ld, (UTC) %s", + (long) rtc_time, asctime(&tm)); + } + +- return 1; ++ return 0; + } + + static int setup_alarm(int fd, time_t *wakeup) +@@ -182,7 +188,17 @@ static int setup_alarm(int fd, time_t *w + struct tm *tm; + struct rtc_wkalrm wake; + +- tm = gmtime(wakeup); ++ /* The wakeup time is in POSIX time (more or less UTC). ++ * Ideally RTCs use that same time; but PCs can't do that ++ * if they need to boot MS-Windows. Messy... ++ * ++ * When clock_mode == CM_UTC this process's timezone is UTC, ++ * so we'll pass a UTC date to the RTC. ++ * ++ * Else clock_mode == CM_LOCAL so the time given to the RTC ++ * will instead use the local time zone. ++ */ ++ tm = localtime(wakeup); + + wake.time.tm_sec = tm->tm_sec; + wake.time.tm_min = tm->tm_min; +@@ -190,41 +206,41 @@ static int setup_alarm(int fd, time_t *w + wake.time.tm_mday = tm->tm_mday; + wake.time.tm_mon = tm->tm_mon; + wake.time.tm_year = tm->tm_year; +- wake.time.tm_wday = tm->tm_wday; +- wake.time.tm_yday = tm->tm_yday; +- wake.time.tm_isdst = tm->tm_isdst; +- +- /* many rtc alarms only support up to 24 hours from 'now' ... */ +- if ((rtc_time + (24 * 60 * 60)) > *wakeup) { +- if (ioctl(fd, RTC_ALM_SET, &wake.time) < 0) { +- perror(_("set rtc alarm")); +- return 0; +- } +- if (ioctl(fd, RTC_AIE_ON, 0) < 0) { +- perror(_("enable rtc alarm")); +- return 0; +- } +- +- /* ... so use the "more than 24 hours" request only if we must */ +- } else { +- /* avoid an extra AIE_ON call */ +- wake.enabled = 1; +- +- if (ioctl(fd, RTC_WKALM_SET, &wake) < 0) { ++ /* wday, yday, and isdst fields are unused by Linux */ ++ wake.time.tm_wday = -1; ++ wake.time.tm_yday = -1; ++ wake.time.tm_isdst = -1; ++ ++ wake.enabled = 1; ++ /* First try the preferred RTC_WKALM_SET */ ++ if (ioctl(fd, RTC_WKALM_SET, &wake) < 0) { ++ wake.enabled = 0; ++ /* Fall back on the non-preferred way of setting wakeups; only ++ * works for alarms < 24 hours from now */ ++ if ((rtc_time + (24 * 60 * 60)) > *wakeup) { ++ if (ioctl(fd, RTC_ALM_SET, &wake.time) < 0) { ++ perror(_("set rtc alarm")); ++ return -1; ++ } ++ if (ioctl(fd, RTC_AIE_ON, 0) < 0) { ++ perror(_("enable rtc alarm")); ++ return -1; ++ } ++ } else { + perror(_("set rtc wake alarm")); +- return 0; ++ return -1; + } + } + +- return 1; ++ return 0; + } + + static void suspend_system(const char *suspend) + { +- FILE *f = fopen(SYS_POWER_SATE_PATH, "w"); ++ FILE *f = fopen(SYS_POWER_STATE_PATH, "w"); + + if (!f) { +- perror(SYS_POWER_SATE_PATH); ++ perror(SYS_POWER_STATE_PATH); + return; + } + +@@ -243,24 +259,24 @@ static int read_clock_mode(void) + + fp = fopen(ADJTIME_PATH, "r"); + if (!fp) +- return 0; ++ return -1; + + /* skip first line */ + if (!fgets(linebuf, MAX_LINE, fp)) { + fclose(fp); +- return 0; ++ return -1; + } + + /* skip second line */ + if (!fgets(linebuf, MAX_LINE, fp)) { + fclose(fp); +- return 0; ++ return -1; + } + + /* read third line */ + if (!fgets(linebuf, MAX_LINE, fp)) { + fclose(fp); +- return 0; ++ return -1; + } + + if (strncmp(linebuf, "UTC", 3) == 0) +@@ -270,7 +286,7 @@ static int read_clock_mode(void) + + fclose(fp); + +- return 1; ++ return 0; + } + + int main(int argc, char **argv) +@@ -321,8 +337,9 @@ int main(int argc, char **argv) + suspend = strdup(optarg); + break; + } +- fprintf(stderr, _("%s: unrecognized suspend state '%s'\n"), +- progname, optarg); ++ fprintf(stderr, ++ _("%s: unrecognized suspend state '%s'\n"), ++ progname, optarg); + usage(EXIT_FAILURE); + + /* alarm time, seconds-to-sleep (relative) */ +@@ -372,14 +389,14 @@ int main(int argc, char **argv) + } + + if (clock_mode == CM_AUTO) { +- if (!read_clock_mode()) { ++ if (read_clock_mode() < 0) { + printf(_("%s: assuming RTC uses UTC ...