From 9ed7c7db02b4c8a13d244c5b3036d3f3034622d7 Mon Sep 17 00:00:00 2001 From: thomas Date: Wed, 26 Jan 2022 12:50:48 +0100 Subject: [PATCH 1/2] polkit: Switch to beehive --- polkit.be0 | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/polkit.be0 b/polkit.be0 index 021f42261..3abae1cd4 100755 --- a/polkit.be0 +++ b/polkit.be0 @@ -1,6 +1,6 @@ #!/usr/bin/env beesh -# BEE_VERSION polkit-0.115-1 +# BEE_VERSION polkit-0.115-2 ## this file was created by bee init and should be executed to build a ## bee-package. (Additional hints are located at the end of this file.) @@ -9,14 +9,15 @@ ## The source URL(s) define the location of the sources that will be ## downloaded. Version variables may be used to simplify reuse of this bee-file. -SRCURL[0]=" https://www.freedesktop.org/software/polkit/releases/polkit-${PKGVERSION}.tar.gz" +# orig https://www.freedesktop.org/software/polkit/releases/polkit-${PKGVERSION}.tar.gz +SRCURL[0]="https://beehive.molgen.mpg.de/f03b055d6ae5fc8eac76838c7d83d082/polkit-0.115.tar.gz" ############################################################################### ## Add URLs/pathes to patch files to the PATCHURL array. ## The sources will be patched in the order of the array. -PATCHURL+=(/src/mariux/patches/polkit-0.115-security_patch-2.patch) -PATCHURL+=(/src/mariux/patches/0001-GHSL-2021-074-authentication-bypass-vulnerability-in.patch) +PATCHURL+=("https://beehive.molgen.mpg.de/252c1b18ba86a7b05840e992321f4639/polkit-0.115-security_patch-2.patch") +PATCHURL+=("https://beehive.molgen.mpg.de/bcf14dcb31568b749c4d163cf8878241/0001-GHSL-2021-074-authentication-bypass-vulnerability-in.patch") ############################################################################### ## Add filename patterns to the EXCLUDE array of files that should not From 295963c25135896c17cdcf374a50f8f77054e921 Mon Sep 17 00:00:00 2001 From: thomas Date: Wed, 26 Jan 2022 13:08:03 +0100 Subject: [PATCH 2/2] polkit: Add patch for CVE-2021-4034 A bug in pkexec allows local privilege escalation. Description: https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034 Patch: https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683 --- polkit.be0 | 1 + 1 file changed, 1 insertion(+) diff --git a/polkit.be0 b/polkit.be0 index 3abae1cd4..7f8341562 100755 --- a/polkit.be0 +++ b/polkit.be0 @@ -18,6 +18,7 @@ SRCURL[0]="https://beehive.molgen.mpg.de/f03b055d6ae5fc8eac76838c7d83d082/polkit PATCHURL+=("https://beehive.molgen.mpg.de/252c1b18ba86a7b05840e992321f4639/polkit-0.115-security_patch-2.patch") PATCHURL+=("https://beehive.molgen.mpg.de/bcf14dcb31568b749c4d163cf8878241/0001-GHSL-2021-074-authentication-bypass-vulnerability-in.patch") +PATCHURL+=("https://beehive.molgen.mpg.de/3aa2c730edd4db0b4028a9b8fb887163/polkit-0.115-cve-2021-4034.patch") ############################################################################### ## Add filename patterns to the EXCLUDE array of files that should not