diff options
Diffstat (limited to 'app-admin/system-tools-backends/files')
3 files changed, 92 insertions, 0 deletions
diff --git a/app-admin/system-tools-backends/files/stb.rc b/app-admin/system-tools-backends/files/stb.rc new file mode 100644 index 000000000000..814f0d359570 --- /dev/null +++ b/app-admin/system-tools-backends/files/stb.rc @@ -0,0 +1,20 @@ +#!/sbin/openrc-run +# Copyright 1999-2007 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +depend() { + need dbus +} + +start() { + ebegin "Starting system-tools-backend" + start-stop-daemon --start --exec /usr/sbin/system-tools-backends -- -D + eend $? +} + +stop() { + ebegin "Stopping system-tools-backend" + start-stop-daemon --stop --pidfile /var/run/system-tools-backends.pid + eend $? +} + diff --git a/app-admin/system-tools-backends/files/system-tools-backends-2.8.2-cve-2008-4311.patch b/app-admin/system-tools-backends/files/system-tools-backends-2.8.2-cve-2008-4311.patch new file mode 100644 index 000000000000..47f93da74f16 --- /dev/null +++ b/app-admin/system-tools-backends/files/system-tools-backends-2.8.2-cve-2008-4311.patch @@ -0,0 +1,47 @@ +From 544d679c2796602ff277e78e238abd56d30ad633 Mon Sep 17 00:00:00 2001 +From: Gilles Dartiguelongue <eva@gentoo.org> +Date: Mon, 14 Dec 2009 20:37:58 +0100 +Subject: [PATCH 3/4] Gentoo: fix CVE-2008-4311 + +commit fd648907e46017d46c367f59c62d0b0395830903 +Author: Simon McVittie <http://smcv.pseudorandom.co.uk/> +Date: 2009-01-04 19:35:51 +0000 + + Allow root to send messages to all the system tools backends, so + they work even when CVE-2008-4311 has been fixed. + + Also disallow normal user access by destination, not by + interface (fd.o #18961). +--- + org.freedesktop.SystemToolsBackends.conf | 8 ++++---- + 1 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/org.freedesktop.SystemToolsBackends.conf b/org.freedesktop.SystemToolsBackends.conf +index 58972ee..537ef73 100644 +--- a/org.freedesktop.SystemToolsBackends.conf ++++ b/org.freedesktop.SystemToolsBackends.conf +@@ -22,8 +22,10 @@ + <allow send_interface="org.freedesktop.SystemToolsBackends.Platform" send_member="getPlatform"/> + --> + +- <!-- Only allow talking to the dispatcher --> +- <allow send_destination="org.freedesktop.SystemToolsBackends"/> ++ <!-- configuration modules can't be accessed directly... --> ++ <deny send_destination="org.freedesktop.SystemToolsBackends"/> ++ <deny send_destination="org.freedesktop.SystemToolsBackends.Platform"/> ++ <deny send_destination="org.freedesktop.SystemToolsBackends"/> + </policy> + + <policy user="0"> +@@ -45,8 +47,6 @@ + + <!-- be able to speak to configuration modules, + so any message to them has to go through the dispatcher --> +- <allow send_interface="org.freedesktop.SystemToolsBackends"/> +- <allow send_interface="org.freedesktop.SystemToolsBackends.Platform"/> + <allow send_destination="org.freedesktop.SystemToolsBackends"/> + <allow send_destination="org.freedesktop.SystemToolsBackends.Platform"/> + <allow send_destination="org.freedesktop.SystemToolsBackends.GroupsConfig"/> +-- +1.6.5.4 + diff --git a/app-admin/system-tools-backends/files/system-tools-backends-2.8.2-default-permissions.patch b/app-admin/system-tools-backends/files/system-tools-backends-2.8.2-default-permissions.patch new file mode 100644 index 000000000000..bc58ba4fb1f9 --- /dev/null +++ b/app-admin/system-tools-backends/files/system-tools-backends-2.8.2-default-permissions.patch @@ -0,0 +1,25 @@ +From ea88120dac8ba2c2dabf4c393c283f69b3d33b5a Mon Sep 17 00:00:00 2001 +From: Gilles Dartiguelongue <eva@gentoo.org> +Date: Mon, 14 Dec 2009 20:37:15 +0100 +Subject: [PATCH 2/4] Gentoo: restrict access to stb to users in stb-admin group + +--- + org.freedesktop.SystemToolsBackends.conf | 4 ++++ + 1 files changed, 4 insertions(+), 0 deletions(-) + +diff --git a/org.freedesktop.SystemToolsBackends.conf b/org.freedesktop.SystemToolsBackends.conf +index d031525..58972ee 100644 +--- a/org.freedesktop.SystemToolsBackends.conf ++++ b/org.freedesktop.SystemToolsBackends.conf +@@ -60,4 +60,8 @@ + <allow send_destination="org.freedesktop.SystemToolsBackends.UserConfig"/> + <allow send_destination="org.freedesktop.SystemToolsBackends.UsersConfig"/> + </policy> ++ <policy group="stb-admin"> ++ <!-- be able to speak to the dispatcher --> ++ <allow send_destination="org.freedesktop.SystemToolsBackends"/> ++ </policy> + </busconfig> +-- +1.6.5.4 + |