diff -Nru sanlock-2.2/debian/changelog sanlock-2.2/debian/changelog --- sanlock-2.2/debian/changelog 2012-06-04 15:33:14.000000000 +0200 +++ sanlock-2.2/debian/changelog 2013-01-15 11:25:31.000000000 +0100 @@ -1,3 +1,17 @@ +sanlock (2.2-1.1) unstable; urgency=low + + * Fix CVE-2012-5638 sanlock world writable /var/log/sanlock.log. + Thanks to Salvatore Bonaccorso (Closes: #696424) + Add patches cherry-picked from git repository: + - 0001-sanlock-remove-umask-0.patch + - 0001-sanlock-use-lockfile-mode-644.patch + - 0001-wdmd-use-lockfile-mode-644.patch + * Replace restrict field name (Closes: #689696) + Add patch cherry-picked from git repository: + - restrict.patch + + -- David Weber Thu, 03 Jan 2013 22:12:33 +0100 + sanlock (2.2-1) unstable; urgency=low * Initial release. (Closes: #669102) diff -Nru sanlock-2.2/debian/patches/0001-sanlock-remove-umask-0.patch sanlock-2.2/debian/patches/0001-sanlock-remove-umask-0.patch --- sanlock-2.2/debian/patches/0001-sanlock-remove-umask-0.patch 1970-01-01 01:00:00.000000000 +0100 +++ sanlock-2.2/debian/patches/0001-sanlock-remove-umask-0.patch 2013-01-07 08:12:57.000000000 +0100 @@ -0,0 +1,23 @@ +From 9b13cb12973fac422423eec1c6a91f21b5257c92 Mon Sep 17 00:00:00 2001 +From: David Teigland +Date: Fri, 3 Aug 2012 14:24:07 -0500 +Subject: [PATCH] sanlock: remove umask 0 + +Remove umask(0) which causes sanlock.log to have mode 666. +It's 644 without the umask. + +Signed-off-by: David Teigland +--- + src/main.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/src/main.c ++++ b/src/main.c +@@ -1198,7 +1198,6 @@ + log_tool("cannot fork daemon\n"); + exit(EXIT_FAILURE); + } +- umask(0); + } + + /* main task never does disk io, so we don't really need to set diff -Nru sanlock-2.2/debian/patches/0001-sanlock-use-lockfile-mode-644.patch sanlock-2.2/debian/patches/0001-sanlock-use-lockfile-mode-644.patch --- sanlock-2.2/debian/patches/0001-sanlock-use-lockfile-mode-644.patch 1970-01-01 01:00:00.000000000 +0100 +++ sanlock-2.2/debian/patches/0001-sanlock-use-lockfile-mode-644.patch 2013-01-07 08:12:57.000000000 +0100 @@ -0,0 +1,21 @@ +From 1339694c3bad23055f896e90353c81fd65bd4a7e Mon Sep 17 00:00:00 2001 +From: David Teigland +Date: Thu, 2 Aug 2012 11:27:54 -0500 +Subject: [PATCH] sanlock: use lockfile mode 644 + +Signed-off-by: David Teigland +--- + src/lockfile.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/src/lockfile.c ++++ b/src/lockfile.c +@@ -47,7 +47,7 @@ + + snprintf(path, PATH_MAX, "%s/%s", dir, name); + +- fd = open(path, O_CREAT|O_WRONLY|O_CLOEXEC, 0666); ++ fd = open(path, O_CREAT|O_WRONLY|O_CLOEXEC, 0644); + if (fd < 0) { + log_error("lockfile open error %s: %s", + path, strerror(errno)); diff -Nru sanlock-2.2/debian/patches/0001-wdmd-use-lockfile-mode-644.patch sanlock-2.2/debian/patches/0001-wdmd-use-lockfile-mode-644.patch --- sanlock-2.2/debian/patches/0001-wdmd-use-lockfile-mode-644.patch 1970-01-01 01:00:00.000000000 +0100 +++ sanlock-2.2/debian/patches/0001-wdmd-use-lockfile-mode-644.patch 2013-01-07 08:12:57.000000000 +0100 @@ -0,0 +1,21 @@ +From 3a2ba2d0fbe78f4eacd438b708ceff6e96903d37 Mon Sep 17 00:00:00 2001 +From: David Teigland +Date: Wed, 1 Aug 2012 17:00:53 -0500 +Subject: [PATCH] wdmd: use lockfile mode 644 + +Signed-off-by: David Teigland +--- + wdmd/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/wdmd/main.c ++++ b/wdmd/main.c +@@ -819,7 +819,7 @@ + + sprintf(lockfile_path, "%s/wdmd.pid", WDMD_RUN_DIR); + +- fd = open(lockfile_path, O_CREAT|O_WRONLY|O_CLOEXEC, 0666); ++ fd = open(lockfile_path, O_CREAT|O_WRONLY|O_CLOEXEC, 0644); + if (fd < 0) { + log_error("lockfile open error %s: %s", + lockfile_path, strerror(errno)); diff -Nru sanlock-2.2/debian/patches/restrict.patch sanlock-2.2/debian/patches/restrict.patch --- sanlock-2.2/debian/patches/restrict.patch 1970-01-01 01:00:00.000000000 +0100 +++ sanlock-2.2/debian/patches/restrict.patch 2013-01-10 10:19:11.000000000 +0100 @@ -0,0 +1,96 @@ +Index: sanlock-2.2/src/cmd.c +=================================================================== +--- sanlock-2.2.orig/src/cmd.c 2012-05-07 17:43:52.000000000 +0200 ++++ sanlock-2.2/src/cmd.c 2013-01-10 10:16:41.452028239 +0100 +@@ -302,7 +302,7 @@ + token->host_id = space.host_id; + token->host_generation = space.host_generation; + token->pid = cl_pid; +- if (cl->restrict & SANLK_RESTRICT_SIGKILL) ++ if (cl->restricted & SANLK_RESTRICT_SIGKILL) + token->flags |= T_RESTRICT_SIGKILL; + + /* save a record of what this token_id is for later debugging */ +@@ -1278,7 +1278,7 @@ + "ci=%d " + "fd=%d " + "pid=%d " +- "restrict=%x " ++ "restricted=%x " + "cmd_active=%d " + "cmd_last=%d " + "pid_dead=%d " +@@ -1289,7 +1289,7 @@ + ci, + cl->fd, + cl->pid, +- cl->restrict, ++ cl->restricted, + cl->cmd_active, + cl->cmd_last, + cl->pid_dead, +@@ -1621,7 +1621,7 @@ + log_debug("cmd_restrict ci %d fd %d pid %d flags %x", + ci, fd, client[ci].pid, h_recv->cmd_flags); + +- client[ci].restrict = h_recv->cmd_flags; ++ client[ci].restricted = h_recv->cmd_flags; + + send_result(fd, h_recv, 0); + } +Index: sanlock-2.2/src/main.c +=================================================================== +--- sanlock-2.2.orig/src/main.c 2013-01-10 09:52:54.000000000 +0100 ++++ sanlock-2.2/src/main.c 2013-01-10 10:18:24.148033530 +0100 +@@ -157,7 +157,7 @@ + cl->need_free = 0; + cl->kill_count = 0; + cl->kill_last = 0; +- cl->restrict = 0; ++ cl->restricted = 0; + memset(cl->owner_name, 0, sizeof(cl->owner_name)); + cl->workfn = NULL; + cl->deadfn = NULL; +@@ -481,9 +481,9 @@ + fd = cl->fd; + pid = cl->pid; + +- if (cl->restrict & SANLK_RESTRICT_SIGKILL) ++ if (cl->restricted & SANLK_RESTRICT_SIGKILL) + sig = SIGTERM; +- else if (cl->restrict & SANLK_RESTRICT_SIGTERM) ++ else if (cl->restricted & SANLK_RESTRICT_SIGTERM) + sig = SIGKILL; + else if (cl->kill_count <= main_task.kill_count_term) + sig = SIGTERM; +@@ -990,7 +990,7 @@ + ci, rv, h.magic, SM_MAGIC); + goto dead; + } +- if (client[ci].restrict & SANLK_RESTRICT_ALL) { ++ if (client[ci].restricted & SANLK_RESTRICT_ALL) { + log_error("ci %d fd %d pid %d cmd %d restrict all", + ci, client[ci].fd, client[ci].pid, h.cmd); + goto dead; +Index: sanlock-2.2/src/sanlock_internal.h +=================================================================== +--- sanlock-2.2.orig/src/sanlock_internal.h 2012-05-07 17:43:52.000000000 +0200 ++++ sanlock-2.2/src/sanlock_internal.h 2013-01-10 10:18:58.000030946 +0100 +@@ -67,7 +67,7 @@ + * 'struct resource' keeps track of resources globally, resources list + */ + +-#define T_RESTRICT_SIGKILL 0x00000001 /* inherited from client->restrict */ ++#define T_RESTRICT_SIGKILL 0x00000001 /* inherited from client->restricted */ + #define T_LS_DEAD 0x00000002 /* don't bother trying to release if ls is dead */ + + struct token { +@@ -492,7 +492,7 @@ + int suspend; + int need_free; + int kill_count; +- uint32_t restrict; ++ uint32_t restricted; + uint64_t kill_last; + char owner_name[SANLK_NAME_LEN+1]; + pthread_mutex_t mutex; diff -Nru sanlock-2.2/debian/patches/series sanlock-2.2/debian/patches/series --- sanlock-2.2/debian/patches/series 2012-06-04 15:33:14.000000000 +0200 +++ sanlock-2.2/debian/patches/series 2013-01-10 10:14:00.000000000 +0100 @@ -1,4 +1,7 @@ sanlock-SCHED_RESET_ON_FORK-undefined.patch libdir.patch put_libs_into_dir.patch - +0001-sanlock-remove-umask-0.patch +0001-sanlock-use-lockfile-mode-644.patch +0001-wdmd-use-lockfile-mode-644.patch +restrict.patch diff -Nru sanlock-2.2/debian/sanlock.postinst sanlock-2.2/debian/sanlock.postinst --- sanlock-2.2/debian/sanlock.postinst 2012-06-04 15:33:14.000000000 +0200 +++ sanlock-2.2/debian/sanlock.postinst 2013-01-15 11:54:16.000000000 +0100 @@ -17,9 +17,27 @@ # for details, see http://www.debian.org/doc/debian-policy/ or # the debian-policy package + + +add_statoverrides() +{ + # Fix permission from old sanlock versions, see #696424 + if [ -f /run/sanlock/sanlock.pid ] && [ `stat -c %a /run/sanlock/sanlock.pid` -ne "644" ] + then + chmod -f 644 /run/sanlock/sanlock.pid + fi + + if [ -f /var/log/sanlock.log ] && [ `stat -c %a /var/log/sanlock.log` -ne "644" ] + then + chmod -f 644 /var/log/sanlock.log + fi +} + + case "$1" in configure) - if ! getent group sanlock >/dev/null; then + add_statoverrides + if ! getent group sanlock >/dev/null; then addgroup --quiet --system sanlock fi