Fix bug 315235, local privilege escalation vulnerability
authorMaciej Mrozowski <reavertm@gentoo.org>
Wed, 14 Apr 2010 18:30:46 +0000 (18:30 +0000)
committerMaciej Mrozowski <reavertm@gentoo.org>
Wed, 14 Apr 2010 18:30:46 +0000 (18:30 +0000)
Package-Manager: portage-2.2_rc67/cvs/Linux x86_64

kde-base/kdm/ChangeLog
kde-base/kdm/Manifest
kde-base/kdm/files/kdm-4.3.5-CVE-2010-0436.patch [new file with mode: 0644]
kde-base/kdm/files/kdm-4.4.2-CVE-2010-0436.patch [new file with mode: 0644]
kde-base/kdm/kdm-4.3.5-r1.ebuild [new file with mode: 0644]
kde-base/kdm/kdm-4.4.2-r2.ebuild [moved from kde-base/kdm/kdm-4.4.2-r1.ebuild with 94% similarity]

index 6a7404101551fdb03d38ca5c8b44892f5f98b82b..22656f19894e79ba9c5a021b0574fa069d5be62d 100644 (file)
@@ -1,6 +1,14 @@
 # ChangeLog for kde-base/kdm
 # Copyright 1999-2010 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/kde-base/kdm/ChangeLog,v 1.209 2010/04/09 14:56:48 reavertm Exp $
+# $Header: /var/cvsroot/gentoo-x86/kde-base/kdm/ChangeLog,v 1.210 2010/04/14 18:30:46 reavertm Exp $
+
+*kdm-4.4.2-r2 (14 Apr 2010)
+*kdm-4.3.5-r1 (14 Apr 2010)
+
+  14 Apr 2010; Maciej Mrozowski <reavertm@gentoo.org> +kdm-4.3.5-r1.ebuild,
+  +files/kdm-4.3.5-CVE-2010-0436.patch, -kdm-4.4.2-r1.ebuild,
+  +kdm-4.4.2-r2.ebuild, +files/kdm-4.4.2-CVE-2010-0436.patch:
+  Fix bug 315235, local privilege escalation vulnerability
 
 *kdm-4.4.2-r1 (09 Apr 2010)
 
index bf5d165bdb8b1c99af112087ac83b5a4d5035cc5..1335aebca0c5aa3117a063561da510d16a50d292 100644 (file)
@@ -1,13 +1,16 @@
 AUX kdebase-4.0.2-pam-optional.patch 979 RMD160 abdb7293c02507dfd0a032e72f3e449405b6d8a0 SHA1 33e2f936f0548f9b19fe541c0f71db06f9daaf63 SHA256 efa4e0132687dbaa68ab5c8a5911c4a08b5d4e9eb4d2a04879f765b8e44ba9ea
 AUX kdm-4-gentoo-xinitrc.d.patch 793 RMD160 1e22f23d7cbd4764b4a7675968e0a387de2fc09a SHA1 226db506807a31b565da598458faed4a3ce3ddb7 SHA256 7ddeaa5b5446ed9e4f94cfc474032ee7d450df3748b378a4803c5b7b2bdce684
 AUX kdm-4.3.1-set-grub-default.patch 953 RMD160 c5cae2d7e2dd6dc8592ba257442cb6074d65d8c3 SHA1 c0610cd3442c11290a203c5cab9d59a7f353ebfc SHA256 0c890850869d048d15e13687d3bb889c2941280cc9ca3d62c57a2d0ea3674273
+AUX kdm-4.3.5-CVE-2010-0436.patch 6735 RMD160 4f7f84fde6026f736cc93d12bab265f07661460c SHA1 e8fea5bd3b9698a53677629620833f02c48a22df SHA256 66c7833cfea48ce6d370d38e0593045a866306e0f36e76f6821bf14fbcca2367
+AUX kdm-4.4.2-CVE-2010-0436.patch 5823 RMD160 f5aa26aca739cfbf099e63c59ab692d0ef3db6a8 SHA1 9eb126737a88f0c8b2729e69ecdd9c3a4929fde4 SHA256 d1a9a957da99f1ceb6b8fff28a4db167d8bff8fcfb23d5c16377b3e6c7a800ca
 DIST kdebase-workspace-4.3.3.tar.bz2 62496238 RMD160 48ab90a519c7811e9fe4aa4e77f06134d2dc4afa SHA1 2839e913cecef8ead0685bd50e9515ccd8bc0a9d SHA256 b66b4e3eefe88edfd9ddd0501b2b6eece39b85fd78f2320967b937f2529c6d3b
 DIST kdebase-workspace-4.3.5.tar.bz2 62525359 RMD160 dcf04a40412ba236365423afc877ea0c2066f972 SHA1 703582cb8a3471c5821986dbdfc3c6deedac0ff3 SHA256 7985634ed1f87889bcd6613ef41127196df442017bf895be6fb2afb196ce149b
 DIST kdebase-workspace-4.4.1.tar.bz2 77053467 RMD160 e841cdfda3d35c1f76acad137abf7fa7644da541 SHA1 f72e0e31c2ea4dc377e7fc14f2a0f5fb6304e71e SHA256 b25c0e13ab1798ffe067e2cd7d5c9afb5f05d0b771306eb84a4bd76a4574ac6a
 DIST kdebase-workspace-4.4.2.tar.bz2 77039701 RMD160 0558ff2102cb380127667a94b69ccb90f656266c SHA1 5fd38e48c6ddcf551bb49cf8841ba23b7682ee5b SHA256 8c32bda86e9ec67244ea2996a7e710ed04f0bb532c691af7d366c278f9b519bd
 EBUILD kdm-4.3.3.ebuild 2608 RMD160 5292a738f45ac8272e816101b76fe753591e5261 SHA1 08b70fbdfd6c0eb709a7b6b96e7123055c4c9193 SHA256 ac59b18170f8c9d6f8128669bd0ef50b84aea76676c800a89439af7cf4cbeb41
