Remove old vulnerable version.

Package-Manager: portage-2.2_rc96/cvs/Linux x86_64

4 files changed, 9 insertions, 241 deletions

diff --git a/sys-auth/pam_krb5/ChangeLog b/sys-auth/pam_krb5/ChangeLog
index ac8ea5093f96..75ca8d664606 100644
--- a/sys-auth/pam_krb5/ChangeLog
+++ b/sys-auth/pam_krb5/ChangeLog
@@ -1,6 +1,10 @@
 # ChangeLog for sys-auth/pam_krb5
 # Copyright 1999-2010 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-auth/pam_krb5/ChangeLog,v 1.37 2010/09/12 04:17:30 josejx Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-auth/pam_krb5/ChangeLog,v 1.38 2010/10/15 15:04:55 flameeyes Exp $
+
+  15 Oct 2010; Diego E. Pettenò <flameeyes@gentoo.org>
+  -pam_krb5-3.12.ebuild, -files/pam_krb5-3.12-CVE-2009-0361-0362.patch:
+  Remove old vulnerable version.
 
   12 Sep 2010; Joseph Jezak <josejx@gentoo.org> pam_krb5-4.3.ebuild:
   Marked ppc stable for bug #326953.
diff --git a/sys-auth/pam_krb5/Manifest b/sys-auth/pam_krb5/Manifest
index 6806f1e2e78f..9adafa560c54 100644
--- a/sys-auth/pam_krb5/Manifest
+++ b/sys-auth/pam_krb5/Manifest
@@ -1,17 +1,14 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA1
 
-AUX pam_krb5-3.12-CVE-2009-0361-0362.patch 7309 RMD160 06d55aa90457db36c23e470dcba3d3851c8f345a SHA1 5f85c68623bb334f07f5ef9ac7f937ba49abc0c7 SHA256 d1bc55e80b24cf27d6a90a282d9c8696c30f18d68195e4c3f222b611d3b62052
-DIST pam-krb5-3.12.tar.gz 153230 RMD160 053c6bce707c4f17986a64401bd688ed85cb240b SHA1 363b4c7a1031f134164190c2cf116f41170012ad SHA256 f5242f509212ab08cdf87b7f399469eca08ea8f3f885dc589d35b225d39b30db
 DIST pam-krb5-4.3.tar.gz 392664 RMD160 da84c425a23aa7f866de236075fd81767cc85d37 SHA1 6008e0988bcb4388d4398f6aed2a1443e53a2bd6 SHA256 485bd5ae7f2b0e7655ee67edf27756cbcb1de3ae7f35fce22909785557f23209
-EBUILD pam_krb5-3.12.ebuild 939 RMD160 c7ebbf9622989090e9b5feef8a4524eb5b32a8d4 SHA1 0c81e827e4e05734713111c57b47bc53cb7ed276 SHA256 12f23f3da34e9cc9f68b9c9bcb92832e39d03e11c78462562b4f68ca5e14e473
 EBUILD pam_krb5-4.3.ebuild 891 RMD160 da75fd317a81b0469285df8037d315a0a8a2c5f0 SHA1 437d58f39aa02f63501769c0135271389f8b4259 SHA256 8d92b137ec9d5994c5cf3af575f84c783b649928f3431b8a33d20ecc263e138f
-MISC ChangeLog 7194 RMD160 0fefea479f6f2134a57970286d8327c974313eb9 SHA1 24877c88d7744f5f2819f8cb2f80e60bfdddd025 SHA256 a0cbcc653c36e8c7975fa60b730d7732f3a00386a191afacec7ff026a2bfcc47
+MISC ChangeLog 7359 RMD160 0352b13bb1c04578d2a2437dce7a431efd94a1c6 SHA1 4a59b5ae0502d2b3f9207fa094a47d5049e388c6 SHA256 b3b02ef1d2a499eec9ca9ef6ee4ee606f0051851311aef59db7f967b1a9b79cc
 MISC metadata.xml 451 RMD160 0484c019600155e553c2cfaf86c74dfac631548b SHA1 f3a976f35770f6dc73d4cc28bc096f3ef4b69f2d SHA256 45b71bfd60f3c6bfd08649c7121f31a5f2f927f33d711ded05202cdc70298200
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.16 (GNU/Linux)
 
-iEYEARECAAYFAkyMU2kACgkQcsIHjyDViGRFAgCeP7xABuEvoiPBLQpFnV6GWjhP
-Gt0AoIAJJS2qI5LT9SqWl4lMg8tKyRx2
-=UJFD
+iEYEARECAAYFAky4bXsACgkQAiZjviIA2XgyrgCgrNYD8ngBlw26ACeSfyqy62mf
+5SQAoNkNWLiMxvkpbLcWJ9iAN8YGzrFM
+=0Nl8
 -----END PGP SIGNATURE-----
