On Wed, 06 Nov 2019 at 12:08:47 +0000, Adam D. Barratt wrote:
> On 2019-11-04 19:12, Simon McVittie wrote:
> > A recent security fix to ibus (CVE-2019-14822, #940267, DSA-4525-1)
> > exposed an interoperability bug between GLib's implementation of D-Bus
> > and the reference implementation libdbus (#941018).
>
> This looks OK to me, but will need a d-i ACK due to the udeb build; thanks.
Here's a final debdiff. The only change outside debian/changelog was to add
the correct branch to the Vcs-Git field.
smcv
diffstat for glib2.0-2.58.3 glib2.0-2.58.3
changelog | 16
control | 3
control.in | 3
patches/Add-a-test-for-GDBusServer-authentication.patch | 536
++++++++++
patches/GDBus-prefer-getsockopt-style-credentials-passing-APIs.patch | 167
+++
patches/credentials-Invalid-Linux-struct-ucred-means-no-informati.patch | 117
++
patches/gdbus-server-auth-test-Create-temporary-directory-for-Uni.patch | 191
+++
patches/gdbus-server-auth-test-Include-gcredentialsprivate.h.patch | 41
patches/series | 5
9 files changed, 1077 insertions(+), 2 deletions(-)
diff -Nru glib2.0-2.58.3/debian/changelog glib2.0-2.58.3/debian/changelog
--- glib2.0-2.58.3/debian/changelog 2019-07-30 10:41:51.000000000 +0100
+++ glib2.0-2.58.3/debian/changelog 2019-11-06 08:29:15.000000000 +0000
@@ -1,3 +1,19 @@
+glib2.0 (2.58.3-2+deb10u2) buster; urgency=medium
+
+ * Team upload
+ * d/p/credentials-Invalid-Linux-struct-ucred-means-no-informati.patch,
+ d/p/GDBus-prefer-getsockopt-style-credentials-passing-APIs.patch:
+ Ensure libdbus clients can authenticate with a GDBusServer like the
+ one in ibus, backported from upstream 2.62.x branch (Closes: #941018)
+ * d/p/Add-a-test-for-GDBusServer-authentication.patch,
+ d/p/gdbus-server-auth-test-Create-temporary-directory-for-Uni.patch,
+ d/p/gdbus-server-auth-test-Include-gcredentialsprivate.h.patch:
+ Backport regression test for #941018
+ * Build-depend on libdbus-1-dev for better test coverage
+ * d/control.in: Set branch to debian/buster in Vcs-Git
+
+ -- Simon McVittie <s...@debian.org> Wed, 06 Nov 2019 08:29:15 +0000
+
glib2.0 (2.58.3-2+deb10u1) buster; urgency=medium
* Team upload
diff -Nru glib2.0-2.58.3/debian/control glib2.0-2.58.3/debian/control
--- glib2.0-2.58.3/debian/control 2019-07-30 10:41:51.000000000 +0100
+++ glib2.0-2.58.3/debian/control 2019-11-06 08:29:15.000000000 +0000
@@ -18,6 +18,7 @@
gettext,
gnome-pkg-tools (>= 0.11),
gtk-doc-tools (>= 1.20),
+ libdbus-1-dev (>= 1.2.14),
libelf-dev (>= 0.142),
libffi-dev (>= 3.0.0),
libgamin-dev [!linux-any] | libfam-dev [!linux-any],
@@ -41,7 +42,7 @@
Standards-Version: 4.3.0
Homepage: http://www.gtk.org/
Vcs-Browser: https://salsa.debian.org/gnome-team/glib
-Vcs-Git: https://salsa.debian.org/gnome-team/glib.git
+Vcs-Git: https://salsa.debian.org/gnome-team/glib.git -b debian/buster
Package: libglib2.0-0
Architecture: any
diff -Nru glib2.0-2.58.3/debian/control.in glib2.0-2.58.3/debian/control.in
--- glib2.0-2.58.3/debian/control.in 2019-07-30 10:41:51.000000000 +0100
+++ glib2.0-2.58.3/debian/control.in 2019-11-06 08:29:15.000000000 +0000
@@ -14,6 +14,7 @@
gettext,
gnome-pkg-tools (>= 0.11),
gtk-doc-tools (>= 1.20),
+ libdbus-1-dev (>= 1.2.14),
libelf-dev (>= 0.142),
libffi-dev (>= 3.0.0),
libgamin-dev [!linux-any] | libfam-dev [!linux-any],
@@ -37,7 +38,7 @@
Standards-Version: 4.3.0
Homepage: http://www.gtk.org/
Vcs-Browser: https://salsa.debian.org/gnome-team/glib
-Vcs-Git: https://salsa.debian.org/gnome-team/glib.git
+Vcs-Git: https://salsa.debian.org/gnome-team/glib.git -b debian/buster
Package: libglib2.0-0
Architecture: any
diff -Nru
glib2.0-2.58.3/debian/patches/Add-a-test-for-GDBusServer-authentication.patch
glib2.0-2.58.3/debian/patches/Add-a-test-for-GDBusServer-authentication.patch
---
glib2.0-2.58.3/debian/patches/Add-a-test-for-GDBusServer-authentication.patch
1970-01-01 01:00:00.000000000 +0100
+++
glib2.0-2.58.3/debian/patches/Add-a-test-for-GDBusServer-authentication.patch
2019-11-06 08:29:15.000000000 +0000
@@ -0,0 +1,536 @@
+From: Simon McVittie <s...@collabora.com>
+Date: Fri, 11 Oct 2019 19:02:55 +0100
+Subject: Add a test for GDBusServer authentication
+
+In particular, if libbdus is available, we test interoperability with
+a libdbus client: see GNOME/glib#1831. Because that issue describes a
+race condition, we do each test repeatedly to try to hit the failing
+case.
+
+Signed-off-by: Simon McVittie <s...@collabora.com>
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=941018
+Origin: upstream, 2.63.1, commit:9f962ebeac1d67223579ad0d261c4c8215f7c427
+---
+ gio/tests/gdbus-server-auth.c | 491 ++++++++++++++++++++++++++++++++++++++++++
+ gio/tests/meson.build | 8 +
+ 2 files changed, 499 insertions(+)
+ create mode 100644 gio/tests/gdbus-server-auth.c
+
+diff --git a/gio/tests/gdbus-server-auth.c b/gio/tests/gdbus-server-auth.c
+new file mode 100644
+index 0000000..6a72ba6
+--- /dev/null
++++ b/gio/tests/gdbus-server-auth.c
+@@ -0,0 +1,491 @@
++/*
++ * Copyright 2019 Collabora Ltd.