+EBUILD kdm-4.3.5-r1.ebuild 2681 RMD160 834c2223088e13021615a79771feed8db2becdb1 SHA1 1154ae856cdf7fcbdd33acb70209f2fa04801735 SHA256 75e8b29951061db387d4762d7e83ae2ef7b46cff0ae36764a23dec0620a1d856
 EBUILD kdm-4.3.5.ebuild 2626 RMD160 b57edfcf5dfcf6ac75130f5f815e5cf2f2c4bc4f SHA1 2c00ef71e83a9977deaf77fea2f25558f3d2b906 SHA256 5ee39257d2355d558ca5cbb24548acdfd37f7c7025a5e3d3f564eb497adec0c8
 EBUILD kdm-4.4.1.ebuild 2582 RMD160 446a741e4fec62a84c1721f13f57b65e78f830f9 SHA1 c7d6551dfa1c57b75556199af583d056c10a34e8 SHA256 646b5587385f401f4ae96223a0b87e37eb255c90e2fe98fa9b5e68373ee362a6
-EBUILD kdm-4.4.2-r1.ebuild 2658 RMD160 46451a03c76227e8595d375f32c91f8e993852be SHA1 3df113f3683fae8ab02361a97b822c24e0aa5459 SHA256 fcb76091ea08f3cbf0f63ca7760e1917fe5fa0ab859d0692f6d099e76e79d180
-MISC ChangeLog 27573 RMD160 119854edc40b2db1fc1215394ac9b37f70142ecc SHA1 5d67474c9988ed89bbe90af76513c13556a0e26e SHA256 93304add02564e48f569500f6d7e2e5dee5bbd1c2c22e85ce77175a195536008
+EBUILD kdm-4.4.2-r2.ebuild 2705 RMD160 42de94f4faac2c369194615918ce867f38ee66a5 SHA1 9fbf4e2adf644b02b1132c24c58a92636e04d9e2 SHA256 d09926e3174a76bd32697000e09bbc6f0cca6e4d07290e228cf8afb85c24bff6
+MISC ChangeLog 27890 RMD160 0190a4f640db842dac78965653491780c4a7912b SHA1 e3af56b3ceb23fa7cf3610e936877b42649b2d84 SHA256 79e14cb8aabca423c6433fa3374ffc3940516e4990abafcd9b3af5936cc650f1
 MISC metadata.xml 253 RMD160 dbe3d0cc1778dad287767c5dee6b46b42ccf20ec SHA1 b4723a2baaec997efee2cdc543248a2aad8f1a7e SHA256 955ffc185b3b01315be94542ea43ae1180d5f61ea539a317c45c5746b463eeba
diff --git a/kde-base/kdm/files/kdm-4.3.5-CVE-2010-0436.patch b/kde-base/kdm/files/kdm-4.3.5-CVE-2010-0436.patch
new file mode 100644 (file)
index 0000000..2ca173a
--- /dev/null
@@ -0,0 +1,225 @@
+Index: kdm/ConfigureChecks.cmake
+===================================================================
+--- kdm/ConfigureChecks.cmake  (revision 1114813)
++++ kdm/ConfigureChecks.cmake  (working copy)
+@@ -80,6 +80,38 @@
+       define_library(nsl gethostbyname)
+ endif (NOT have_gethostbyname)
+ 
++macro_push_required_vars()
++set(CMAKE_REQUIRED_LIBRARIES ${SOCKET_LIBRARIES})
++check_c_source_runs("
++#include <sys/socket.h>
++#include <sys/un.h>
++#include <sys/stat.h>
++#include <sys/types.h>
++#include <string.h>
++#include <unistd.h>
++#include <errno.h>
++int main()
++{
++    int fd, fd2;
++    struct sockaddr_un sa;
++
++    if ((fd = socket(PF_UNIX, SOCK_STREAM, 0)) < 0)
++        return 2;
++    sa.sun_family = AF_UNIX;
++    strcpy(sa.sun_path, \"testsock\");
++    unlink(sa.sun_path);
++    if (bind(fd, (struct sockaddr *)&sa, sizeof(sa)))
++        return 2;
++    chmod(sa.sun_path, 0);
++    setuid(getuid() + 1000);
++    if ((fd2 = socket(PF_UNIX, SOCK_STREAM, 0)) < 0)
++        return 2;
++    connect(fd2, (struct sockaddr *)&sa, sizeof(sa));
++    return errno != EACCES;
++}
++" HONORS_SOCKET_PERMS)
++macro_pop_required_vars()
++
+ # for genkdmconf; this is TODO
+ #if (EXISTS /etc/ttys)
+ #     set(BSD_INIT 1)
+Index: kdm/config-kdm.h.cmake
+===================================================================
+--- kdm/config-kdm.h.cmake     (revision 1114813)
++++ kdm/config-kdm.h.cmake     (working copy)
+@@ -129,6 +129,9 @@
+ /* Define to 1 if the ck-connector library is found */
+ #cmakedefine HAVE_CKCONNECTOR 1
+ 
++/* Define to 1 if OS honors permission bits on socket inodes */
++#cmakedefine HONORS_SOCKET_PERMS 1
++
+ /* $PATH defaults set by KDM */
