November 2023 - openSUSE Commits - openSUSE Mailing Lists

commit jasper for openSUSE:Factory
by Source-Sync 30 Nov '23

30 Nov '23

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package jasper for openSUSE:Factory checked in at 2023-11-30 21:59:21 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/jasper (Old) and /work/SRC/openSUSE:Factory/.jasper.new.25432 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "jasper" Thu Nov 30 21:59:21 2023 rev:25 rq:1129748 version:4.1.1 Changes: -------- --- /work/SRC/openSUSE:Factory/jasper/jasper.changes 2023-11-06 21:13:48.546228308 +0100 +++ /work/SRC/openSUSE:Factory/.jasper.new.25432/jasper.changes 2023-11-30 22:00:22.790978996 +0100 @@ -1,0 +2,8 @@ +Wed Nov 29 09:29:34 UTC 2023 - Michael Vetter <mvetter(a)suse.com> + +- Update to 4.1.1: + * Disallow in-source builds by default #364 + * Fix a potential integer overflow problem in the + jas_get_total_mem_size function (for the Windows platform) #363 + +------------------------------------------------------------------- Old: ---- version-4.1.0.tar.gz New: ---- version-4.1.1.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ jasper.spec ++++++ --- /var/tmp/diff_new_pack.3oZ1fg/_old 2023-11-30 22:00:23.623009647 +0100 +++ /var/tmp/diff_new_pack.3oZ1fg/_new 2023-11-30 22:00:23.627009795 +0100 @@ -20,7 +20,7 @@ %global __builddir obs_build Name: jasper -Version: 4.1.0 +Version: 4.1.1 Release: 0 Summary: An Implementation of the JPEG-2000 Standard, Part 1 License: JasPer-2.0 @@ -29,7 +29,7 @@ Source: https://github.com/jasper-software/jasper/archive/version-%{version}.tar.gz Source1: baselibs.conf BuildRequires: Mesa-libGL-devel -BuildRequires: cmake +BuildRequires: cmake >= 3.20 BuildRequires: doxygen BuildRequires: fdupes BuildRequires: freeglut-devel @@ -69,7 +69,7 @@ %build export CFLAGS="%{optflags} -Wall -std=c99 -D_BSD_SOURCE" -%cmake -DCMAKE_INSTALL_DOCDIR=%{_docdir}/%{name} +%cmake -DCMAKE_INSTALL_DOCDIR=%{_docdir}/%{name} -DALLOW_IN_SOURCE_BUILD=ON %make_build %install ++++++ version-4.1.0.tar.gz -> version-4.1.1.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/jasper-version-4.1.0/.github/workflows/ci.yml new/jasper-version-4.1.1/.github/workflows/ci.yml --- old/jasper-version-4.1.0/.github/workflows/ci.yml 2023-11-05 05:39:06.000000000 +0100 +++ new/jasper-version-4.1.1/.github/workflows/ci.yml 2023-11-28 18:19:23.000000000 +0100 @@ -6,7 +6,7 @@ build: strategy: matrix: - os: [ubuntu-22.04, ubuntu-20.04, macos-12, macos-11] + os: [ubuntu-22.04, ubuntu-20.04, macos-13, macos-12] compiler: [ {cc: gcc, cxx: g++}, {cc: clang, cxx: clang++} ] include: - os: [windows-2022] diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/jasper-version-4.1.0/CMakeLists.txt new/jasper-version-4.1.1/CMakeLists.txt --- old/jasper-version-4.1.0/CMakeLists.txt 2023-11-05 05:39:06.000000000 +0100 +++ new/jasper-version-4.1.1/CMakeLists.txt 2023-11-28 18:19:23.000000000 +0100 @@ -1,4 +1,6 @@ -cmake_minimum_required(VERSION 3.12) +cmake_minimum_required(VERSION 3.20) +# Version 3.20 needed for cmake_path. +# Version 3.19 needed for file(REAL_PATH ...). # Version 3.12 needed for FindJPEG imported targets. # Version 3.10 needed for FindOpenGL imported targets. # Version 3.1 needed for FindGLUT imported targets. @@ -10,7 +12,7 @@ # The major, minor, and micro version numbers of the project. set(JAS_VERSION_MAJOR 4) set(JAS_VERSION_MINOR 1) -set(JAS_VERSION_PATCH 0) +set(JAS_VERSION_PATCH 1) # The shared library versioning information. # Guidelines on how to change this information can be found below. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/jasper-version-4.1.0/NEWS.txt new/jasper-version-4.1.1/NEWS.txt --- old/jasper-version-4.1.0/NEWS.txt 2023-11-05 05:39:06.000000000 +0100 +++ new/jasper-version-4.1.1/NEWS.txt 2023-11-28 18:19:23.000000000 +0100 @@ -1,3 +1,10 @@ +4.1.1 (2023-11-28) +================== + +* Disallow in-source builds by default. +* Fix a potential integer overflow problem in the jas_get_total_mem_size + function (for the Windows platform). + 4.1.0 (2023-11-04) ================== @@ -110,6 +117,7 @@ =================== * Fix potential null pointer dereference in the JP2/JPC decoder. (#269) + (CVE-2021-3443) * Fix ignoring of JAS_STREAM_FILEOBJ_NOCLOSE at stream close time. (#286) * Fix integral type sizing problem in JP2 codec. (#284) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/jasper-version-4.1.0/appveyor.yml new/jasper-version-4.1.1/appveyor.yml --- old/jasper-version-4.1.0/appveyor.yml 2023-11-05 05:39:06.000000000 +0100 +++ new/jasper-version-4.1.1/appveyor.yml 2023-11-28 18:19:23.000000000 +0100 @@ -3,8 +3,9 @@ # build worker image (VM template) image: - - Visual Studio 2015 - - Visual Studio 2013 + - Visual Studio 2022 + #- Visual Studio 2015 + #- Visual Studio 2013 configuration: - Release diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/jasper-version-4.1.0/build/appveyor/build.bat new/jasper-version-4.1.1/build/appveyor/build.bat --- old/jasper-version-4.1.0/build/appveyor/build.bat 2023-11-05 05:39:06.000000000 +0100 +++ new/jasper-version-4.1.1/build/appveyor/build.bat 2023-11-28 18:19:23.000000000 +0100 @@ -41,7 +41,8 @@ cmake ^ -H%source_dir% -B%build_dir_shared% %allow_in_source_build% ^ -DCMAKE_INSTALL_PREFIX=%install_dir_shared% ^ - -DJAS_ENABLE_SHARED=true || exit /B 1 + -DJAS_ENABLE_SHARED=true ^ + -DJAS_ENABLE_DOC=false || exit /B 1 rem msbuild %build_dir_shared%\INSTALL.vcxproj || exit /B 1 cmake --build %build_dir_shared% --clean-first || exit /B 1 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/jasper-version-4.1.0/build/cmake/modules/InSourceBuild.cmake new/jasper-version-4.1.1/build/cmake/modules/InSourceBuild.cmake --- old/jasper-version-4.1.0/build/cmake/modules/InSourceBuild.cmake 2023-11-05 05:39:06.000000000 +0100 +++ new/jasper-version-4.1.1/build/cmake/modules/InSourceBuild.cmake 2023-11-28 18:19:23.000000000 +0100 @@ -1,15 +1,48 @@ option(ALLOW_IN_SOURCE_BUILD "Allow an in-source build" OFF) function(prevent_in_source_build) - get_filename_component(source_dir "${CMAKE_SOURCE_DIR}" REALPATH) - get_filename_component(binary_dir "${CMAKE_BINARY_DIR}" REALPATH) - if(source_dir STREQUAL binary_dir) - message(FATAL_ERROR - "The use of an in-source build is not recommended. " - "For this reason, the use of in-source build is disabled by default. " - "If you want to override this default behavior, add the -DALLOW_IN_SOURCE_BUILD option to cmake." - ) + + # Determine if an in-source build is in progress. + file(REAL_PATH "${CMAKE_SOURCE_DIR}" source_dir) + file(REAL_PATH "${CMAKE_BINARY_DIR}" binary_dir) + cmake_path(IS_PREFIX source_dir "${binary_dir}" result) + + # If an in-source build is in progress, and the build directory is not + # chosen in a very specific way, then stop the build. + if(result) + cmake_path(RELATIVE_PATH binary_dir BASE_DIRECTORY "${source_dir}" + OUTPUT_VARIABLE cur_path) + #message("cur_path ${cur_path}") + while(true) + cmake_path(HAS_PARENT_PATH cur_path has_parent) + if(NOT has_parent) + break() + endif() + cmake_path(GET cur_path PARENT_PATH cur_path) + #message("cur_path ${cur_path}") + endwhile() + cmake_path(GET cur_path FILENAME top_dir_name) + #message("top_dir_name ${top_dir_name}") + if(NOT (top_dir_name MATCHES "^tmp")) + message(FATAL_ERROR + "The use of an in-source build has been detected " + "(i.e., the binary directory specified to CMake is located " + "in or under the source directory). " + "This can potentially trash the source tree. " + "In fact, if you are seeing this message, you may have already " + "partially trashed the source tree. " + "The use of an in-source build is not officially supported and " + "is therefore disallowed by default. " + "If you like to live dangerously and would like to override " + "this default behavior, this can be accomplished via the " + "CMake option ALLOW_IN_SOURCE_BUILD.\n" + "CMake source directory: ${CMAKE_SOURCE_DIR}\n" + "CMake binary directory: ${CMAKE_BINARY_DIR}\n" + "CMake binary directory root: ${CMAKE_SOURCE_DIR}/${top_dir_name}\n" + ) + endif() endif() + endfunction() if(NOT ALLOW_IN_SOURCE_BUILD) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/jasper-version-4.1.0/src/libjasper/base/jas_malloc.c new/jasper-version-4.1.1/src/libjasper/base/jas_malloc.c --- old/jasper-version-4.1.0/src/libjasper/base/jas_malloc.c 2023-11-05 05:39:06.000000000 +0100 +++ new/jasper-version-4.1.1/src/libjasper/base/jas_malloc.c 2023-11-28 18:19:23.000000000 +0100 @@ -661,11 +661,12 @@ Reference: https://docs.microsoft.com/en-us/windows/win32/api/sysinfoapi/nf-sysinfoapi… */ - ULONGLONG size; - if (!GetPhysicallyInstalledSystemMemory(&size)) { + ULONGLONG mem_size_in_kb; + if (!GetPhysicallyInstalledSystemMemory(&mem_size_in_kb)) { return 0; } - return 1024 * size; + return (mem_size_in_kb < SIZE_MAX / JAS_CAST(size_t, 1024)) ? + JAS_CAST(size_t, 1024) * mem_size_in_kb : SIZE_MAX; #else return 0; #endif