++ *
++ * This library is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU Lesser General Public
++ * License as published by the Free Software Foundation; either
++ * version 2.1 of the License, or (at your option) any later version.
++ *
++ * This library is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ * Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General
++ * Public License along with this library; if not, see
<http://www.gnu.org/licenses/>.
++ */
++
++#include "config.h"
++
++#include <gio/gio.h>
++
++#ifdef HAVE_DBUS1
++#include <dbus/dbus.h>
++#endif
++
++typedef enum
++{
++ INTEROP_FLAGS_EXTERNAL = (1 << 0),
++ INTEROP_FLAGS_ANONYMOUS = (1 << 1),
++ INTEROP_FLAGS_SHA1 = (1 << 2),
++ INTEROP_FLAGS_TCP = (1 << 3),
++ INTEROP_FLAGS_LIBDBUS = (1 << 4),
++ INTEROP_FLAGS_NONE = 0
++} InteropFlags;
++
++static gboolean
++allow_external_cb (G_GNUC_UNUSED GDBusAuthObserver *observer,
++ const char *mechanism,
++ G_GNUC_UNUSED gpointer user_data)
++{
++ if (g_strcmp0 (mechanism, "EXTERNAL") == 0)
++ {
++ g_debug ("Accepting EXTERNAL authentication");
++ return TRUE;
++ }
++ else
++ {
++ g_debug ("Rejecting \"%s\" authentication: not EXTERNAL", mechanism);
++ return FALSE;
++ }
++}
++
++static gboolean
++allow_anonymous_cb (G_GNUC_UNUSED GDBusAuthObserver *observer,
++ const char *mechanism,
++ G_GNUC_UNUSED gpointer user_data)
++{
++ if (g_strcmp0 (mechanism, "ANONYMOUS") == 0)
++ {
++ g_debug ("Accepting ANONYMOUS authentication");
++ return TRUE;
++ }
++ else
++ {
++ g_debug ("Rejecting \"%s\" authentication: not ANONYMOUS", mechanism);
++ return FALSE;
++ }
++}
++
++static gboolean
++allow_sha1_cb (G_GNUC_UNUSED GDBusAuthObserver *observer,
++ const char *mechanism,
++ G_GNUC_UNUSED gpointer user_data)
++{
++ if (g_strcmp0 (mechanism, "DBUS_COOKIE_SHA1") == 0)
++ {
++ g_debug ("Accepting DBUS_COOKIE_SHA1 authentication");
++ return TRUE;
++ }
++ else
++ {
++ g_debug ("Rejecting \"%s\" authentication: not DBUS_COOKIE_SHA1",
++ mechanism);
++ return FALSE;
++ }
++}
++
++static gboolean
++allow_any_mechanism_cb (G_GNUC_UNUSED GDBusAuthObserver *observer,
++ const char *mechanism,
++ G_GNUC_UNUSED gpointer user_data)
++{
++ g_debug ("Accepting \"%s\" authentication", mechanism);
++ return TRUE;
++}
++
++static gboolean
++authorize_any_authenticated_peer_cb (G_GNUC_UNUSED GDBusAuthObserver
*observer,
++ G_GNUC_UNUSED GIOStream *stream,
++ GCredentials *credentials,
++ G_GNUC_UNUSED gpointer user_data)
++{
++ if (credentials == NULL)
++ {
++ g_debug ("Authorizing peer with no credentials");
++ }
++ else
++ {
++ gchar *str = g_credentials_to_string (credentials);
++
++ g_debug ("Authorizing peer with credentials: %s", str);
++ g_free (str);
++ }
++
++ return TRUE;
++}
++
++static GDBusMessage *
++whoami_filter_cb (GDBusConnection *connection,
++ GDBusMessage *message,
++ gboolean incoming,
++ G_GNUC_UNUSED gpointer user_data)
++{
++ if (!incoming)
++ return message;
++
++ if (g_dbus_message_get_message_type (message) ==
G_DBUS_MESSAGE_TYPE_METHOD_CALL &&
++ g_strcmp0 (g_dbus_message_get_member (message), "WhoAmI") == 0)
++ {
++ GDBusMessage *reply = g_dbus_message_new_method_reply (message);
++ gint64 uid = -1;
++ gint64 pid = -1;
++#ifdef G_OS_UNIX
++ GCredentials *credentials = g_dbus_connection_get_peer_credentials
(connection);
++
++ if (credentials != NULL)
++ {
++ uid = (gint64) g_credentials_get_unix_user (credentials, NULL);
++ pid = (gint64) g_credentials_get_unix_pid (credentials, NULL);
++ }
++#endif
++
++ g_dbus_message_set_body (reply,
++ g_variant_new ("(xx)", uid, pid));
++ g_dbus_connection_send_message (connection, reply,
++ G_DBUS_SEND_MESSAGE_FLAGS_NONE,
++ NULL, NULL);
++
++ /* handled */
++ g_object_unref (message);
++ return NULL;
++ }
++
++ return message;
++}
++
++static gboolean
++new_connection_cb (G_GNUC_UNUSED GDBusServer *server,
++ GDBusConnection *connection,
++ G_GNUC_UNUSED gpointer user_data)
++{
++ GCredentials *credentials = g_dbus_connection_get_peer_credentials
(connection);
++
++ if (credentials == NULL)
++ {
++ g_debug ("New connection from peer with no credentials");
++ }
++ else
++ {
++ gchar *str = g_credentials_to_string (credentials);
++
++ g_debug ("New connection from peer with credentials: %s", str);
++ g_free (str);
++ }
++
++ g_object_ref (connection);
++ g_dbus_connection_add_filter (connection, whoami_filter_cb, NULL, NULL);
++ return TRUE;
++}
++
++#ifdef HAVE_DBUS1
++typedef struct
++{
++ DBusError error;
++ DBusConnection *conn;
++ DBusMessage *call;
++ DBusMessage *reply;
++} LibdbusCall;
++
++static void
++libdbus_call_task_cb (GTask *task,
++ G_GNUC_UNUSED gpointer source_object,
++ gpointer task_data,
++ G_GNUC_UNUSED GCancellable *cancellable)
++{
++ LibdbusCall *libdbus_call = task_data;
++
++ libdbus_call->reply = dbus_connection_send_with_reply_and_block
(libdbus_call->conn,
++
libdbus_call->call,
++ -1,
++
&libdbus_call->error);
++}
++#endif /* HAVE_DBUS1 */
++
++static void
++store_result_cb (G_GNUC_UNUSED GObject *source_object,
++ GAsyncResult *res,
++ gpointer user_data)
++{
++ GAsyncResult **result = user_data;
++
