diff --git a/.dbus-glib.metadata b/.dbus-glib.metadata new file mode 100644 index 0000000..08d08ec --- /dev/null +++ b/.dbus-glib.metadata @@ -0,0 +1 @@ +dc58ec3466fc08cd1ec7c5ccc0d45c7881fb0610 SOURCES/dbus-glib-0.100.tar.gz diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..e4f30be --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +SOURCES/dbus-glib-0.100.tar.gz diff --git a/SOURCES/0001-CVE-2013-0292-dbus-gproxy-Verify-sender-of-NameOwner.patch b/SOURCES/0001-CVE-2013-0292-dbus-gproxy-Verify-sender-of-NameOwner.patch new file mode 100644 index 0000000..b168d13 --- /dev/null +++ b/SOURCES/0001-CVE-2013-0292-dbus-gproxy-Verify-sender-of-NameOwner.patch @@ -0,0 +1,51 @@ +From 166978a09cf5edff4028e670b6074215a4c75eca Mon Sep 17 00:00:00 2001 +From: Colin Walters +Date: Thu, 14 Feb 2013 10:19:34 -0500 +Subject: [PATCH] CVE-2013-0292: dbus-gproxy: Verify sender of NameOwnerChanged signals to be o.f.DBus + +Anyone can hop on the bus and emit a signal whose interface is +o.f.DBus; it's expected at the moments that clients (and notably DBus +libraries) check the sender. + +This could previously be used to trick a system service using dbus-glib +into thinking a malicious signal came from a privileged source, by +claiming that ownership of the privileged source's well-known name had +changed from the privileged source's real unique name to the attacker's +unique name. + +[altered to be NULL-safe so it won't crash on peer connections -smcv] +Signed-off-by: Simon McVittie +Reviewed-by: Simon McVittie +--- + dbus/dbus-gproxy.c | 7 ++++--- + 1 files changed, 4 insertions(+), 3 deletions(-) + +diff --git a/dbus/dbus-gproxy.c b/dbus/dbus-gproxy.c +index 2fc52f9..c3ae9ec 100644 +--- a/dbus/dbus-gproxy.c ++++ b/dbus/dbus-gproxy.c +@@ -1250,8 +1250,11 @@ dbus_g_proxy_manager_filter (DBusConnection *connection, + GSList *tmp; + const char *sender; + ++ sender = dbus_message_get_sender (message); ++ + /* First we handle NameOwnerChanged internally */ +- if (dbus_message_is_signal (message, ++ if (g_strcmp0 (sender, DBUS_SERVICE_DBUS) == 0 && ++ dbus_message_is_signal (message, + DBUS_INTERFACE_DBUS, + "NameOwnerChanged")) + { +@@ -1280,8 +1283,6 @@ dbus_g_proxy_manager_filter (DBusConnection *connection, + } + } + +- sender = dbus_message_get_sender (message); +- + /* dbus spec requires these, libdbus validates */ + g_assert (dbus_message_get_path (message) != NULL); + g_assert (dbus_message_get_interface (message) != NULL); +-- +1.7.1 + diff --git a/SPECS/dbus-glib.spec b/SPECS/dbus-glib.spec new file mode 100644 index 0000000..cab1e05 --- /dev/null +++ b/SPECS/dbus-glib.spec @@ -0,0 +1,294 @@ +%define gettext_package dbus + +%define expat_version 1.95.5 +%define glib2_version 2.2.0 +%define gtk2_version 2.4.0 +%define dbus_version 1.1 + +Summary: GLib bindings for D-Bus +Name: dbus-glib +Version: 0.100 +Release: 7%{?dist} +URL: http://www.freedesktop.org/software/dbus/ +#VCS: git:git://git.freedesktop.org/git/dbus/dbus-glib +Source0: http://dbus.freedesktop.org/releases/dbus-glib/%{name}-%{version}.tar.gz +License: AFL and GPLv2+ +Group: System Environment/Libraries +BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) +Requires: chkconfig >= 1.3.26 +BuildRequires: libtool +BuildRequires: dbus-devel >= %{dbus_version} +BuildRequires: expat-devel >= %{expat_version} +BuildRequires: libxml2-devel +BuildRequires: glib2-devel >= %{glib2_version} +BuildRequires: gettext + +Patch0: 0001-CVE-2013-0292-dbus-gproxy-Verify-sender-of-NameOwner.patch + +%description + +D-Bus add-on library