1 0

commit kernel-firmware for openSUSE:Factory
by Source-Sync 30 Nov '23

30 Nov '23

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package kernel-firmware for openSUSE:Factory checked in at 2023-11-30 21:59:11 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/kernel-firmware (Old) and /work/SRC/openSUSE:Factory/.kernel-firmware.new.25432 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "kernel-firmware" Thu Nov 30 21:59:11 2023 rev:217 rq:1129741 version:20231128 Changes: -------- --- /work/SRC/openSUSE:Factory/kernel-firmware/kernel-firmware.changes 2023-11-28 22:17:57.870607737 +0100 +++ /work/SRC/openSUSE:Factory/.kernel-firmware.new.25432/kernel-firmware.changes 2023-11-30 22:00:18.686827806 +0100 @@ -1,0 +2,7 @@ +Wed Nov 29 08:21:09 UTC 2023 - tiwai(a)suse.com + +- Update to version 20231128 (git commit d9f6088f7e91): + * Add a COPYOPTS variable + * rtl_bt: Update RTL8852A BT USB firmware to 0xDFC8_145F + +------------------------------------------------------------------- @@ -110 +117,2 @@ -- Update to version 20231019 (git commit d983107a2dfa): +- Update to version 20231019 (git commit d983107a2dfa) + (bsc#1215823, CVE-2023-20592): @@ -280,0 +289,3 @@ + (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, + CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, + CVE-2023-20526, CVE-2023-20533, CVE-2023-20566): Old: ---- kernel-firmware-20231127.tar.xz New: ---- kernel-firmware-20231128.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ kernel-firmware.spec ++++++ --- /var/tmp/diff_new_pack.0h5wuR/_old 2023-11-30 22:00:21.686938325 +0100 +++ /var/tmp/diff_new_pack.0h5wuR/_new 2023-11-30 22:00:21.694938620 +0100 @@ -21,11 +21,11 @@ %define _firmwaredir /lib/firmware %endif %define __ksyms_path ^%{_firmwaredir} -%define version_unconverted 20231127 +%define version_unconverted 20231128 # Force bzip2 instead of lzma compression (bsc#1176981) %define _binary_payload w9.bzdio Name: kernel-firmware -Version: 20231127 +Version: 20231128 Release: 0 Summary: Linux kernel firmware files License: GPL-2.0-only AND SUSE-Firmware AND GPL-2.0-or-later AND MIT ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.0h5wuR/_old 2023-11-30 22:00:21.782941862 +0100 +++ /var/tmp/diff_new_pack.0h5wuR/_new 2023-11-30 22:00:21.782941862 +0100 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git</param> - <param name="changesrevision">4124f8f928d51a1437e2fd2636b20d540edc2836</param></service></servicedata> + <param name="changesrevision">d9f6088f7e91d246d9e8d92187ecd49e44a36d9d</param></service></servicedata> (No newline at EOF) ++++++ kernel-firmware-20231127.tar.xz -> kernel-firmware-20231128.tar.xz ++++++ /work/SRC/openSUSE:Factory/kernel-firmware/kernel-firmware-20231127.tar.xz /work/SRC/openSUSE:Factory/.kernel-firmware.new.25432/kernel-firmware-20231128.tar.xz differ: char 27, line 1

1 0

commit fonts-config for openSUSE:Factory
by Source-Sync 30 Nov '23

30 Nov '23

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package fonts-config for openSUSE:Factory checked in at 2023-11-30 21:59:10 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/fonts-config (Old) and /work/SRC/openSUSE:Factory/.fonts-config.new.25432 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "fonts-config" Thu Nov 30 21:59:10 2023 rev:62 rq:1129731 version:20230604+git0.630c8206607c Changes: -------- --- /work/SRC/openSUSE:Factory/fonts-config/fonts-config.changes 2020-06-11 14:46:08.145633110 +0200 +++ /work/SRC/openSUSE:Factory/.fonts-config.new.25432/fonts-config.changes 2023-11-30 21:59:52.785873654 +0100 @@ -1,0 +2,20 @@ +Tue Nov 28 16:38:44 UTC 2023 - Takashi Iwai <tiwai(a)suse.com> + +- Update to 20230604+git0.630c8206607c: + * Fix uninitialised use of the HOME environment variable + (bsc#1086804,bsc#1210700) + * font match and pattern match can't put in one file. + * source han are packaged nowadays, no need to give alias; + just give CFF fontformat fonts in zh-/ja/ko hintfull + * split 59-family-prefer-lang-specific to cjk/noto and raw, + the former two may be generated by scripts in later version + * emoji support(part1): add emoji family + * delete 10-group-tt*.conf, since fontconfig 2.14 introduces + 09-autohint-if-no-hinting.conf (bsc#1217542) + * Fix fonts-config does not read user config with `-u` option given + * widen comparison operator for emoji fonts +- Fix typos in the configs: + 0001-Fix-typos-in-32-emoji-reject.conf-and-59-family-pref.patch +- Enable 09-autohint-if-no-hinting.conf from fontconfig + +------------------------------------------------------------------- Old: ---- fonts-config-20200609+git0.42e2b1b.tar.xz New: ---- 0001-Fix-typos-in-32-emoji-reject.conf-and-59-family-pref.patch fonts-config-20230604+git0.630c8206607c.tar.xz BETA DEBUG BEGIN: New:- Fix typos in the configs: 0001-Fix-typos-in-32-emoji-reject.conf-and-59-family-pref.patch - Enable 09-autohint-if-no-hinting.conf from fontconfig BETA DEBUG END: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ fonts-config.spec ++++++ --- /var/tmp/diff_new_pack.WHkNZ9/_old 2023-11-30 21:59:53.505900178 +0100 +++ /var/tmp/diff_new_pack.WHkNZ9/_new 2023-11-30 21:59:53.509900326 +0100 @@ -22,18 +22,19 @@ %endif Name: fonts-config -Version: 20200609+git0.42e2b1b +Version: 20230604+git0.630c8206607c Release: 0 Summary: Script to configure fonts for X Windows and other applications # MIT for infinality License: GPL-2.0-or-later AND MIT Group: System/X11/Fonts Source: %{name}-%{version}.tar.xz +Patch1: 0001-Fix-typos-in-32-emoji-reject.conf-and-59-family-pref.patch BuildRequires: fontconfig BuildRequires: fontpackages-devel Requires(pre): %fillup_prereq %reconfigure_fonts_prereq -Requires: fontconfig +Requires: fontconfig >= 2.14 Requires: gawk Requires: perl(English) Recommends: mkfontscale @@ -49,7 +50,7 @@ directly, which is mainly useful to debug it (use the --debug flag). %prep -%setup +%autosetup -p1 %build # empty configuration now, should be filled after fonts-config call @@ -81,24 +82,31 @@ install -m 644 $conf %{buildroot}%{_fontsconfddir} done # -for conf in 10-group-tt-hinted-fonts.conf \ - 10-group-tt-non-hinted-fonts.conf \ - 11-base-rendering.conf \ +for conf in 11-base-rendering.conf \ 12-tt-monospace-rendering.conf \ 13-selective-rendering.conf \ 13-selective-rendering-ipa.conf \ 21-emoji-rendering.conf \ + 22-noto-cjk-rendering.conf \ 31-metric-aliases-bw.conf \ 32-emoji-reject.conf \ 32-symbol-substitution.conf \ 49-family-default.conf \ + 49-family-default-emoji.conf \ 59-family-prefer-lang-specific.conf \ + 59-family-prefer-lang-specific-cjk.conf \ + 59-family-prefer-lang-specific-noto.conf \ 60-family-prefer.conf \ 61-wine-aliases.conf \ 70-reject.conf; do install -m 644 $conf %{buildroot}%{_datadir}/%{name}/conf.avail/ %link_avail_to_system_fontsconf $conf done +# missing symlink from fontconfig +for conf in 09-autohint-if-no-hinting.conf; do + ln -s ../../..%{_datadir}/fontconfig/conf.avail/$conf \ + %{buildroot}%{_fontsconfddir}/$conf +done %post if [ -f %{_sysconfdir}/sysconfig/fonts-config ]; then ++++++ 0001-Fix-typos-in-32-emoji-reject.conf-and-59-family-pref.patch ++++++ From e167f66b80dc4511a614e6fe971261ff125d021b Mon Sep 17 00:00:00 2001 From: Takashi Iwai <tiwai(a)suse.de> Date: Tue, 28 Nov 2023 18:01:49 +0100 Subject: [PATCH] Fix typos in 32-emoji-reject.conf and 59-family-prefer-lang-specific Fix typos as fc-cache complained: Fontconfig error: "/etc/fonts/conf.d/32-emoji-reject.conf", line 27: mismatched tag Fontconfig error: "/etc/fonts/conf.d/59-family-prefer-lang-specific-cjk.conf", line 165: mismatched tag Fontconfig warning: "/etc/fonts/conf.d/59-family-prefer-lang-specific-cjk.conf", line 165: invalid attribute 'name' Fontconfig warning: "/etc/fonts/conf.d/59-family-prefer-lang-specific-cjk.conf", line 165: invalid attribute 'mode' --- 32-emoji-reject.conf | 2 +- 59-family-prefer-lang-specific-cjk.conf | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/32-emoji-reject.conf b/32-emoji-reject.conf index b07d8e44ba82..134877428107 100644 --- a/32-emoji-reject.conf +++ b/32-emoji-reject.conf @@ -23,6 +23,6 @@ <string>Noto Emoji</string> </patelt> </pattern> - <rejectfont> + </rejectfont> </selectfont> </fontconfig> diff --git a/59-family-prefer-lang-specific-cjk.conf b/59-family-prefer-lang-specific-cjk.conf index 11aa96b27837..8692e103a519 100644 --- a/59-family-prefer-lang-specific-cjk.conf +++ b/59-family-prefer-lang-specific-cjk.conf @@ -162,7 +162,7 @@ </test> <edit name="family" mode="prepend"> <string>Noto Serif SC</string> - <string>Noto Serif HK</stirng> + <string>Noto Serif HK</string> <string>Noto Serif TC</string> <string>Noto Serif JP</string> <string>Noto Serif KR</string> @@ -194,7 +194,7 @@ </test> <edit name="family" mode="prepend"> <string>Noto Serif TC</string> - <string>Noto Serif HK</stirng> + <string>Noto Serif HK</string> <string>Noto Serif JP</string> <string>Noto Serif KR</string> <string>Noto Serif SC</string> -- 2.35.3 ++++++ fonts-config-20200609+git0.42e2b1b.tar.xz -> fonts-config-20230604+git0.630c8206607c.tar.xz ++++++ ++++ 8876 lines of diff (skipped)