++ g_assert_nonnull (result);
++ g_assert_null (*result);
++ *result = g_object_ref (res);
++}
++
++static void
++assert_expected_uid_pid (InteropFlags flags,
++ gint64 uid,
++ gint64 pid)
++{
++#ifdef G_OS_UNIX
++ if (flags & (INTEROP_FLAGS_ANONYMOUS | INTEROP_FLAGS_SHA1 |
INTEROP_FLAGS_TCP))
++ {
++ /* No assertion. There is no guarantee whether credentials will be
++ * passed even though we didn't send them. Conversely, if
++ * credentials were not passed,
++ * g_dbus_connection_get_peer_credentials() always returns the
++ * credentials of the socket, and not the uid that a
++ * client might have proved it has by using DBUS_COOKIE_SHA1. */
++ }
++ else /* We should prefer EXTERNAL whenever it is allowed. */
++ {
++#ifdef __linux__
++ /* We know that both GDBus and libdbus support full credentials-passing
++ * on Linux. */
++ g_assert_cmpint (uid, ==, getuid ());
++ g_assert_cmpint (pid, ==, getpid ());
++#else
++ g_test_message ("Please open a merge request to add appropriate "
++ "assertions for your platform");
++#endif
++ }
++#endif /* G_OS_UNIX */
++}
++
++static void
++do_test_server_auth (const char *listenable_address,
++ InteropFlags flags)
++{
++ GError *error = NULL;
++ GDBusServer *server;
++ GDBusAuthObserver *observer;
++ GDBusServerFlags server_flags = G_DBUS_SERVER_FLAGS_RUN_IN_THREAD;
++ gchar *guid;
++ const char *connectable_address;
++ GDBusConnection *client;
++ GAsyncResult *result = NULL;
++ GVariant *tuple;
++ gint64 uid, pid;
++#ifdef HAVE_DBUS1
++ /* GNOME/glib#1831 seems to involve a race condition, so try a few times
++ * to see if we can trigger it. */
++ gsize i;
++ gsize n = 20;
++#endif
++
++ if (g_str_has_prefix (listenable_address, "tcp:") ||
++ g_str_has_prefix (listenable_address, "nonce-tcp:"))
++ g_assert_cmpint (flags & INTEROP_FLAGS_TCP, !=, 0);
++ else
++ g_assert_cmpint (flags & INTEROP_FLAGS_TCP, ==, 0);
++
++ g_test_message ("Testing GDBus server at %s / libdbus client, with flags: "
++ "external:%s "
++ "anonymous:%s "
++ "sha1:%s "
++ "tcp:%s",
++ listenable_address,
++ (flags & INTEROP_FLAGS_EXTERNAL) ? "true" : "false",
++ (flags & INTEROP_FLAGS_ANONYMOUS) ? "true" : "false",
++ (flags & INTEROP_FLAGS_SHA1) ? "true" : "false",
++ (flags & INTEROP_FLAGS_TCP) ? "true" : "false");
++
++#ifndef G_OS_UNIX
++ if (g_str_has_prefix (listenable_address, "unix:"))
++ {
++ g_test_skip ("unix: addresses only work on Unix");
++ return;
++ }
++#endif
++
++#if !defined(G_CREDENTIALS_UNIX_CREDENTIALS_MESSAGE_SUPPORTED) \
++ && !defined(G_CREDENTIALS_SOCKET_GET_CREDENTIALS_SUPPORTED)
++ if (flags & INTEROP_FLAGS_EXTERNAL)
++ {
++ g_test_skip ("EXTERNAL authentication not implemented on this
platform");
++ return;
++ }
++#endif
++
++ if (flags & INTEROP_FLAGS_ANONYMOUS)
++ server_flags |= G_DBUS_SERVER_FLAGS_AUTHENTICATION_ALLOW_ANONYMOUS;
++
++ observer = g_dbus_auth_observer_new ();
++
++ if (flags & INTEROP_FLAGS_EXTERNAL)
++ g_signal_connect (observer, "allow-mechanism",
++ G_CALLBACK (allow_external_cb), NULL);
++ else if (flags & INTEROP_FLAGS_ANONYMOUS)
++ g_signal_connect (observer, "allow-mechanism",
++ G_CALLBACK (allow_anonymous_cb), NULL);
++ else if (flags & INTEROP_FLAGS_SHA1)
++ g_signal_connect (observer, "allow-mechanism",
++ G_CALLBACK (allow_sha1_cb), NULL);
++ else
++ g_signal_connect (observer, "allow-mechanism",
++ G_CALLBACK (allow_any_mechanism_cb), NULL);
++
++ g_signal_connect (observer, "authorize-authenticated-peer",
++ G_CALLBACK (authorize_any_authenticated_peer_cb),
++ NULL);
++
++ guid = g_dbus_generate_guid ();
++ server = g_dbus_server_new_sync (listenable_address,
++ server_flags,
++ guid,
++ observer,
++ NULL,
++ &error);
++ g_assert_no_error (error);
++ g_assert_nonnull (server);
++ g_signal_connect (server, "new-connection", G_CALLBACK (new_connection_cb),
NULL);
++ g_dbus_server_start (server);
++ connectable_address = g_dbus_server_get_client_address (server);
++
++ result = NULL;
++ g_dbus_connection_new_for_address (connectable_address,
++
G_DBUS_CONNECTION_FLAGS_AUTHENTICATION_CLIENT,
++ NULL, NULL, store_result_cb, &result);
++
++ while (result == NULL)
++ g_main_context_iteration (NULL, TRUE);
++
++ client = g_dbus_connection_new_for_address_finish (result, &error);
++ g_assert_no_error (error);
++ g_assert_nonnull (client);
++ g_clear_object (&result);
++
++ g_dbus_connection_call (client, NULL, "/", "com.example.Test", "WhoAmI",
++ NULL, G_VARIANT_TYPE ("(xx)"),
++ G_DBUS_CALL_FLAGS_NONE, -1, NULL, store_result_cb,
++ &result);
++
++ while (result == NULL)
++ g_main_context_iteration (NULL, TRUE);
++
++ tuple = g_dbus_connection_call_finish (client, result, &error);
++ g_assert_no_error (error);
++ g_assert_nonnull (tuple);
++ g_clear_object (&result);
++ g_clear_object (&client);
++
++ uid = -2;
++ pid = -2;
++ g_variant_get (tuple, "(xx)", &uid, &pid);
++
++ g_debug ("Server says GDBus client is uid %" G_GINT64_FORMAT ", pid %"
G_GINT64_FORMAT,
++ uid, pid);
++
++ assert_expected_uid_pid (flags, uid, pid);
++
++ g_clear_pointer (&tuple, g_variant_unref);
++
++#ifdef HAVE_DBUS1
++ for (i = 0; i < n; i++)
++ {
