diff options
Diffstat (limited to 'meta/recipes-extended/shadow/files/CVE-2019-19882.patch')
| -rw-r--r-- | meta/recipes-extended/shadow/files/CVE-2019-19882.patch | 55 |
1 files changed, 55 insertions, 0 deletions
diff --git a/meta/recipes-extended/shadow/files/CVE-2019-19882.patch b/meta/recipes-extended/shadow/files/CVE-2019-19882.patch new file mode 100644 index 0000000000..894d867680 --- /dev/null +++ b/meta/recipes-extended/shadow/files/CVE-2019-19882.patch @@ -0,0 +1,55 @@ +From 66b7bc0dcfda12d7f58eba993bd02872cae1d713 Mon Sep 17 00:00:00 2001 +From: Dave Reisner <dreisner@archlinux.org> +Date: Mon, 16 Dec 2019 14:11:23 -0500 +Subject: [PATCH] Don't auto-enable ACCT_TOOLS_SETUID if PAM is detected + +Here's a sad story: + +* 70971457 is merged into shadow, allowing newgidmap/newuidmap to be +installed with file caps rather than setuid. +* https://bugs.archlinux.org/task/63248 is filed to take advantage of +this. +* The arch maintainer of the 'shadow' package notices that this doesn't +work, and submits a pull request to fix this in shadow. +* edf7547ad5 is merged, fixing the post install hooks. + +The problem here is that distros have been building shadow with PAM for +O(years), but the install hooks have silently failed due to the +combination of the directory mismatch (suidubins vs suidsbins) and later +success with setuid'ing newgidmap/newuidmap. + +With the install hooks fixed, those of us (Arch[1] and Gentoo[2] so far) +who never built shadow explicitly with --enable-account-tools-setuid are +now getting setuid account tools, and don't have PAM configuration +suitable for use with setuid account management tools. + +It's entirely unclear to me why you'd want this, but I assume there's +some reason out there for it existing. Regardless, setuid binaries are +dangerous and shouldn't be enabled by default without good reason. + +[1] https://bugs.archlinux.org/task/64836 +[2] https://bugs.gentoo.org/702252 + +Upstream-Status: Backport +CVE: CVE-2019-19882 +Signed-off-by: Li Zhou <li.zhou@windriver.com> +--- + configure.ac | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/configure.ac b/configure.ac +index e3ed3b43..d6e2bfbd 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -226,7 +226,7 @@ AC_ARG_ENABLE(account-tools-setuid, + *) AC_MSG_ERROR(bad value ${enableval} for --enable-account-tools-setuid) + ;; + esac], +- [enable_acct_tools_setuid="maybe"] ++ [enable_acct_tools_setuid="no"] + ) + + AC_ARG_ENABLE(utmpx, +-- +2.17.1 + |