Version bump for kernel attribute vulnerabilities, bug #56479.

9 files changed, 142 insertions, 4 deletions

diff --git a/sys-kernel/ppc-sources/ChangeLog b/sys-kernel/ppc-sources/ChangeLog
index 7d96a1d2de1b..f7a6b98d16d6 100644
--- a/sys-kernel/ppc-sources/ChangeLog
+++ b/sys-kernel/ppc-sources/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for sys-kernel/ppc-sources
 # Copyright 2002-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/ppc-sources/ChangeLog,v 1.45 2004/06/26 11:15:54 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/ppc-sources/ChangeLog,v 1.46 2004/07/09 18:17:50 plasmaroo Exp $
+
+*ppc-sources-2.4.26-r3 (09 Jul 2004)
+
+  09 Jul 2004; <plasmaroo@gentoo.org> +ppc-sources-2.4.26-r3.ebuild,
+  +files/ppc-sources-2.4.26.CAN-2004-0497.patch:
+  Version bump for kernel attribute vulnerabilities, bug #56479.
 
 *ppc-sources-2.4.26-r2 (26 Jun 2004)
 
diff --git a/sys-kernel/ppc-sources/files/digest-ppc-sources-2.4.26-r3 b/sys-kernel/ppc-sources/files/digest-ppc-sources-2.4.26-r3
new file mode 100644
index 000000000000..2b90d62bed78
--- /dev/null
+++ b/sys-kernel/ppc-sources/files/digest-ppc-sources-2.4.26-r3
@@ -0,0 +1,2 @@
+MD5 88d7aefa03c92739cb70298a0b486e2c linux-2.4.26.tar.bz2 30772389
+MD5 fd4d82eef832f87127b85ddcc2f3bac9 pegpatches-2.4-26.1-base.tar.bz2 906564
diff --git a/sys-kernel/ppc-sources/files/ppc-sources-2.4.26.CAN-2004-0497.patch b/sys-kernel/ppc-sources/files/ppc-sources-2.4.26.CAN-2004-0497.patch
new file mode 100644
index 000000000000..9503e9efe57b
--- /dev/null
+++ b/sys-kernel/ppc-sources/files/ppc-sources-2.4.26.CAN-2004-0497.patch
@@ -0,0 +1,23 @@
+# ChangeSet
+#
+# fs/attr.c
+#   2004/07/03 18:28:30-03:00 marcelo@logos.cnet +1 -0
+#   Thomas Biege: Fix missing DAC check on sys_chown
+# 
+# fs/attr.c
+#   2004/07/03 19:28:29-03:00 marcelo@logos.cnet +1 -1
+#   Add missing bracket to inode_change_ok() fix
+# 
+diff -Nru a/fs/attr.c b.plasmaroo/fs/attr.c
+--- a/fs/attr.c	2004-07-08 17:05:20 -07:00
++++ b.plasmaroo/fs/attr.c	2004-07-08 17:05:20 -07:00
+@@ -35,7 +35,8 @@
+ 
+ 	/* Make sure caller can chgrp. */
+ 	if ((ia_valid & ATTR_GID) &&