++ LibdbusCall libdbus_call = { DBUS_ERROR_INIT, NULL, NULL, NULL };
++ GTask *task;
++
++ libdbus_call.conn = dbus_connection_open_private (connectable_address,
++ &libdbus_call.error);
++ g_assert_cmpstr (libdbus_call.error.name, ==, NULL);
++ g_assert_nonnull (libdbus_call.conn);
++
++ libdbus_call.call = dbus_message_new_method_call (NULL, "/",
++ "com.example.Test",
++ "WhoAmI");
++
++ if (libdbus_call.call == NULL)
++ g_error ("Out of memory");
++
++ result = NULL;
++ task = g_task_new (NULL, NULL, store_result_cb, &result);
++ g_task_set_task_data (task, &libdbus_call, NULL);
++ g_task_run_in_thread (task, libdbus_call_task_cb);
++
++ while (result == NULL)
++ g_main_context_iteration (NULL, TRUE);
++
++ g_clear_object (&result);
++
++ g_assert_cmpstr (libdbus_call.error.name, ==, NULL);
++ g_assert_nonnull (libdbus_call.reply);
++
++ uid = -2;
++ pid = -2;
++ dbus_message_get_args (libdbus_call.reply, &libdbus_call.error,
++ DBUS_TYPE_INT64, &uid,
++ DBUS_TYPE_INT64, &pid,
++ DBUS_TYPE_INVALID);
++ g_assert_cmpstr (libdbus_call.error.name, ==, NULL);
++
++ g_debug ("Server says libdbus client %" G_GSIZE_FORMAT " is uid %"
G_GINT64_FORMAT ", pid %" G_GINT64_FORMAT,
++ i, uid, pid);
++ assert_expected_uid_pid (flags | INTEROP_FLAGS_LIBDBUS, uid, pid);
++
++ dbus_connection_close (libdbus_call.conn);
++ dbus_connection_unref (libdbus_call.conn);
++ dbus_message_unref (libdbus_call.call);
++ dbus_message_unref (libdbus_call.reply);
++ g_clear_object (&task);
++ }
++#else /* !HAVE_DBUS1 */
++ g_test_skip ("Testing interop with libdbus not supported");
++#endif /* !HAVE_DBUS1 */
++
++ g_dbus_server_stop (server);
++ g_clear_object (&server);
++ g_clear_object (&observer);
++ g_free (guid);
++}
++
++static void
++test_server_auth (void)
++{
++ do_test_server_auth ("unix:tmpdir=/tmp/gdbus-test", INTEROP_FLAGS_NONE);
++}
++
++static void
++test_server_auth_tcp (void)
++{
++ do_test_server_auth ("tcp:host=127.0.0.1", INTEROP_FLAGS_TCP);
++}
++
++static void
++test_server_auth_anonymous (void)
++{
++ do_test_server_auth ("unix:tmpdir=/tmp/gdbus-test",
INTEROP_FLAGS_ANONYMOUS);
++}
++
++static void
++test_server_auth_anonymous_tcp (void)
++{
++ do_test_server_auth ("tcp:host=127.0.0.1", INTEROP_FLAGS_ANONYMOUS |
INTEROP_FLAGS_TCP);
++}
++
++static void
++test_server_auth_external (void)
++{
++ do_test_server_auth ("unix:tmpdir=/tmp/gdbus-test", INTEROP_FLAGS_EXTERNAL);
++}
++
++static void
++test_server_auth_sha1 (void)
++{
++ do_test_server_auth ("unix:tmpdir=/tmp/gdbus-test", INTEROP_FLAGS_SHA1);
++}
++
++static void
++test_server_auth_sha1_tcp (void)
++{
++ do_test_server_auth ("tcp:host=127.0.0.1", INTEROP_FLAGS_SHA1 |
INTEROP_FLAGS_TCP);
++}
++
++int
++main (int argc,
++ char *argv[])
++{
++ g_test_init (&argc, &argv, NULL);
++
++ g_test_add_func ("/gdbus/server-auth", test_server_auth);
++ g_test_add_func ("/gdbus/server-auth/tcp", test_server_auth_tcp);
++ g_test_add_func ("/gdbus/server-auth/anonymous",
test_server_auth_anonymous);
++ g_test_add_func ("/gdbus/server-auth/anonymous/tcp",
test_server_auth_anonymous_tcp);
++ g_test_add_func ("/gdbus/server-auth/external", test_server_auth_external);
++ g_test_add_func ("/gdbus/server-auth/sha1", test_server_auth_sha1);
++ g_test_add_func ("/gdbus/server-auth/sha1/tcp", test_server_auth_sha1_tcp);
++
++ return g_test_run();
++}
+diff --git a/gio/tests/meson.build b/gio/tests/meson.build
+index dca33bd..2b59198 100644
+--- a/gio/tests/meson.build
++++ b/gio/tests/meson.build
+@@ -117,8 +117,16 @@ if dbus1_dep.found()
+ 'gdbus-serialization' : {
+ 'extra_sources' : ['gdbus-tests.c'],
+ 'dependencies' : [dbus1_dep],
++ },
++ 'gdbus-server-auth' : {
++ 'dependencies' : [dbus1_dep],
+ }
+ }]
++else
++ # We can build a cut-down version of this test without libdbus
++ gio_tests += [{
++ 'gdbus-server-auth' : {},
++ }]
+ endif
+
+ # Test programs buildable on UNIX only
diff -Nru
glib2.0-2.58.3/debian/patches/credentials-Invalid-Linux-struct-ucred-means-no-informati.patch
glib2.0-2.58.3/debian/patches/credentials-Invalid-Linux-struct-ucred-means-no-informati.patch
---
glib2.0-2.58.3/debian/patches/credentials-Invalid-Linux-struct-ucred-means-no-informati.patch
1970-01-01 01:00:00.000000000 +0100
+++
glib2.0-2.58.3/debian/patches/credentials-Invalid-Linux-struct-ucred-means-no-informati.patch
2019-11-06 08:29:15.000000000 +0000
@@ -0,0 +1,117 @@
+From: Simon McVittie <s...@collabora.com>
+Date: Fri, 18 Oct 2019 10:55:09 +0100
+Subject: credentials: Invalid Linux struct ucred means "no information"
+
+On Linux, if getsockopt SO_PEERCRED is used on a TCP socket, one
+might expect it to fail with an appropriate error like ENOTSUP or
+EPROTONOSUPPORT. However, it appears that in fact it succeeds, but
+yields a credentials structure with pid 0, uid -1 and gid -1. These
+are not real process, user and group IDs that can be allocated to a
+real process (pid 0 needs to be reserved to give kill(0) its documented
+special semantics, and similarly uid and gid -1 need to be reserved for
+setresuid() and setresgid()) so it is not meaningful to signal them to
+high-level API users.