diff --git a/sys-auth/pam_krb5/files/pam_krb5-3.12-CVE-2009-0361-0362.patch b/sys-auth/pam_krb5/files/pam_krb5-3.12-CVE-2009-0361-0362.patch
deleted file mode 100644
index 542679a42b6f..000000000000
--- a/sys-auth/pam_krb5/files/pam_krb5-3.12-CVE-2009-0361-0362.patch
+++ /dev/null
@@ -1,194 +0,0 @@
-diff --git a/api-auth.c b/api-auth.c
-index 55df461..f6af390 100644
---- a/api-auth.c
-+++ b/api-auth.c
-@@ -494,6 +494,37 @@ pam_sm_setcred(pam_handle_t *pamh, int flags, int argc, const char **argv)
-     if (reinit) {
-         const char *name, *k5name;
- 
-+        /*
-+         * Solaris su calls pam_setcred as root with PAM_REINITIALIZE_CREDS,
-+         * preserving the user-supplied environment.  An xlock program may
-+         * also do this if it's setuid root and doesn't drop credentials
-+         * before calling pam_setcred.
-+         *
-+         * There isn't any safe way of reinitializing the exiting ticket cache
-+         * for the user if we're setuid without calling setreuid().  Calling
-+         * setreuid() is possible, but if the calling application is threaded,
-+         * it will change credentials for the whole application, with possibly
-+         * bizarre and unintended (and insecure) results.  Trying to verify
-+         * ownership of the existing ticket cache before using it fails under
-+         * various race conditions (for example, having one of the elements of
-+         * the path be a symlink and changing the target of that symlink
-+         * between our check and the call to krb5_cc_resolve.  Without calling
-+         * setreuid(), we run the risk of replacing a file owned by another
-+         * user with a credential cache.
-+         *
-+         * We could fail with an error in the setuid case, which would be
-+         * maximally safe, but it would prevent use of the module for
-+         * authentication with programs such as Solaris su.  Failure to
-+         * reinitialize the cache is normally not a serious problem, just a
-+         * missing feature.  We therefore log an error and exit with
-+         * PAM_SUCCESS for the setuid case.
-+         */
-+        if (pamk5_compat_issetugid()) {
-+            pamk5_error(args, "credential reinitialization in a setuid"
-+                        " context ignored");
-+            pamret = PAM_SUCCESS;
-+            goto done;
-+        }
-         name = pamk5_get_krb5ccname(args, "KRB5CCNAME");
-         if (name == NULL)
-             name = krb5_cc_default_name(ctx->context);
-diff --git a/compat.c b/compat.c
-index e6ad6b0..1bf981d 100644
---- a/compat.c
-+++ b/compat.c
-@@ -24,6 +24,7 @@
- # include <security/pam_modutil.h>
- #endif
- #include <stdlib.h>
-+#include <unistd.h>
- 
- #if !defined(HAVE_KRB5_GET_ERROR_MESSAGE) && !defined(HAVE_KRB5_GET_ERR_TEXT)
- # if !defined(HAVE_KRB5_GET_ERROR_STRING)
-@@ -146,6 +147,39 @@ pamk5_compat_free_error(krb5_context ctx, const char *msg)
- 
- 
- /*
-+ * AIX's NAS Kerberos implementation mysteriously provides the struct and the
-+ * krb5_verify_init_creds function but not this function.