1 0

commit firewalld for openSUSE:Factory
by Source-Sync 30 Nov '23

30 Nov '23

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package firewalld for openSUSE:Factory checked in at 2023-11-30 21:59:08 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/firewalld (Old) and /work/SRC/openSUSE:Factory/.firewalld.new.25432 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "firewalld" Thu Nov 30 21:59:08 2023 rev:85 rq:1129728 version:2.0.2 Changes: -------- --- /work/SRC/openSUSE:Factory/firewalld/firewalld.changes 2023-10-25 18:02:39.250066095 +0200 +++ /work/SRC/openSUSE:Factory/.firewalld.new.25432/firewalld.changes 2023-11-30 21:59:47.953695644 +0100 @@ -1,0 +2,7 @@ +Wed Nov 29 07:10:44 UTC 2023 - Mohd Saquib <mohd.saquib(a)suse.com> + +- update to 2.0.2: + * fix(policy): runtime dispatch update if *-zone=ANY (e8b9637) + * fix(nm): release NM client after a timeout (d534f07) + +------------------------------------------------------------------- Old: ---- firewalld-2.0.1.tar.bz2 New: ---- firewalld-2.0.2.tar.bz2 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ firewalld.spec ++++++ --- /var/tmp/diff_new_pack.Jx68xA/_old 2023-11-30 21:59:48.665721874 +0100 +++ /var/tmp/diff_new_pack.Jx68xA/_new 2023-11-30 21:59:48.669722021 +0100 @@ -27,7 +27,7 @@ %global modprobe_d_files firewalld-sysctls.conf Name: firewalld -Version: 2.0.1 +Version: 2.0.2 Release: 0 Summary: A firewall daemon with D-Bus interface providing a dynamic firewall License: GPL-2.0-or-later ++++++ firewalld-2.0.1.tar.bz2 -> firewalld-2.0.2.tar.bz2 ++++++ ++++ 5909 lines of diff (skipped)

1 0

commit libavif for openSUSE:Factory
by Source-Sync 30 Nov '23

30 Nov '23

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libavif for openSUSE:Factory checked in at 2023-11-30 21:59:07 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libavif (Old) and /work/SRC/openSUSE:Factory/.libavif.new.25432 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "libavif" Thu Nov 30 21:59:07 2023 rev:22 rq:1129716 version:1.0.2 Changes: -------- --- /work/SRC/openSUSE:Factory/libavif/libavif.changes 2023-08-31 13:42:48.181972032 +0200 +++ /work/SRC/openSUSE:Factory/.libavif.new.25432/libavif.changes 2023-11-30 21:59:46.081626679 +0100 @@ -1,0 +2,11 @@ +Tue Nov 28 20:40:32 UTC 2023 - Andreas Stieger <andreas.stieger(a)gmx.de> + +- update to 1.0.2: + * Update avifCropRectConvertCleanApertureBox() to the revised + requirements in ISO/IEC 23000-22:2019/Amd. 2:2021 Section + 7.3.6.7. + * CVE-2023-6350: Out of bounds memory to alphaItemIndices (boo#1217614) + * CVE-2023-6351: use-after-free in colorProperties (boo#1217615) +- drop fix-gdkpixbuf.patch + +------------------------------------------------------------------- Old: ---- fix-gdkpixbuf.patch libavif-1.0.0.tar.gz New: ---- libavif-1.0.2.tar.gz BETA DEBUG BEGIN: Old: * CVE-2023-6351: use-after-free in colorProperties (boo#1217615) - drop fix-gdkpixbuf.patch BETA DEBUG END: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libavif.spec ++++++ --- /var/tmp/diff_new_pack.RwJorM/_old 2023-11-30 21:59:47.033661751 +0100 +++ /var/tmp/diff_new_pack.RwJorM/_new 2023-11-30 21:59:47.037661898 +0100 @@ -16,6 +16,9 @@ # +# Also update baselibs.conf if you bump the version +%global lib_soversion 16 +%global lib_name libavif%{lib_soversion} %if 0%{?suse_version} >= 1550 %bcond_without aom %bcond_without yuv @@ -23,13 +26,8 @@ %bcond_with aom %bcond_with yuv %endif - -# Also update baselibs.conf if you bump the version -%global lib_soversion 16 -%global lib_name libavif%{lib_soversion} - Name: libavif -Version: 1.0.0 +Version: 1.0.2 Release: 0 Summary: Library for encoding and decoding .avif files License: BSD-2-Clause @@ -37,11 +35,10 @@ URL: https://github.com/AOMediaCodec/libavif Source: https://github.com/AOMediaCodec/libavif/archive/v%{version}/%{name}-%{versi… Source99: baselibs.conf -# PATCH-FIX-UPSTREAM https://github.com/AOMediaCodec/libavif/pull/1528 -Patch0: fix-gdkpixbuf.patch +BuildRequires: c++_compiler BuildRequires: cmake -BuildRequires: gcc-c++ BuildRequires: libjpeg8-devel +BuildRequires: pkgconfig BuildRequires: pkgconfig(dav1d) BuildRequires: pkgconfig(gdk-pixbuf-2.0) BuildRequires: pkgconfig(glib-2.0) @@ -97,10 +94,10 @@ A pixbuf-loader plugin to load AVIF images in GTK+ applications. %package devel -Requires: %{lib_name} = %{version}-%{release} # Summary: Development files for libavif Group: Development/Libraries/C and C++ +Requires: %{lib_name} = %{version}-%{release} %description devel This library aims to be a friendly, portable C implementation of the AV1 Image @@ -148,6 +145,7 @@ %{_bindir}/avifenc %files -n gdk-pixbuf-loader-libavif +%license LICENSE %{_libdir}/gdk-pixbuf-2.0/*/loaders/libpixbufloader-avif.so %dir %{_datadir}/thumbnailers %{_datadir}/thumbnailers/avif.thumbnailer ++++++ libavif-1.0.0.tar.gz -> libavif-1.0.2.tar.gz ++++++ /work/SRC/openSUSE:Factory/libavif/libavif-1.0.0.tar.gz /work/SRC/openSUSE:Factory/.libavif.new.25432/libavif-1.0.2.tar.gz differ: char 29, line 1

1 0

commit fontconfig for openSUSE:Factory
by Source-Sync 30 Nov '23

30 Nov '23

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package fontconfig for openSUSE:Factory checked in at 2023-11-30 21:59:05 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/fontconfig (Old) and /work/SRC/openSUSE:Factory/.fontconfig.new.25432 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "fontconfig" Thu Nov 30 21:59:05 2023 rev:96 rq:1129692 version:2.14.2 Changes: -------- --- /work/SRC/openSUSE:Factory/fontconfig/fontconfig.changes 2023-02-02 18:23:56.597837562 +0100 +++ /work/SRC/openSUSE:Factory/.fontconfig.new.25432/fontconfig.changes 2023-11-30 21:59:29.881029873 +0100 @@ -1,0 +2,5 @@ +Tue Nov 28 16:24:08 UTC 2023 - Takashi Iwai <tiwai(a)suse.com> + +- Run autoreconf for Leap 15.x to fix build breakage + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ fontconfig.spec ++++++ --- /var/tmp/diff_new_pack.ePBCYY/_old 2023-11-30 21:59:30.737061408 +0100 +++ /var/tmp/diff_new_pack.ePBCYY/_new 2023-11-30 21:59:30.737061408 +0100 @@ -95,6 +95,9 @@ %autosetup -p1 # use suse-specific doc path: find -name \*.1 -o -name \*.sgml -exec sed -i -e 's/usr\/share\/doc\/fontconfig/usr\/share\/doc\/packages\/fontconfig/g' {} + +%if 0%{?suse_version} < 1550 +autoreconf -fi +%endif %build # We don't want to rebuild the docs, but we want to install the included ones.