+ #cmakedefine KDM_DEF_USER_PATH "${KDM_DEF_USER_PATH}"
+ #cmakedefine KDM_DEF_SYSTEM_PATH "${KDM_DEF_SYSTEM_PATH}"
+Index: kdm/backend/ctrl.c
+===================================================================
+--- kdm/backend/ctrl.c (revision 1114813)
++++ kdm/backend/ctrl.c (working copy)
+@@ -78,8 +78,26 @@
+ }
+ 
+ 
++#ifdef HONORS_SOCKET_PERMS
+ static CtrlRec ctrl = { 0, 0, -1, 0 };
++#else
++static CtrlRec ctrl = { 0, 0, 0, -1, 0 };
+ 
++static int mkTempDir( char *dir )
++{
++      int i, l = strlen( dir ) - 6;
++
++      for (i = 0; i < 100; i++) {
++              randomStr( dir + l );
++              if (!mkdir( dir, 0700 ))
++                      return True;
++              if (errno != EEXIST)
++                      break;
++      }
++      return False;
++}
++#endif
++
+ void
+ openCtrl( struct display *d )
+ {
+@@ -97,7 +115,7 @@
+       if (cr->fd < 0) {
+               if (mkdir( fifoDir, 0755 )) {
+                       if (errno != EEXIST) {
+-                              logError( "mkdir %\"s failed; no control FiFos will be available\n",
++                              logError( "mkdir %\"s failed: %m; no control sockets will be available\n",
+                                         fifoDir );
+                               return;
+                       }
+@@ -110,38 +128,74 @@
+                       strApp( &cr->path, sockdir, "/socket", (char *)0 );
+                       if (cr->path) {
+                               if (strlen( cr->path ) >= sizeof(sa.sun_path))
+-                                      logError( "path %\"s too long; no control sockets will be available\n",
++                                      logError( "path %\"s too long; control socket will not be available\n",
+                                                 cr->path );
+-                              else if (mkdir( sockdir, 0755 ) && errno != EEXIST)
+-                                      logError( "mkdir %\"s failed; no control sockets will be available\n",
++#ifdef HONORS_SOCKET_PERMS
++                              else if (mkdir( sockdir, 0700 ) && errno != EEXIST)
++                                      logError( "mkdir %\"s failed: %m; control socket will not be available\n",
+                                                 sockdir );
++                              else if (unlink( cr->path ) && errno != ENOENT)
++                                      logError( "unlink %\"s failed: %m; control socket will not be available\n",
++                                                cr->path );
+                               else {
+-                                      if (!d)
+-                                              chown( sockdir, -1, fifoGroup );
++#else
++                              else if (unlink( sockdir ) && errno != ENOENT)
++                                      logError( "unlink %\"s failed: %m; control socket will not be available\n",
++                                                sockdir );
++                              else if (!strApp( &cr->realdir, sockdir, "-XXXXXX", (char *)0))
++                                      ;
++                              else if (!mkTempDir( cr->realdir )) {
++                                      logError( "mkdir %\"s failed: %m; control socket will not be available\n",
++                                                cr->realdir );
++                                      free( cr->realdir );
++                                      cr->realdir = 0;
++                              } else if (symlink( cr->realdir, sockdir )) {