+
+An API user with Linux-specific knowledge can still inspect these fields
+via g_credentials_get_native() if desired.
+
+Similarly, if SO_PASSCRED is used to receive a SCM_CREDENTIALS message
+on a receiving Unix socket, but the sending socket had not enabled
+SO_PASSCRED at the time that the message was sent, it is possible
+for it to succeed but yield a credentials structure with pid 0, uid
+/proc/sys/kernel/overflowuid and gid /proc/sys/kernel/overflowgid. Even
+if we were to read those pseudo-files, we cannot distinguish between
+the overflow IDs and a real process that legitimately has the same IDs
+(typically they are set to 'nobody' and 'nogroup', which can be used
+by a real process), so we detect this situation by noticing that
+pid == 0, and to save syscalls we do not read the overflow IDs from
+/proc at all.
+
+This results in a small API change: g_credentials_is_same_user() now
+returns FALSE if we compare two credentials structures that are both
+invalid. This seems like reasonable, conservative behaviour: if we cannot
+prove that they are the same user, we should assume they are not.
+
+[Philip Withnall: Dropped new translatable string when backporting to
+`glib-2-62`.]
+
+Signed-off-by: Simon McVittie <s...@collabora.com>
+Origin: upstream, 2.62.3, commit:5f9318af8f19756685c1b79cf8b76f3e66614d84
+---
+ gio/gcredentials.c | 42 +++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 39 insertions(+), 3 deletions(-)
+
+diff --git a/gio/gcredentials.c b/gio/gcredentials.c
+index cc0cd82..866c671 100644
+--- a/gio/gcredentials.c
++++ b/gio/gcredentials.c
+@@ -265,6 +265,35 @@ g_credentials_to_string (GCredentials *credentials)
+
+ /*
----------------------------------------------------------------------------------------------------
*/
+
++#if G_CREDENTIALS_USE_LINUX_UCRED
++/*
++ * Check whether @native contains invalid data. If getsockopt SO_PEERCRED
++ * is used on a TCP socket, it succeeds but yields a credentials structure
++ * with pid 0, uid -1 and gid -1. Similarly, if SO_PASSCRED is used on a
++ * receiving Unix socket when the sending socket did not also enable
++ * SO_PASSCRED, it can succeed but yield a credentials structure with
++ * pid 0, uid /proc/sys/kernel/overflowuid and gid
++ * /proc/sys/kernel/overflowgid.
++ */
++static gboolean
++linux_ucred_check_valid (struct ucred *native,
++ GError **error)
++{
++ if (native->pid == 0
++ || native->uid == -1
++ || native->gid == -1)
++ {
++ g_set_error_literal (error,
++ G_IO_ERROR,
++ G_IO_ERROR_INVALID_DATA,
++ "GCredentials contains invalid data");
++ return FALSE;
++ }
++
++ return TRUE;
++}
++#endif
++
+ /**
+ * g_credentials_is_same_user:
+ * @credentials: A #GCredentials.
+@@ -294,7 +323,8 @@ g_credentials_is_same_user (GCredentials *credentials,
+
+ ret = FALSE;
+ #if G_CREDENTIALS_USE_LINUX_UCRED
+- if (credentials->native.uid == other_credentials->native.uid)
++ if (linux_ucred_check_valid (&credentials->native, NULL)
++ && credentials->native.uid == other_credentials->native.uid)
+ ret = TRUE;
+ #elif G_CREDENTIALS_USE_FREEBSD_CMSGCRED
+ if (credentials->native.cmcred_euid ==
other_credentials->native.cmcred_euid)
+@@ -453,7 +483,10 @@ g_credentials_get_unix_user (GCredentials *credentials,
+ g_return_val_if_fail (error == NULL || *error == NULL, -1);
+
+ #if G_CREDENTIALS_USE_LINUX_UCRED
+- ret = credentials->native.uid;
++ if (linux_ucred_check_valid (&credentials->native, error))
++ ret = credentials->native.uid;
++ else
++ ret = -1;
+ #elif G_CREDENTIALS_USE_FREEBSD_CMSGCRED
+ ret = credentials->native.cmcred_euid;
+ #elif G_CREDENTIALS_USE_NETBSD_UNPCBID
+@@ -499,7 +532,10 @@ g_credentials_get_unix_pid (GCredentials *credentials,
+ g_return_val_if_fail (error == NULL || *error == NULL, -1);
+
+ #if G_CREDENTIALS_USE_LINUX_UCRED
+- ret = credentials->native.pid;
++ if (linux_ucred_check_valid (&credentials->native, error))
++ ret = credentials->native.pid;
++ else
++ ret = -1;
+ #elif G_CREDENTIALS_USE_FREEBSD_CMSGCRED
+ ret = credentials->native.cmcred_pid;
+ #elif G_CREDENTIALS_USE_NETBSD_UNPCBID
diff -Nru
glib2.0-2.58.3/debian/patches/GDBus-prefer-getsockopt-style-credentials-passing-APIs.patch
glib2.0-2.58.3/debian/patches/GDBus-prefer-getsockopt-style-credentials-passing-APIs.patch
---
glib2.0-2.58.3/debian/patches/GDBus-prefer-getsockopt-style-credentials-passing-APIs.patch
1970-01-01 01:00:00.000000000 +0100
+++
glib2.0-2.58.3/debian/patches/GDBus-prefer-getsockopt-style-credentials-passing-APIs.patch
2019-11-06 08:29:15.000000000 +0000
@@ -0,0 +1,167 @@
+From: Simon McVittie <s...@collabora.com>
+Date: Mon, 14 Oct 2019 08:47:39 +0100
+Subject: GDBus: prefer getsockopt()-style credentials-passing APIs
+
+Conceptually, a D-Bus server is really trying to determine the credentials
+of (the process that initiated) a connection, not the credentials that
+the process had when it sent a particular message. Ideally, it does
+this with a getsockopt()-style API that queries the credentials of the
+connection's initiator without requiring any particular cooperation from
+that process, avoiding a class of possible failures.