+-	    (!in_group_p(attr->ia_gid) && attr->ia_gid != inode->i_gid) &&
++	    (current->fsuid != inode->i_uid ||
++	    (!in_group_p(attr->ia_gid) && attr->ia_gid != inode->i_gid)) &&
+ 	    !capable(CAP_CHOWN))
+ 		goto error;
+ 
diff --git a/sys-kernel/ppc-sources/ppc-sources-2.4.26-r3.ebuild b/sys-kernel/ppc-sources/ppc-sources-2.4.26-r3.ebuild
new file mode 100644
index 000000000000..564926b7b2b2
--- /dev/null
+++ b/sys-kernel/ppc-sources/ppc-sources-2.4.26-r3.ebuild
@@ -0,0 +1,25 @@
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/ppc-sources/ppc-sources-2.4.26-r3.ebuild,v 1.1 2004/07/09 18:17:50 plasmaroo Exp $
+
+ETYPE="sources"
+inherit kernel-2
+detect_version
+
+# Version of gentoo patchset
+GPV=26.1
+GPV_SRC="mirror://gentoo/pegpatches-${KV_MAJOR}.${KV_MINOR}-${GPV}-base.tar.bz2"
+
+KEYWORDS="-* ppc"
+
+UNIPATCH_LIST="${DISTDIR}/pegpatches-${KV_MAJOR}.${KV_MINOR}-${GPV}-base.tar.bz2
+	${FILESDIR}/${P}.CAN-2004-0394.patch
+	${FILESDIR}/${P}.CAN-2004-0495.patch
+	${FILESDIR}/${P}.CAN-2004-0497.patch
+	${FILESDIR}/${P}.CAN-2004-0535.patch"
+UNIPATCH_DOCS="${WORKDIR}/patches/pegpatches-${KV_MAJOR}.${KV_MINOR}-${GPV}/0000_README"
+
+DESCRIPTION="Full sources including the Pegasos patchset for the ${KV_MAJOR}.${KV_MINOR} kernel tree"
+SRC_URI="${KERNEL_URI} ${GPV_SRC}"
+
+DEPEND="${DEPEND}"
diff --git a/sys-kernel/xbox-sources/ChangeLog b/sys-kernel/xbox-sources/ChangeLog
index d11a7563bee3..804bc623b4c0 100644
--- a/sys-kernel/xbox-sources/ChangeLog
+++ b/sys-kernel/xbox-sources/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for sys-kernel/xbox-sources
 # Copyright 1999-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/ChangeLog,v 1.2 2004/07/04 19:10:32 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/ChangeLog,v 1.3 2004/07/09 18:12:57 plasmaroo Exp $
+
+*xbox-sources-2.6.7-r2 (09 Jul 2004)
+
+  09 Jul 2004; <plasmaroo@gentoo.org> -xbox-sources-2.6.7-r1.ebuild,
+  +xbox-sources-2.6.7-r2.ebuild, +files/xbox-sources.CAN-2004-0497.patch,
+  +files/xbox-sources.ProcPerms.patch:
+  Version bump for kernel attribute vulnerabilities, bug #56479.
 