++                                      logError( "symlink %\"s => %\"s failed: %m; control socket will not be available\n",
++                                                sockdir, cr->realdir );
++                                      rmdir( cr->realdir );
++                                      free( cr->realdir );
++                                      cr->realdir = 0;
++                              } else {
++                                      chown( sockdir, 0, d ? 0 : fifoGroup );
+                                       chmod( sockdir, 0750 );
++#endif
+                                       if ((cr->fd = socket( PF_UNIX, SOCK_STREAM, 0 )) < 0)
+-                                              logError( "Cannot create control socket\n" );
++                                              logError( "Cannot create control socket: %m\n" );
+                                       else {
+-                                              unlink( cr->path );
+                                               sa.sun_family = AF_UNIX;
+                                               strcpy( sa.sun_path, cr->path );
+                                               if (!bind( cr->fd, (struct sockaddr *)&sa, sizeof(sa) )) {
+                                                       if (!listen( cr->fd, 5 )) {
++#ifdef HONORS_SOCKET_PERMS
++                                                              chmod( cr->path, 0660 );
++                                                              if (!d)
++                                                                      chown( cr->path, -1, fifoGroup );
++                                                              chmod( sockdir, 0755 );
++#else
+                                                               chmod( cr->path, 0666 );
++#endif
+                                                               registerCloseOnFork( cr->fd );
+                                                               registerInput( cr->fd );
+                                                               free( sockdir );
+                                                               return;
+                                                       }
+                                                       unlink( cr->path );
+-                                                      logError( "Cannot listen on control socket %\"s\n",
++                                                      logError( "Cannot listen on control socket %\"s: %m\n",
+                                                                 cr->path );
+                                               } else
+-                                                      logError( "Cannot bind control socket %\"s\n",
++                                                      logError( "Cannot bind control socket %\"s: %m\n",
+                                                                 cr->path );
+                                               close( cr->fd );
+                                               cr->fd = -1;
+                                       }
++#ifdef HONORS_SOCKET_PERMS
++                                      rmdir( sockdir );
++#else
++                                      unlink( sockdir );
++                                      rmdir( cr->realdir );
++                                      free( cr->realdir );
++                                      cr->realdir = 0;
++#endif
+                               }
+                               free( cr->path );
