smani pushed to gmsh (f22). "Update to 2.9.2"
by notificationsï¼ fedoraproject.org
>From 310e560eadaf32e9cb5e6fae5219cdf4ba5b9425 Mon Sep 17 00:00:00 2001
From: Sandro Mani <manisandro(a)gmail.com>
Date: Tue, 31 Mar 2015 23:35:45 +0200
Subject: Update to 2.9.2
diff --git a/.gitignore b/.gitignore
index d4bd401..b583603 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,4 @@
/gmsh-2.9.0-source-fedora.tar.xz
/gmsh-2.9.1-source.tgz
/gmsh-2.9.1-source-fedora.tar.xz
+/gmsh-2.9.2-source-fedora.tar.xz
diff --git a/gmsh.spec b/gmsh.spec
index 86e8753..dee8aa4 100644
--- a/gmsh.spec
+++ b/gmsh.spec
@@ -1,12 +1,12 @@
Name: gmsh
Summary: A three-dimensional finite element mesh generator
-Version: 2.9.1
+Version: 2.9.2
Release: 1%{?dist}
License: GPLv2+
URL: http://geuz.org/gmsh/
# Download source from http://geuz.org/gmsh/src/%%{name}-%%{version}-source.tgz
-# Delete contrib/blossoms and contrib/mpeg_encode from source archive
+# Delete contrib/blossom and contrib/mpeg_encode from source archive
Source0: %{name}-%{version}-source-fedora.tar.xz
Source1: %{name}.desktop
@@ -360,6 +360,9 @@ fi
%changelog
+* Tue Mar 31 2015 Sandro Mani <manisandro(a)gmail.com> - 2.9.2-1
+- Update to 2.9.2
+
* Wed Mar 18 2015 Sandro Mani <manisandro(a)gmail.com> - 2.9.1-1
- Update to 2.9.1
diff --git a/sources b/sources
index 1c9f284..d5a45c2 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-d740c50ebfd752e479e3d62604ccbe47 gmsh-2.9.1-source-fedora.tar.xz
+5fb3e892e4f03fafaa23897d613d298a gmsh-2.9.2-source-fedora.tar.xz
--
cgit v0.10.2
http://pkgs.fedoraproject.org/cgit/gmsh.git/commit/?h=f22&id=310e560eadaf...
7Â years, 10Â months
smani pushed to gmsh (master). "Update to 2.9.2"
by notificationsï¼ fedoraproject.org
>From 310e560eadaf32e9cb5e6fae5219cdf4ba5b9425 Mon Sep 17 00:00:00 2001
From: Sandro Mani <manisandro(a)gmail.com>
Date: Tue, 31 Mar 2015 23:35:45 +0200
Subject: Update to 2.9.2
diff --git a/.gitignore b/.gitignore
index d4bd401..b583603 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,4 @@
/gmsh-2.9.0-source-fedora.tar.xz
/gmsh-2.9.1-source.tgz
/gmsh-2.9.1-source-fedora.tar.xz
+/gmsh-2.9.2-source-fedora.tar.xz
diff --git a/gmsh.spec b/gmsh.spec
index 86e8753..dee8aa4 100644
--- a/gmsh.spec
+++ b/gmsh.spec
@@ -1,12 +1,12 @@
Name: gmsh
Summary: A three-dimensional finite element mesh generator
-Version: 2.9.1
+Version: 2.9.2
Release: 1%{?dist}
License: GPLv2+
URL: http://geuz.org/gmsh/
# Download source from http://geuz.org/gmsh/src/%%{name}-%%{version}-source.tgz
-# Delete contrib/blossoms and contrib/mpeg_encode from source archive
+# Delete contrib/blossom and contrib/mpeg_encode from source archive
Source0: %{name}-%{version}-source-fedora.tar.xz
Source1: %{name}.desktop
@@ -360,6 +360,9 @@ fi
%changelog
+* Tue Mar 31 2015 Sandro Mani <manisandro(a)gmail.com> - 2.9.2-1
+- Update to 2.9.2
+
* Wed Mar 18 2015 Sandro Mani <manisandro(a)gmail.com> - 2.9.1-1
- Update to 2.9.1
diff --git a/sources b/sources
index 1c9f284..d5a45c2 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-d740c50ebfd752e479e3d62604ccbe47 gmsh-2.9.1-source-fedora.tar.xz
+5fb3e892e4f03fafaa23897d613d298a gmsh-2.9.2-source-fedora.tar.xz
--
cgit v0.10.2
http://pkgs.fedoraproject.org/cgit/gmsh.git/commit/?h=master&id=310e560ea...
7Â years, 10Â months
simo pushed to mod_auth_gssapi (master). "Fix sbrequests authentication"
by notificationsï¼ fedoraproject.org
>From e4fcf291b73c874789c0fa6e728497b724a4a7ab Mon Sep 17 00:00:00 2001
From: Simo Sorce <simo(a)redhat.com>
Date: Tue, 31 Mar 2015 17:22:15 -0400
Subject: Fix sbrequests authentication
diff --git a/0001-Handle-authentication-on-subrequests.patch b/0001-Handle-authentication-on-subrequests.patch
new file mode 100644
index 0000000..4cc6fb7
--- /dev/null
+++ b/0001-Handle-authentication-on-subrequests.patch
@@ -0,0 +1,70 @@
+From e5db7c1f5738c7874e73869a2f4511193f956b81 Mon Sep 17 00:00:00 2001
+From: Simo Sorce <simo(a)redhat.com>
+Date: Mon, 30 Mar 2015 12:48:30 -0400
+Subject: [PATCH] Handle authentication on subrequests
+
+In some cases (like during directory listing) Apache will re-run the
+authentication code. Many GSSAPI mechanism have replay detection so
+we cannot simply rerun the accept_sec_context phase. Others require
+multiple steps. When authntication has already been estalished just
+implicitly consider the authentication successfully performed and
+copy the user name. Otherwise fail.
+If a subrequest hits a location with a different mod_auth_gssapi
+configuration warn but do not error off right away.
