diff --git a/0001-Disable-logfile-and-modulepath-when-running-with-ele.patch b/0001-Disable-logfile-and-modulepath-when-running-with-ele.patch new file mode 100644 index 0000000..aededb0 --- /dev/null +++ b/0001-Disable-logfile-and-modulepath-when-running-with-ele.patch @@ -0,0 +1,51 @@ +From 8a59e3b7dbb30532a7c3769c555e00d7c4301170 Mon Sep 17 00:00:00 2001 +From: Matthieu Herrb +Date: Tue, 23 Oct 2018 21:29:08 +0200 +Subject: [PATCH xserver] Disable -logfile and -modulepath when running with + elevated privileges + +Could cause privilege elevation and/or arbitrary files overwrite, when +the X server is running with elevated privileges (ie when Xorg is +installed with the setuid bit set and started by a non-root user). + +CVE-2018-14665 + +Issue reported by Narendra Shinde and Red Hat. + +Signed-off-by: Matthieu Herrb +Reviewed-by: Alan Coopersmith +Reviewed-by: Peter Hutterer +Reviewed-by: Adam Jackson +(cherry picked from commit 50c0cf885a6e91c0ea71fb49fa8f1b7c86fe330e) +--- + hw/xfree86/common/xf86Init.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/hw/xfree86/common/xf86Init.c b/hw/xfree86/common/xf86Init.c +index 3c5cc7097c..cabf8716b6 100644 +--- a/hw/xfree86/common/xf86Init.c ++++ b/hw/xfree86/common/xf86Init.c +@@ -1027,14 +1027,18 @@ ddxProcessArgument(int argc, char **argv, int i) + /* First the options that are not allowed with elevated privileges */ + if (!strcmp(argv[i], "-modulepath")) { + CHECK_FOR_REQUIRED_ARGUMENT(); +- xf86CheckPrivs(argv[i], argv[i + 1]); ++ if (xf86PrivsElevated()) ++ FatalError("\nInvalid argument -modulepath " ++ "with elevated privileges\n"); + xf86ModulePath = argv[i + 1]; + xf86ModPathFrom = X_CMDLINE; + return 2; + } + if (!strcmp(argv[i], "-logfile")) { + CHECK_FOR_REQUIRED_ARGUMENT(); +- xf86CheckPrivs(argv[i], argv[i + 1]); ++ if (xf86PrivsElevated()) ++ FatalError("\nInvalid argument -logfile " ++ "with elevated privileges\n"); + xf86LogFile = argv[i + 1]; + xf86LogFileFrom = X_CMDLINE; + return 2; +-- +2.19.1 + diff --git a/0001-vfb-Bump-default-depth-to-24.patch b/0001-vfb-Bump-default-depth-to-24.patch new file mode 100644 index 0000000..6c8bd03 --- /dev/null +++ b/0001-vfb-Bump-default-depth-to-24.patch @@ -0,0 +1,28 @@ +From c9cbdada755f1d00d164bef7833f1aef139ffeb0 Mon Sep 17 00:00:00 2001 +From: Adam Jackson +Date: Mon, 20 Feb 2017 10:24:14 -0500 +Subject: [PATCH xserver] vfb: Bump default depth to 24 + +Signed-off-by: Adam Jackson +Acked-by: Keith Packard +Reviewed-by: Eric Anholt +--- + hw/vfb/InitOutput.