+                               cr->path = 0;
+@@ -162,7 +216,14 @@
+               cr->fd = -1;
+               unlink( cr->path );
+               *strrchr( cr->path, '/' ) = 0;
++#ifdef HONORS_SOCKET_PERMS
+               rmdir( cr->path );
++#else
++              rmdir( cr->realdir );
++              free( cr->realdir );
++              cr->realdir = 0;
++              unlink( cr->path );
++#endif
+               free( cr->path );
+               cr->path = 0;
+               while (cr->css) {
+@@ -177,10 +238,11 @@
+ chownCtrl( CtrlRec *cr, int uid )
+ {
+       if (cr->path) {
+-              char *ptr = strrchr( cr->path, '/' );
+-              *ptr = 0;
++#ifdef HONORS_SOCKET_PERMS
+               chown( cr->path, uid, -1 );
+-              *ptr = '/';
++#else
++              chown( cr->realdir, uid, -1 );
++#endif
+       }
+ }
+ 
+Index: kdm/backend/dm.h
+===================================================================
+--- kdm/backend/dm.h   (revision 1114813)
++++ kdm/backend/dm.h   (working copy)
+@@ -232,6 +232,9 @@
+       struct cmdsock *css;  /* open connections */
+ 
+       char *path;           /* filename of the socket */
++#ifndef HONORS_SOCKET_PERMS
++      char *realdir;        /* real dirname of the socket */
++#endif
+       int fd;               /* fd of the socket */
+       int gid;              /* owner group of the socket */
+ } CtrlRec;
diff --git a/kde-base/kdm/files/kdm-4.4.2-CVE-2010-0436.patch b/kde-base/kdm/files/kdm-4.4.2-CVE-2010-0436.patch
new file mode 100644 (file)
index 0000000..b6363bf
--- /dev/null
@@ -0,0 +1,202 @@
+Index: kdm/ConfigureChecks.cmake
+===================================================================
+--- kdm/ConfigureChecks.cmake  (revision 1114416)
++++ kdm/ConfigureChecks.cmake  (revision 1114417)
+@@ -80,6 +80,38 @@
+       define_library(nsl gethostbyname)
+ endif (NOT have_gethostbyname)
+ 
++macro_push_required_vars()
++set(CMAKE_REQUIRED_LIBRARIES ${SOCKET_LIBRARIES})
++check_c_source_runs("
++#include <sys/socket.h>
++#include <sys/un.h>
++#include <sys/stat.h>
++#include <sys/types.h>
++#include <string.h>
++#include <unistd.h>
++#include <errno.h>
++int main()
++{
++    int fd, fd2;
++    struct sockaddr_un sa;
++
++    if ((fd = socket(PF_UNIX, SOCK_STREAM, 0)) < 0)
++        return 2;
++    sa.sun_family = AF_UNIX;
++    strcpy(sa.sun_path, \"testsock\");
++    unlink(sa.sun_path);
++    if (bind(fd, (struct sockaddr *)&sa, sizeof(sa)))
++        return 2;
++    chmod(sa.sun_path, 0);
++    setuid(getuid() + 1000);
++    if ((fd2 = socket(PF_UNIX, SOCK_STREAM, 0)) < 0)
++        return 2;
++    connect(fd2, (struct sockaddr *)&sa, sizeof(sa));
++    return errno != EACCES;
++}
++" HONORS_SOCKET_PERMS)
++macro_pop_required_vars()
++
+ # for genkdmconf; this is TODO
+ #if (EXISTS /etc/ttys)
+ #     set(BSD_INIT 1)
+Index: kdm/config-kdm.h.cmake
+===================================================================
+--- kdm/config-kdm.h.cmake     (revision 1114416)
++++ kdm/config-kdm.h.cmake     (revision 1114417)
+@@ -129,6 +129,9 @@
+ /* Define to 1 if the ck-connector library is found */
+ #cmakedefine HAVE_CKCONNECTOR 1
+ 
++/* Define to 1 if OS honors permission bits on socket inodes */
++#cmakedefine HONORS_SOCKET_PERMS 1
++
+ /* $PATH defaults set by KDM */
+ #cmakedefine KDM_DEF_USER_PATH "${KDM_DEF_USER_PATH}"
+ #cmakedefine KDM_DEF_SYSTEM_PATH "${KDM_DEF_SYSTEM_PATH}"
+Index: kdm/backend/ctrl.c
+===================================================================
+--- kdm/backend/ctrl.c (revision 1114416)