\n"), progname); + clock_mode = CM_UTC; + } +- if (verbose) +- printf(_("Using %s time\n"), +- clock_mode == CM_UTC ? "UTC" : _("local")); + } ++ if (verbose) ++ printf(clock_mode == CM_UTC ? _("Using UTC time.\n") : ++ _("Using local time.\n")); + + if (!alarm && !seconds) { + fprintf(stderr, _("%s: must provide wake time\n"), progname); +@@ -402,7 +419,7 @@ int main(int argc, char **argv) + devname = new_devname; + } + +- if (strcmp(suspend, "on") != 0 && !may_wakeup(devname)) { ++ if (strcmp(suspend, "on") != 0 && !is_wakeup_enabled(devname)) { + fprintf(stderr, _("%s: %s not enabled for wakeup events\n"), + progname, devname); + exit(EXIT_FAILURE); +@@ -416,15 +433,16 @@ int main(int argc, char **argv) + } + + /* relative or absolute alarm time, normalized to time_t */ +- if (!get_basetimes(fd)) ++ if (get_basetimes(fd) < 0) + exit(EXIT_FAILURE); + if (verbose) + printf(_("alarm %ld, sys_time %ld, rtc_time %ld, seconds %u\n"), + alarm, sys_time, rtc_time, seconds); + if (alarm) { + if (alarm < sys_time) { +- fprintf(stderr, _("%s: time doesn't go backward to %s\n"), +- progname, ctime(&alarm)); ++ fprintf(stderr, ++ _("%s: time doesn't go backward to %s\n"), ++ progname, ctime(&alarm)); + exit(EXIT_FAILURE); + } + alarm += sys_time - rtc_time; diff --git a/util-linux-ng.spec b/util-linux-ng.spec index 03d44bf..7f9fc10 100644 --- a/util-linux-ng.spec +++ b/util-linux-ng.spec @@ -2,7 +2,7 @@ Summary: A collection of basic system utilities Name: util-linux-ng Version: 2.13.1 -Release: 8.2%{?dist} +Release: 8.3%{?dist} License: GPLv2 and GPLv2+ and BSD with advertising and Public Domain Group: System Environment/Base URL: ftp://ftp.kernel.org/pub/linux/utils/util-linux-ng @@ -110,6 +110,13 @@ Patch13: util-linux-ng-2.13-mkswap-uuid.patch Patch14: util-linux-ng-2.13-login-audit.patch # 443823 - ionice.1 doesn't to reflect idle class changes in 2.6.25 Patch15: util-linux-ng-2.13-ionice-man-idle.patch +# 454252 - Problem with who,write and tty permissions (upstream patch) +Patch16: write-doesn-t-check-for-tty-group.patch +# 449738 - Wakeup on RTC alarm does not work anymore +# [rebase to rtcwake(8) from util-linux-ng 2.14.1] +Patch17: rtcwake-rebase-2.14.1.patch +# 454354 - FAT filesystem mount option utf8=0 is not documented +Patch18: mount-add-docs-about-utf8-0-for-vfat.patch %description The util-linux-ng package contains a large variety of low-level system @@ -137,6 +144,9 @@ cp %{SOURCE8} %{SOURCE9} . %patch13 -p1 %patch14 -p1 %patch15 -p1 +%patch16 -p1 +%patch17 -p1 +%patch18 -p1 %build unset LINGUAS || : @@ -530,6 +540,12 @@ exit 0 /sbin/losetup %changelog +* Tue Aug 12 2008 Karel Zak 2.13.1-8.3 +- fix #454252 - Problem with who,write and tty permissions +- fix #449738 - Wakeup on RTC alarm does not work anymore + [rebase to rtcwake(8) from util-linux-ng 2.14.1] +- fix #454354 - FAT filesystem mount option utf8=0 is not documented + * Mon Apr 28 2008 Karel Zak 2.13.1-8.2 - fix #443823 - ionice.1 doesn't to reflect idle class changes in 2.6.25 diff --git a/write-doesn-t-check-for-tty-group.patch b/write-doesn-t-check-for-tty-group.patch new file mode 100644 index 0000000..97617c5 --- /dev/null +++ b/write-doesn-t-check-for-tty-group.patch @@ -0,0 +1,78 @@ +From ced94242e11e2ac121c9dae5c707bac5b47e501a Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Mon, 7 Jul 2008 15:22:22 +0200 +Subject: [PATCH] write: doesn't check for tty group + +write(1) selects a wrong tty, because there is not a proper +check of tty group ownership: + + $ write kzak + write: kzak is logged in more than once; writing to tty7 + write: /dev/tty7: Permission denied + + $ ls -la /dev/tty7 + crw--w---- 