Bug #356811:

- Fix CVE-2011-1154
- Fix CVE-2011-1098
- Fix CVE-2011-1155

Package-Manager: portage-2.2.0_alpha29/cvs/Linux x86_64

6 files changed, 419 insertions, 2 deletions

diff --git a/app-admin/logrotate/ChangeLog b/app-admin/logrotate/ChangeLog
index 34c2f721898e..e8c23014804b 100644
--- a/app-admin/logrotate/ChangeLog
+++ b/app-admin/logrotate/ChangeLog
@@ -1,6 +1,17 @@
 # ChangeLog for app-admin/logrotate
 # Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-admin/logrotate/ChangeLog,v 1.90 2011/02/06 05:17:33 leio Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-admin/logrotate/ChangeLog,v 1.91 2011/04/12 02:29:09 dang Exp $
+
+*logrotate-3.7.9-r1 (12 Apr 2011)
+
+  12 Apr 2011; Daniel Gryniewicz <dang@gentoo.org> +logrotate-3.7.9-r1.ebuild,
+  +files/logrotate-3.7.9-atomic-create.patch,
+  +files/logrotate-3.7.9-shred.patch, +files/logrotate-3.7.9-statefile.patch:
+  Bug #356811:
+  - Fix CVE-2011-1154
+  - Fix CVE-2011-1098
+  - Fix CVE-2011-1155
+
 
   06 Feb 2011; Mart Raudsepp <leio@gentoo.org> logrotate-3.7.1-r2.ebuild,
   logrotate-3.7.2.ebuild:
diff --git a/app-admin/logrotate/Manifest b/app-admin/logrotate/Manifest
index 50807ac5b821..cdfeb1144b9b 100644
--- a/app-admin/logrotate/Manifest
+++ b/app-admin/logrotate/Manifest
@@ -1,3 +1,6 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA1
+
 AUX logrotate-3.7.1-dateext-maxage.patch 14282 RMD160 b133eb1334a60113489e8eef93eda4d75e3d14cb SHA1 7483cbd7f734aac34e58333df353624d2e2d7b20 SHA256 391762c83304139a074f5e2b14283a254a99e53e09ee26832dd8447aa8f63573
 AUX logrotate-3.7.1-datehack.patch 516 RMD160 6b68d211ef6fa4bc5b87eb8a12ecce3e0d005d75 SHA1 8f8057e72eda4869a0418fdccaa03fe4e367ce89 SHA256 5deebe34063e614d5e13b7631ddd5cb0dc5ab3f749ce3e912c3fe30059488246
 AUX logrotate-3.7.1-ignore-hidden.patch 517 RMD160 ef4e65b9a7c1e3167695531b2e4e1bdf2d424ca6 SHA1 b5d71b244b0ae55f94309f943f8dae7b072f0c87 SHA256 cc41d44494626327228994933701003d7d5f73ed3141d88ec14c739eeee5bcb6
@@ -9,6 +12,9 @@ AUX logrotate-3.7.7-datehack.patch 589 RMD160 5b9314e3cd6f100cb0272146baceda0177
 AUX logrotate-3.7.7-fbsd.patch 983 RMD160 727327c302e48a3cbea73f3429322c72a67e323f SHA1 5ac5bc9e037c494bb92731deba67e4ca4ad7110b SHA256 961676ab9a0d7f4e5030c4a04531cefc681bfcac883e329c2e1abfc48e790b23
 AUX logrotate-3.7.7-ignore-hidden.patch 734 RMD160 7bc3628c64eaf1c39b6d7431e0a1a06f0979cd08 SHA1 85270672cf772b10fee234a00a20310d28f60722 SHA256 717ae92f87d0c1b53d8930efb7fe61d0884fb599a5fe706dcabc41c116cd093b
 AUX logrotate-3.7.7-weekly.patch 1228 RMD160 8dbaec65fd9c2cec3cef6c01b33f95fb9bfaae50 SHA1 bd03af7849e280a1cc00118194d5fad0211c57f5 SHA256 fef846a8cd140c1d6a182de81b76c65d0ececf1b463c6d5efdb84ed2aa3a2440