++++ kdm/backend/ctrl.c (revision 1114417)
+@@ -79,8 +79,26 @@
+ }
+ 
+ 
++#ifdef HONORS_SOCKET_PERMS
+ static CtrlRec ctrl = { 0, 0, -1, 0 };
++#else
++static CtrlRec ctrl = { 0, 0, 0, -1, 0 };
+ 
++static int mkTempDir( char *dir )
++{
++      int i, l = strlen( dir ) - 6;
++
++      for (i = 0; i < 100; i++) {
++              randomStr( dir + l );
++              if (!mkdir( dir, 0700 ))
++                      return True;
++              if (errno != EEXIST)
++                      break;
++      }
++      return False;
++}
++#endif
++
+ void
+ openCtrl( struct display *d )
+ {
+@@ -113,22 +131,50 @@
+                               if (strlen( cr->path ) >= sizeof(sa.sun_path))
+                                       logError( "path %\"s too long; control socket will not be available\n",
+                                                 cr->path );
+-                              else if (mkdir( sockdir, 0755 ) && errno != EEXIST)
++#ifdef HONORS_SOCKET_PERMS
++                              else if (mkdir( sockdir, 0700 ) && errno != EEXIST)
+                                       logError( "mkdir %\"s failed: %m; control socket will not be available\n",
+                                                 sockdir );
++                              else if (unlink( cr->path ) && errno != ENOENT)
++                                      logError( "unlink %\"s failed: %m; control socket will not be available\n",
++                                                cr->path );
+                               else {
+-                                      if (!d)
+-                                              chown( sockdir, -1, fifoGroup );
++#else
++                              else if (unlink( sockdir ) && errno != ENOENT)
++                                      logError( "unlink %\"s failed: %m; control socket will not be available\n",
++                                                sockdir );
++                              else if (!strApp( &cr->realdir, sockdir, "-XXXXXX", (char *)0))
++                                      ;
++                              else if (!mkTempDir( cr->realdir )) {
++                                      logError( "mkdir %\"s failed: %m; control socket will not be available\n",
++                                                cr->realdir );
++                                      free( cr->realdir );
++                                      cr->realdir = 0;
++                              } else if (symlink( cr->realdir, sockdir )) {
++                                      logError( "symlink %\"s => %\"s failed: %m; control socket will not be available\n",
++                                                sockdir, cr->realdir );
++                                      rmdir( cr->realdir );
++                                      free( cr->realdir );
++                                      cr->realdir = 0;
++                              } else {
++                                      chown( sockdir, 0, d ? 0 : fifoGroup );
+                                       chmod( sockdir, 0750 );
++#endif
+                                       if ((cr->fd = socket( PF_UNIX, SOCK_STREAM, 0 )) < 0)
+                                               logError( "Cannot create control socket: %m\n" );
+                                       else {
+-                                              unlink( cr->path );
+                                               sa.sun_family = AF_UNIX;
+                                               strcpy( sa.sun_path, cr->path );