-+ */
-+#ifndef HAVE_KRB5_VERIFY_INIT_CREDS_OPT_INIT
-+void
-+krb5_verify_init_creds_opt_init(krb5_verify_init_creds_opt *opt)
-+{
-+    opt->flags = 0;
-+    opt->ap_req_nofail = 0;
-+}
-+#endif
-+
-+
-+/*
-+ * MIT provides a krb5_init_secure_context that ignores all the environment
-+ * variables that may otherwise influence context creation.  We call that
-+ * function if we detect that we're setuid.  Heimdal doesn't have this
-+ * function, but instead automatically ignores the environment variables if it
-+ * detects we're setuid.  This means that we should be able to fall back
-+ * safely to krb5_init_context if krb5_init_secure_context isn't available.
-+ */
-+krb5_error_code
-+pamk5_compat_secure_context(krb5_context *ctx)
-+{
-+#ifdef HAVE_KRB5_INIT_SECURE_CONTEXT
-+    return krb5_init_secure_context(ctx);
-+#else
-+    return krb5_init_context(ctx);
-+#endif
-+}
-+
-+
-+/*
-  * Linux PAM provides a thread-safe version of getpwnam that we want to use if
-  * available.  If it's not, fall back on getpwnam.  (Ideally, we should check
-  * for getpwnam_r and use it, but I haven't written that routine.)
-@@ -162,14 +196,19 @@ pamk5_compat_getpwnam(struct pam_args *args UNUSED, const char *user)
- 
- 
- /*
-- * AIX's NAS Kerberos implementation mysteriously provides the struct and the
-- * krb5_verify_init_creds function but not this function.
-+ * Call the Solaris issetugid function if available.  If not, check whether
-+ * the real and effective UIDs and GIDs match.
-  */
--#ifndef HAVE_KRB5_VERIFY_INIT_CREDS_OPT_INIT
--void
--krb5_verify_init_creds_opt_init(krb5_verify_init_creds_opt *opt)
-+int
-+pamk5_compat_issetugid(void)
- {
--    opt->flags = 0;
--    opt->ap_req_nofail = 0;
--}
-+#ifdef HAVE_ISSETUGID
-+    return issetugid();
-+#else
-+    if (getuid() != geteuid())
-+        return 1;
-+    if (getgid() != getegid())
-+        return 1;
-+    return 0;
- #endif
-+}
-diff --git a/configure.ac b/configure.ac
-index 6835a2d..2d04f58 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -21,6 +22,10 @@ AC_PROG_MAKE_SET
- AC_CANONICAL_HOST
- AC_AIX
- 
-+dnl Check for the Solaris issetugid function, which is nicer than comparing
-+dnl real and effective UIDs and GIDs.
-+AC_CHECK_FUNCS([issetugid])
-+
- dnl Probe for the functionality of the PAM libraries and their include file
- dnl naming.  Mac OS X puts them in pam/* instead of security/*.