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/hw/vfb/InitOutput.c b/hw/vfb/InitOutput.c +index d7bfd70e9d..6d386ee2f1 100644 +--- a/hw/vfb/InitOutput.c ++++ b/hw/vfb/InitOutput.c +@@ -70,7 +70,7 @@ from The Open Group. + + #define VFB_DEFAULT_WIDTH 1280 + #define VFB_DEFAULT_HEIGHT 1024 +-#define VFB_DEFAULT_DEPTH 8 ++#define VFB_DEFAULT_DEPTH 24 + #define VFB_DEFAULT_WHITEPIXEL 1 + #define VFB_DEFAULT_BLACKPIXEL 0 + #define VFB_DEFAULT_LINEBIAS 0 +-- +2.17.0 + diff --git a/0001-xfree86-add-default-modes-for-16-9-and-16-10.patch b/0001-xfree86-add-default-modes-for-16-9-and-16-10.patch new file mode 100644 index 0000000..c9ed462 --- /dev/null +++ b/0001-xfree86-add-default-modes-for-16-9-and-16-10.patch @@ -0,0 +1,171 @@ +From 8be1dbeacf5f29c0b538414e87d47c9d5af08d9d Mon Sep 17 00:00:00 2001 +From: Martin Wilck +Date: Tue, 9 Jan 2018 20:33:09 +0100 +Subject: xfree86: add default modes for 16:9 and 16:10 + +Improve the user experience for users with wide screens by adding standard +16:9 and 16:10 modes to extramodes, as suggested previously +(https://lists.x.org/archives/xorg-devel/2016-February/048866.html). +Tested successfully on my laptop. Feedback welcome. + +See also https://bugs.freedesktop.org/show_bug.cgi?id=37858. + +Signed-off-by: Martin Wilck +Reviewed-by: Adam Jackson +(cherry picked from commit a5e9bcad7ad0887f804905b482894b85751519fb) +--- + hw/xfree86/common/extramodes | 141 +++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 141 insertions(+) + +diff --git a/hw/xfree86/common/extramodes b/hw/xfree86/common/extramodes +index 4505026..006b5cb 100644 +--- a/hw/xfree86/common/extramodes ++++ b/hw/xfree86/common/extramodes +@@ -25,3 +25,144 @@ Modeline "2048x1536" 340.48 2048 2216 2440 2832 1536 1537 1540 1603 -hsync +vs + # 2048x1536 @ 85Hz (VESA GTF) hsync: 137.0kHz + Modeline "2048x1536" 388.04 2048 2216 2440 2832 1536 1537 1540 1612 -hsync +vsync + ++### 16:9 modelines generated by cvt ++ ++# 640x360 59.32 Hz (CVT 0.23M9-R) hsync: 22.19 kHz; pclk: 17.75 MHz ++Modeline "640x360R" 17.75 640 688 720 800 360 363 368 374 +hsync -vsync ++ ++# 640x360 59.84 Hz (CVT 0.23M9) hsync: 22.50 kHz; pclk: 18.00 MHz ++Modeline "640x360" 18.00 640 664 720 800 360 363 368 376 -hsync +vsync ++ ++# 720x405 58.99 Hz (CVT 0.29M9-R) hsync: 24.72 kHz; pclk: 21.75 MHz ++Modeline "720x405R" 21.75 720 768 800 880 405 408 413 419 +hsync -vsync ++ ++# 720x405 59.51 Hz (CVT 0.29M9) hsync: 25.11 kHz; pclk: 22.50 MHz ++Modeline "720x405" 22.50 720 744 808 896 405 408 413 422 -hsync +vsync ++ ++# 864x486 59.57 Hz (CVT 0.42M9-R) hsync: 29.79 kHz; pclk: 30.50 MHz ++Modeline "864x486R" 30.50 864 912 944 1024 486 489 494 500 +hsync -vsync ++ ++# 864x486 59.92 Hz (CVT 0.42M9) hsync: 30.32 kHz; pclk: 32.50 MHz ++Modeline "864x486" 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync ++ ++# 960x540 59.82 Hz (CVT 0.52M9-R) hsync: 33.26 kHz; pclk: 37.25 MHz ++Modeline "960x540R" 37.25 960 1008 1040 1120 540 543 548 556 +hsync -vsync ++ ++# 960x540 59.63 Hz (CVT 0.52M9) hsync: 33.51 kHz; pclk: 40.75 MHz ++Modeline "960x540" 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync ++ ++# 1024x576 59.82 Hz (CVT 0.59M9-R) hsync: 35.47 kHz; pclk: 42.00 MHz ++Modeline "1024x576R" 42.00 1024 1072 1104 1184 576 579 584 593 +hsync -vsync ++ ++# 1024x576 59.90 Hz (CVT 0.59M9) hsync: 35.88 kHz; pclk: 46.50 MHz ++Modeline "1024x576" 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync ++ ++# 1280x720 59.74 Hz (CVT 0.92M9-R) hsync: 44.27 kHz; pclk: 63.75 MHz ++Modeline "1280x720R" 63.75 1280 1328 1360 1440 720 723 728 741 +hsync -vsync ++ ++# 1280x720 59.86 Hz (CVT 0.92M9) hsync: 44.77 kHz; pclk: 74.50 MHz ++Modeline "1280x720" 74.50 1280 1344 1472 1664 720 723 728 748 -hsync +vsync ++ ++# 1368x768 59.85 Hz (CVT) hsync: 47.28 kHz; pclk: 72.25 MHz ++Modeline "1368x768R" 72.25 1368 1416 1448 1528 768 771 781 790 +hsync -vsync ++ ++# 1368x768 59.88 Hz (CVT) hsync: 47.79 kHz; pclk: 85.25 MHz ++Modeline "1368x768" 85.25 1368 1440 1576 1784 768 771 781 798 -hsync +vsync ++ ++# 1600x900 59.82 Hz (CVT 1.44M9-R) hsync: 55.40 kHz; pclk: 97.50 MHz ++Modeline "1600x900R" 97.50 1600 1648 1680 1760 900 903 908 926 +hsync -vsync ++ ++# 1600x900 59.95 Hz (CVT 1.44M9) hsync: 55.99 kHz; pclk: 118.25 MHz ++Modeline "1600x900" 118.25 1600 1696 1856 2112 900 903 908 934 -hsync +vsync ++ ++# 1920x1080 59.93 Hz (CVT 2.07M9-R) hsync: 66.59 kHz; pclk: 138.50 MHz ++Modeline "1920x1080R" 138.50 1920 1968 2000 2080 1080 1083 1088 1111 +hsync -vsync ++ ++# 1920x1080 59.96 Hz (CVT 2.07M9) hsync: 67.16 kHz; pclk: 173.00 MHz ++Modeline "1920x1080" 173.00 1920 2048 2248 2576 1080 1083 1088 1120 -hsync +vsync ++ ++# 2048x1152 59.91 Hz (CVT 2.36M9-R) hsync: 70.99 kHz; pclk: 156.75 MHz ++Modeline "2048x1152R" 156.75 2048 2096 2128 2208 1152 1155 1160 1185 +hsync -vsync ++ ++# 2048x1152 59.90 Hz (CVT 2.36M9) hsync: 71.58 kHz; pclk: 197.00 MHz ++Modeline "2048x1152" 197.00 2048 2184 2400 2752 1152 1155 1160 1195 -hsync +vsync ++ ++# 2560x1440 59.95 Hz (CVT 3.69M9-R) hsync: 88.79 kHz; pclk: 241.50 MHz ++Modeline "2560x1440R" 241.50 2560 2608 2640 2720 1440 1443 1448 1481 +hsync -vsync ++ ++# 2560x1440 59.96 Hz (CVT 3.69M9) hsync: 89.52 kHz; pclk: 312.25 MHz ++Modeline "2560x1440" 312.25 2560 2752 3024 3488 1440 1443 1448 1493 -hsync +vsync ++ ++# 2880x1620 59.97 Hz (CVT 4.67M9-R) hsync: 99.92 kHz; pclk: 303.75 MHz ++Modeline "2880x1620R" 303.75 2880 2928 