+                                               if (!bind( cr->fd, (struct sockaddr *)&sa, sizeof(sa) )) {
+                                                       if (!listen( cr->fd, 5 )) {
++#ifdef HONORS_SOCKET_PERMS
++                                                              chmod( cr->path, 0660 );
++                                                              if (!d)
++                                                                      chown( cr->path, -1, fifoGroup );
++                                                              chmod( sockdir, 0755 );
++#else
+                                                               chmod( cr->path, 0666 );
++#endif
+                                                               registerCloseOnFork( cr->fd );
+                                                               registerInput( cr->fd );
+                                                               free( sockdir );
+@@ -143,6 +189,14 @@
+                                               close( cr->fd );
+                                               cr->fd = -1;
+                                       }
++#ifdef HONORS_SOCKET_PERMS
++                                      rmdir( sockdir );
++#else
++                                      unlink( sockdir );
++                                      rmdir( cr->realdir );
++                                      free( cr->realdir );
++                                      cr->realdir = 0;
++#endif
+                               }
+                               free( cr->path );
+                               cr->path = 0;
+@@ -163,7 +217,14 @@
+               cr->fd = -1;
+               unlink( cr->path );
+               *strrchr( cr->path, '/' ) = 0;
++#ifdef HONORS_SOCKET_PERMS
+               rmdir( cr->path );
++#else
++              rmdir( cr->realdir );
++              free( cr->realdir );
++              cr->realdir = 0;
++              unlink( cr->path );
++#endif
+               free( cr->path );
+               cr->path = 0;
+               while (cr->css) {
+@@ -178,10 +239,11 @@
+ chownCtrl( CtrlRec *cr, int uid )
+ {
+       if (cr->path) {
+-              char *ptr = strrchr( cr->path, '/' );
+-              *ptr = 0;
++#ifdef HONORS_SOCKET_PERMS
+               chown( cr->path, uid, -1 );
+-              *ptr = '/';
++#else
++              chown( cr->realdir, uid, -1 );
++#endif
+       }
+ }
+ 
+Index: kdm/backend/dm.h
+===================================================================
+--- kdm/backend/dm.h   (revision 1114416)
++++ kdm/backend/dm.h   (revision 1114417)
+@@ -232,6 +232,9 @@
+       struct cmdsock *css;  /* open connections */
+ 
+       char *path;           /* filename of the socket */
++#ifndef HONORS_SOCKET_PERMS
++      char *realdir;        /* real dirname of the socket */
++#endif
+       int fd;               /* fd of the socket */
+       int gid;              /* owner group of the socket */
+ } CtrlRec;
diff --git a/kde-base/kdm/kdm-4.3.5-r1.ebuild b/kde-base/kdm/kdm-4.3.5-r1.ebuild
new file mode 100644 (file)
index 0000000..f23acf0
--- /dev/null
@@ -0,0 +1,100 @@
+# Copyright 1999-2010 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/kde-base/kdm/kdm-4.3.5-r1.ebuild,v 1.1 2010/04/14 18:30:46 reavertm Exp $
+
+EAPI="2"
+
+KMNAME="kdebase-workspace"
+inherit kde4-meta flag-o-matic
+
+DESCRIPTION="KDE login manager, similar to xdm and gdm"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86"
+IUSE="consolekit debug +handbook kerberos pam"
+
+DEPEND="