+
+Fixes #15
+---
+ src/mod_auth_gssapi.c | 35 ++++++++++++++++++++++++++++++-----
+ 1 file changed, 30 insertions(+), 5 deletions(-)
+
+diff --git a/src/mod_auth_gssapi.c b/src/mod_auth_gssapi.c
+index c7881bf9e149bb190ad73741250d94541abfd0e8..e2331107b89734bd5da3a742a884c6a92489d5a8 100644
+--- a/src/mod_auth_gssapi.c
++++ b/src/mod_auth_gssapi.c
+@@ -245,13 +245,38 @@ static int mag_auth(request_rec *req)
+ return DECLINED;
+ }
+
+- /* ignore auth for subrequests */
+- if (!ap_is_initial_req(req)) {
+- return OK;
+- }
+-
+ cfg = ap_get_module_config(req->per_dir_config, &auth_gssapi_module);
+
++ /* implicit auth for subrequests if main auth already happened */
++ if (!ap_is_initial_req(req)) {
++ type = ap_auth_type(req->main);
++ if ((type != NULL) && (strcasecmp(type, "GSSAPI") == 0)) {
++ /* warn if the subrequest location and the main request
++ * location have different configs */
++ if (cfg != ap_get_module_config(req->main->per_dir_config,
++ &auth_gssapi_module)) {
++ ap_log_rerror(APLOG_MARK, APLOG_WARNING||APLOG_NOERRNO, 0,
++ req, "Subrequest authentication bypass on "
++ "location with different configuration!");
++ }
++ if (req->main->user) {
++ req->user = apr_pstrdup(req->pool, req->main->user);
++ return OK;
++ } else {
++ ap_log_rerror(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, req,
++ "The main request is tasked to establish the "
++ "security context, can't proceed!");
++ return HTTP_UNAUTHORIZED;
++ }
++ } else {
++ ap_log_rerror(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, req,
++ "Subrequest GSSAPI auth with no auth on the main "
++ "request. This operation may fail if other "
++ "subrequests already established a context or the "
++ "mechanism requires multiple roundtrips.");
++ }
++ }
++
+ if (cfg->ssl_only) {
+ if (!mag_conn_is_https(req->connection)) {
+ ap_log_rerror(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, req,
+--
+2.1.0
+
diff --git a/mod_auth_gssapi.spec b/mod_auth_gssapi.spec
index 4766d23..474b238 100644
--- a/mod_auth_gssapi.spec
+++ b/mod_auth_gssapi.spec
@@ -1,6 +1,6 @@
Name: mod_auth_gssapi
Version: 1.1.0
-Release: 2%{?dist}
+Release: 3%{?dist}
Summary: A GSSAPI Authentication module for Apache
Group: System Environment/Daemons
@@ -13,6 +13,7 @@ Requires: httpd-mmn = %{_httpd_mmn}
Requires: krb5-libs >= 1.11.5
Patch01: 0001-Escape-principal-name-to-remove-the-path-separator.patch
+Patch02: 0001-Handle-authentication-on-subrequests.patch
%description
The mod_auth_gssapi module is an authentication service that implements the
@@ -46,6 +47,9 @@ install -m 644 10-auth_gssapi.conf %{buildroot}%{_httpd_modconfdir}
%{_httpd_moddir}/mod_auth_gssapi.so
%changelog
+* Thu Mar 31 2015 Simo Sorce <simo(a)redhat.com> 1.1.0-3
+- Fix some authentication issues
+
* Thu Mar 26 2015 Simo Sorce <simo(a)redhat.com> 1.1.0-2
- Fix saving delegated credentials for SPNs
--
cgit v0.10.2
http://pkgs.fedoraproject.org/cgit/mod_auth_gssapi.git/commit/?h=master&i...
7Â years, 10Â months
flepied pushed to python-hardware (master). "Upstream release 0.14 (bug #1196176)"
by notificationsï¼ fedoraproject.org
>From fd493ffaaa938c46b90cb2d9eba99e7596cba09c Mon Sep 17 00:00:00 2001
From: Frederic Lepied <frederic.lepied(a)redhat.com>
Date: Tue, 31 Mar 2015 21:21:23 +0000
Subject: Upstream release 0.14 (bug #1196176)
diff --git a/.gitignore b/.gitignore
index 40e0724..e2e8533 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@
/hardware-0.11.tar.gz
/hardware-0.12.tar.gz
/hardware-0.13.tar.gz
+/hardware-0.14.tar.gz
diff --git a/python-hardware.spec b/python-hardware.spec
index b4381bf..6ca7d7d 100644
--- a/python-hardware.spec
+++ b/python-hardware.spec
@@ -5,7 +5,7 @@
Name: python-hardware
Summary: Hardware detection and classification utilities
-Version: 0.13
+Version: 0.14
Release: 1%{?dist}
License: ASL 2.0
Group: Development/Languages
@@ -124,6 +124,9 @@ Documentation for Hardware detection and classification utilities.
%endif # with_python3
%changelog
+* Tue Mar 31 2015 Frederic Lepied <frederic.lepied(a)redhat.com> - 0.14-1
+- new version (bug #1196176)
+
* Thu Mar 26 2015 Frederic Lepied <frederic.lepied(a)redhat.com> - 0.13-1
- new version (bug #1196176)
diff --git a/sources b/sources
index e4a949f..06d0697 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-6234c2b3586266e1ac9c5973d9a9ffa0 hardware-0.13.tar.gz
+caee618334e17f0f506fcdb08b287063 hardware-0.14.tar.gz
--
cgit v0.10.2
http://pkgs.fedoraproject.org/cgit/python-hardware.git/commit/?h=master&i...
7Â years, 10Â months
bioinfornatics pushed to ldc (master). "rebuild"
by notificationsï¼ fedoraproject.org
>From be14d0c01b407e744170abee7abbbbd3685c550c Mon Sep 17 00:00:00 2001
From: bioinfornatics <bioinfornatics(a)fedoraproject.org>
Date: Tue, 31 Mar 2015 23:18:50 +0200
Subject: rebuild
diff --git a/ldc.spec b/ldc.spec
index 11915f2..21be914 100644
--- a/ldc.spec
+++ b/ldc.spec
@@ -6,7 +6,7 @@
Name: ldc
Version: %ldc_version.beta1
-Release: 67%{?dist}
+Release: 68%{?dist}
Epoch: 1
Summary: A compiler for the D programming language
@@ -239,6 +239,9 @@ install -m0644 phobos.d.tags %{buildroot}/%{_datadir}/geany/tags/
%changelog
+* Tue Mar 31 2015 bioinfornatics(a)gmail.com - 1:0.15.2.beta1-68
+- rebuild
+
* Fri Mar 20 2015 Jonathan MERCIER <bioinfornatics(a)gmail.com> - 1:0.15.2.beta1-66
- update to beta release 0.15.2
diff --git a/sources b/sources
index c7688eb..49ef937 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-2207fd2545a5fc62c93e3ba72c89c4ca macros.ldc
b4009a73659c2d7732bd7ed1c7689733 ldc-0.15.2-beta1-src.tar.gz
+2207fd2545a5fc62c93e3ba72c89c4ca macros.ldc
--
cgit v0.10.2
http://pkgs.fedoraproject.org/cgit/ldc.git/commit/?h=master&id=be14d0c01b...