1 root root 4, 7 2008-07-04 00:32 /dev/tty7 + ^^^^ + + $ ls -la /usr/bin/write + -rwxr-sr-x 1 root tty 11864 2008-04-02 16:24 /usr/bin/write + ^ ^^^ + +We have to check for tty group owner, because we don't have +permissions to write to arbitrary tty. + +Fixed version: + + $ write kzak + write: kzak is logged in more than once; writing to pts/6 + ^^^^ + Message from test@nb on pts/7 at 15:22 ... + + ^C + + $ ls -la /dev/pts/6 + crw--w---- 1 kzak tty 136, 6 2008-07-07 15:35 /dev/pts/6 + ^^^ + +Addresses-Red-Hat-Bugzilla: #454252 +Signed-off-by: Karel Zak +--- + misc-utils/write.c | 8 +++++++- + 1 files changed, 7 insertions(+), 1 deletions(-) + +diff --git a/misc-utils/write.c b/misc-utils/write.c +index 46b8f0a..276fe96 100644 +--- a/misc-utils/write.c ++++ b/misc-utils/write.c +@@ -72,6 +72,8 @@ static void done(int); + int term_chk(char *, int *, time_t *, int); + int utmp_chk(char *, char *); + ++static gid_t myegid; ++ + int + main(int argc, char **argv) { + time_t atime; +@@ -83,6 +85,8 @@ main(int argc, char **argv) { + bindtextdomain(PACKAGE, LOCALEDIR); + textdomain(PACKAGE); + ++ myegid = getegid(); ++ + /* check that sender has write enabled */ + if (isatty(fileno(stdin))) + myttyfd = fileno(stdin); +@@ -267,7 +271,9 @@ int term_chk(char *tty, int *msgsokP, time_t *atimeP, int showerror) + "write: %s: %s\n", path, strerror(errno)); + return(1); + } +- *msgsokP = (s.st_mode & (S_IWRITE >> 3)) != 0; /* group write bit */ ++ ++ /* group write bit and group ownership */ ++ *msgsokP = (s.st_mode & (S_IWRITE >> 3)) && myegid == s.st_gid; + *atimeP = s.st_atime; + return(0); + } +-- +1.5.5.1 + From e336b5784d883bb75f45ad9591ac8a930d0720f6 Mon Sep 17 00:00:00 2001 From: Bill Nottingham Date: Thu, 26 Nov 2009 01:16:36 +0000 Subject: [PATCH 5/6] Fix typo that causes a failure to update the common directory. (releng #2781) --- Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index c0f296d..c5d5fa9 100644 --- a/Makefile +++ b/Makefile @@ -1,10 +1,10 @@ # Makefile for source rpm: util-linux-ng -# $Id$ +# $Id: Makefile,v 1.1 2007/08/17 21:07:02 wtogami Exp $ NAME := util-linux-ng SPECFILE = $(firstword $(wildcard *.spec)) define find-makefile-common -for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done +for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done endef MAKEFILE_COMMON := $(shell $(find-makefile-common)) From 7248db76860bf186f1a94c00e60670933cba6815 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 29 Jul 2010 14:50:15 +0000 Subject: [PATCH 6/6] dist-git conversion --- .cvsignore => .gitignore | 0 Makefile | 21 --------------------- branch | 1 - 3 files changed, 22 deletions(-) rename .cvsignore => .gitignore (100%) delete mode 100644 Makefile delete mode 100644 branch diff --git a/.cvsignore b/.gitignore similarity index 100% rename from .cvsignore rename to .gitignore diff --git a/Makefile b/Makefile deleted file mode 100644 index c5d5fa9..0000000 --- a/Makefile +++ /dev/null @@ -1,21 +0,0 @@ -# Makefile for source rpm: util-linux-ng -# $Id: Makefile,v 1.1 2007/08/17 21:07:02 wtogami Exp $ -NAME := util-linux-ng -SPECFILE = $(firstword $(wildcard *.spec)) - -define find-makefile-common -for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done -endef - -MAKEFILE_COMMON := $(shell $(find-makefile-common)) - -ifeq ($(MAKEFILE_COMMON),) -# attept a checkout -define checkout-makefile-common -test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2 -endef - -MAKEFILE_COMMON := $(shell $(checkout-makefile-common)) -endif - -include $(MAKEFILE_COMMON) diff --git a/branch b/branch deleted file mode 100644 index 1c26f78..0000000 --- a/branch +++ /dev/null @@ -1 +0,0 @@ -F-9