+AUX logrotate-3.7.9-atomic-create.patch 1788 RMD160 ce1a9b520567a38b6e134e2d8996ca63084d06d2 SHA1 a7c41b06a4037d36193dfb8e30922bf7b824d409 SHA256 6a4f4a325c49c9a7eaa4a5a9fb4a049cad5b3b7864a55135b42ed624d2a7cbdf
+AUX logrotate-3.7.9-shred.patch 3988 RMD160 0a4f4ced9b533eb79d29fdb7f3614cd745d56d31 SHA1 8518457a9c206d7d1229b3b686343c586fa9a7f9 SHA256 e1ab3027cf5697d59b6b9da4c96bcb967a66f2110a68b6105bdb73e38b965bf3
+AUX logrotate-3.7.9-statefile.patch 1847 RMD160 51d5d9a09d8388d19be7cbf12e1dc1a0cfe4140b SHA1 8748af9f2690bf00a016550f95b9481cf1a9234c SHA256 014dd543785ccdd74e47084be3c77c78b22d240252197f88caa680a32e397549
 AUX logrotate.conf 860 RMD160 a7ab0fef1822d135fb1d194ced8d8ae487f729d8 SHA1 c9f1e3cab04c7fcc1a3a4bac5b0c54a88ee81fdb SHA256 5a0d6a2f331af0df8e0b87904ba522b64bfebc13f47b0a5717e03257d3f29ad7
 AUX logrotate.cron 52 RMD160 fc2606fcd6d6bbdcf189ff3aa3a112e481182a9e SHA1 0a681301e9f22178691cae25799351c220712a7f SHA256 5eeae7dfbd54f74108d49cda8285211898d29ab7d547dee267803299e7339560
 DIST logrotate-3.7.1.tar.bz2 31953 RMD160 cee80082113a6ddae8c694aa4b9a035f6aff61b1 SHA1 8177ae49ba1ed0c9db1bd76be9135249b2a5470b SHA256 d828ced574eea4900ae7a1179730503cd2984c685fa97967a2d9c743b0d4071f
@@ -20,6 +26,14 @@ EBUILD logrotate-3.7.1-r2.ebuild 1790 RMD160 43ed4ab2822cbcbb8b94b4c65c1c257bc04
 EBUILD logrotate-3.7.2.ebuild 1555 RMD160 448b2f63dc96bac2d12f95bddb82a3fdf477605c SHA1 6bb91491ad57f4e4c706c5085444b35cb3482e85 SHA256 ba91f914a09ab24964b19972e8aa0039d7278f80884771af816a2aa92ccd1583
 EBUILD logrotate-3.7.7.ebuild 1793 RMD160 f98e5197a3bc08db6ec9c0539d05daf19831d652 SHA1 efe6dda0ecfddd1a339f2ec02a067488db2c7a8f SHA256 fb88a025beee6ecb619cd2c52895ebe72d4d900d9c71f4fdb7cb3b1635d7469d
 EBUILD logrotate-3.7.8.ebuild 1753 RMD160 47e46705c1c7d5be3122d580499fc2f2fe152ed1 SHA1 db51844d03b426888c9c17a5274c178c6be3674f SHA256 2ffbe523f4211212d1b6691e6e6901e1b520e3a473844163a29a270ec094af6b
+EBUILD logrotate-3.7.9-r1.ebuild 1899 RMD160 1593cdf2f3f01e62976ffaba654130ce0bf1589d SHA1 e3b43521a49dd4af69e38510313543b83a1591c3 SHA256 877f298cf68150c9da702f6a2e44b0c6f488084d6507afd5dabd350a5df21c36
 EBUILD logrotate-3.7.9.ebuild 1758 RMD160 36e056060804869f0befcc28d982ba35943f3208 SHA1 c8a2a49b36014b5182f0b0a80990a22cb98e778a SHA256 71a6ce06a1280878b12525e0348ac91bb24be410ddf05391727d8e1863977609
-MISC ChangeLog 12358 RMD160 71b3e74d0869e07254ecdf98929f7925c5423829 SHA1 e88e915a310f3c92e4675f541bb0b87ad0e3db77 SHA256 54a0399e509cc80ec6f7a035cfa79352fc4bd9d81be252f61630ad45c1871c68
+MISC ChangeLog 12679 RMD160 2a63111c084ee5457bfa1c0b538b6301cd53cd12 SHA1 7382097495fa9db6e1c7222efeadb4251292ee30 SHA256 b4f551a16797b1d1c07a6749cf6ffda3037d955726171554070f18932ad1bc96
 MISC metadata.xml 216 RMD160 9bd928268bad8d343ce07f1c2f875b7c296db426 SHA1 df32457660dc43f2fd8b867c0b01ff7aed8e8f98 SHA256 4285dde164ce71c8922ac0cb88e9ea655f517c2d5c25437090466df3988658c0