7Â years, 10Â months
myoung pushed to xen (f20). "Long latency MMIO mapping operations are not preemptible [XSA-125, CVE-2015-2752] (#1207741) (..more)"
by notificationsï¼ fedoraproject.org
>From 6920ceda0e986d854b1bc5f1b3b7647718e8b4ff Mon Sep 17 00:00:00 2001
From: Michael Young <m.a.young(a)durham.ac.uk>
Date: Tue, 31 Mar 2015 22:16:23 +0100
Subject: Long latency MMIO mapping operations are not preemptible [XSA-125,
CVE-2015-2752] (#1207741) Unmediated PCI command register access in qemu
[XSA-126, CVE-2015-2756] (#1307738) Certain domctl operations may be abused
to lock up the host [XSA-127, CVE-2015-2751] (#1207739)
diff --git a/xen.spec b/xen.spec
index daa1615..dd8f945 100644
--- a/xen.spec
+++ b/xen.spec
@@ -51,7 +51,7 @@
Summary: Xen is a virtual machine monitor
Name: xen
Version: 4.3.4
-Release: 1%{?dist}
+Release: 2%{?dist}
Group: Development/Libraries
License: GPLv2+ and LGPLv2+ and BSD
URL: http://xen.org/
@@ -107,6 +107,10 @@ Patch32: xen.git-3460eeb3fc2811efcf2e8ac13a0882ab72ef92bc.patch
Patch33: xl.migrate.debug.crash.patch
Patch34: xl.migrate.debug.fail.patch
Patch36: xl.migrate.debug.fail.fix.patch
+Patch37: xsa125-4.3.patch
+Patch38: xsa126-qemuu-4.3.patch
+Patch39: xsa126-qemut.patch
+Patch40: xsa127-4.x.patch
Patch100: xen-configure-xend.patch
@@ -298,6 +302,10 @@ manage Xen virtual machines.
%patch33 -p1
%patch34 -p1
%patch36 -p1
+%patch37 -p1
+%patch38 -p1
+%patch39 -p1
+%patch40 -p1
%patch100 -p1
@@ -871,6 +879,14 @@ rm -rf %{buildroot}
%endif
%changelog
+* Tue Mar 31 2015 Michael Young <m.a.young(a)durham.ac.uk> - 4.3.4-2
+- Long latency MMIO mapping operations are not preemptible [XSA-125,
+ CVE-2015-2752] (#1207741)
+- Unmediated PCI command register access in qemu [XSA-126,
+ CVE-2015-2756] (#1307738)
+- Certain domctl operations may be abused to lock up the host [XSA-127,
+ CVE-2015-2751] (#1207739)
+
* Mon Mar 23 2015 Michael Young <m.a.young(a)durham.ac.uk> - 4.3.4-1
- update to xen-4.3.4
remove patches for fixes that are now included
diff --git a/xsa125-4.3.patch b/xsa125-4.3.patch
new file mode 100644
index 0000000..2d1247f
--- /dev/null
+++ b/xsa125-4.3.patch
@@ -0,0 +1,148 @@
+Limit XEN_DOMCTL_memory_mapping hypercall to only process up to 64 GFNs (or less)
+
+Said hypercall for large BARs can take quite a while. As such
+we can require that the hypercall MUST break up the request
+in smaller values.
+
+Another approach is to add preemption to it - whether we do the
+preemption using hypercall_create_continuation or returning
+EAGAIN to userspace (and have it re-invocate the call) - either
+way the issue we cannot easily solve is that in 'map_mmio_regions'
+if we encounter an error we MUST call 'unmap_mmio_regions' for the
+whole BAR region.
+
+Since the preemption would re-use input fields such as nr_mfns,
+first_gfn, first_mfn - we would lose the original values -
+and only undo what was done in the current round (i.e. ignoring
+anything that was done prior to earlier preemptions).
+
+Unless we re-used the return value as 'EAGAIN|nr_mfns_done<<10' but
+that puts a limit (since the return value is a long) on the amount
+of nr_mfns that can provided.
+
+This patch sidesteps this problem by:
+ - Setting an hard limit of nr_mfns having to be 64 or less.
+ - Toolstack adjusts correspondingly to the nr_mfn limit.
+ - If the there is an error when adding the toolstack will call the
+ remove operation to remove the whole region.
+
+The need to break this hypercall down is for large BARs can take
+more than the guest (initial domain usually) time-slice. This has
+the negative result in that the guest is locked out for a long
+duration and is unable to act on any pending events.
+
+We also augment the code to return zero if nr_mfns instead
+of trying to the hypercall.
+
+Suggested-by: Jan Beulich <jbeulich(a)suse.com>
+Acked-by: Jan Beulich <jbeulich(a)suse.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk(a)oracle.com>
+Acked-by: Ian Campbell <ian.campbell(a)citrix.com>
+
+diff --git a/tools/libxc/xc_domain.c b/tools/libxc/xc_domain.c
+index 3257e2a..7386e58 100644
+--- a/tools/libxc/xc_domain.c
++++ b/tools/libxc/xc_domain.c
+@@ -1467,6 +1467,13 @@ int xc_domain_bind_pt_isa_irq(
+ PT_IRQ_TYPE_ISA, 0, 0, 0, machine_irq));
+ }
+
++#ifndef min
++#define min(X, Y) ({ \
++ const typeof (X) _x = (X); \
++ const typeof (Y) _y = (Y); \
++ (void) (&_x == &_y); \
++ (_x < _y) ? _x : _y; })
++#endif
+ int xc_domain_memory_mapping(
+ xc_interface *xch,
+ uint32_t domid,
+@@ -1476,17 +1483,55 @@ int xc_domain_memory_mapping(
+ uint32_t add_mapping)
+ {
+ DECLARE_DOMCTL;
++ int ret = 0, err;
++ unsigned long done = 0, nr, max_batch_sz;
++
++ if ( !nr_mfns )
++ return 0;
+
+ domctl.cmd = XEN_DOMCTL_memory_mapping;
+ domctl.domain = domid;
+- domctl.u.memory_mapping.first_gfn = first_gfn;
+- domctl.u.memory_mapping.first_mfn = first_mfn;
+- domctl.u.memory_mapping.nr_mfns = nr_mfns;
+ domctl.u.memory_mapping.add_mapping = add_mapping;
++ max_batch_sz = nr_mfns;
++ do
++ {
++ nr = min(nr_mfns - done, max_batch_sz);
++ domctl.u.memory_mapping.nr_mfns = nr;
++ domctl.u.memory_mapping.first_gfn = first_gfn + done;
++ domctl.u.memory_mapping.first_mfn = first_mfn + done;
++ err = do_domctl(xch, &domctl);
++ if ( err && errno == E2BIG )
++ {
++ if ( max_batch_sz <= 1 )
++ break;
++ max_batch_sz >>= 1;
++ continue;
++ }
++ /* Save the first error... */
++ if ( !ret )
++ ret = err;
++ /* .. and ignore the rest of them when removing. */
++ if ( err && add_mapping != DPCI_REMOVE_MAPPING )
++ break;
+
+- return do_domctl(xch, &domctl);
+-}
++ done += nr;
++ } while ( done < nr_mfns );
+
++ /*
++ * Undo what we have done unless unmapping, by unmapping the entire region.