2960 3040 1620 1623 1628 1666 +hsync -vsync ++ ++# 2880x1620 59.96 Hz (CVT 4.67M9) hsync: 100.67 kHz; pclk: 396.25 MHz ++Modeline "2880x1620" 396.25 2880 3096 3408 3936 1620 1623 1628 1679 -hsync +vsync ++ ++# 3200x1800 59.94 Hz (CVT 5.76M9-R) hsync: 111.01 kHz; pclk: 373.00 MHz ++Modeline "3200x1800R" 373.00 3200 3248 3280 3360 1800 1803 1808 1852 +hsync -vsync ++ ++# 3200x1800 59.96 Hz (CVT 5.76M9) hsync: 111.82 kHz; pclk: 492.00 MHz ++Modeline "3200x1800" 492.00 3200 3456 3800 4400 1800 1803 1808 1865 -hsync +vsync ++ ++# 3840x2160 59.97 Hz (CVT 8.29M9-R) hsync: 133.25 kHz; pclk: 533.00 MHz ++Modeline "3840x2160R" 533.00 3840 3888 3920 4000 2160 2163 2168 2222 +hsync -vsync ++ ++# 3840x2160 59.98 Hz (CVT 8.29M9) hsync: 134.18 kHz; pclk: 712.75 MHz ++Modeline "3840x2160" 712.75 3840 4160 4576 5312 2160 2163 2168 2237 -hsync +vsync ++ ++# 4096x2304 59.98 Hz (CVT 9.44M9-R) hsync: 142.15 kHz; pclk: 605.00 MHz ++Modeline "4096x2304R" 605.00 4096 4144 4176 4256 2304 2307 2312 2370 +hsync -vsync ++ ++# 4096x2304 59.99 Hz (CVT 9.44M9) hsync: 143.13 kHz; pclk: 813.00 MHz ++Modeline "4096x2304" 813.00 4096 4440 4888 5680 2304 2307 2312 2386 -hsync +vsync ++ ++# 5120x2880 59.99 Hz (CVT 14.75M9-R) hsync: 177.70 kHz; pclk: 938.25 MHz ++Modeline "5120x2880R" 938.25 5120 5168 5200 5280 2880 2883 2888 2962 +hsync -vsync ++ ++# 5120x2880 59.99 Hz (CVT 14.75M9) hsync: 178.88 kHz; pclk: 1276.50 MHz ++Modeline "5120x2880" 1276.50 5120 5560 6128 7136 2880 2883 2888 2982 -hsync +vsync ++ ++# 7680x4320 59.99 Hz (CVT 33.18M9-R) hsync: 266.55 kHz; pclk: 2089.75 MHz ++Modeline "7680x4320R" 2089.75 7680 7728 7760 7840 4320 4323 4328 4443 +hsync -vsync ++ ++# 7680x4320 59.99 Hz (CVT 33.18M9) hsync: 268.22 kHz; pclk: 2892.50 MHz ++Modeline "7680x4320" 2892.50 7680 8376 9232 10784 4320 4323 4328 4471 -hsync +vsync ++ ++# 15360x8640 59.99 Hz (CVT 132.71M9-R) hsync: 533.10 kHz; pclk: 8273.75 MHz ++Modeline "15360x8640R" 8273.75 15360 15408 15440 15520 8640 8643 8648 8886 +hsync -vsync ++ ++# 15360x8640 60.00 Hz (CVT 132.71M9) hsync: 536.27 kHz; pclk: 11669.25 MHz ++Modeline "15360x8640" 11669.25 15360 16824 18560 21760 8640 8643 8648 8938 -hsync +vsync ++ ++## 16:10 modelines generated by cvt ++ ++# 1280x800 59.91 Hz (CVT 1.02MA-R) hsync: 49.31 kHz; pclk: 71.00 MHz ++Modeline "1280x800R" 71.00 1280 1328 1360 1440 800 803 809 823 +hsync -vsync ++ ++# 1280x800 59.81 Hz (CVT 1.02MA) hsync: 49.70 kHz; pclk: 83.50 MHz ++Modeline "1280x800" 83.50 1280 1352 1480 1680 800 803 809 831 -hsync +vsync ++ ++# 1400x900 59.88 Hz (CVT) hsync: 55.45 kHz; pclk: 86.50 MHz ++Modeline "1400x900R" 86.50 1400 1448 1480 1560 900 903 913 926 +hsync -vsync ++ ++# 1400x900 59.96 Hz (CVT) hsync: 56.01 kHz; pclk: 103.50 MHz ++Modeline "1400x900" 103.50 1400 1480 1624 1848 900 903 913 934 -hsync +vsync ++ ++# 1680x1050 59.88 Hz (CVT 1.76MA-R) hsync: 64.67 kHz; pclk: 119.00 MHz ++Modeline "1680x1050R" 119.00 1680 1728 1760 1840 1050 1053 1059 1080 +hsync -vsync ++ ++# 1680x1050 59.95 Hz (CVT 1.76MA) hsync: 65.29 kHz; pclk: 146.25 MHz ++Modeline "1680x1050" 146.25 1680 1784 1960 2240 1050 1053 1059 1089 -hsync +vsync ++ ++# 1920x1200 59.95 Hz (CVT 2.30MA-R) hsync: 74.04 kHz; pclk: 154.00 MHz ++Modeline "1920x1200R" 154.00 1920 1968 2000 2080 1200 1203 1209 1235 +hsync -vsync ++ ++# 1920x1200 59.88 Hz (CVT 2.30MA) hsync: 74.56 kHz; pclk: 193.25 MHz ++Modeline "1920x1200" 193.25 1920 2056 2256 2592 1200 1203 1209 1245 -hsync +vsync ++ ++# 2560x1600 59.97 Hz (CVT 4.10MA-R) hsync: 98.71 kHz; pclk: 268.50 MHz ++Modeline "2560x1600R" 268.50 2560 2608 2640 2720 1600 1603 1609 1646 +hsync -vsync ++ ++# 2560x1600 59.99 Hz (CVT 4.10MA) hsync: 99.46 kHz; pclk: 348.50 MHz ++Modeline "2560x1600" 348.50 2560 2760 3032 3504 1600 1603 1609 1658 -hsync +vsync +-- +cgit v1.1 + diff --git a/xorg-x11-server.spec b/xorg-x11-server.spec index 2169679..ab194bd 100644 --- a/xorg-x11-server.spec +++ b/xorg-x11-server.spec @@ -46,7 +46,7 @@ Summary: X.Org X11 X server Name: xorg-x11-server Version: 1.19.6 -Release: 5%{?gitdate:.%{gitdate}}%{dist} +Release: 10%{?gitdate:.%{gitdate}}%{dist} URL: http://www.x.org License: MIT Group: User Interface/X @@ -78,6 +78,8 @@ Source31: xserver-sdk-abi-requires.git # maintainer convenience script Source40: driver-abi-rebuild.sh +Patch1: 0001-Disable-logfile-and-modulepath-when-running-with-ele.patch + # Various fixes pending upstream Patch2: 0005-xfree86-Remove-redundant-ServerIsNotSeat0-check-from.patch Patch3: 0006-xfree86-Make-adding-unclaimed-devices-as-GPU-devices.patch @@ -111,6 +113,7 @@ Patch9950: 0001-xwayland-Give-up-cleanly-on-Wayland-socket-errors.patch Patch9951: 0001-xwayland-Keep-separate-variables-for-pointer-and-tab.patch # Upstream commit 16fd1847 for Xwayland - Not in xorg-server-1.19.6 Patch9952: 0001-xwayland-avoid-race-condition-on-new-keymap.patch +Patch9953: 0001-vfb-Bump-default-depth-to-24.patch # From Debian use intel ddx driver only for gen4 and older chipsets %if 0%{?fedora} > 25 || 0%{?rhel} > 7 @@ -136,6 +139,9 @@ Patch10001: 0001-xfree86-use-modesetting-driver-by-default-on-GeForce.patch # Upstream commit a309323328d9d6e0bf Patch10002: 0001-config-fix-NULL-value-detection-for-ID_INPUT-being-u.patch +# Upstream commit 8be1dbe - in 1.19 and master branches +Patch10010: 