Fri Jan 29 07:53:39 2021 UTC ()
opendoas: Apply patch for CVE-2019-25016.

Patch from __skn on IRC.  Thanks!  Bump PKGREVISION.


(jperkin)
diff -r1.1 -r1.2 pkgsrc/security/opendoas/Makefile
diff -r1.1 -r1.2 pkgsrc/security/opendoas/distinfo
diff -r0 -r1.1 pkgsrc/security/opendoas/patches/patch-doas.c
cvs diff -r1.1 -r1.2 pkgsrc/security/opendoas/Makefile (expand / switch to unified diff)

--- pkgsrc/security/opendoas/Makefile 2021/01/01 14:28:56 1.1
+++ pkgsrc/security/opendoas/Makefile 2021/01/29 07:53:38 1.2
@@ -1,16 +1,17 @@ @@ -1,16 +1,17 @@
1# $NetBSD: Makefile,v 1.1 2021/01/01 14:28:56 pin Exp $ 1# $NetBSD: Makefile,v 1.2 2021/01/29 07:53:38 jperkin Exp $
2 2
3DISTNAME= opendoas-6.8 3DISTNAME= opendoas-6.8
 4PKGREVISION= 1
4CATEGORIES= security 5CATEGORIES= security
5MASTER_SITES= ${MASTER_SITE_GITHUB:=duncaen/} 6MASTER_SITES= ${MASTER_SITE_GITHUB:=duncaen/}
6GITHUB_TAG= v${PKGVERSION_NOREV} 7GITHUB_TAG= v${PKGVERSION_NOREV}
7 8
8MAINTAINER= sunil@nimmagadda.net 9MAINTAINER= sunil@nimmagadda.net
9HOMEPAGE= https://github.com/duncaen/opendoas 10HOMEPAGE= https://github.com/duncaen/opendoas
10COMMENT= Execute commands as another user 11COMMENT= Execute commands as another user
11LICENSE= isc 12LICENSE= isc
12 13
13CONFLICTS= doas-[0-9]* 14CONFLICTS= doas-[0-9]*
14 15
15WRKSRC= ${WRKDIR}/OpenDoas-${PKGVERSION_NOREV} 16WRKSRC= ${WRKDIR}/OpenDoas-${PKGVERSION_NOREV}
16 17
cvs diff -r1.1 -r1.2 pkgsrc/security/opendoas/distinfo (expand / switch to unified diff)

--- pkgsrc/security/opendoas/distinfo 2021/01/01 14:28:56 1.1
+++ pkgsrc/security/opendoas/distinfo 2021/01/29 07:53:38 1.2
@@ -1,7 +1,8 @@ @@ -1,7 +1,8 @@
1$NetBSD: distinfo,v 1.1 2021/01/01 14:28:56 pin Exp $ 1$NetBSD: distinfo,v 1.2 2021/01/29 07:53:38 jperkin Exp $
2 2
3SHA1 (opendoas-6.8.tar.gz) = 11963ee647b7166972512740bc7f648c8aa1272f 3SHA1 (opendoas-6.8.tar.gz) = 11963ee647b7166972512740bc7f648c8aa1272f
4RMD160 (opendoas-6.8.tar.gz) = 56f9c02d81f6ad9925323f1b44d7f7087f1108f0 4RMD160 (opendoas-6.8.tar.gz) = 56f9c02d81f6ad9925323f1b44d7f7087f1108f0
5SHA512 (opendoas-6.8.tar.gz) = 4a57079bba353247e645bc07a5d4e78fd01471d193e83751fd87b72cffa4e152c0f7ea172563f767a7193b14489f57bc066b4fee50842d30b5b7f7ce918434bb 5SHA512 (opendoas-6.8.tar.gz) = 4a57079bba353247e645bc07a5d4e78fd01471d193e83751fd87b72cffa4e152c0f7ea172563f767a7193b14489f57bc066b4fee50842d30b5b7f7ce918434bb
6Size (opendoas-6.8.tar.gz) = 32307 bytes 6Size (opendoas-6.8.tar.gz) = 32307 bytes
7SHA1 (patch-GNUmakefile) = d301c0334ce6ac7992d61681e1852a301557d300 7SHA1 (patch-GNUmakefile) = d301c0334ce6ac7992d61681e1852a301557d300
 8SHA1 (patch-doas.c) = 3c4e734e3c8f7bf38e2a58ddb1ba4e1eefe99087
File Added: pkgsrc/security/opendoas/patches/Attic/patch-doas.c
$NetBSD: patch-doas.c,v 1.1 2021/01/29 07:53:38 jperkin Exp $

Fix for CVE-2019-25016 (Unsafe, incomplete PATH reset).

--- doas.c.orig	2020-11-14 15:44:04.000000000 +0000
+++ doas.c
@@ -386,6 +386,7 @@ main(int argc, char **argv)
 
 #ifdef HAVE_LOGIN_CAP_H
 	if (setusercontext(NULL, targpw, target, LOGIN_SETGROUP |
+	    LOGIN_SETPATH |
 	    LOGIN_SETPRIORITY | LOGIN_SETRESOURCES | LOGIN_SETUMASK |
 	    LOGIN_SETUSER) != 0)
 		errx(1, "failed to set user context for target");
@@ -396,6 +397,8 @@ main(int argc, char **argv)
 		err(1, "initgroups");
 	if (setresuid(target, target, target) != 0)
 		err(1, "setresuid");
+	if (setenv("PATH", safepath, 1) == -1)
+		err(1, "failed to set PATH '%s'", safepath);
 #endif
 
 	if (getcwd(cwdpath, sizeof(cwdpath)) == NULL)