++ * Errors here are ignored.
++ */
++ if ( ret && add_mapping != DPCI_REMOVE_MAPPING )
++ xc_domain_memory_mapping(xch, domid, first_gfn, first_mfn, nr_mfns,
++ DPCI_REMOVE_MAPPING);
++
++ /* We might get E2BIG so many times that we never advance. */
++ if ( !done && !ret )
++ ret = -1;
++
++ return ret;
++}
++#undef min
+ int xc_domain_ioport_mapping(
+ xc_interface *xch,
+ uint32_t domid,
+diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c
+index 173bf01..306297a 100644
+--- a/xen/arch/x86/domctl.c
++++ b/xen/arch/x86/domctl.c
+@@ -655,6 +655,11 @@ long arch_do_domctl(
+ (gfn + nr_mfns - 1) < gfn ) /* wrap? */
+ break;
+
++ ret = -E2BIG;
++ /* Must break hypercall up as this could take a while. */
++ if ( nr_mfns > 64 )
++ break;
++
+ ret = -EPERM;
+ if ( !iomem_access_permitted(current->domain, mfn, mfn + nr_mfns - 1) )
+ break;
+diff --git a/xen/include/public/domctl.h b/xen/include/public/domctl.h
+index d381903..8f9d5c0 100644
+--- a/xen/include/public/domctl.h
++++ b/xen/include/public/domctl.h
+@@ -513,6 +513,7 @@ DEFINE_XEN_GUEST_HANDLE(xen_domctl_bind_pt_irq_t);
+
+
+ /* Bind machine I/O address range -> HVM address range. */
++/* If this returns -E2BIG lower nr_mfns value. */
+ /* XEN_DOMCTL_memory_mapping */
+ #define DPCI_ADD_MAPPING 1
+ #define DPCI_REMOVE_MAPPING 0
diff --git a/xsa126-qemut.patch b/xsa126-qemut.patch
new file mode 100644
index 0000000..796ff9e
--- /dev/null
+++ b/xsa126-qemut.patch
@@ -0,0 +1,151 @@
+xen: limit guest control of PCI command register
+
+Otherwise the guest can abuse that control to cause e.g. PCIe
+Unsupported Request responses (by disabling memory and/or I/O decoding
+and subsequently causing [CPU side] accesses to the respective address
+ranges), which (depending on system configuration) may be fatal to the
+host.
+
+This is CVE-2015-2756 / XSA-126.
+
+Signed-off-by: Jan Beulich <jbeulich(a)suse.com>
+Reviewed-by: Stefano Stabellini <stefano.stabellini(a)eu.citrix.com>
+Acked-by: Ian Campbell <ian.campbell(a)citrix.com>
+
+--- a/tools/qemu-xen-traditional/hw/pass-through.c
++++ b/tools/qemu-xen-traditional/hw/pass-through.c
+@@ -172,9 +172,6 @@ static int pt_word_reg_read(struct pt_de
+ static int pt_long_reg_read(struct pt_dev *ptdev,
+ struct pt_reg_tbl *cfg_entry,
+ uint32_t *value, uint32_t valid_mask);
+-static int pt_cmd_reg_read(struct pt_dev *ptdev,
+- struct pt_reg_tbl *cfg_entry,
+- uint16_t *value, uint16_t valid_mask);
+ static int pt_bar_reg_read(struct pt_dev *ptdev,
+ struct pt_reg_tbl *cfg_entry,
+ uint32_t *value, uint32_t valid_mask);
+@@ -286,9 +283,9 @@ static struct pt_reg_info_tbl pt_emu_reg
+ .size = 2,
+ .init_val = 0x0000,
+ .ro_mask = 0xF880,
+- .emu_mask = 0x0740,
++ .emu_mask = 0x0743,
+ .init = pt_common_reg_init,
+- .u.w.read = pt_cmd_reg_read,
++ .u.w.read = pt_word_reg_read,
+ .u.w.write = pt_cmd_reg_write,
+ .u.w.restore = pt_cmd_reg_restore,
+ },
+@@ -1905,7 +1902,7 @@ static int pt_dev_is_virtfn(struct pci_d
+ return rc;
+ }
+
+-static int pt_register_regions(struct pt_dev *assigned_device)
++static int pt_register_regions(struct pt_dev *assigned_device, uint16_t *cmd)
+ {
+ int i = 0;
+ uint32_t bar_data = 0;
+@@ -1925,17 +1922,26 @@ static int pt_register_regions(struct pt
+
+ /* Register current region */
+ if ( pci_dev->base_addr[i] & PCI_ADDRESS_SPACE_IO )
++ {
+ pci_register_io_region((PCIDevice *)assigned_device, i,
+ (uint32_t)pci_dev->size[i], PCI_ADDRESS_SPACE_IO,
+ pt_ioport_map);
++ *cmd |= PCI_COMMAND_IO;
++ }
+ else if ( pci_dev->base_addr[i] & PCI_ADDRESS_SPACE_MEM_PREFETCH )
++ {
+ pci_register_io_region((PCIDevice *)assigned_device, i,
+ (uint32_t)pci_dev->size[i], PCI_ADDRESS_SPACE_MEM_PREFETCH,
+ pt_iomem_map);
++ *cmd |= PCI_COMMAND_MEMORY;
++ }
+ else
++ {
+ pci_register_io_region((PCIDevice *)assigned_device, i,
+ (uint32_t)pci_dev->size[i], PCI_ADDRESS_SPACE_MEM,
+ pt_iomem_map);
++ *cmd |= PCI_COMMAND_MEMORY;
++ }
+
+ PT_LOG("IO region registered (size=0x%08x base_addr=0x%08x)\n",
+ (uint32_t)(pci_dev->size[i]),
+@@ -3263,27 +3269,6 @@ static int pt_long_reg_read(struct pt_de
+ return 0;
+ }
+