to integrate the standard D-Bus library with +the GLib thread abstraction and main loop. + +%package devel +Summary: Libraries and headers for the D-Bus GLib bindings +Group: Development/Libraries +Requires: %name = %{version}-%{release} +Requires: glib2-devel +Requires: dbus-devel +Requires: pkgconfig +Obsoletes: dbus-devel < 0.90 + +%description devel + +Headers and static libraries for the D-Bus GLib bindings + +%if 0 +%package gtk +Summary: GTK based tools +Group: Development/Tools +Requires: %name = %{version}-%{release} +Requires: gtk2 >= %{gtk_version} +%description gtk + +D-Bus tools written using the gtk+ GUI libaries + +%endif + +%prep +%setup -q +%patch0 -p1 + +%build +%configure --disable-tests \ + --enable-verbose-mode=yes \ + --enable-asserts=yes \ + --disable-gtk-doc + +#build with checks for right now but disable checks for final release +#%configure --disable-tests --disable-verbose-mode --disable-asserts +make + +%install +rm -rf %{buildroot} + +make install DESTDIR=$RPM_BUILD_ROOT + +rm -f $RPM_BUILD_ROOT%{_libdir}/*.a +rm -f $RPM_BUILD_ROOT%{_libdir}/*.la + +%clean +rm -rf %{buildroot} + + +%post -p /sbin/ldconfig + +%postun -p /sbin/ldconfig + +%files +%defattr(-,root,root) + +%doc COPYING NEWS + +%{_libdir}/*glib*.so.* +%{_bindir}/dbus-binding-tool + +%files devel +%defattr(-,root,root) + +%{_libdir}/lib*.so +%{_libdir}/pkgconfig/dbus-glib-1.pc +%{_includedir}/dbus-1.0/dbus/* +%{_datadir}/gtk-doc/html/dbus-glib +%{_mandir}/man1/* +%{_sysconfdir}/bash_completion.d/dbus-bash-completion.sh +%{_libexecdir}/dbus-bash-completion-helper + +%if 0 +%files gtk +%defattr(-,root,root) + +%{_bindir}/dbus-viewer + +%endif + +%changelog +* Fri Jan 24 2014 Daniel Mach - 0.100-7 +- Mass rebuild 2014-01-24 + +* Fri Dec 27 2013 Daniel Mach - 0.100-6 +- Mass rebuild 2013-12-27 + +* Mon Jul 01 2013 Colin Walters - 0.100-5 +- CVE-2013-0292 (previous patch was not actually applied) +- Resolves: #911714 + +* Fri Jun 21 2013 Matthias Clasen - 0.100-4 +- Don't install ChangeLog (need to save space on the live image) + +* Wed Feb 20 2013 Colin Walters - 0.100-3 +- CVE-2013-0292 + Resolves: #911714 + +* Wed Feb 13 2013 Fedora Release Engineering - 0.100-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild + +* Tue Jul 17 2012 Colin Walters - 0.100-1 +- Update to 0.100 + +* Fri Jan 13 2012 Fedora Release Engineering - 0.92-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild + +* Tue Feb 08 2011 Fedora Release Engineering - 0.92-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild + +* Sat Jan 22 2011 Christopher Aillon - 0.92-1 +- Update to 0.92 + +* Wed Sep 29 2010 jkeating - 0.88-3 +- Rebuilt for gcc bug 634757 + +* Tue Sep 21 2010 Colin Walters - 0.88-2 +- Drop .gir file, it's now in gobject-introspection + +* Thu Aug 12 2010 Colin Walters - 0.88-1 +- New upstream version +- drop now-merged shadow props patch + +* Mon Jul 12 2010 Colin Walters - 0.86-4 +- Rebuild against new gobject-introspection + +* Tue Jun 29 2010 Dan Williams - 0.86-3 +- Fix shadow property access (fdo #28835) + +* Tue Jun 29 2010 Bastien Nocera 0.86-2 +- Add introspection data from gir-repository +- Remove unneeded autotools calls + +* Thu Mar 18 2010 Colin Walters - 0.86-1 +- New upstream + Drop upstreamed patch + +* Tue Mar 02 2010 Colin Walters - 0.84-3 +- Revert previous broken patch for error names, add better fix + +* Mon Feb 15 2010 Colin Walters - 0.84-2 +- Add patch to avoid assertions when setting a GError that + includes a '-' in the enumeration value. Should fix #528897 + +* Wed Jan 27 