1 0

commit python-pythran for openSUSE:Factory
by Source-Sync 30 Nov '23

30 Nov '23

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-pythran for openSUSE:Factory checked in at 2023-11-30 21:59:04 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-pythran (Old) and /work/SRC/openSUSE:Factory/.python-pythran.new.25432 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "python-pythran" Thu Nov 30 21:59:04 2023 rev:13 rq:1129689 version:0.14.0 Changes: -------- --- /work/SRC/openSUSE:Factory/python-pythran/python-pythran.changes 2023-11-22 18:54:13.938747508 +0100 +++ /work/SRC/openSUSE:Factory/.python-pythran.new.25432/python-pythran.changes 2023-11-30 21:59:27.796953099 +0100 @@ -1,0 +2,6 @@ +Wed Nov 29 04:27:01 UTC 2023 - Steve Kowalik <steven.kowalik(a)suse.com> + +- Prepare for Python 3.12, by skipping it for the other test flavors, and + adding one for it. + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-pythran.spec ++++++ --- /var/tmp/diff_new_pack.tTijee/_old 2023-11-30 21:59:28.300971667 +0100 +++ /var/tmp/diff_new_pack.tTijee/_new 2023-11-30 21:59:28.300971667 +0100 @@ -22,18 +22,28 @@ %define skip_python38 1 %define skip_python310 1 %define skip_python311 1 +%define skip_python312 1 %endif %if "%{flavor}" == "test-py310" %define psuffix -test-py310 %define skip_python38 1 %define skip_python39 1 %define skip_python311 1 +%define skip_python312 1 %endif %if "%{flavor}" == "test-py311" %define psuffix -test-py311 %define skip_python38 1 %define skip_python39 1 %define skip_python310 1 +%define skip_python312 1 +%endif +%if "%{flavor}" == "test-py312" +%define psuffix -test-py312 +%define skip_python38 1 +%define skip_python39 1 +%define skip_python310 1 +%define skip_python311 1 %endif %if "%{flavor}" == "" %define psuffix %{nil}

1 0

commit python-testfixtures for openSUSE:Factory
by Source-Sync 30 Nov '23

30 Nov '23

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-testfixtures for openSUSE:Factory checked in at 2023-11-30 21:59:03 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-testfixtures (Old) and /work/SRC/openSUSE:Factory/.python-testfixtures.new.25432 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "python-testfixtures" Thu Nov 30 21:59:03 2023 rev:25 rq:1129684 version:7.2.2 Changes: -------- --- /work/SRC/openSUSE:Factory/python-testfixtures/python-testfixtures.changes 2022-12-15 19:24:03.947667343 +0100 +++ /work/SRC/openSUSE:Factory/.python-testfixtures.new.25432/python-testfixtures.changes 2023-11-30 21:59:26.496905207 +0100 @@ -1,0 +2,18 @@ +Wed Nov 29 01:50:24 UTC 2023 - Steve Kowalik <steven.kowalik(a)suse.com> + +- Update to 7.2.2: + * Fix bug in support for :class:`os.PathLike` arguments to + :class:`popen.MockPopen`. + * Added missing support for :class:`os.PathLike` arguments to + :class:`popen.MockPopen`. + * Add ``order_matters`` parameter to :class:`ShouldWarn`. + * Implement new IDE and static-analysis ways of :doc:`mocking <mocking>` + including additional parameters to :meth:`~Replacer.replace` along with + the :any:`replace_on_class`, :any:`replace_in_module` and + :any:`replace_in_environ` context managers. +- Add patch path-comparsion-312.patch: + * Compare paths string-wise, due to Python 3.12 changes. +- Switch to autosetup and pyproject macros. +- Remove now unneeded Python 3.6 special-casing. + +------------------------------------------------------------------- Old: ---- testfixtures-7.0.4.tar.gz New: ---- path-comparsion-312.patch testfixtures-7.2.2.tar.gz BETA DEBUG BEGIN: New: :any:`replace_in_environ` context managers. - Add patch path-comparsion-312.patch: * Compare paths string-wise, due to Python 3.12 changes. BETA DEBUG END: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-testfixtures.spec ++++++ --- /var/tmp/diff_new_pack.AkBqz1/_old 2023-11-30 21:59:27.404938658 +0100 +++ /var/tmp/diff_new_pack.AkBqz1/_new 2023-11-30 21:59:27.404938658 +0100 @@ -1,7 +1,7 @@ # # spec file for package python-testfixtures # -# Copyright (c) 2022 SUSE LLC +# Copyright (c) 2023 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -16,23 +16,26 @@ # -%define skip_python2 1 Name: python-testfixtures -Version: 7.0.4 +Version: 7.2.2 Release: 0 Summary: A collection of helpers and mock objects for unit tests and doc tests License: MIT URL: https://github.com/Simplistix/testfixtures Source: https://files.pythonhosted.org/packages/source/t/testfixtures/testfixtures-… +# PATCH-FIX-UPSTREAM gh#simplistix/testfixtures#720ff80e9cfff17e4f0af1792d866edf49a8f02b +Patch0: path-comparsion-312.patch +BuildRequires: %{python_module Django} BuildRequires: %{python_module Twisted} +BuildRequires: %{python_module pip} BuildRequires: %{python_module pytest >= 3.6} +BuildRequires: %{python_module pytest-django} BuildRequires: %{python_module setuptools} BuildRequires: %{python_module sybil >= 3} +BuildRequires: %{python_module wheel} BuildRequires: %{python_module zope.component} BuildRequires: fdupes BuildRequires: python-rpm-macros -BuildRequires: %{python_module Django if (%python-base without python36-base)} -BuildRequires: %{python_module pytest-django if (%python-base without python36-base)} Suggests: python-Django Suggests: python-Twisted Suggests: python-sybil >= 3 @@ -52,27 +55,25 @@ their own library and give them some tests of their own! %prep -%setup -q -n testfixtures-%{version} -%autopatch -p1 +%autosetup -p1 -n testfixtures-%{version} chmod a-x docs/*.txt %build -%python_build +%pyproject_wheel %install -%python_install +%pyproject_install %python_expand rm -r %{buildroot}%{$python_sitelib}/testfixtures/tests %python_expand %fdupes %{buildroot}%{$python_sitelib} %check export DJANGO_SETTINGS_MODULE=testfixtures.tests.test_django.settings export PYTHONPATH=$(pwd) -python36_flags="--ignore testfixtures/tests/test_django" -%pytest testfixtures/tests ${$python_flags} +%pytest testfixtures/tests %files %{python_files} %license LICENSE.txt %doc README.rst docs/*.txt %{python_sitelib}/testfixtures -%{python_sitelib}/testfixtures-%{version}*-info +%{python_sitelib}/testfixtures-%{version}.dist-info ++++++ path-comparsion-312.patch ++++++ From 720ff80e9cfff17e4f0af1792d866edf49a8f02b Mon Sep 17 00:00:00 2001 From: Chris Withers <chris(a)simplistix.co.uk> Date: Mon, 20 Nov 2023 08:20:33 +0000 Subject: [PATCH] Path internals are unequal on Python 3.12 --- testfixtures/comparison.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/testfixtures/comparison.py b/testfixtures/comparison.py index c05ab75..26bddfa 100644 --- a/testfixtures/comparison.py +++ b/testfixtures/comparison.py @@ -4,6 +4,7 @@ from difflib import unified_diff from functools import partial as partial_type, reduce from operator import __or__ +from pathlib import Path from pprint import pformat from typing import ( Dict, Any, Optional, Sequence, Generator, TypeVar, List, Mapping, Pattern, Union, @@ -445,6 +446,10 @@ def compare_partial(x: partial_type, y: partial_type, context: 'CompareContext') 'attributes ', '.%s') +def compare_path(x: Path, y: Path, context: 'CompareContext') -> Optional[str]: + return compare_text(str(x), str(y), context) + + def _short_repr(obj) -> str: repr_ = repr(obj) if len(repr_) > 30: @@ -470,6 +475,7 @@ def _short_repr(obj) -> str: unittest_mock_call.__class__: compare_call, BaseException: compare_exception, partial_type: compare_partial, + Path: compare_path, } ++++++ testfixtures-7.0.4.tar.gz -> testfixtures-7.2.2.tar.gz ++++++ ++++ 2748 lines of diff (skipped)