+-/* read Command register */
+-static int pt_cmd_reg_read(struct pt_dev *ptdev,
+- struct pt_reg_tbl *cfg_entry,
+- uint16_t *value, uint16_t valid_mask)
+-{
+- struct pt_reg_info_tbl *reg = cfg_entry->reg;
+- uint16_t valid_emu_mask = 0;
+- uint16_t emu_mask = reg->emu_mask;
+-
+- if ( ptdev->is_virtfn )
+- emu_mask |= PCI_COMMAND_MEMORY;
+- if ( pt_is_iomul(ptdev) )
+- emu_mask |= PCI_COMMAND_IO;
+-
+- /* emulate word register */
+- valid_emu_mask = emu_mask & valid_mask;
+- *value = PT_MERGE_VALUE(*value, cfg_entry->data, ~valid_emu_mask);
+-
+- return 0;
+-}
+-
+ /* read BAR */
+ static int pt_bar_reg_read(struct pt_dev *ptdev,
+ struct pt_reg_tbl *cfg_entry,
+@@ -3418,19 +3403,13 @@ static int pt_cmd_reg_write(struct pt_de
+ uint16_t writable_mask = 0;
+ uint16_t throughable_mask = 0;
+ uint16_t wr_value = *value;
+- uint16_t emu_mask = reg->emu_mask;
+-
+- if ( ptdev->is_virtfn )
+- emu_mask |= PCI_COMMAND_MEMORY;
+- if ( pt_is_iomul(ptdev) )
+- emu_mask |= PCI_COMMAND_IO;
+
+ /* modify emulate register */
+ writable_mask = ~reg->ro_mask & valid_mask;
+ cfg_entry->data = PT_MERGE_VALUE(*value, cfg_entry->data, writable_mask);
+
+ /* create value for writing to I/O device register */
+- throughable_mask = ~emu_mask & valid_mask;
++ throughable_mask = ~reg->emu_mask & valid_mask;
+
+ if (*value & PCI_COMMAND_DISABLE_INTx)
+ {
+@@ -4211,6 +4190,7 @@ static struct pt_dev * register_real_dev
+ struct pt_dev *assigned_device = NULL;
+ struct pci_dev *pci_dev;
+ uint8_t e_device, e_intx;
++ uint16_t cmd = 0;
+ char *key, *val;
+ int msi_translate, power_mgmt;
+
+@@ -4300,7 +4280,7 @@ static struct pt_dev * register_real_dev
+ assigned_device->dev.config[i] = pci_read_byte(pci_dev, i);
+
+ /* Handle real device's MMIO/PIO BARs */
+- pt_register_regions(assigned_device);
++ pt_register_regions(assigned_device, &cmd);
+
+ /* Setup VGA bios for passthroughed gfx */
+ if ( setup_vga_pt(assigned_device) < 0 )
+@@ -4378,6 +4358,10 @@ static struct pt_dev * register_real_dev
+ }
+
+ out:
++ if (cmd)
++ pci_write_word(pci_dev, PCI_COMMAND,
++ *(uint16_t *)(&assigned_device->dev.config[PCI_COMMAND]) | cmd);
++
+ PT_LOG("Real physical device %02x:%02x.%x registered successfuly!\n"
+ "IRQ type = %s\n", r_bus, r_dev, r_func,
+ assigned_device->msi_trans_en? "MSI-INTx":"INTx");
diff --git a/xsa126-qemuu-4.3.patch b/xsa126-qemuu-4.3.patch
new file mode 100644
index 0000000..8ad3d7d
--- /dev/null
+++ b/xsa126-qemuu-4.3.patch
@@ -0,0 +1,128 @@
+xen: limit guest control of PCI command register
+
+Otherwise the guest can abuse that control to cause e.g. PCIe
+Unsupported Request responses (by disabling memory and/or I/O decoding
+and subsequently causing [CPU side] accesses to the respective address
+ranges), which (depending on system configuration) may be fatal to the
+host.
+
+This is CVE-2015-2756 / XSA-126.
+
+Signed-off-by: Jan Beulich <jbeulich(a)suse.com>
+Reviewed-by: Stefano Stabellini <stefano.stabellini(a)eu.citrix.com>
+Acked-by: Ian Campbell <ian.campbell(a)citrix.com>
+
+--- a/tools/qemu-xen/hw/xen_pt.c
++++ b/tools/qemu-xen/hw/xen_pt.c
+@@ -388,7 +388,7 @@ static const MemoryRegionOps ops = {
+ .write = xen_pt_bar_write,
+ };
+
+-static int xen_pt_register_regions(XenPCIPassthroughState *s)
++static int xen_pt_register_regions(XenPCIPassthroughState *s, uint16_t *cmd)
+ {
+ int i = 0;
+ XenHostPCIDevice *d = &s->real_device;
+@@ -406,6 +406,7 @@ static int xen_pt_register_regions(XenPC
+
+ if (r->type & XEN_HOST_PCI_REGION_TYPE_IO) {
+ type = PCI_BASE_ADDRESS_SPACE_IO;
++ *cmd |= PCI_COMMAND_IO;
+ } else {
+ type = PCI_BASE_ADDRESS_SPACE_MEMORY;
+ if (r->type & XEN_HOST_PCI_REGION_TYPE_PREFETCH) {
+@@ -414,6 +415,7 @@ static int xen_pt_register_regions(XenPC
+ if (r->type & XEN_HOST_PCI_REGION_TYPE_MEM_64) {
+ type |= PCI_BASE_ADDRESS_MEM_TYPE_64;
+ }
++ *cmd |= PCI_COMMAND_MEMORY;
+ }
+
+ memory_region_init_io(&s->bar[i], &ops, &s->dev,
+@@ -652,6 +654,7 @@ static int xen_pt_initfn(PCIDevice *d)
+ XenPCIPassthroughState *s = DO_UPCAST(XenPCIPassthroughState, dev, d);
+ int rc = 0;
+ uint8_t machine_irq = 0;
++ uint16_t cmd = 0;