2010 Colin Walters - 0.84-1 +- New upstream + Has introspect.xml internally, drop it from here + +* Fri Jan 15 2010 Colin Walters - 0.82-3 +- Add ListActivatableNames to dbus-bus-introspect.xml to help tracker build + +* Fri Jul 24 2009 Fedora Release Engineering - 0.82-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild + +* Thu Jul 16 2009 Colin Walters - 0.82-1 +- New upstream 0.82 +- Remove mclasen accidental commit of CFLAGS="-O0 -g3" + +* Sun Jun 14 2009 Matthias Clasen - 0.80-3 +- Minor directory ownership cleanup + +* Tue Feb 24 2009 Fedora Release Engineering - 0.80-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild + +* Mon Feb 02 2009 Colin Walters - 0.80-1 +- New upstream release +- Adjust to new bash completion dir +- Includes patch noreply patch + +* Wed Jan 07 2009 Colin Walters - 0.78-2 +- Add patch to avoid sending reply to noreply messages; this avoids + some spurious dbus denial logs during system startup from NM + +* Thu Dec 04 2008 Colin Walters - 0.78-1 +- New upstream release, drop upstreamed patches + +* Tue Nov 25 2008 Matthias Clasen - 0.76-4 +- Avoid some spurious linkage + +* Mon Nov 17 2008 Dan Williams - 0.76-3 +- Fix crashes when a tracked service restarts too quickly (fdo #18573) + +* Thu Jul 31 2008 David Zeuthen - 0.76-2 +- Add bash completion for dbus-send(1) + +* Thu Jun 05 2008 Colin Walters - 0.76-1 +- New upstream 0.76 +- Drop all upstreamed patches + +* Tue May 27 2008 Dan Williams - 0.74-9 +- Handle unknown object properties without asserting (fdo #16079) +- Handle GetAll() property names correctly (fdo #16114) +- Enable the freeze-abi patch +- Cherry-pick some fixes from upstream git + +* Thu May 8 2008 Matthias Clasen - 0.74-8 +- Fix license field + +* Tue Apr 15 2008 Colin Walters - 0.74-7 +- Ensure ABI is frozen as it stands now + +* Fri Apr 4 2008 David Zeuthen - 0.74-6 +- Add another upstreamed patch for setting the default timeout + on a proxy + +* Fri Apr 4 2008 David Zeuthen - 0.74-5 +- Add an already upstreamed patch to export the GetAll() method on + the org.freedesktop.DBus.Properties interface + +* Wed Mar 19 2008 Dan Williams - 0.74-4 +- Ignore children of namespaced nodes too + +* Tue Feb 12 2008 Dan Williams - 0.74-3 +- Ignore namespaces in introspection XML + +* Sun Nov 18 2007 Dan Williams - 0.74-2 +- Actually apply the patch for fdo #12505 + +* Mon Oct 22 2007 Ray Strode - 0.74-1 +- Update to 0.74 + +* Mon Sep 24 2007 Dan Williams - 0.73-4 +- Dispatch NameOwnerChanged signals to proxies only once (fdo #12505) + +* Sat Sep 15 2007 Matthias Clasen - 0.73-3 +- Rebuild against new expat + +* Wed Aug 1 2007 Matthias Clasen - 0.73-2 +- Fix a bug in introspection support (#248150) + +* Wed Apr 4 2007 Matthias Clasen - 0.73-1 +- Update to 0.73 (#233631) +- Drop upstreamed patches + +* Tue Dec 19 2006 John (J5) Palmieri - 0.71-4 +- Add dbus-glib-0.70-use-default-threads.patch +- Partial fix to #219257 + +* Wed Nov 29 2006 David Zeuthen - 0.71-3%{?dist} +- Add dbus-glib-0.70-fix-info-leak.patch +- Resolves: #216034 + +* Sun Nov 5 2006 Matthias Clasen - 0.71-2 +- Fix up Requires for the -devel package + +* Mon Oct 23 2006 Matthias Clasen - 0.71-1 +- Update to 0.71 + +* Thu Jul 20 2006 Jesse Keating - 0.70-4 +- remove improper obsoletes + +* Tue Jul 18 2006 John (J5) Palmieri - 0.70-3 +- Pregenerate the xml introspect file so you don't need dbus running during + the build + +* Tue Jul 18 2006 John (J5) Palmieri - 0.70-2 +- Spec file cleanups + +* Mon Jul 17 2006 John (J5) Palmieri - 0.70-1 +- Initial dbus-glib package