1 0

commit openssh for openSUSE:Factory
by Source-Sync 30 Nov '23

30 Nov '23

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package openssh for openSUSE:Factory checked in at 2023-11-30 21:59:01 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/openssh (Old) and /work/SRC/openSUSE:Factory/.openssh.new.25432 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "openssh" Thu Nov 30 21:59:01 2023 rev:168 rq:1129646 version:9.3p2 Changes: -------- --- /work/SRC/openSUSE:Factory/openssh/openssh.changes 2023-10-25 18:02:49.458442925 +0200 +++ /work/SRC/openSUSE:Factory/.openssh.new.25432/openssh.changes 2023-11-30 21:59:23.260785993 +0100 @@ -1,0 +2,24 @@ +Fri Nov 3 10:44:14 UTC 2023 - Johannes Segitz <jsegitz(a)suse.com> + +- Enhanced SELinux functionality. Added + * openssh-7.8p1-role-mls.patch + Proper handling of MLS systems and basis for other SELinux + improvements + * openssh-6.6p1-privsep-selinux.patch + Properly set contexts during privilege separation + * openssh-6.6p1-keycat.patch + Add ssh-keycat command to allow retrival of authorized_keys + on MLS setups with polyinstantiation + * openssh-6.6.1p1-selinux-contexts.patch + Additional changes to set the proper context during privilege + separation + * openssh-7.6p1-cleanup-selinux.patch + Various changes and putting the pieces together + + For now we don't ship the ssh-keycat command, but we need the patch + for the other SELinux infrastructure + + This change fixes issues like bsc#1214788, where the ssh daemon + needs to act on behalf of a user and needs a proper context for this + +------------------------------------------------------------------- New: ---- openssh-6.6.1p1-selinux-contexts.patch openssh-6.6p1-keycat.patch openssh-6.6p1-privsep-selinux.patch openssh-7.6p1-cleanup-selinux.patch openssh-7.8p1-role-mls.patch BETA DEBUG BEGIN: New:/work/SRC/openSUSE:Factory/.openssh.new.25432/openssh.changes- on MLS setups with polyinstantiation /work/SRC/openSUSE:Factory/.openssh.new.25432/openssh.changes: * openssh-6.6.1p1-selinux-contexts.patch /work/SRC/openSUSE:Factory/.openssh.new.25432/openssh.changes- Additional changes to set the proper context during privilege New:/work/SRC/openSUSE:Factory/.openssh.new.25432/openssh.changes- Properly set contexts during privilege separation /work/SRC/openSUSE:Factory/.openssh.new.25432/openssh.changes: * openssh-6.6p1-keycat.patch /work/SRC/openSUSE:Factory/.openssh.new.25432/openssh.changes- Add ssh-keycat command to allow retrival of authorized_keys New:/work/SRC/openSUSE:Factory/.openssh.new.25432/openssh.changes- improvements /work/SRC/openSUSE:Factory/.openssh.new.25432/openssh.changes: * openssh-6.6p1-privsep-selinux.patch /work/SRC/openSUSE:Factory/.openssh.new.25432/openssh.changes- Properly set contexts during privilege separation New:/work/SRC/openSUSE:Factory/.openssh.new.25432/openssh.changes- separation /work/SRC/openSUSE:Factory/.openssh.new.25432/openssh.changes: * openssh-7.6p1-cleanup-selinux.patch /work/SRC/openSUSE:Factory/.openssh.new.25432/openssh.changes- Various changes and putting the pieces together New:/work/SRC/openSUSE:Factory/.openssh.new.25432/openssh.changes-- Enhanced SELinux functionality. Added /work/SRC/openSUSE:Factory/.openssh.new.25432/openssh.changes: * openssh-7.8p1-role-mls.patch /work/SRC/openSUSE:Factory/.openssh.new.25432/openssh.changes- Proper handling of MLS systems and basis for other SELinux BETA DEBUG END: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ openssh.spec ++++++ --- /var/tmp/diff_new_pack.6fInxO/_old 2023-11-30 21:59:25.196857315 +0100 +++ /var/tmp/diff_new_pack.6fInxO/_new 2023-11-30 21:59:25.200857463 +0100 @@ -119,6 +119,11 @@ # PATCH-FIx-UPSTREAM cb4ed12f.patch -- Fix build with zlib 1.3 Patch53: https://github.com/openssh/openssh-portable/commit/cb4ed12f.patch Patch100: fix-missing-lz.patch +Patch102: openssh-7.8p1-role-mls.patch +Patch103: openssh-6.6p1-privsep-selinux.patch +Patch104: openssh-6.6p1-keycat.patch +Patch105: openssh-6.6.1p1-selinux-contexts.patch +Patch106: openssh-7.6p1-cleanup-selinux.patch BuildRequires: audit-devel BuildRequires: automake BuildRequires: groff @@ -383,6 +388,9 @@ mkdir -p %{buildroot}%{_sysusersdir} install -m 644 %{SOURCE14} %{buildroot}%{_sysusersdir}/sshd.conf +rm %{buildroot}/usr/libexec/ssh/ssh-keycat +#rm -r %{buildroot}/usr/lib/debug/.build-id + # the hmac hashes - taken from openssl # # re-define the __os_install_post macro: the macro strips ++++++ openssh-6.6.1p1-selinux-contexts.patch ++++++ Index: openssh-9.3p2/openbsd-compat/port-linux-sshd.c =================================================================== --- openssh-9.3p2.orig/openbsd-compat/port-linux-sshd.c +++ openssh-9.3p2/openbsd-compat/port-linux-sshd.c @@ -33,6 +33,7 @@ #include "misc.h" /* servconf.h needs misc.h for struct ForwardOptions */ #include "servconf.h" #include "port-linux.h" +#include "misc.h" #include "sshkey.h" #include "hostfile.h" #include "auth.h" @@ -451,7 +452,7 @@ sshd_selinux_setup_exec_context(char *pw void sshd_selinux_copy_context(void) { - security_context_t *ctx; + char *ctx; if (!sshd_selinux_enabled()) return; @@ -470,6 +471,72 @@ sshd_selinux_copy_context(void) } } +void +sshd_selinux_change_privsep_preauth_context(void) +{ + int len; + char line[1024], *preauth_context = NULL, *cp, *arg; + const char *contexts_path; + FILE *contexts_file; + struct stat sb; + + contexts_path = selinux_openssh_contexts_path(); + if (contexts_path == NULL) { + debug3_f("Failed to get the path to SELinux context"); + return; + } + + if ((contexts_file = fopen(contexts_path, "r")) == NULL) { + debug_f("Failed to open SELinux context file"); + return; + } + + if (fstat(fileno(contexts_file), &sb) != 0 || + sb.st_uid != 0 || (sb.st_mode & 022) != 0) { + logit_f("SELinux context file needs to be owned by root" + " and not writable by anyone else"); + fclose(contexts_file); + return; + } + + while (fgets(line, sizeof(line), contexts_file)) { + /* Strip trailing whitespace */ + for (len = strlen(line) - 1; len > 0; len--) { + if (strchr(" \t\r\n", line[len]) == NULL) + break; + line[len] = '\0'; + } + + if (line[0] == '\0') + continue; + + cp = line; + arg = strdelim(&cp); + if (arg && *arg == '\0') + arg = strdelim(&cp); + + if (arg && strcmp(arg, "privsep_preauth") == 0) { + arg = strdelim(&cp); + if (!arg || *arg == '\0') { + debug_f("privsep_preauth is empty"); + fclose(contexts_file); + return; + } + preauth_context = xstrdup(arg); + } + } + fclose(contexts_file); + + if (preauth_context == NULL) { + debug_f("Unable to find 'privsep_preauth' option in" + " SELinux context file"); + return; + } + + ssh_selinux_change_context(preauth_context); + free(preauth_context); +} + #endif #endif Index: openssh-9.3p2/openbsd-compat/port-linux.c =================================================================== --- openssh-9.3p2.orig/openbsd-compat/port-linux.c +++ openssh-9.3p2/openbsd-compat/port-linux.c @@ -182,7 +182,7 @@ ssh_selinux_change_context(const char *n strlcpy(newctx + len, newname, newlen - len); if ((cx = index(cx + 1, ':'))) strlcat(newctx, cx, newlen); - debug3("%s: setting context from '%s' to '%s'", __func__, + debug_f("setting context from '%s' to '%s'", oldctx, newctx); if (setcon(newctx) < 0) do_log2(log_level, "%s: setcon %s from %s failed with %s", Index: openssh-9.3p2/openbsd-compat/port-linux.h =================================================================== --- openssh-9.3p2.orig/openbsd-compat/port-linux.h +++ openssh-9.3p2/openbsd-compat/port-linux.h @@ -27,6 +27,7 @@ int sshd_selinux_enabled(void); void sshd_selinux_copy_context(void); void sshd_selinux_setup_exec_context(char *); int sshd_selinux_setup_env_variables(void); +void sshd_selinux_change_privsep_preauth_context(void); #endif #ifdef LINUX_OOM_ADJUST Index: openssh-9.3p2/sshd.c =================================================================== --- openssh-9.3p2.orig/sshd.c +++ openssh-9.3p2/sshd.c @@ -511,7 +511,7 @@ privsep_preauth_child(struct ssh *ssh) demote_sensitive_data(ssh); #ifdef WITH_SELINUX - ssh_selinux_change_context("sshd_net_t"); + sshd_selinux_change_privsep_preauth_context(); #endif /* Demote the child */ ++++++ openssh-6.6p1-keycat.patch ++++++ Index: openssh-9.3p2/misc.c =================================================================== --- openssh-9.3p2.orig/misc.c +++ openssh-9.3p2/misc.c @@ -2770,6 +2770,13 @@ subprocess(const char *tag, const char * error("%s: dup2: %s", tag, strerror(errno)); _exit(1); } +#ifdef WITH_SELINUX + if (sshd_selinux_setup_env_variables() < 0) { + error ("failed to copy environment: %s", + strerror(errno)); + _exit(127); + } +#endif if (env != NULL) execve(av[0], av, env); else Index: openssh-9.3p2/HOWTO.ssh-keycat =================================================================== --- /dev/null +++ openssh-9.3p2/HOWTO.ssh-keycat @@ -0,0 +1,12 @@ +The ssh-keycat retrieves the content of the ~/.ssh/authorized_keys +of an user in any environment. This includes environments with +polyinstantiation of home directories and SELinux MLS policy enabled. + +To use ssh-keycat, set these options in /etc/ssh/sshd_config file: + AuthorizedKeysCommand /usr/libexec/openssh/ssh-keycat + AuthorizedKeysCommandUser root + +Do not forget to enable public key authentication: + PubkeyAuthentication yes + + Index: openssh-9.3p2/Makefile.in =================================================================== --- openssh-9.3p2.orig/Makefile.in +++ openssh-9.3p2/Makefile.in @@ -24,6 +24,7 @@ SSH_PROGRAM=@bindir@/ssh ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass SFTP_SERVER=$(libexecdir)/sftp-server SSH_KEYSIGN=$(libexecdir)/ssh-keysign +SSH_KEYCAT=$(libexecdir)/ssh-keycat SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper SSH_LDAP_HELPER=$(libexecdir)/ssh-ldap-helper @@ -57,6 +58,7 @@ CHANNELLIBS=@CHANNELLIBS@ K5LIBS=@K5LIBS@ GSSLIBS=@GSSLIBS@ SSHDLIBS=@SSHDLIBS@ +KEYCATLIBS=@KEYCATLIBS@ LIBEDIT=@LIBEDIT@ LIBFIDO2=@LIBFIDO2@ LIBWTMPDB=@LIBWTMPDB@ @@ -75,7 +77,7 @@ MKDIR_P=@MKDIR_P@ .SUFFIXES: .lo -TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) +TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) ssh-keycat$(EXEEXT) TARGETS += cavstest-ctr$(EXEEXT) cavstest-kdf$(EXEEXT) @@ -245,6 +247,9 @@ ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) ssh-sk-helper$(EXEEXT): $(LIBCOMPAT) libssh.a $(SKHELPER_OBJS) $(LD) -o $@ $(SKHELPER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS) $(LIBFIDO2) $(CHANNELLIBS) +ssh-keycat$(EXEEXT): $(LIBCOMPAT) $(SSHDOBJS) libssh.a ssh-keycat.o uidswap.o + $(LD) -o $@ ssh-keycat.o uidswap.o $(LDFLAGS) -lssh -lopenbsd-compat $(KEYCATLIBS) $(LIBS) + ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS) $(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) $(CHANNELLIBS) @@ -431,6 +436,7 @@ install-files: $(INSTALL) -m 0755 ssh-ldap-wrapper $(DESTDIR)$(SSH_LDAP_WRAPPER) ; \ fi $(INSTALL) -m 0755 $(STRIP_OPT) ssh-sk-helper$(EXEEXT) $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT) + $(INSTALL) -m 0755 $(STRIP_OPT) ssh-keycat$(EXEEXT) $(DESTDIR)$(libexecdir)/ssh-keycat$(EXEEXT) $(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT) $(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT) $(INSTALL) -m 0755 $(STRIP_OPT) cavstest-ctr$(EXEEXT) $(DESTDIR)$(libexecdir)/cavstest-ctr$(EXEEXT) Index: openssh-9.3p2/openbsd-compat/port-linux.h =================================================================== --- openssh-9.3p2.orig/openbsd-compat/port-linux.h +++ openssh-9.3p2/openbsd-compat/port-linux.h @@ -23,8 +23,10 @@ void ssh_selinux_setup_pty(char *, const void ssh_selinux_change_context(const char *); void ssh_selinux_setfscreatecon(const char *); +int sshd_selinux_enabled(void); void sshd_selinux_copy_context(void); void sshd_selinux_setup_exec_context(char *); +int sshd_selinux_setup_env_variables(void); #endif #ifdef LINUX_OOM_ADJUST Index: openssh-9.3p2/openbsd-compat/port-linux-sshd.c =================================================================== --- openssh-9.3p2.orig/openbsd-compat/port-linux-sshd.c +++ openssh-9.3p2/openbsd-compat/port-linux-sshd.c @@ -53,6 +53,20 @@ extern Authctxt *the_authctxt; extern int inetd_flag; extern int rexeced_flag; +/* Wrapper around is_selinux_enabled() to log its return value once only */ +int +sshd_selinux_enabled(void) +{ + static int enabled = -1; + + if (enabled == -1) { + enabled = (is_selinux_enabled() == 1); + debug("SELinux support %s", enabled ? "enabled" : "disabled"); + } + + return (enabled); +} + /* Send audit message */ static int sshd_selinux_send_audit_message(int success, security_context_t default_context, @@ -318,7 +332,7 @@ sshd_selinux_getctxbyname(char *pwname, /* Setup environment variables for pam_selinux */ static int -sshd_selinux_setup_pam_variables(void) +sshd_selinux_setup_variables(int(*set_it)(char *, const char *)) { const char *reqlvl; char *role; @@ -329,16 +343,16 @@ sshd_selinux_setup_pam_variables(void) ssh_selinux_get_role_level(&role, &reqlvl); - rv = do_pam_putenv("SELINUX_ROLE_REQUESTED", role ? role : ""); + rv = set_it("SELINUX_ROLE_REQUESTED", role ? role : ""); if (inetd_flag && !rexeced_flag) { use_current = "1"; } else { use_current = ""; - rv = rv || do_pam_putenv("SELINUX_LEVEL_REQUESTED", reqlvl ? reqlvl: ""); + rv = rv || set_it("SELINUX_LEVEL_REQUESTED", reqlvl ? reqlvl: ""); } - rv = rv || do_pam_putenv("SELINUX_USE_CURRENT_RANGE", use_current); + rv = rv || set_it("SELINUX_USE_CURRENT_RANGE", use_current); if (role != NULL) free(role); @@ -346,6 +360,24 @@ sshd_selinux_setup_pam_variables(void) return rv; } +static int +sshd_selinux_setup_pam_variables(void) +{ + return sshd_selinux_setup_variables(do_pam_putenv); +} + +static int +do_setenv(char *name, const char *value) +{ + return setenv(name, value, 1); +} + +int +sshd_selinux_setup_env_variables(void) +{ + return sshd_selinux_setup_variables(do_setenv); +} + /* Set the execution context to the default for the specified user */ void sshd_selinux_setup_exec_context(char *pwname) @@ -354,7 +386,7 @@ sshd_selinux_setup_exec_context(char *pw int r = 0; security_context_t default_ctx = NULL; - if (!ssh_selinux_enabled()) + if (!sshd_selinux_enabled()) return; if (options.use_pam) { @@ -421,7 +453,7 @@ sshd_selinux_copy_context(void) { security_context_t *ctx; - if (!ssh_selinux_enabled()) + if (!sshd_selinux_enabled()) return; if (getexeccon((security_context_t *)&ctx) != 0) { Index: openssh-9.3p2/platform.c =================================================================== --- openssh-9.3p2.orig/platform.c +++ openssh-9.3p2/platform.c @@ -100,7 +100,7 @@ platform_setusercontext(struct passwd *p { #ifdef WITH_SELINUX /* Cache selinux status for later use */ - (void)ssh_selinux_enabled(); + (void)sshd_selinux_enabled(); #endif #ifdef USE_SOLARIS_PROJECTS Index: openssh-9.3p2/ssh-keycat.c =================================================================== --- /dev/null +++ openssh-9.3p2/ssh-keycat.c @@ -0,0 +1,241 @@ +/* + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, and the entire permission notice in its entirety, + * including the disclaimer of warranties. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. The name of the author may not be used to endorse or promote + * products derived from this software without specific prior + * written permission. + * + * ALTERNATIVELY, this product may be distributed under the terms of + * the GNU Public License, in which case the provisions of the GPL are + * required INSTEAD OF the above restrictions. (This clause is + * necessary due to a potential bad interaction between the GPL and + * the restrictions contained in a BSD-style copyright.) + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED + * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, + * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +/* + * Copyright (c) 2011 Red Hat, Inc. + * Written by Tomas Mraz <tmraz(a)redhat.com> +*/ + +#define _GNU_SOURCE + +#include "config.h" +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <sys/types.h> +#include <sys/stat.h> +#include <pwd.h> +#include <fcntl.h> +#include <unistd.h> +#ifdef HAVE_STDINT_H +#include <stdint.h> +#endif + +#include <security/pam_appl.h> + +#include "uidswap.h" +#include "misc.h" + +#define ERR_USAGE 1 +#define ERR_PAM_START 2 +#define ERR_OPEN_SESSION 3 +#define ERR_CLOSE_SESSION 4 +#define ERR_PAM_END 5 +#define ERR_GETPWNAM 6 +#define ERR_MEMORY 7 +#define ERR_OPEN 8 +#define ERR_FILE_MODE 9 +#define ERR_FDOPEN 10 +#define ERR_STAT 11 +#define ERR_WRITE 12 +#define ERR_PAM_PUTENV 13 +#define BUFLEN 4096 + +/* Just ignore the messages in the conversation function */ +static int +dummy_conv(int num_msg, const struct pam_message **msgm, + struct pam_response **response, void *appdata_ptr) +{ + struct pam_response *rsp; + + (void)msgm; + (void)appdata_ptr; + + if (num_msg <= 0) + return PAM_CONV_ERR; + + /* Just allocate the array as empty responses */ + rsp = calloc (num_msg, sizeof (struct pam_response)); + if (rsp == NULL) + return PAM_CONV_ERR; + + *response = rsp; + return PAM_SUCCESS; +} + +static struct pam_conv conv = { + dummy_conv, + NULL +}; + +char * +make_auth_keys_name(const struct passwd *pwd) +{ + char *fname; + + if (asprintf(&fname, "%s/.ssh/authorized_keys", pwd->pw_dir) < 0) + return NULL; + + return fname; +} + +int +dump_keys(const char *user) +{ + struct passwd *pwd; + int fd = -1; + FILE *f = NULL; + char *fname = NULL; + int rv = 0; + char buf[BUFLEN]; + size_t len; + struct stat st; + + if ((pwd = getpwnam(user)) == NULL) { + return ERR_GETPWNAM; + } + + if ((fname = make_auth_keys_name(pwd)) == NULL) { + return ERR_MEMORY; + } + + temporarily_use_uid(pwd); + + if ((fd = open(fname, O_RDONLY|O_NONBLOCK|O_NOFOLLOW, 0)) < 0) { + rv = ERR_OPEN; + goto fail; + } + + if (fstat(fd, &st) < 0) { + rv = ERR_STAT; + goto fail; + } + + if (!S_ISREG(st.st_mode) || + (st.st_uid != pwd->pw_uid && st.st_uid != 0)) { + rv = ERR_FILE_MODE; + goto fail; + } + + unset_nonblock(fd); + + if ((f = fdopen(fd, "r")) == NULL) { + rv = ERR_FDOPEN; + goto fail; + } + + fd = -1; + + while ((len = fread(buf, 1, sizeof(buf), f)) > 0) { + rv = fwrite(buf, 1, len, stdout) != len ? ERR_WRITE : 0; + } + +fail: + if (fd != -1) + close(fd); + if (f != NULL) + fclose(f); + free(fname); + restore_uid(); + return rv; +} + +static const char *env_names[] = { "SELINUX_ROLE_REQUESTED", + "SELINUX_LEVEL_REQUESTED", + "SELINUX_USE_CURRENT_RANGE" +}; + +extern char **environ; + +int +set_pam_environment(pam_handle_t *pamh) +{ + int i; + size_t j; + + for (j = 0; j < sizeof(env_names)/sizeof(env_names[0]); ++j) { + int len = strlen(env_names[j]); + + for (i = 0; environ[i] != NULL; ++i) { + if (strncmp(env_names[j], environ[i], len) == 0 && + environ[i][len] == '=') { + if (pam_putenv(pamh, environ[i]) != PAM_SUCCESS) + return ERR_PAM_PUTENV; + } + } + } + + return 0; +} + +int +main(int argc, char *argv[]) +{ + pam_handle_t *pamh = NULL; + int retval; + int ev = 0; + + if (argc != 2) { + fprintf(stderr, "Usage: %s <user-name>\n", argv[0]); + return ERR_USAGE; + } + + retval = pam_start("ssh-keycat", argv[1], &conv, &pamh); + if (retval != PAM_SUCCESS) { + return ERR_PAM_START; + } + + ev = set_pam_environment(pamh); + if (ev != 0) + goto finish; + + retval = pam_open_session(pamh, PAM_SILENT); + if (retval != PAM_SUCCESS) { + ev = ERR_OPEN_SESSION; + goto finish; + } + + ev = dump_keys(argv[1]); + + retval = pam_close_session(pamh, PAM_SILENT); + if (retval != PAM_SUCCESS) { + ev = ERR_CLOSE_SESSION; + } + +finish: + retval = pam_end (pamh,retval); + if (retval != PAM_SUCCESS) { + ev = ERR_PAM_END; + } + return ev; +} Index: openssh-9.3p2/configure.ac =================================================================== --- openssh-9.3p2.orig/configure.ac +++ openssh-9.3p2/configure.ac @@ -3632,6 +3632,7 @@ AC_ARG_WITH([pam], PAM_MSG="yes" SSHDLIBS="$SSHDLIBS -lpam" + KEYCATLIBS="$KEYCATLIBS -lpam" AC_DEFINE([USE_PAM], [1], [Define if you want to enable PAM support]) @@ -3642,6 +3643,7 @@ AC_ARG_WITH([pam], ;; *) SSHDLIBS="$SSHDLIBS -ldl" + KEYCATLIBS="$KEYCATLIBS -ldl" ;; esac fi @@ -4875,6 +4877,7 @@ AC_ARG_WITH([selinux], fi ] ) AC_SUBST([SSHDLIBS]) +AC_SUBST([KEYCATLIBS]) # Check whether user wants Kerberos 5 support KRB5_MSG="no" @@ -5905,6 +5908,9 @@ fi if test ! -z "${SSHDLIBS}"; then echo " +for sshd: ${SSHDLIBS}" fi +if test ! -z "${KEYCATLIBS}"; then +echo " +for ssh-keycat: ${KEYCATLIBS}" +fi echo "" ++++++ openssh-6.6p1-privsep-selinux.patch ++++++ Index: openssh-9.3p2/openbsd-compat/port-linux.h =================================================================== --- openssh-9.3p2.orig/openbsd-compat/port-linux.h +++ openssh-9.3p2/openbsd-compat/port-linux.h @@ -23,6 +23,7 @@ void ssh_selinux_setup_pty(char *, const void ssh_selinux_change_context(const char *); void ssh_selinux_setfscreatecon(const char *); +void sshd_selinux_copy_context(void); void sshd_selinux_setup_exec_context(char *); #endif Index: openssh-9.3p2/openbsd-compat/port-linux-sshd.c =================================================================== --- openssh-9.3p2.orig/openbsd-compat/port-linux-sshd.c +++ openssh-9.3p2/openbsd-compat/port-linux-sshd.c @@ -416,6 +416,28 @@ sshd_selinux_setup_exec_context(char *pw debug3_f("done"); } +void +sshd_selinux_copy_context(void) +{ + security_context_t *ctx; + + if (!ssh_selinux_enabled()) + return; + + if (getexeccon((security_context_t *)&ctx) != 0) { + logit_f("getexeccon failed with %s", strerror(errno)); + return; + } + if (ctx != NULL) { + /* unset exec context before we will lose this capabililty */ + if (setexeccon(NULL) != 0) + fatal_f("setexeccon failed with %s", strerror(errno)); + if (setcon(ctx) != 0) + fatal_f("setcon failed with %s", strerror(errno)); + freecon(ctx); + } +} + #endif #endif Index: openssh-9.3p2/session.c =================================================================== --- openssh-9.3p2.orig/session.c +++ openssh-9.3p2/session.c @@ -1403,7 +1403,7 @@ do_setusercontext(struct passwd *pw) platform_setusercontext(pw); - if (platform_privileged_uidswap()) { + if (platform_privileged_uidswap() && (!is_child || !use_privsep)) { #ifdef HAVE_LOGIN_CAP if (setusercontext(lc, pw, pw->pw_uid, (LOGIN_SETALL & ~(LOGIN_SETPATH|LOGIN_SETUSER))) < 0) { @@ -1435,6 +1435,9 @@ do_setusercontext(struct passwd *pw) (unsigned long long)pw->pw_uid); chroot_path = percent_expand(tmp, "h", pw->pw_dir, "u", pw->pw_name, "U", uidstr, (char *)NULL); +#ifdef WITH_SELINUX + sshd_selinux_copy_context(); +#endif safely_chroot(chroot_path, pw->pw_uid); free(tmp); free(chroot_path); @@ -1470,6 +1473,11 @@ do_setusercontext(struct passwd *pw) /* Permanently switch to the desired uid. */ permanently_set_uid(pw); #endif + +#ifdef WITH_SELINUX + if (in_chroot == 0) + sshd_selinux_copy_context(); +#endif } else if (options.chroot_directory != NULL && strcasecmp(options.chroot_directory, "none") != 0) { fatal("server lacks privileges to chroot to ChrootDirectory"); @@ -1487,9 +1495,6 @@ do_pwchange(Session *s) if (s->ttyfd != -1) { fprintf(stderr, "You must change your password now and login again!