+ int pirq = XEN_PT_UNASSIGNED_PIRQ;
+
+ /* register real device */
+@@ -686,7 +689,7 @@ static int xen_pt_initfn(PCIDevice *d)
+ s->io_listener = xen_pt_io_listener;
+
+ /* Handle real device's MMIO/PIO BARs */
+- xen_pt_register_regions(s);
++ xen_pt_register_regions(s, &cmd);
+
+ /* reinitialize each config register to be emulated */
+ if (xen_pt_config_init(s)) {
+@@ -750,6 +753,11 @@ static int xen_pt_initfn(PCIDevice *d)
+ }
+
+ out:
++ if (cmd) {
++ xen_host_pci_set_word(&s->real_device, PCI_COMMAND,
++ pci_get_word(d->config + PCI_COMMAND) | cmd);
++ }
++
+ memory_listener_register(&s->memory_listener, &address_space_memory);
+ memory_listener_register(&s->io_listener, &address_space_io);
+ XEN_PT_LOG(d, "Real physical device %02x:%02x.%d registered successfuly!\n",
+--- a/tools/qemu-xen/hw/xen_pt_config_init.c
++++ b/tools/qemu-xen/hw/xen_pt_config_init.c
+@@ -286,23 +286,6 @@ static int xen_pt_irqpin_reg_init(XenPCI
+ }
+
+ /* Command register */
+-static int xen_pt_cmd_reg_read(XenPCIPassthroughState *s, XenPTReg *cfg_entry,
+- uint16_t *value, uint16_t valid_mask)
+-{
+- XenPTRegInfo *reg = cfg_entry->reg;
+- uint16_t valid_emu_mask = 0;
+- uint16_t emu_mask = reg->emu_mask;
+-
+- if (s->is_virtfn) {
+- emu_mask |= PCI_COMMAND_MEMORY;
+- }
+-
+- /* emulate word register */
+- valid_emu_mask = emu_mask & valid_mask;
+- *value = XEN_PT_MERGE_VALUE(*value, cfg_entry->data, ~valid_emu_mask);
+-
+- return 0;
+-}
+ static int xen_pt_cmd_reg_write(XenPCIPassthroughState *s, XenPTReg *cfg_entry,
+ uint16_t *val, uint16_t dev_value,
+ uint16_t valid_mask)
+@@ -310,18 +293,13 @@ static int xen_pt_cmd_reg_write(XenPCIPa
+ XenPTRegInfo *reg = cfg_entry->reg;
+ uint16_t writable_mask = 0;
+ uint16_t throughable_mask = 0;
+- uint16_t emu_mask = reg->emu_mask;
+-
+- if (s->is_virtfn) {
+- emu_mask |= PCI_COMMAND_MEMORY;
+- }
+
+ /* modify emulate register */
+ writable_mask = ~reg->ro_mask & valid_mask;
+ cfg_entry->data = XEN_PT_MERGE_VALUE(*val, cfg_entry->data, writable_mask);
+
+ /* create value for writing to I/O device register */
+- throughable_mask = ~emu_mask & valid_mask;
++ throughable_mask = ~reg->emu_mask & valid_mask;
+
+ if (*val & PCI_COMMAND_INTX_DISABLE) {
+ throughable_mask |= PCI_COMMAND_INTX_DISABLE;
+@@ -605,9 +583,9 @@ static XenPTRegInfo xen_pt_emu_reg_heade
+ .size = 2,
+ .init_val = 0x0000,
+ .ro_mask = 0xF880,
+- .emu_mask = 0x0740,
++ .emu_mask = 0x0743,
+ .init = xen_pt_common_reg_init,
+- .u.w.read = xen_pt_cmd_reg_read,
++ .u.w.read = xen_pt_word_reg_read,
+ .u.w.write = xen_pt_cmd_reg_write,
+ },
+ /* Capabilities Pointer reg */
diff --git a/xsa127-4.x.patch b/xsa127-4.x.patch
new file mode 100644
index 0000000..463b1dd
--- /dev/null
+++ b/xsa127-4.x.patch
@@ -0,0 +1,50 @@
+domctl: don't allow a toolstack domain to call domain_pause() on itself
+
+These DOMCTL subops were accidentally declared safe for disaggregation
+in the wake of XSA-77.
+
+This is XSA-127.
+
+Signed-off-by: Andrew Cooper <andrew.cooper3(a)citrix.com>
+Reviewed-by: Jan Beulich <jbeulich(a)suse.com>
+Acked-by: Ian Campbell <ian.campbell(a)citrix.com>
+
+--- a/xen/arch/x86/domctl.c
++++ b/xen/arch/x86/domctl.c
+@@ -888,6 +888,10 @@ long arch_do_domctl(
+ {
+ xen_guest_tsc_info_t info;
+
++ ret = -EINVAL;
++ if ( d == current->domain ) /* no domain_pause() */
++ break;
++
+ domain_pause(d);
+ tsc_get_info(d, &info.tsc_mode,
+ &info.elapsed_nsec,
+@@ -903,6 +907,10 @@ long arch_do_domctl(
+
+ case XEN_DOMCTL_settscinfo:
+ {
++ ret = -EINVAL;
++ if ( d == current->domain ) /* no domain_pause() */
++ break;
++
+ domain_pause(d);
+ tsc_set_info(d, domctl->u.tsc_info.info.tsc_mode,
+ domctl->u.tsc_info.info.elapsed_nsec,
+--- a/xen/common/domctl.c
++++ b/xen/common/domctl.c
+@@ -522,8 +522,10 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xe
+
+ case XEN_DOMCTL_resumedomain:
+ {
+- domain_resume(d);
+- ret = 0;
++ if ( d == current->domain ) /* no domain_pause() */
++ ret = -EINVAL;
++ else
++ domain_resume(d);
+ }
+ break;
+
--
cgit v0.10.2
http://pkgs.fedoraproject.org/cgit/xen.git/commit/?h=f20&id=6920ceda0e986...