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.17 (GNU/Linux)
+
+iEYEARECAAYFAk2juO4ACgkQomPajV0RnrH7GACdHqj4DQruU9pLspGD7ZLmHQj+
+b80An0bIFcT7vNe3vkYuq8DesXFjN4co
+=1loj
+-----END PGP SIGNATURE-----
diff --git a/app-admin/logrotate/files/logrotate-3.7.9-atomic-create.patch b/app-admin/logrotate/files/logrotate-3.7.9-atomic-create.patch
new file mode 100644
index 000000000000..b888dc0231a4
--- /dev/null
+++ b/app-admin/logrotate/files/logrotate-3.7.9-atomic-create.patch
@@ -0,0 +1,70 @@
+diff --git a/logrotate.c b/logrotate.c
+index 3748918..fbe232a 100644
+--- a/logrotate.c
++++ b/logrotate.c
+@@ -194,31 +194,41 @@ static int runScript(char *logfn, char *script)
+ int createOutputFile(char *fileName, int flags, struct stat *sb)
+ {
+     int fd;
++	char template[PATH_MAX + 1];
++	mode_t umask_value;
++	snprintf(template, PATH_MAX, "%s/logrotate_temp.XXXXXX", ourDirName(fileName));
++
++	umask_value = umask(0000);
++	fd = mkstemp(template);
++	umask(umask_value);
++
++	if (fd < 0) {
++		message(MESS_ERROR, "error creating unique temp file: %s\n",
++				strerror(errno));
++		return -1;
++	}
++
++	if (fchown(fd, sb->st_uid, sb->st_gid)) {
++		message(MESS_ERROR, "error setting owner of %s: %s\n",
++				fileName, strerror(errno));
++		close(fd);
++		return -1;
++	}
++
++	if (fchmod(fd, sb->st_mode)) {
++		message(MESS_ERROR, "error setting mode of %s: %s\n",
++				fileName, strerror(errno));
++		close(fd);
++		return -1;
++	}
++
++	if (rename(template, fileName)) {
++		message(MESS_ERROR, "error renaming temp file to %s: %s\n",
++				fileName, strerror(errno));
++		close(fd);
++		return -1;
++	}
+ 
+-    fd = open(fileName, flags, sb->st_mode);
+-    if (fd < 0) {
+-	message(MESS_ERROR, "error creating output file %s: %s\n",
+-		fileName, strerror(errno));
+-	return -1;
+-    }
+-    if (fchmod(fd, (S_IRUSR | S_IWUSR) & sb->st_mode)) {
+-	message(MESS_ERROR, "error setting mode of %s: %s\n",
+-		fileName, strerror(errno));
+-	close(fd);
+-	return -1;
+-    }
+-    if (fchown(fd, sb->st_uid, sb->st_gid)) {
+-	message(MESS_ERROR, "error setting owner of %s: %s\n",
+-		fileName, strerror(errno));
+-	close(fd);
+-	return -1;
+-    }
+-    if (fchmod(fd, sb->st_mode)) {
+-	message(MESS_ERROR, "error setting mode of %s: %s\n",
+-		fileName, strerror(errno));
+-	close(fd);
+-	return -1;
+-    }
+     return fd;
+ }
+ 
diff --git a/app-admin/logrotate/files/logrotate-3.7.9-shred.patch b/app-admin/logrotate/files/logrotate-3.7.9-shred.patch
new file mode 100644
index 000000000000..7df1e96c0d56
--- /dev/null
+++ b/app-admin/logrotate/files/logrotate-3.7.9-shred.patch
@@ -0,0 +1,151 @@
+diff --git a/logrotate.c b/logrotate.c
+index 95bc80b..8dfb3d7 100644
+--- a/logrotate.c
++++ b/logrotate.c