+
+The leading '\0' in the D-Bus protocol is primarily a workaround
+for platforms where the message-based credentials-passing API is
+strictly better than the getsockopt()-style API (for example, on
+FreeBSD, SCM_CREDS includes a process ID but getpeereid() does not),
+or where the getsockopt()-style API does not exist at all. As a result
+libdbus, the reference implementation of D-Bus, does not implement
+Linux SCM_CREDENTIALS at all - it has no reason to do so, because the
+SO_PEERCRED socket option is equally informative.
+
+This change makes GDBusServer on Linux more closely match the behaviour
+of libdbus.
+
+In particular, GNOME/glib#1831 indicates that when a libdbus client
+connects to a GDBus server, recvmsg() sometimes yields a SCM_CREDENTIALS
+message with cmsg_data={pid=0, uid=65534, gid=65534}. I think this is
+most likely a race condition in the early steps to connect:
+
+ client server
+ connect
+ accept
+ send '\0' <- race -> set SO_PASSCRED = 1
+ receive '\0'
+
+If the server wins the race:
+
+ client server
+ connect
+ accept
+ set SO_PASSCRED = 1
+ send '\0'
+ receive '\0'
+
+then everything is fine. However, if the client wins the race:
+
+ client server
+ connect
+ accept
+ send '\0'
+ set SO_PASSCRED = 1
+ receive '\0'
+
+then the kernel does not record credentials for the message containing
+'\0' (because SO_PASSCRED was 0 at the time). However, by the time the
+server receives the message, the kernel knows that credentials are
+desired. I would have expected the kernel to omit the credentials header
+in this case, but it seems that instead, it synthesizes a credentials
+structure with a dummy process ID 0, a dummy uid derived from
+/proc/sys/kernel/overflowuid and a dummy gid derived from
+/proc/sys/kernel/overflowgid.
+
+In an unconfigured GDBusServer, hitting this race condition results in
+falling back to DBUS_COOKIE_SHA1 authentication, which in practice usually
+succeeds in authenticating the peer's uid. However, we encourage AF_UNIX
+servers on Unix platforms to allow only EXTERNAL authentication as a
+security-hardening measure, because DBUS_COOKIE_SHA1 relies on a series
+of assumptions including a cryptographically strong PRNG and a shared
+home directory with no write access by others, which are not necessarily
+true for all operating systems and users. EXTERNAL authentication will
+fail if the server cannot determine the client's credentials.
+
+In particular, this caused a regression when CVE-2019-14822 was fixed
+in ibus, which appears to be resolved by this commit. Qt clients
+(which use libdbus) intermittently fail to connect to an ibus server
+(which uses GDBusServer), because ibus no longer allows DBUS_COOKIE_SHA1
+authentication or non-matching uids.
+
+Signed-off-by: Simon McVittie <s...@collabora.com>
+Bug: https://gitlab.gnome.org/GNOME/glib/issues/1831
+Origin: upstream, 2.62.3, commit:c7618cce3752e1f3681f75d0a26c7e07c15bd6a2
+---
+ gio/gcredentialsprivate.h | 18 ++++++++++++++++++
+ gio/gdbusauth.c | 27 +++++++++++++++++++++++++--
+ 2 files changed, 43 insertions(+), 2 deletions(-)
+
+diff --git a/gio/gcredentialsprivate.h b/gio/gcredentialsprivate.h
+index 4d1c420..a4aa463 100644
+--- a/gio/gcredentialsprivate.h
++++ b/gio/gcredentialsprivate.h
+@@ -22,6 +22,18 @@
+ #include "gio/gcredentials.h"
+ #include "gio/gnetworking.h"
+
++/*
++ * G_CREDENTIALS_PREFER_MESSAGE_PASSING:
++ *
++ * Defined to 1 if the data structure transferred by the message-passing
++ * API is strictly more informative than the one transferred by the
++ * `getsockopt()`-style API, and hence should be preferred, even for
++ * protocols like D-Bus that are defined in terms of the credentials of
++ * the (process that opened the) socket, as opposed to the credentials
++ * of an individual message.
++ */
++#undef G_CREDENTIALS_PREFER_MESSAGE_PASSING
++
+ #ifdef __linux__
+ #define G_CREDENTIALS_SUPPORTED 1
+ #define G_CREDENTIALS_USE_LINUX_UCRED 1
+@@ -41,6 +53,12 @@
+ #define G_CREDENTIALS_NATIVE_SIZE (sizeof (struct cmsgcred))
+ #define G_CREDENTIALS_UNIX_CREDENTIALS_MESSAGE_SUPPORTED 1
+ #define G_CREDENTIALS_SPOOFING_SUPPORTED 1
++/* GLib doesn't implement it yet, but FreeBSD's getsockopt()-style API
++ * is getpeereid(), which is not as informative as struct cmsgcred -
++ * it does not tell us the PID. As a result, libdbus prefers to use
++ * SCM_CREDS, and if we implement getpeereid() in future, we should
++ * do the same. */
++#define G_CREDENTIALS_PREFER_MESSAGE_PASSING 1
+
+ #elif defined(__NetBSD__)
+ #define G_CREDENTIALS_SUPPORTED 1
+diff --git a/gio/gdbusauth.c b/gio/gdbusauth.c
+index 1f8ea80..b4d92c0 100644
+--- a/gio/gdbusauth.c
++++ b/gio/gdbusauth.c
+@@ -31,6 +31,7 @@
+ #include "gdbusutils.h"
+ #include "gioenumtypes.h"
+ #include "gcredentials.h"
++#include "gcredentialsprivate.h"
+ #include "gdbusprivate.h"
+ #include "giostream.h"
+ #include "gdatainputstream.h"
+@@ -969,9 +970,31 @@ _g_dbus_auth_run_server (GDBusAuth *auth,
+
+ g_data_input_stream_set_newline_type (dis,
G_DATA_STREAM_NEWLINE_TYPE_CR_LF);
+
+- /* first read the NUL-byte */
++ /* read the NUL-byte, possibly with credentials attached */
+ #ifdef G_OS_UNIX
+- if (G_IS_UNIX_CONNECTION (auth->priv->stream))
++#ifndef G_CREDENTIALS_PREFER_MESSAGE_PASSING
++ if (G_IS_SOCKET_CONNECTION (auth->priv->stream))
++ {
++ GSocket *sock = g_socket_connection_get_socket (G_SOCKET_CONNECTION
(auth->priv->stream));
++
++ local_error = NULL;
++ credentials = g_socket_get_credentials (sock, &local_error);
++
++ if (credentials == NULL && !g_error_matches (local_error, G_IO_ERROR,
G_IO_ERROR_NOT_SUPPORTED))
++ {
++ g_propagate_error (error, local_error);
++ goto out;
++ }
++ else
++ {
++ /* Clear the error indicator, so we can retry with
++ * g_unix_connection_receive_credentials() if necessary */
++ g_clear_error (&local_error);
++ }
++ }
++#endif
++
++ if (credentials == NULL && G_IS_UNIX_CONNECTION (auth->priv->stream))
+ {
+ local_error = NULL;
+ credentials = g_unix_connection_receive_credentials (G_UNIX_CONNECTION
(auth->priv->stream),
diff -Nru
glib2.0-2.58.3/debian/patches/gdbus-server-auth-test-Create-temporary-directory-for-Uni.patch
glib2.0-2.58.3/debian/patches/gdbus-server-auth-test-Create-temporary-directory-for-Uni.patch
---
glib2.0-2.58.3/debian/patches/gdbus-server-auth-test-Create-temporary-directory-for-Uni.patch
1970-01-01 01:00:00.000000000 +0100
+++
glib2.0-2.58.3/debian/patches/gdbus-server-auth-test-Create-temporary-directory-for-Uni.patch
2019-11-06 08:29:15.000000000 +0000
@@ -0,0 +1,191 @@
+From: Simon McVittie <s...@collabora.com>
+Date: Tue, 29 Oct 2019 16:27:53 +0000
+Subject: gdbus-server-auth test: Create temporary directory for Unix socket
+
+This avoids failure to listen on the given address on non-Linux Unix
+kernels, where abstract sockets do not exist and so unix:tmpdir is
+equivalent to unix:dir.