7Â years, 10Â months
kengert pushed to ca-certificates (f20). "rename legacy=enable to legacy=default and related changes; add ca-legacy man page; handle absent configuration in ca-legacy"
by notificationsï¼ fedoraproject.org
>From b172017384ecb7ea3564505879dde6d8871b4bd5 Mon Sep 17 00:00:00 2001
From: Kai Engert <kaie(a)redhat.com>
Date: Tue, 31 Mar 2015 23:07:25 +0200
Subject: rename legacy=enable to legacy=default and related changes; add
ca-legacy man page; handle absent configuration in ca-legacy
diff --git a/ca-certificates.spec b/ca-certificates.spec
index bb496f0..1335d18 100644
--- a/ca-certificates.spec
+++ b/ca-certificates.spec
@@ -2,7 +2,7 @@
%define catrustdir %{_sysconfdir}/pki/ca-trust
%define classic_tls_bundle ca-bundle.crt
%define trusted_all_bundle ca-bundle.trust.crt
-%define legacy_enable_bundle ca-bundle.legacy.enable.crt
+%define legacy_default_bundle ca-bundle.legacy.default.crt
%define legacy_disable_bundle ca-bundle.legacy.disable.crt
%define neutral_bundle ca-bundle.neutral-trust.crt
%define bundle_supplement ca-bundle.supplement.p11-kit
@@ -39,7 +39,7 @@ Name: ca-certificates
Version: 2015.2.3
# for Rawhide, please always use release >= 2
# for Fedora release branches, please use release < 2 (1.0, 1.1, ...)
-Release: 1.0%{?dist}
+Release: 1.1%{?dist}
License: Public Domain
Group: System Environment/Base
@@ -53,6 +53,7 @@ Source3: trust-fixes
Source4: certdata2pem.py
Source5: ca-legacy.conf
Source6: ca-legacy
+Source9: ca-legacy.8.txt
Source10: update-ca-trust.8.txt
Source11: README.usr
Source12: README.etc
@@ -82,7 +83,7 @@ Mozilla Foundation for use with the Internet PKI.
rm -rf %{name}
mkdir %{name}
mkdir %{name}/certs
-mkdir %{name}/certs/legacy-enable
+mkdir %{name}/certs/legacy-default
mkdir %{name}/certs/legacy-disable
mkdir %{name}/java
@@ -142,7 +143,7 @@ EOF
fi
done
- for f in certs/legacy-enable/*.crt; do
+ for f in certs/legacy-default/*.crt; do
echo "processing $f"
tbits=`sed -n '/^# openssl-trust/{s/^.*=//;p;}' $f`
alias=`sed -n '/^# alias=/{s/^.*=//;p;q;}' $f | sed "s/'//g" | sed 's/"//g'`
@@ -153,8 +154,8 @@ EOF
done
fi
if [ -n "$targs" ]; then
- echo "legacy enable flags $targs for $f" >> info.trust
- openssl x509 -text -in "$f" -trustout $targs -setalias "$alias" >> %{legacy_enable_bundle}
+ echo "legacy default flags $targs for $f" >> info.trust
+ openssl x509 -text -in "$f" -trustout $targs -setalias "$alias" >> %{legacy_default_bundle}
fi
done
@@ -189,6 +190,10 @@ cp %{SOURCE10} %{name}/update-ca-trust.8.txt
asciidoc.py -v -d manpage -b docbook %{name}/update-ca-trust.8.txt
xsltproc --nonet -o %{name}/update-ca-trust.8 /usr/share/asciidoc/docbook-xsl/manpage.xsl %{name}/update-ca-trust.8.xml
+cp %{SOURCE9} %{name}/ca-legacy.8.txt
+asciidoc.py -v -d manpage -b docbook %{name}/ca-legacy.8.txt
+xsltproc --nonet -o %{name}/ca-legacy.8 /usr/share/asciidoc/docbook-xsl/manpage.xsl %{name}/ca-legacy.8.xml
+
%install
rm -rf $RPM_BUILD_ROOT
@@ -210,6 +215,7 @@ mkdir -p -m 755 $RPM_BUILD_ROOT%{_bindir}
mkdir -p -m 755 $RPM_BUILD_ROOT%{_mandir}/man8
install -p -m 644 %{name}/update-ca-trust.8 $RPM_BUILD_ROOT%{_mandir}/man8
+install -p -m 644 %{name}/ca-legacy.8 $RPM_BUILD_ROOT%{_mandir}/man8
install -p -m 644 %{SOURCE11} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source/README
install -p -m 644 %{SOURCE12} $RPM_BUILD_ROOT%{catrustdir}/README
install -p -m 644 %{SOURCE13} $RPM_BUILD_ROOT%{catrustdir}/extracted/README
@@ -222,7 +228,7 @@ install -p -m 644 %{name}/%{trusted_all_bundle} $RPM_BUILD_ROOT%{_datadir}/pki/c
install -p -m 644 %{name}/%{neutral_bundle} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source/%{neutral_bundle}
install -p -m 644 %{name}/%{bundle_supplement} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source/%{bundle_supplement}
-install -p -m 644 %{name}/%{legacy_enable_bundle} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-legacy/%{legacy_enable_bundle}
+install -p -m 644 %{name}/%{legacy_default_bundle} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-legacy/%{legacy_default_bundle}
install -p -m 644 %{name}/%{legacy_disable_bundle} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-legacy/%{legacy_disable_bundle}
install -p -m 644 %{SOURCE5} $RPM_BUILD_ROOT%{catrustdir}/ca-legacy.conf
@@ -231,7 +237,7 @@ touch -r %{SOURCE0} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source/%{trusted_all
touch -r %{SOURCE0} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source/%{neutral_bundle}
touch -r %{SOURCE0} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source/%{bundle_supplement}
-touch -r %{SOURCE0} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-legacy/%{legacy_enable_bundle}
+touch -r %{SOURCE0} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-legacy/%{legacy_default_bundle}
touch -r %{SOURCE0} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-legacy/%{legacy_disable_bundle}
# TODO: consider to dynamically create the update-ca-trust script from within
@@ -334,6 +340,7 @@ fi
%config(noreplace) %{catrustdir}/ca-legacy.conf
%{_mandir}/man8/update-ca-trust.8.gz
+%{_mandir}/man8/ca-legacy.8.gz
%{_datadir}/pki/ca-trust-source/README
%{catrustdir}/README
%{catrustdir}/extracted/README
@@ -353,7 +360,7 @@ fi
%{_datadir}/pki/ca-trust-source/%{trusted_all_bundle}
%{_datadir}/pki/ca-trust-source/%{neutral_bundle}
%{_datadir}/pki/ca-trust-source/%{bundle_supplement}
-%{_datadir}/pki/ca-trust-legacy/%{legacy_enable_bundle}
+%{_datadir}/pki/ca-trust-legacy/%{legacy_default_bundle}
%{_datadir}/pki/ca-trust-legacy/%{legacy_disable_bundle}
# update/extract tool
%{_bindir}/update-ca-trust
@@ -368,7 +375,18 @@ fi
%changelog
-* Mon Mar 24 2015 Kai Engert <kaie(a)redhat.com> - 2015.2.3-1.0
+* Tue Mar 31 2015 Kai Engert <kaie(a)redhat.com> - 2015.2.3-1.1
+- Don't use "enable" as a value for the legacy configuration, instead
+ of the value "default", to make it clear that this preference isn't
+ a promise to keep certificates enabled, but rather that we only
+ keep them enabled as long as it's considered necessary.