+@@ -56,7 +56,7 @@ int debug = 0;
+ char *mailCommand = DEFAULT_MAIL_COMMAND;
+ time_t nowSecs = 0;
+ 
+-static int shred_file(char *filename, struct logInfo *log);
++static int shred_file(int fd, char *filename, struct logInfo *log);
+ 
+ static int globerr(const char *pathname, int theerr)
+ {
+@@ -216,59 +216,79 @@ int createOutputFile(char *fileName, int flags, struct stat *sb)
+     return fd;
+ }
+ 
+-#define SHRED_CALL "shred -u "
+-#define SHRED_COUNT_FLAG "-n "
+ #define DIGITS 10
++
+ /* unlink, but try to call shred from GNU fileutils */
+-static int shred_file(char *filename, struct logInfo *log)
++static int shred_file(int fd, char *filename, struct logInfo *log)
+ {
+-	int len, ret;
+-	char *cmd;
+ 	char count[DIGITS];    /*  that's a lot of shredding :)  */
++	const char **fullCommand;
++	int id = 0;
++	int status;
+ 
+ 	if (!(log->flags & LOG_FLAG_SHRED)) {
+ 		return unlink(filename);
+ 	}
+ 
+-	len = strlen(filename) + strlen(SHRED_CALL);
+-	len += strlen(SHRED_COUNT_FLAG) + DIGITS;
+-	cmd = malloc(len);
++	message(MESS_DEBUG, "Using shred to remove the file %s\n", filename);
+ 
+-	if (!cmd) {
+-		message(MESS_ERROR, "malloc error while shredding");
+-		return unlink(filename);
++	if (log->shred_cycles != 0) {
++		fullCommand = alloca(sizeof(*fullCommand) * 6);
++	}
++	else {
++		fullCommand = alloca(sizeof(*fullCommand) * 4);
+ 	}
+-	strcpy(cmd, SHRED_CALL);
++	fullCommand[id++] = "shred";
++	fullCommand[id++] = "-u";
++
+ 	if (log->shred_cycles != 0) {
+-		strcat(cmd, SHRED_COUNT_FLAG);
++		fullCommand[id++] = "-n";
+ 		snprintf(count, DIGITS - 1, "%d", log->shred_cycles);
+-		strcat(count, " ");
+-		strcat(cmd, count);
++		fullCommand[id++] = count;
++	}
++	fullCommand[id++] = "-";
++	fullCommand[id++] = NULL;
++
++	if (!fork()) {
++		dup2(fd, 1);
++		close(fd);
++
++		execvp(fullCommand[0], (void *) fullCommand);
++		exit(1);
+ 	}
+-	strcat(cmd, filename);
+-	ret = system(cmd);
+-	free(cmd);
+-	if (ret != 0) {
++	
++	wait(&status);
++
++	if (!WIFEXITED(status) || WEXITSTATUS(status)) {
+ 		message(MESS_ERROR, "Failed to shred %s\n, trying unlink", filename);
+-		if (ret != -1) {
+-			message(MESS_NORMAL, "Shred returned %d\n", ret);
+-		}
+ 		return unlink(filename);
+-	} else {
+-		return ret;
+ 	}
++
++	/* We have to unlink it after shred anyway,
++	 * because it doesn't remove the file itself */
++	return unlink(filename);
+ }
+ 
+ static int removeLogFile(char *name, struct logInfo *log)
+ {
+-    message(MESS_DEBUG, "removing old log %s\n", name);
++	int fd;
++	message(MESS_DEBUG, "removing old log %s\n", name);
+ 
+-    if (!debug && shred_file(name, log)) {
+-	message(MESS_ERROR, "Failed to remove old log %s: %s\n",
+-		name, strerror(errno));
+-	return 1;
+-    }
+-    return 0;