 *xbox-sources-2.6.7-r1 (30 Jun 2004)
 
diff --git a/sys-kernel/xbox-sources/files/digest-xbox-sources-2.6.7-r1 b/sys-kernel/xbox-sources/files/digest-xbox-sources-2.6.7-r2
index 44de8f6c9172..44de8f6c9172 100644
--- a/sys-kernel/xbox-sources/files/digest-xbox-sources-2.6.7-r1
+++ b/sys-kernel/xbox-sources/files/digest-xbox-sources-2.6.7-r2
diff --git a/sys-kernel/xbox-sources/files/xbox-sources.CAN-2004-0497.patch b/sys-kernel/xbox-sources/files/xbox-sources.CAN-2004-0497.patch
new file mode 100644
index 000000000000..41b3196f84ea
--- /dev/null
+++ b/sys-kernel/xbox-sources/files/xbox-sources.CAN-2004-0497.patch
@@ -0,0 +1,26 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+#   2004/07/02 20:55:04-07:00 chrisw@osdl.org 
+#   [PATCH] chown permission check fix for ATTR_GID
+#   
+#   SuSE discovered this problem with chown and ATTR_GID.  Make sure user
+#   is authorized to change the group, CAN-2004-0497.
+# 
+# fs/attr.c
+#   2004/07/02 09:07:32-07:00 chrisw@osdl.org +2 -1
+#   chown permission check fix for ATTR_GID
+# 
+diff -Nru a/fs/attr.c b/fs/attr.c
+--- a/fs/attr.c	2004-07-08 16:35:57 -07:00
++++ b/fs/attr.c	2004-07-08 16:35:57 -07:00
+@@ -35,7 +35,8 @@
+ 
+ 	/* Make sure caller can chgrp. */
+ 	if ((ia_valid & ATTR_GID) &&
+-	    (!in_group_p(attr->ia_gid) && attr->ia_gid != inode->i_gid) &&
++	    (current->fsuid != inode->i_uid ||
++	    (!in_group_p(attr->ia_gid) && attr->ia_gid != inode->i_gid)) &&
+ 	    !capable(CAP_CHOWN))
+ 		goto error;
+ 
diff --git a/sys-kernel/xbox-sources/files/xbox-sources.ProcPerms.patch b/sys-kernel/xbox-sources/files/xbox-sources.ProcPerms.patch
new file mode 100644
index 000000000000..d90b8d1815d4
--- /dev/null
+++ b/sys-kernel/xbox-sources/files/xbox-sources.ProcPerms.patch
@@ -0,0 +1,49 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+#   2004/07/02 18:48:26-07:00 chrisw@osdl.org 
+#   [PATCH] check attr updates in /proc
+#   
+#   Any proc entry with default proc_file_inode_operations allow unauthorized
+#   attribute updates.  This is very dangerous for proc entries that rely
+#   solely on file permissions for open/read/write.
+#   
+#   Signed-off-by: Chris Wright <chrisw@osdl.org>
+#   Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+# 
+# fs/proc/generic.c
+#   2004/07/02 15:47:55-07:00 chrisw@osdl.org +14 -7
+#   check attr updates in /proc
+# 
+diff -Nru a/fs/proc/generic.c b/fs/proc/generic.c
+--- a/fs/proc/generic.c	2004-07-08 17:03:20 -07:00
++++ b/fs/proc/generic.c	2004-07-08 17:03:20 -07:00
+@@ -231,14 +231,21 @@
+ static int proc_notify_change(struct dentry *dentry, struct iattr *iattr)
+ {
+ 	struct inode *inode = dentry->d_inode;
+-	int error = inode_setattr(inode, iattr);
+-	if (!error) {
+-		struct proc_dir_entry *de = PDE(inode);
+-		de->uid = inode->i_uid;
+-		de->gid = inode->i_gid;
+-		de->mode = inode->i_mode;
+-	}
++	struct proc_dir_entry *de = PDE(inode);
++	int error;
+ 
++	error = inode_change_ok(inode, iattr);
++	if (error)
++		goto out;
++
++	error = inode_setattr(inode, iattr);
++	if (error)
++		goto out;
++	
++	de->uid = inode->i_uid;
++	de->gid = inode->i_gid;
++	de->mode = inode->i_mode;
++out:
+ 	return error;
+ }
+ 
diff --git a/sys-kernel/xbox-sources/xbox-sources-2.6.7-r1.ebuild b/sys-kernel/xbox-sources/xbox-sources-2.6.7-r2.ebuild
index c562545d713d..8c889cb3cac2 100644
--- a/sys-kernel/xbox-sources/xbox-sources-2.6.7-r1.ebuild
+++ b/sys-kernel/xbox-sources/xbox-sources-2.6.7-r2.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2004 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/xbox-sources-2.6.7-r1.ebuild,v 1.1 2004/07/04 19:09:31 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/xbox-sources-2.6.7-r2.ebuild,v 1.1 2004/07/09 18:12:57 plasmaroo Exp $
 
 ETYPE="sources"
 inherit kernel-2
@@ -12,7 +12,7 @@ XBOX_PATCHES=xboxpatches-${KV_MAJOR}.${KV_MINOR}-${XPV}.tar.bz2
 
 K_NOSETEXTRAVERSION="don't_set_it"
 KEYWORDS="~x86 -*"
-UNIPATCH_LIST="${DISTDIR}/${XBOX_PATCHES} ${FILESDIR}/${PN}.IPTables-RDoS.patch"
+UNIPATCH_LIST="${DISTDIR}/${XBOX_PATCHES} ${FILESDIR}/${PN}.CAN-2004-0497.patch ${FILESDIR}/${PN}.IPTables-RDoS.patch ${FILESDIR}/${PN}.ProcPerms.patch"
 DESCRIPTION="Full sources for the Xbox Linux kernel"
 SRC_URI="${KERNEL_URI}
 	mirror://gentoo/${XBOX_PATCHES}"