\n"); -#ifdef WITH_SELINUX - setexeccon(NULL); -#endif #ifdef PASSWD_NEEDS_USERNAME execl(_PATH_PASSWD_PROG, "passwd", s->pw->pw_name, (char *)NULL); @@ -1723,9 +1728,6 @@ do_child(struct ssh *ssh, Session *s, co argv[i] = NULL; optind = optreset = 1; __progname = argv[0]; -#ifdef WITH_SELINUX - ssh_selinux_change_context("sftpd_t"); -#endif exit(sftp_server_main(i, argv, s->pw)); } Index: openssh-9.3p2/sshd.c =================================================================== --- openssh-9.3p2.orig/sshd.c +++ openssh-9.3p2/sshd.c @@ -510,6 +510,10 @@ privsep_preauth_child(struct ssh *ssh) /* Demote the private keys to public keys. */ demote_sensitive_data(ssh); +#ifdef WITH_SELINUX + ssh_selinux_change_context("sshd_net_t"); +#endif + /* Demote the child */ if (privsep_chroot) { /* Change our root directory */ @@ -602,6 +606,9 @@ privsep_postauth(struct ssh *ssh, Authct { #ifdef DISABLE_FD_PASSING if (1) { +#elif defined(WITH_SELINUX) + if (0) { + /* even root user can be confined by SELinux */ #else if (authctxt->pw->pw_uid == 0) { #endif ++++++ openssh-7.6p1-cleanup-selinux.patch ++++++ Index: openssh-9.3p2/auth2-pubkey.c =================================================================== --- openssh-9.3p2.orig/auth2-pubkey.c +++ openssh-9.3p2/auth2-pubkey.c @@ -72,6 +72,9 @@ /* import */ extern ServerOptions options; +extern int inetd_flag; +extern int rexeced_flag; +extern Authctxt *the_authctxt; static char * format_key(const struct sshkey *key) @@ -459,7 +462,8 @@ match_principals_command(struct passwd * if ((pid = subprocess("AuthorizedPrincipalsCommand", command, ac, av, &f, SSH_SUBPROCESS_STDOUT_CAPTURE|SSH_SUBPROCESS_STDERR_DISCARD, - runas_pw, temporarily_use_uid, restore_uid)) == 0) + runas_pw, temporarily_use_uid, restore_uid, + (inetd_flag && !rexeced_flag), the_authctxt)) == 0) goto out; uid_swapped = 1; @@ -727,7 +731,8 @@ user_key_command_allowed2(struct passwd if ((pid = subprocess("AuthorizedKeysCommand", command, ac, av, &f, SSH_SUBPROCESS_STDOUT_CAPTURE|SSH_SUBPROCESS_STDERR_DISCARD, - runas_pw, temporarily_use_uid, restore_uid)) == 0) + runas_pw, temporarily_use_uid, restore_uid, + (inetd_flag && !rexeced_flag), the_authctxt)) == 0) goto out; uid_swapped = 1; Index: openssh-9.3p2/misc.c =================================================================== --- openssh-9.3p2.orig/misc.c +++ openssh-9.3p2/misc.c @@ -2637,7 +2637,8 @@ stdfd_devnull(int do_stdin, int do_stdou pid_t subprocess(const char *tag, const char *command, int ac, char **av, FILE **child, u_int flags, - struct passwd *pw, privdrop_fn *drop_privs, privrestore_fn *restore_privs) + struct passwd *pw, privdrop_fn *drop_privs, + privrestore_fn *restore_privs, int inetd, void *the_authctxt) { FILE *f = NULL; struct stat st; @@ -2771,7 +2772,7 @@ subprocess(const char *tag, const char * _exit(1); } #ifdef WITH_SELINUX - if (sshd_selinux_setup_env_variables() < 0) { + if (sshd_selinux_setup_env_variables(inetd, the_authctxt) < 0) { error ("failed to copy environment: %s", strerror(errno)); _exit(127); Index: openssh-9.3p2/misc.h =================================================================== --- openssh-9.3p2.orig/misc.h +++ openssh-9.3p2/misc.h @@ -110,7 +110,7 @@ typedef void privrestore_fn(void); #define SSH_SUBPROCESS_UNSAFE_PATH (1<<3) /* Don't check for safe cmd */ #define SSH_SUBPROCESS_PRESERVE_ENV (1<<4) /* Keep parent environment */ pid_t subprocess(const char *, const char *, int, char **, FILE **, u_int, - struct passwd *, privdrop_fn *, privrestore_fn *); + struct passwd *, privdrop_fn *, privrestore_fn *, int, void *); typedef struct arglist arglist; struct arglist { Index: openssh-9.3p2/openbsd-compat/port-linux.h =================================================================== --- openssh-9.3p2.orig/openbsd-compat/port-linux.h +++ openssh-9.3p2/openbsd-compat/port-linux.h @@ -25,8 +25,8 @@ void ssh_selinux_setfscreatecon(const ch int sshd_selinux_enabled(void); void sshd_selinux_copy_context(void); -void sshd_selinux_setup_exec_context(char *); -int sshd_selinux_setup_env_variables(void); +void sshd_selinux_setup_exec_context(char *, int, int(char *, const char *), void *, int); +int sshd_selinux_setup_env_variables(int inetd, void *); void sshd_selinux_change_privsep_preauth_context(void); #endif Index: openssh-9.3p2/openbsd-compat/port-linux-sshd.c =================================================================== --- openssh-9.3p2.orig/openbsd-compat/port-linux-sshd.c +++ openssh-9.3p2/openbsd-compat/port-linux-sshd.c @@ -49,11 +49,6 @@ #include <unistd.h> #endif -extern ServerOptions options; -extern Authctxt *the_authctxt; -extern int inetd_flag; -extern int rexeced_flag; - /* Wrapper around is_selinux_enabled() to log its return value once only */ int sshd_selinux_enabled(void) @@ -223,7 +218,8 @@ get_user_context(const char *sename, con } static void -ssh_selinux_get_role_level(char **role, const char **level) +ssh_selinux_get_role_level(char **role, const char **level, + Authctxt *the_authctxt) { *role = NULL; *level = NULL; @@ -241,8 +237,8 @@ ssh_selinux_get_role_level(char **role, /* Return the default security context for the given username */ static int -sshd_selinux_getctxbyname(char *pwname, - security_context_t *default_sc, security_context_t *user_sc) +sshd_selinux_getctxbyname(char *pwname, security_context_t *default_sc, + security_context_t *user_sc, int inetd, Authctxt *the_authctxt) { char *sename, *lvl; char *role; @@ -250,7 +246,7 @@ sshd_selinux_getctxbyname(char *pwname, int r = 0; context_t con = NULL; - ssh_selinux_get_role_level(&role, &reqlvl); + ssh_selinux_get_role_level(&role, &reqlvl, the_authctxt); #ifdef HAVE_GETSEUSERBYNAME if ((r=getseuserbyname(pwname, &sename, &lvl)) != 0) { @@ -272,7 +268,7 @@ sshd_selinux_getctxbyname(char *pwname, if (r == 0) { /* If launched from xinetd, we must use current level */ - if (inetd_flag && !rexeced_flag) { + if (inetd) { security_context_t sshdsc=NULL; if (getcon_raw(&sshdsc) < 0) @@ -333,7 +329,8 @@ sshd_selinux_getctxbyname(char *pwname, /* Setup environment variables for pam_selinux */ static int -sshd_selinux_setup_variables(int(*set_it)(char *, const char *)) +sshd_selinux_setup_variables(int(*set_it)(char *, const char *), int inetd, + Authctxt *the_authctxt) { const char *reqlvl; char *role; @@ -342,11 +339,11 @@ sshd_selinux_setup_variables(int(*set_it debug3_f("setting execution context"); - ssh_selinux_get_role_level(&role, &reqlvl); + ssh_selinux_get_role_level(&role, &reqlvl, the_authctxt); rv = set_it("SELINUX_ROLE_REQUESTED", role ? role : ""); - if (inetd_flag && !rexeced_flag) { + if (inetd) { use_current = "1"; } else { use_current = ""; @@ -362,9 +359,10 @@ sshd_selinux_setup_variables(int(*set_it } static int -sshd_selinux_setup_pam_variables(void) +sshd_selinux_setup_pam_variables(int inetd, + int(pam_setenv)(char *, const char *), Authctxt *the_authctxt) { - return sshd_selinux_setup_variables(do_pam_putenv); + return sshd_selinux_setup_variables(pam_setenv, inetd, the_authctxt); } static int @@ -374,25 +372,28 @@ do_setenv(char *name, const char *value) } int -sshd_selinux_setup_env_variables(void) +sshd_selinux_setup_env_variables(int inetd, void *the_authctxt) { - return sshd_selinux_setup_variables(do_setenv); + Authctxt *authctxt = (Authctxt *) the_authctxt; + return sshd_selinux_setup_variables(do_setenv, inetd, authctxt); } /* Set the execution context to the default for the specified user */ void -sshd_selinux_setup_exec_context(char *pwname) +sshd_selinux_setup_exec_context(char *pwname, int inetd, + int(pam_setenv)(char *, const char *), void *the_authctxt, int use_pam) { security_context_t user_ctx = NULL; int r = 0; security_context_t default_ctx = NULL; + Authctxt *authctxt = (Authctxt *) the_authctxt; if (!sshd_selinux_enabled()) return; - if (options.use_pam) { + if (use_pam) { /* do not compute context, just setup environment for pam_selinux */ - if (sshd_selinux_setup_pam_variables()) { + if (sshd_selinux_setup_pam_variables(inetd, pam_setenv, authctxt)) { switch (security_getenforce()) { case -1: fatal_f("security_getenforce() failed"); @@ -408,7 +409,7 @@ sshd_selinux_setup_exec_context(char *pw debug3_f("setting execution context"); - r = sshd_selinux_getctxbyname(pwname, &default_ctx, &user_ctx); + r = sshd_selinux_getctxbyname(pwname, &default_ctx, &user_ctx, inetd, authctxt); if (r >= 0) { r = setexeccon(user_ctx); if (r < 0) { Index: openssh-9.3p2/platform.c =================================================================== --- openssh-9.3p2.orig/platform.c +++ openssh-9.3p2/platform.c @@ -34,6 +34,9 @@ extern int use_privsep; extern ServerOptions options; +extern int inetd_flag; +extern int rexeced_flag; +extern Authctxt *the_authctxt; void platform_pre_listen(void) @@ -185,7 +188,9 @@ platform_setusercontext_post_groups(stru } #endif /* HAVE_SETPCRED */ #ifdef WITH_SELINUX - sshd_selinux_setup_exec_context(pw->pw_name); + sshd_selinux_setup_exec_context(pw->pw_name, + (inetd_flag && !rexeced_flag), do_pam_putenv, the_authctxt, + options.use_pam); #endif } Index: openssh-9.3p2/sshd.c =================================================================== --- openssh-9.3p2.orig/sshd.c +++ openssh-9.3p2/sshd.c @@ -166,7 +166,7 @@ int debug_flag = 0; static int test_flag = 0; /* Flag indicating that the daemon is being started from inetd. */ -static int inetd_flag = 0; +int inetd_flag = 0; /* Flag indicating that sshd should not detach and become a daemon. */ static int no_daemon_flag = 0; @@ -179,7 +179,7 @@ static char **saved_argv; static int saved_argc; /* re-exec */ -static int rexeced_flag = 0; +int rexeced_flag = 0; static int rexec_flag = 1; static int rexec_argc = 0; static char **rexec_argv; @@ -2396,7 +2396,9 @@ main(int ac, char **av) } #endif #ifdef WITH_SELINUX - sshd_selinux_setup_exec_context(authctxt->pw->pw_name); + sshd_selinux_setup_exec_context(authctxt->pw->pw_name, + (inetd_flag && !rexeced_flag), do_pam_putenv, the_authctxt, + options.use_pam); #endif #ifdef USE_PAM if (options.use_pam) { Index: openssh-9.3p2/sshconnect.c =================================================================== --- openssh-9.3p2.orig/sshconnect.c +++ openssh-9.3p2/sshconnect.c @@ -893,7 +893,7 @@ load_hostkeys_command(struct hostkeys *h if ((pid = subprocess(tag, command, ac, av, &f, SSH_SUBPROCESS_STDOUT_CAPTURE|SSH_SUBPROCESS_UNSAFE_PATH| - SSH_SUBPROCESS_PRESERVE_ENV, NULL, NULL, NULL)) == 0) + SSH_SUBPROCESS_PRESERVE_ENV, NULL, NULL, NULL, 0, NULL)) == 0) goto out; load_hostkeys_file(hostkeys, hostfile_hostname, tag, f, 1); ++++++ openssh-7.8p1-role-mls.patch ++++++ ++++ 886 lines (skipped)