++	if ((fd = open(name, O_RDWR)) < 0) {
++		message(MESS_ERROR, "error opening %s: %s\n",
++			name, strerror(errno));
++		return 1;
++	}
++
++	if (!debug && shred_file(fd, name, log)) {
++		message(MESS_ERROR, "Failed to remove old log %s: %s\n",
++			name, strerror(errno));
++		close(fd);
++		return 1;
++	}
++
++	close(fd);
++	return 0;
+ }
+ 
+ static int compressLogFile(char *name, struct logInfo *log, struct stat *sb)
+@@ -294,7 +314,7 @@ static int compressLogFile(char *name, struct logInfo *log, struct stat *sb)
+     compressedName = alloca(strlen(name) + strlen(log->compress_ext) + 2);
+     sprintf(compressedName, "%s%s", name, log->compress_ext);
+ 
+-    if ((inFile = open(name, O_RDONLY)) < 0) {
++    if ((inFile = open(name, O_RDWR)) < 0) {
+ 	message(MESS_ERROR, "unable to open %s for compression\n", name);
+ 	return 1;
+     }
+@@ -316,7 +336,6 @@ static int compressLogFile(char *name, struct logInfo *log, struct stat *sb)
+ 	exit(1);
+     }
+ 
+-    close(inFile);
+     close(outFile);
+ 
+     wait(&status);
+@@ -326,7 +345,8 @@ static int compressLogFile(char *name, struct logInfo *log, struct stat *sb)
+ 	return 1;
+     }
+ 
+-    shred_file(name, log);
++    shred_file(inFile, name, log);
++	close(inFile);
+ 
+     return 0;
+ }
diff --git a/app-admin/logrotate/files/logrotate-3.7.9-statefile.patch b/app-admin/logrotate/files/logrotate-3.7.9-statefile.patch
new file mode 100644
index 000000000000..daa02402fad7
--- /dev/null
+++ b/app-admin/logrotate/files/logrotate-3.7.9-statefile.patch
@@ -0,0 +1,96 @@
+Index: logrotate.c
+===================================================================
+--- logrotate.c	(revision 314)
++++ logrotate.c	(working copy)
+@@ -45,6 +45,12 @@
+ #define GLOB_ABORTED GLOB_ABEND
+ #endif
+ 
++#ifdef PATH_MAX
++#define STATEFILE_BUFFER_SIZE 2 * PATH_MAX + 16
++#else
++#define STATEFILE_BUFFER_SIZE 4096
++#endif
++
+ struct logState {
+     char *fn;
+     struct tm lastRotated;	/* only tm.mon, tm_mday, tm_year are good! */
+@@ -82,6 +88,34 @@
+     return 1;
+ }
+ 
++static void unescape(char *arg)
++{
++	char *p = arg;
++	char *next;
++	char escaped;
++	while ((next = strchr(p, '\\')) != NULL) {
++
++		p = next;
++
++		switch (p[1]) {
++		case 'n':
++			escaped = '\n';
++			break;
++		case '\\':
++			escaped = '\\';
++			break;
++		default:
++			++p;
++			continue;
++		}
++
++		/* Overwrite the backslash with the intended character,
++		 * and shift everything down one */
++		*p++ = escaped;
++		memmove(p, p+1, 1 + strlen(p+1));
++	}
++}
++
+ #define HASH_SIZE_MIN 64
+ static int allocateHash(void)
+ {
+@@ -1546,7 +1580,13 @@
+ 			for (chptr = p->fn; *chptr; chptr++) {
+ 				switch (*chptr) {
+ 				case '"':
++				case '\\':
+ 					fputc('\\', f);
++					break;
++				case '\n':