- AC_SEARCH_LIBS([pam_set_data], [pam])
-@@ -46,6 +51,7 @@ AC_CHECK_FUNCS([krb5_appdefault_string \
-     krb5_get_init_creds_opt_set_change_password_prompt \
-     krb5_get_init_creds_opt_set_default_flags \
-     krb5_get_init_creds_opt_set_pa \
-+    krb5_init_secure_context \
-     krb5_verify_init_creds_opt_init])
- AC_CHECK_FUNCS([krb5_get_init_creds_opt_set_pkinit],
-     [RRA_FUNC_KRB5_GET_INIT_CREDS_OPT_SET_PKINIT_ARGS])
-diff --git a/context.c b/context.c
-index 9a70aa7..8475d81 100644
---- a/context.c
-+++ b/context.c
-@@ -66,7 +66,10 @@ pamk5_context_new(struct pam_args *args)
-         goto done;
-     }
-     ctx->name = strdup(name);
--    retval = krb5_init_context(&ctx->context);
-+    if (pamk5_compat_issetugid())
-+        retval = pamk5_compat_secure_context(&ctx->context);
-+    else
-+        retval = krb5_init_context(&ctx->context);
-     if (retval != 0) {
-         pamk5_error_krb5(args, "krb5_init_context", retval);
-         retval = PAM_SERVICE_ERR;
-diff --git a/internal.h b/internal.h
-index 48c5b74..7356e8a 100644
---- a/internal.h
-+++ b/internal.h
-@@ -247,6 +247,12 @@ krb5_error_code pamk5_compat_set_realm(struct pam_args *, const char *)
-     __attribute__((__visibility__("hidden")));
- void pamk5_compat_free_realm(struct pam_args *)
-     __attribute__((__visibility__("hidden")));
-+krb5_error_code pamk5_compat_secure_context(krb5_context *)
-+    __attribute__((__visibility__("hidden")));
-+
-+/* Calls issetugid if available, otherwise checks effective IDs. */
-+int pamk5_compat_issetugid(void)
-+    __attribute__((__visibility__("hidden")));
- 
- /* Calls pam_modutil_getpwnam if available, otherwise getpwnam. */
- struct passwd *pamk5_compat_getpwnam(struct pam_args *, const char *)
-diff --git a/options.c b/options.c
-index b03ee0a..e8f9da5 100644
---- a/options.c
-+++ b/options.c
-@@ -276,7 +276,10 @@ pamk5_args_parse(pam_handle_t *pamh, int flags, int argc, const char **argv)
-      * proceed; we'll die soon enough later and this way we'll die after we
-      * know whether to debug things.
-      */
--    retval = krb5_init_context(&c);
-+    if (pamk5_compat_issetugid())
-+        retval = pamk5_compat_secure_context(&c);
-+    else
-+        retval = krb5_init_context(&c);
-     if (retval != 0)
-         c = NULL;
-     if (c != NULL) {
diff --git a/sys-auth/pam_krb5/pam_krb5-3.12.ebuild b/sys-auth/pam_krb5/pam_krb5-3.12.ebuild
deleted file mode 100644
index 823a545dc6f3..000000000000
--- a/sys-auth/pam_krb5/pam_krb5-3.12.ebuild
+++ /dev/null
@@ -1,39 +0,0 @@
-# Copyright 1999-2009 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-auth/pam_krb5/pam_krb5-3.12.ebuild,v 1.4 2009/02/14 16:33:54 armin76 Exp $
-
-inherit multilib eutils pam
-
-DESCRIPTION="Kerberos 5 PAM Authentication Module"
-HOMEPAGE="http://www.eyrie.org/~eagle/software/pam-krb5/"
-SRC_URI="http://archives.eyrie.org/software/ARCHIVE/pam-krb5/pam-krb5-${PV}.tar.gz"
-
-LICENSE="|| ( BSD-2 GPL-2 )"
-SLOT="0"
-KEYWORDS="amd64 ppc sparc x86"
-IUSE="doc"
-
-DEPEND="virtual/krb5"
-RDEPEND="${DEPEND}"
-S="${WORKDIR}/${P/_/-}"
-
-src_unpack() {
-	unpack ${A}
-	cd "${S}"
-	epatch "${FILESDIR}/${P}-CVE-2009-0361-0362.patch"
-}
-
-src_compile() {
-	econf \
-		  --libdir=/$(get_libdir)\
-		  || die "econf failed"
-	emake || die "emake failed"
-}
-
-src_install() {
-	newpammod pam_krb5.so pam_krb5.so
-	if use doc; then
-		doman pam_krb5.5
-		dodoc CHANGES CHANGES-old NEWS README TODO
-	fi;
-}