+
+Unlike the corresponding commit in GLib 2.63.1, this backport continues
+to use unix:tmpdir addresses on Linux kernels, because GLib didn't
+implement unix:dir until version 2.61.2.
+
+Bug: GNOME/glib#1920
+Fixes: 9f962ebe "Add a test for GDBusServer authentication"
+Signed-off-by: Simon McVittie <s...@collabora.com>
+Origin: backport, 2.63.1, commit:2b1e706b2f0007982f4fe6a70734d4490e4093a3
+---
+ gio/tests/gdbus-server-auth.c | 76 +++++++++++++++++++++++++++----------------
+ 1 file changed, 48 insertions(+), 28 deletions(-)
+
+diff --git a/gio/tests/gdbus-server-auth.c b/gio/tests/gdbus-server-auth.c
+index 6a72ba6..95b1e37 100644
+--- a/gio/tests/gdbus-server-auth.c
++++ b/gio/tests/gdbus-server-auth.c
+@@ -17,6 +17,9 @@
+
+ #include "config.h"
+
++#include <errno.h>
++
++#include <glib/gstdio.h>
+ #include <gio/gio.h>
+
+ #ifdef HAVE_DBUS1
+@@ -245,18 +248,19 @@ assert_expected_uid_pid (InteropFlags flags,
+ }
+
+ static void
+-do_test_server_auth (const char *listenable_address,
+- InteropFlags flags)
++do_test_server_auth (InteropFlags flags)
+ {
+ GError *error = NULL;
+- GDBusServer *server;
+- GDBusAuthObserver *observer;
++ gchar *tmpdir = NULL;
++ gchar *listenable_address = NULL;
++ GDBusServer *server = NULL;
++ GDBusAuthObserver *observer = NULL;
+ GDBusServerFlags server_flags = G_DBUS_SERVER_FLAGS_RUN_IN_THREAD;
+- gchar *guid;
++ gchar *guid = NULL;
+ const char *connectable_address;
+- GDBusConnection *client;
++ GDBusConnection *client = NULL;
+ GAsyncResult *result = NULL;
+- GVariant *tuple;
++ GVariant *tuple = NULL;
+ gint64 uid, pid;
+ #ifdef HAVE_DBUS1
+ /* GNOME/glib#1831 seems to involve a race condition, so try a few times
+@@ -265,11 +269,25 @@ do_test_server_auth (const char *listenable_address,
+ gsize n = 20;
+ #endif
+
+- if (g_str_has_prefix (listenable_address, "tcp:") ||
+- g_str_has_prefix (listenable_address, "nonce-tcp:"))
+- g_assert_cmpint (flags & INTEROP_FLAGS_TCP, !=, 0);
++ if (flags & INTEROP_FLAGS_TCP)
++ {
++ listenable_address = g_strdup ("tcp:host=127.0.0.1");
++ }
+ else
+- g_assert_cmpint (flags & INTEROP_FLAGS_TCP, ==, 0);
++ {
++#ifdef G_OS_UNIX
++ gchar *escaped;
++
++ tmpdir = g_dir_make_tmp ("gdbus-server-auth-XXXXXX", &error);
++ g_assert_no_error (error);
++ escaped = g_dbus_address_escape_value (tmpdir);
++ listenable_address = g_strdup_printf ("unix:tmpdir=%s", escaped);
++ g_free (escaped);
++#else
++ g_test_skip ("unix: addresses only work on Unix");
++ goto out;
++#endif
++ }
+
+ g_test_message ("Testing GDBus server at %s / libdbus client, with flags: "
+ "external:%s "
+@@ -282,20 +300,12 @@ do_test_server_auth (const char *listenable_address,
+ (flags & INTEROP_FLAGS_SHA1) ? "true" : "false",
+ (flags & INTEROP_FLAGS_TCP) ? "true" : "false");
+
+-#ifndef G_OS_UNIX
+- if (g_str_has_prefix (listenable_address, "unix:"))
+- {
+- g_test_skip ("unix: addresses only work on Unix");
+- return;
+- }
+-#endif
+-
+ #if !defined(G_CREDENTIALS_UNIX_CREDENTIALS_MESSAGE_SUPPORTED) \
+ && !defined(G_CREDENTIALS_SOCKET_GET_CREDENTIALS_SUPPORTED)
+ if (flags & INTEROP_FLAGS_EXTERNAL)
+ {
+ g_test_skip ("EXTERNAL authentication not implemented on this
platform");
+- return;
++ goto out;
+ }
+ #endif
+
+@@ -333,6 +343,7 @@ do_test_server_auth (const char *listenable_address,
+ g_signal_connect (server, "new-connection", G_CALLBACK (new_connection_cb),
NULL);
+ g_dbus_server_start (server);
+ connectable_address = g_dbus_server_get_client_address (server);
++ g_test_message ("Connectable address: %s", connectable_address);
+
+ result = NULL;
+ g_dbus_connection_new_for_address (connectable_address,
+@@ -425,52 +436,61 @@ do_test_server_auth (const char *listenable_address,
+ g_test_skip ("Testing interop with libdbus not supported");
+ #endif /* !HAVE_DBUS1 */
+
+- g_dbus_server_stop (server);
++out:
++ if (server != NULL)
++ g_dbus_server_stop (server);
++
++ if (tmpdir != NULL)
++ g_assert_cmpstr (g_rmdir (tmpdir) == 0 ? "OK" : g_strerror (errno),
++ ==, "OK");
++
+ g_clear_object (&server);
+ g_clear_object (&observer);