1 0

commit usbutils for openSUSE:Factory
by Source-Sync 30 Nov '23

30 Nov '23

Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package usbutils for openSUSE:Factory checked in at 2023-11-30 21:59:01 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/usbutils (Old) and /work/SRC/openSUSE:Factory/.usbutils.new.25432 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "usbutils" Thu Nov 30 21:59:01 2023 rev:46 rq:1129643 version:017 Changes: -------- --- /work/SRC/openSUSE:Factory/usbutils/usbutils.changes 2023-11-27 22:41:54.130576339 +0100 +++ /work/SRC/openSUSE:Factory/.usbutils.new.25432/usbutils.changes 2023-11-30 21:59:19.688654402 +0100 @@ -1,0 +2,8 @@ +Tue Nov 28 13:16:27 UTC 2023 - Dominique Leuenberger <dimstar(a)opensuse.org> + +- Split out devel package, containing the .pc file: + + The .pc file declares dependencies on other devel packages, + which is not wanted on regular end-user systems. + + Drop rpmlintrc file. + +------------------------------------------------------------------- Old: ---- usbutils-rpmlintrc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ usbutils.spec ++++++ --- /var/tmp/diff_new_pack.eoiFcL/_old 2023-11-30 21:59:20.500684316 +0100 +++ /var/tmp/diff_new_pack.eoiFcL/_new 2023-11-30 21:59:20.500684316 +0100 @@ -24,7 +24,6 @@ Group: Hardware/Other URL: https://sourceforge.net/projects/linux-usb/ Source0: https://github.com/gregkh/usbutils/archive/refs/tags/v%{version}.tar.gz -Source1: usbutils-rpmlintrc BuildRequires: autoconf BuildRequires: automake BuildRequires: libtool @@ -37,6 +36,16 @@ This package contains a utility for inspecting devices connected to USB ports. +%package devel +Summary: Developer tools and libraries for USB devices +Requires: %{name} = %{version} + +%description devel +This package contains a utility for inspecting devices connected to USB +ports. + +This package is needed when programatically locating the usbutils database + %prep %setup -q @@ -60,5 +69,7 @@ %{_mandir}/man1/usb-devices.1%{?ext_man} %{_mandir}/man8/lsusb.8%{?ext_man} %{_mandir}/man8/usbhid-dump.8%{?ext_man} + +%files devel %{_libdir}/pkgconfig/usbutils.pc

1 0