++					fputc('\\', f);
++					fputc('n', f);
++					continue;
+ 				}
+ 
+ 				fputc(*chptr, f);
+@@ -1567,7 +1607,8 @@
+ static int readState(char *stateFilename)
+ {
+     FILE *f;
+-    char buf[1024];
++    char buf[STATEFILE_BUFFER_SIZE];
++	char *filename;
+     const char **argv;
+     int argc;
+     int year, month, day;
+@@ -1678,7 +1719,10 @@
+ 
+ 	year -= 1900, month -= 1;
+ 
+-	if ((st = findState(argv[0])) == NULL)
++	filename = strdup(argv[0]);
++	unescape(filename);
++	
++	if ((st = findState(filename)) == NULL)
+ 		return 1;
+ 
+ 	st->lastRotated.tm_mon = month;
+@@ -1690,6 +1734,7 @@
+ 	st->lastRotated = *localtime(&lr_time);
+ 
+ 	free(argv);
++	free(filename);
+     }
+ 
+     fclose(f);
diff --git a/app-admin/logrotate/logrotate-3.7.9-r1.ebuild b/app-admin/logrotate/logrotate-3.7.9-r1.ebuild
new file mode 100644
index 000000000000..17f133170175
--- /dev/null
+++ b/app-admin/logrotate/logrotate-3.7.9-r1.ebuild
@@ -0,0 +1,75 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/app-admin/logrotate/logrotate-3.7.9-r1.ebuild,v 1.1 2011/04/12 02:29:09 dang Exp $
+
+EAPI="2"
+
+inherit eutils toolchain-funcs flag-o-matic
+
+DESCRIPTION="Rotates, compresses, and mails system logs"
+HOMEPAGE="https://fedorahosted.org/logrotate/"
+SRC_URI="https://fedorahosted.org/releases/l/o/logrotate/${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~x86-fbsd"
+IUSE="selinux"
+
+RDEPEND="
+	>=dev-libs/popt-1.5
+	selinux? (
+		sys-libs/libselinux
+		sec-policy/selinux-logrotate
+	)"
+
+DEPEND="${RDEPEND}
+	>=sys-apps/sed-4"
+
+src_prepare() {
+	strip-flags
+
+	epatch \
+		"${FILESDIR}"/${PN}-3.7.7-datehack.patch \
+		"${FILESDIR}"/${PN}-3.7.7-ignore-hidden.patch \
+		"${FILESDIR}"/${PN}-3.7.7-weekly.patch \
+		"${FILESDIR}"/${PN}-3.7.7-fbsd.patch \
+		"${FILESDIR}"/${PN}-3.7.9-atomic-create.patch \
+		"${FILESDIR}"/${PN}-3.7.9-shred.patch \
+		"${FILESDIR}"/${PN}-3.7.9-statefile.patch
+}
+
+src_configure() {
+	return
+}
+
+src_compile() {
+	local myconf
+	myconf="CC=$(tc-getCC)"
+	useq selinux && myconf="${myconf} WITH_SELINUX=yes"
+	use elibc_FreeBSD && append-flags -DNO_ALLOCA_H
+	emake ${myconf} RPM_OPT_FLAGS="${CFLAGS}" || die "emake failed"
+}
+
+src_install() {
+	insinto /usr
+	dosbin logrotate
+	doman logrotate.8
+	dodoc examples/logrotate*
+
+	exeinto /etc/cron.daily
+	doexe "${FILESDIR}"/logrotate.cron
+
+	insinto /etc
+	doins "${FILESDIR}"/logrotate.conf
+
+	keepdir /etc/logrotate.d
+}
+
+pkg_postinst() {
+	elog "If you wish to have logrotate e-mail you updates, please"
+	elog "emerge virtual/mailx and configure logrotate in"
+	elog "/etc/logrotate.conf appropriately"
+	elog
+	elog "Additionally, /etc/logrotate.conf may need to be modified"
+	elog "for your particular needs.  See man logrotate for details."
+}