+ g_free (guid);
++ g_free (listenable_address);
++ g_free (tmpdir);
+ }
+
+ static void
+ test_server_auth (void)
+ {
+- do_test_server_auth ("unix:tmpdir=/tmp/gdbus-test", INTEROP_FLAGS_NONE);
++ do_test_server_auth (INTEROP_FLAGS_NONE);
+ }
+
+ static void
+ test_server_auth_tcp (void)
+ {
+- do_test_server_auth ("tcp:host=127.0.0.1", INTEROP_FLAGS_TCP);
++ do_test_server_auth (INTEROP_FLAGS_TCP);
+ }
+
+ static void
+ test_server_auth_anonymous (void)
+ {
+- do_test_server_auth ("unix:tmpdir=/tmp/gdbus-test",
INTEROP_FLAGS_ANONYMOUS);
++ do_test_server_auth (INTEROP_FLAGS_ANONYMOUS);
+ }
+
+ static void
+ test_server_auth_anonymous_tcp (void)
+ {
+- do_test_server_auth ("tcp:host=127.0.0.1", INTEROP_FLAGS_ANONYMOUS |
INTEROP_FLAGS_TCP);
++ do_test_server_auth (INTEROP_FLAGS_ANONYMOUS | INTEROP_FLAGS_TCP);
+ }
+
+ static void
+ test_server_auth_external (void)
+ {
+- do_test_server_auth ("unix:tmpdir=/tmp/gdbus-test", INTEROP_FLAGS_EXTERNAL);
++ do_test_server_auth (INTEROP_FLAGS_EXTERNAL);
+ }
+
+ static void
+ test_server_auth_sha1 (void)
+ {
+- do_test_server_auth ("unix:tmpdir=/tmp/gdbus-test", INTEROP_FLAGS_SHA1);
++ do_test_server_auth (INTEROP_FLAGS_SHA1);
+ }
+
+ static void
+ test_server_auth_sha1_tcp (void)
+ {
+- do_test_server_auth ("tcp:host=127.0.0.1", INTEROP_FLAGS_SHA1 |
INTEROP_FLAGS_TCP);
++ do_test_server_auth (INTEROP_FLAGS_SHA1 | INTEROP_FLAGS_TCP);
+ }
+
+ int
diff -Nru
glib2.0-2.58.3/debian/patches/gdbus-server-auth-test-Include-gcredentialsprivate.h.patch
glib2.0-2.58.3/debian/patches/gdbus-server-auth-test-Include-gcredentialsprivate.h.patch
---
glib2.0-2.58.3/debian/patches/gdbus-server-auth-test-Include-gcredentialsprivate.h.patch
1970-01-01 01:00:00.000000000 +0100
+++
glib2.0-2.58.3/debian/patches/gdbus-server-auth-test-Include-gcredentialsprivate.h.patch
2019-11-06 08:29:15.000000000 +0000
@@ -0,0 +1,41 @@
+From: Simon McVittie <s...@collabora.com>
+Date: Mon, 4 Nov 2019 10:21:51 +0000
+Subject: gdbus-server-auth test: Include gcredentialsprivate.h
+
+Otherwise we'll never test the EXTERNAL-only mode, because that relies
+on testing the private macros
+G_CREDENTIALS_UNIX_CREDENTIALS_MESSAGE_SUPPORTED and
+G_CREDENTIALS_SOCKET_GET_CREDENTIALS_SUPPORTED.
+
+Fixes: 9f962ebe "Add a test for GDBusServer authentication"
+Signed-off-by: Simon McVittie <s...@collabora.com>
+Applied-upstream: 2.63.2, commit:49eccfbe709e73932048ab88cf905798b708222a
+---
+ gio/tests/gdbus-server-auth.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/gio/tests/gdbus-server-auth.c b/gio/tests/gdbus-server-auth.c
+index 95b1e37..a683965 100644
+--- a/gio/tests/gdbus-server-auth.c
++++ b/gio/tests/gdbus-server-auth.c
+@@ -22,6 +22,9 @@
+ #include <glib/gstdio.h>
+ #include <gio/gio.h>
+
++/* For G_CREDENTIALS_*_SUPPORTED */
++#include <gio/gcredentialsprivate.h>
++
+ #ifdef HAVE_DBUS1
+ #include <dbus/dbus.h>
+ #endif
+@@ -436,6 +439,10 @@ do_test_server_auth (InteropFlags flags)
+ g_test_skip ("Testing interop with libdbus not supported");
+ #endif /* !HAVE_DBUS1 */
+
++ /* No practical effect, just to avoid -Wunused-label under some
++ * combinations of #ifdefs */
++ goto out;
++
+ out:
+ if (server != NULL)
+ g_dbus_server_stop (server);
diff -Nru glib2.0-2.58.3/debian/patches/series
glib2.0-2.58.3/debian/patches/series
--- glib2.0-2.58.3/debian/patches/series 2019-07-30 10:41:51.000000000
+0100
+++ glib2.0-2.58.3/debian/patches/series 2019-11-06 08:29:15.000000000
+0000
@@ -3,6 +3,11 @@
closures-test-Avoid-timeout-on-ARM64-CPUs.patch
gfile-Limit-access-to-files-when-copying.patch
keyfile-settings-Use-tighter-permissions.patch
+credentials-Invalid-Linux-struct-ucred-means-no-informati.patch
+GDBus-prefer-getsockopt-style-credentials-passing-APIs.patch
+Add-a-test-for-GDBusServer-authentication.patch
+gdbus-server-auth-test-Create-temporary-directory-for-Uni.patch
+gdbus-server-auth-test-Include-gcredentialsprivate.h.patch
01_gettext-desktopfiles.patch
81-skip-monitor-test-on-non-linux.patch
0001-timer-test-use-volatile-for-locals.patch
