Missed one more patch, bug #264564, fix for CVE-2009-0115.

Package-Manager: portage-2.2_rc46/cvs/Linux x86_64

4 files changed, 41 insertions, 4 deletions

diff --git a/sys-fs/multipath-tools/ChangeLog b/sys-fs/multipath-tools/ChangeLog
index 315e1c7aca0c..eefb0f5edef8 100644
--- a/sys-fs/multipath-tools/ChangeLog
+++ b/sys-fs/multipath-tools/ChangeLog
@@ -1,6 +1,11 @@
 # ChangeLog for sys-fs/multipath-tools
 # Copyright 1999-2009 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-fs/multipath-tools/ChangeLog,v 1.27 2009/10/30 06:50:12 robbat2 Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-fs/multipath-tools/ChangeLog,v 1.28 2009/10/30 07:01:35 robbat2 Exp $
+
+  30 Oct 2009; Robin H. Johnson <robbat2@gentoo.org>
+  multipath-tools-0.4.8-r1.ebuild,
+  +files/multipath-tools-0.4.8-socket-cve-2009-0115.patch:
+  Missed one more patch, bug #264564, fix for CVE-2009-0115.
 
 *multipath-tools-0.4.8-r1 (30 Oct 2009)
 
diff --git a/sys-fs/multipath-tools/Manifest b/sys-fs/multipath-tools/Manifest
index 0180b3cb1f05..c7a6c0c61f86 100644
--- a/sys-fs/multipath-tools/Manifest
+++ b/sys-fs/multipath-tools/Manifest
@@ -6,13 +6,14 @@ AUX multipath-tools-0.4.7-build.patch 5389 RMD160 aedc8321511402f951a9bf8534f7d8
 AUX multipath-tools-0.4.7-udev-rules.patch 1927 RMD160 3fd2ff93da07a6446fe9cdae6a5097e971a6710b SHA1 da769d174673f7ac136239b2ca71b17f968a893d SHA256 85dedab1da1899f55aa747f141224b6211694dee7a659245981919745f064293
 AUX multipath-tools-0.4.8-build.patch 9529 RMD160 a7cfcbe99242de7de1281ba4c525e35ae36b1118 SHA1 3c78a5cd3e8752b00548edecff7a4d391ed5dd77 SHA256 e2f81548ff91d53f93dceeb8a4bd5a0f17f206996a797b39380733c0a319b5d8
 AUX multipath-tools-0.4.8-r1-kpartx.patch 7076 RMD160 a5933b1a143fb7817e991a4a26d096259d7da534 SHA1 a1c18e52e36ab700c4a51dfe6817e7720d630c66 SHA256 0de7a21f1be7eba1ff389203e24c64b28d59be645e752de56c06d00275e0b703
+AUX multipath-tools-0.4.8-socket-cve-2009-0115.patch 848 RMD160 4e4298b87c60546b0d9ffad54f2070f386e34625 SHA1 2dbc4afd69df4d5227d9090e00e5b7d041eb1ae9 SHA256 2ed8234f7d37fbc4cd77dcf77e71de3bdbcca2bef6726e1f1a99d46878ac3a04
 AUX multipath-tools-0.4.8-udev-scsi_id-changes.patch 4125 RMD160 e7f6feca014bf462c0580caabedc73152e423e3c SHA1 bd8b5f30b0cbda8a3d15b3a2383812d58a5d7ced SHA256 dca166caf506ea496f7cb883a98d1b5b1c77f5a91afa343e1ddc27d2a89ef0e3
 AUX rc-multipathd 517 RMD160 9963ca90fa08c6631b7768df7fb99414de53343d SHA1 a2c7c8c8836360ca208bfa82c406419c16045be2 SHA256 d96e3d7ca1edbbbc92f1336d4c340f1b516e71c49c85e990e3f4063c1b5db241
 DIST multipath-tools-0.4.7.tar.bz2 139312 RMD160 b9ecd84e01e03fe631e9ee9953ea7dbadb04c01d SHA1 c78e53ec5934180e37f376348d5ef5db790f3689 SHA256 1b48684c9ce956bb2294640a92f1da8ddea4e991e4d7b974697660de5e44a9d7
 DIST multipath-tools-0.4.8.tar.bz2 160706 RMD160 18a6f2c8180516c67bc7c634133218213cfa7dfc SHA1 aadc7c7ed072c3df2e32c64a2ab1ba7fac850d7a SHA256 b76d93d244f51e328969203366939d4336c89bd572e275d6a0d50d0bc8b4cd23
 EBUILD multipath-tools-0.4.7-r1.ebuild 1624 RMD160 d57ed47bf52f1943db5010bbd959097ad65c4d5c SHA1 66b461c473d26be477918eed3bb63be66e3893b5 SHA256 e9ce5c4681dfe45848ff222c36e5ec38fb01abfe3ef1120396820a07835fd59d
 EBUILD multipath-tools-0.4.7-r2.ebuild 1666 RMD160 cb1022eff5a6e32af02f73ee07de3b20482c978d SHA1 77f0adf406a16412679fc0b8258411466785c318 SHA256 c918d16867c229178ffdae654cd56566b29d19b53335ab40f73c13d20e7b7c83