0001-xfree86-add-default-modes-for-16-9-and-16-10.patch + %global moduledir %{_libdir}/xorg/modules %global drimoduledir %{_libdir}/dri %global sdkdir %{_includedir}/xorg @@ -196,7 +202,7 @@ BuildRequires: libdrm-devel >= 2.4.0 kernel-headers BuildRequires: audit-libs-devel libselinux-devel >= 2.0.86-1 BuildRequires: libudev-devel -%if 0%{?fedora} > 24 || 0%{?rhel} > 7 +%if 0%{?fedora} > 24 # libunwind is Exclusive for the following arches %ifarch aarch64 %{arm} hppa ia64 mips ppc ppc64 %{ix86} x86_64 BuildRequires: libunwind-devel @@ -256,6 +262,7 @@ Obsoletes: xorg-x11-drv-vmmouse < 13.1.0-4 Requires: xorg-x11-server-common >= %{version}-%{release} Requires: system-setup-keyboard +Requires: mesa-dri-drivers %description Xorg X.org X11 is an open source implementation of the X Window System. It @@ -305,6 +312,7 @@ Requires: xorg-x11-server-common >= %{version}-%{release} # required for xvfb-run Requires: xorg-x11-xauth Provides: Xvfb +Requires: mesa-dri-drivers %description Xvfb Xvfb (X Virtual Frame Buffer) is an X server that is able to run on @@ -319,6 +327,7 @@ Summary: A nested server Group: User Interface/X Requires: xorg-x11-server-common >= %{version}-%{release} Provides: Xephyr +Requires: mesa-dri-drivers %description Xephyr Xephyr is an X server which has been implemented as an ordinary @@ -335,6 +344,7 @@ Render and Composite. Summary: Wayland X Server Group: User Interface/X Requires: xorg-x11-server-common >= %{version}-%{release} +Requires: mesa-dri-drivers %description Xwayland Xwayland is an X server for running X clients under Wayland. @@ -628,6 +638,22 @@ find %{inst_srcdir}/hw/xfree86 -name \*.c -delete %changelog +* Thu Nov 01 2018 Adam Jackson - 1.19.6-10 +- Fix for CVE-2018-14665 + +* Tue Apr 24 2018 Adam Jackson - 1.19.6-9 +- Require mesa-dri-drivers from the servers with GLX support (#1568644) + +* Mon Apr 23 2018 Adam Jackson - 1.19.6-8 +- Bump Xvfb default depth to 24 to match 1.20 + +* Thu Apr 12 2018 Olivier Fourdan - 1.19.6-7 +- Re-fix "use type instead of which in xvfb-run (rhbz#1443357)" which + was overridden inadvertently + +* Thu Apr 05 2018 Michael Cronenworth - 1.19.6-6 +- Patch for adding default modes for 16:9 and 16:10 resolutions (rhbz#1339930) + * Tue Feb 13 2018 Olivier Fourdan 1.19.6-5 - xwayland: avoid race condition on new keymap - xwayland: Keep separate variables for pointer and tablet foci (rhbz#1519961) diff --git a/xvfb-run.sh b/xvfb-run.sh index 473688c..b5cb02c 100644 --- a/xvfb-run.sh +++ b/xvfb-run.sh @@ -142,7 +142,7 @@ if [ -z "$*" ]; then exit 2 fi -if ! which xauth >/dev/null; then +if ! type xauth >/dev/null; then error "xauth command not found" exit 3 fi