+       x11-libs/libXau
+       x11-libs/libXdmcp
+       x11-libs/libXtst
+       consolekit? (
+               >=sys-apps/dbus-1.0.2
+               sys-auth/consolekit
+       )
+       kerberos? ( virtual/krb5 )
+       pam? (
+               $(add_kdebase_dep kcheckpass)
+               virtual/pam
+       )
+"
+RDEPEND="${DEPEND}
+       $(add_kdebase_dep kdepasswd)
+       >=x11-apps/xinit-1.0.5-r2
+       x11-apps/xmessage
+"
+
+KMEXTRACTONLY="
+       kcontrol/kdm/
+"
+KMEXTRA="
+       libs/kdm/
+"
+
+PATCHES=(
+       "${FILESDIR}/kdebase-4.0.2-pam-optional.patch"
+       "${FILESDIR}/${PN}-4-gentoo-xinitrc.d.patch"
+       "${FILESDIR}/${PN}-4.3.1-set-grub-default.patch"
+       "${FILESDIR}/${PN}-4.3.5-CVE-2010-0436.patch"
+)
+
+src_configure() {
+       # genkdmconf breaks with -O3
+       # last checked in 4.2.95
+       replace-flags -O3 -O2
+
+       mycmakeargs=(
+               $(cmake-utils_use kerberos KDE4_KRB5AUTH)
+               $(cmake-utils_use_with pam)
+               $(cmake-utils_use_with consolekit CkConnector)
+       )
+
+       kde4-meta_src_configure
+}
+
+src_install() {
+       export GENKDMCONF_FLAGS="--no-old --no-backup"
+
+       kde4-meta_src_install
+
+       # Customize the kdmrc configuration
+       sed -i -e "s:^.*SessionsDirs=.*$:#&\nSessionsDirs=${EPREFIX}/usr/share/xsessions:" \
+               "${ED}"/${PREFIX}/share/config/kdm/kdmrc \
+               || die "Failed to set SessionsDirs correctly."
+
+       # Don't install empty dir
+       rmdir "${ED}${KDEDIR}"/share/config/kdm/sessions
+}
+
+pkg_postinst() {
+       kde4-meta_pkg_postinst
+
+       # Set the default kdm face icon if it's not already set by the system admin
+       # because this is user-overrideable in that way, it's not in src_install
+       if [[ ! -e "${EROOT}${KDEDIR}/share/apps/kdm/faces/.default.face.icon" ]]; then
+               mkdir -p "${EROOT}${KDEDIR}/share/apps/kdm/faces"
+               cp "${EROOT}${KDEDIR}/share/apps/kdm/pics/users/default1.png" \
+                       "${EROOT}${KDEDIR}/share/apps/kdm/faces/.default.face.icon"
+       fi
+       if [[ ! -e "${EROOT}${KDEDIR}/share/apps/kdm/faces/root.face.icon" ]]; then
+               mkdir -p "${EROOT}${KDEDIR}/share/apps/kdm/faces"
+               cp "${EROOT}${KDEDIR}/share/apps/kdm/pics/users/root1.png" \
+                       "${EROOT}${KDEDIR}/share/apps/kdm/faces/root.face.icon"
+       fi
+
+       if use consolekit; then
+               echo
+               elog "You have compiled 'kdm' with consolekit support. If you want to use kdm,"
+               elog "make sure consolekit daemon is running and started at login time"
+               elog
+               elog "rc-update add consolekit default && /etc/init.d/consolekit start"
+               echo
+       fi
+}
similarity index 94%
rename from kde-base/kdm/kdm-4.4.2-r1.ebuild
rename to kde-base/kdm/kdm-4.4.2-r2.ebuild
index 0f876b15fe7c12fd8e9d213d5caf3591fa4cd473..6e95e0178fd8c42763aa4c3a6f1f7c7ebb57628d 100644 (file)
@@ -1,6 +1,6 @@
 # Copyright 1999-2010 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/kde-base/kdm/kdm-4.4.2-r1.ebuild,v 1.1 2010/04/09 14:56:48 reavertm Exp $
+# $Header: /var/cvsroot/gentoo-x86/kde-base/kdm/kdm-4.4.2-r2.ebuild,v 1.1 2010/04/14 18:30:46 reavertm Exp $
 
 EAPI="3"
 
@@ -41,6 +41,7 @@ KMEXTRA="
 PATCHES=(
        "${FILESDIR}/kdebase-4.0.2-pam-optional.patch"
        "${FILESDIR}/${PN}-4-gentoo-xinitrc.d.patch"
+       "${FILESDIR}/${PN}-4.4.2-CVE-2010-0436.patch"
 )
 
 src_configure() {