-EBUILD multipath-tools-0.4.8-r1.ebuild 2699 RMD160 14b56fdb08c95817776f9039924964521cf0d1aa SHA1 13796a74ac494e1fbf5127a131ccca14c4d5c2c0 SHA256 42732770654a5442c68fa3a83838043ce9d256bf8941f0140bc478607ef45ab4
+EBUILD multipath-tools-0.4.8-r1.ebuild 2800 RMD160 c6c624e3722c24bc0b0196563a497b2898f3d9a5 SHA1 ad89f5a8b71034da965087599d25300df8bd16c9 SHA256 f5c2328e5d8aca075eb486a89cbe7f0638269ca231a6a6bacf1d161c27e572f2
 EBUILD multipath-tools-0.4.8.ebuild 2353 RMD160 3d9fa33afadf53d9ae77caadecdbf4bdaca5cae8 SHA1 457961dddf7f3312bb71c6d237b23294f6b19c1b SHA256 b72c469e490c78138c0b1d147b19dfa8679a3746bb3bf984673c3ebeda421793
-MISC ChangeLog 4894 RMD160 45c8c9828ad8cc8283e78194e2cd02aaef40afd8 SHA1 eb4ddb7f0ecbfb31133446ce6016afd261736e7d SHA256 dadf8ac93f6675e538cdab24972f40410c05a8ce3ab4bc8636f98769bda0092a
+MISC ChangeLog 5103 RMD160 d49c2b3f2c16e68aceffb9afe1880a80afe09a4d SHA1 7e3d02f7dd652772cdfaf025dd87002a1367c6e2 SHA256 1ea8e3854166dcfa0824e3bca419dd764acf071b6900b17d3bdce8d1f3e50cd8
 MISC metadata.xml 164 RMD160 f43cbec30b7074319087c9acffdb9354b17b0db3 SHA1 9c213f5803676c56439df3716be07d6692588856 SHA256 f5f2891f2a4791cd31350bb2bb572131ad7235cd0eeb124c9912c187ac10ce92
diff --git a/sys-fs/multipath-tools/files/multipath-tools-0.4.8-socket-cve-2009-0115.patch b/sys-fs/multipath-tools/files/multipath-tools-0.4.8-socket-cve-2009-0115.patch
new file mode 100644
index 000000000000..deab7620657d
--- /dev/null
+++ b/sys-fs/multipath-tools/files/multipath-tools-0.4.8-socket-cve-2009-0115.patch
@@ -0,0 +1,29 @@
+From: Hannes Reinecke <hare@suse.de>
+Date: Wed, 1 Apr 2009 20:31:01 +0000 (+0200)
+Subject: [multipathd] /var/run/multipathd.sock is world-writable
+X-Git-Url: http://git.kernel.org/gitweb.cgi?p=linux%2Fstorage%2Fmultipath-tools%2F.git;a=commitdiff_plain;h=0a0319d381249760c71023edbe0ac9c093bb4a74;hp=15d4bdddcb9b71e0ec6fecc3c37a1b8cae8f51ff
+
+[multipathd] /var/run/multipathd.sock is world-writable
+
+Due to an stray 'umask()' the socket file is in fact world-writable,
+allowing for an easy exploit.
+
+References: 458598
+---
+
+diff --git a/multipathd/main.c b/multipathd/main.c
+index 8a1a63d..9957f1f 100644
+--- a/multipathd/main.c
++++ b/multipathd/main.c
+@@ -1454,8 +1454,9 @@ daemonize(void)
+ 
+ 	close(in_fd);
+ 	close(out_fd);
+-	chdir("/");
+-	umask(0);
++	if (chdir("/") < 0)
++		fprintf(stderr, "cannot chdir to '/', continuing\n");
++
+ 	return 0;
+ }
+ 
diff --git a/sys-fs/multipath-tools/multipath-tools-0.4.8-r1.ebuild b/sys-fs/multipath-tools/multipath-tools-0.4.8-r1.ebuild
index 24126b09f986..1db3527e9982 100644
--- a/sys-fs/multipath-tools/multipath-tools-0.4.8-r1.ebuild
+++ b/sys-fs/multipath-tools/multipath-tools-0.4.8-r1.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2009 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-fs/multipath-tools/multipath-tools-0.4.8-r1.ebuild,v 1.1 2009/10/30 06:50:12 robbat2 Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-fs/multipath-tools/multipath-tools-0.4.8-r1.ebuild,v 1.2 2009/10/30 07:01:35 robbat2 Exp $
 
 EAPI=2
 inherit eutils toolchain-funcs
@@ -28,6 +28,8 @@ src_prepare() {
 	epatch "${FILESDIR}"/${PN}-0.4.8-udev-scsi_id-changes.patch
 	# Patch per upstream tree for 1GiB limit of kpartx
 	epatch "${FILESDIR}"/${PN}-0.4.8-r1-kpartx.patch
+	# CVE-2009-0115, world writable socket
+	epatch "${FILESDIR}"/${PN}-0.4.8-socket-cve-2009-0115.patch
 }
 
 src_compile() {