+- Changed the configuration file, the ca-legacy utility and filenames
+ to use the term "default" (instead of the term "enable").
+- Added a manual page for the ca-legacy utility.
+- Fixed the ca-legacy utility to handle absence of the configuration
+ setting and treat absence as the default setting.
+
+* Tue Mar 24 2015 Kai Engert <kaie(a)redhat.com> - 2015.2.3-1.0
- Update to CKBI 2.3 from NSS 3.18 with legacy modifications
- Fixed a mistake in the legacy handling of the upstream 2.2 release:
Removed two AOL certificates from the legacy group, because
diff --git a/ca-legacy b/ca-legacy
index 4b57fd8..d63489e 100644
--- a/ca-legacy
+++ b/ca-legacy
@@ -4,23 +4,24 @@
LCFILE=/etc/pki/ca-trust/ca-legacy.conf
LLINK=/etc/pki/ca-trust/source/ca-bundle.legacy.crt
-LENABLE=/usr/share/pki/ca-trust-legacy/ca-bundle.legacy.enable.crt
+LDEFAULT=/usr/share/pki/ca-trust-legacy/ca-bundle.legacy.default.crt
LDISABLE=/usr/share/pki/ca-trust-legacy/ca-bundle.legacy.disable.crt
-do_grep()
+# An absent value, or any unexpected value, is treated as "default".
+is_disabled()
{
- grep -i "^legacy *= *enable *$" $LCFILE >/dev/null 2>&1
+ grep -i "^legacy *= *disable *$" $LCFILE >/dev/null 2>&1
}
do_check()
{
- do_grep
+ is_disabled
if [ $? -eq 0 ]; then
- echo "Legacy CAs are set to ENABLED in file $LCFILE (affects install/upgrade)"
- LEXPECT=$LENABLE
- else
echo "Legacy CAs are set to DISABLED in file $LCFILE (affects install/upgrade)"
LEXPECT=$LDISABLE
+ else
+ echo "Legacy CAs are set to DEFAULT in file $LCFILE (affects install/upgrade)"
+ LEXPECT=$LDEFAULT
fi
echo "Status of symbolic link $LLINK:"
readlink -v $LLINK
@@ -28,19 +29,19 @@ do_check()
do_install()
{
- do_grep
+ is_disabled
if [ $? -eq 0 ]; then
- # expression was found, legacy is enabled
- ln -sf $LENABLE $LLINK
- else
- # not found, legacy is disabled
+ # found, legacy is disabled
ln -sf $LDISABLE $LLINK
+ else
+ # expression not found, legacy is set to default
+ ln -sf $LDEFAULT $LLINK
fi
}
-do_enable()
+do_default()
{
- sed -i 's/^legacy *=.*$/legacy=enable/' $LCFILE
+ sed -i 's/^legacy *=.*$/legacy=default/' $LCFILE
do_install
/usr/bin/update-ca-trust
}
@@ -54,7 +55,7 @@ do_disable()
do_help()
{
- echo "usage: $0 [check | enable | disable | install]"
+ echo "usage: $0 [check | default | disable | install]"
}
if [[ $# -eq 0 ]]; then
@@ -68,8 +69,8 @@ if [[ "$1" = "install" ]]; then
exit $?
fi
-if [[ "$1" = "enable" ]]; then
- do_enable
+if [[ "$1" = "default" ]]; then
+ do_default
exit $?
fi
if [[ "$1" = "disable" ]]; then
@@ -81,3 +82,6 @@ if [[ "$1" = "check" ]]; then
do_check
exit $?
fi
+
+echo "$0: Unsupported command $1"
+do_help
diff --git a/ca-legacy.8.txt b/ca-legacy.8.txt
new file mode 100644
index 0000000..8f8bc49
--- /dev/null
+++ b/ca-legacy.8.txt
@@ -0,0 +1,85 @@
+////
+Copyright (C) 2013 Red Hat, Inc.
+
+This program is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU General Public License for more details.
+////
+
+
+ca-legacy(8)
+============
+:doctype: manpage
+:man source: ca-legacy
+
+
+NAME
+----
+ca-legacy - Manage the system configuration for legacy CA certificates
+
+
+SYNOPSIS
+--------
+*ca-legacy* ['COMMAND']
+
+
+DESCRIPTION
+-----------
+ca-legacy(8) is used to include or exclude a set of legacy Certificate Authority (CA)
+certificates in the system's list of trusted CA certificates.
+
+The list of CA certificates and trust flags included in the ca-certificates package
+are based on the decisions made by Mozilla.org according to the Mozilla CA policy.
+
+Occassionally, removal or distrust decisions made by Mozilla.org might be incompatible with the requirements
+or limitations of some applications that also use the CA certificates list in the Linux environment.
+
+The ca-certificates package might keep some CA certificates included and trusted by default,
+as long as it is seen necessary by the maintainers, despite the fact that they have
+been removed by Mozilla. These certificates are called legacy CA certificates.
+
+The general requirements to keep legacy CA certificates included and trusted might change over time,
+for example if functional limitations of software packages have been resolved.
+Future versions of the ca-certificates package might reduce the set of legacy CA certificates
+that are included and trusted by default.
+
+The ca-legacy(8) command can be used to override the default behaviour.
+
+The mechanisms to individually trust or distrust CA certificates as described in update-ca-trust(8) still apply.
+
+
+COMMANDS
+--------
+*check*::
+ The current configuration will be shown.
+
+*default*::
+ Configure the system to use the default configuration, as recommended
+ by the package maintainers.
+
+*disable*::
+ Configure the system to explicitly disable legacy CA certificates.
+ Using this configuration, the system will use the set of
+ included and trusted CA certificates as released by Mozilla.
+
+*install*::
+ The configuration file will be read and the system configuration
+ will be set accordingly. This command is executed automatically during
+ upgrades of the ca-certificates package.
+
+
+FILES
+-----
+/etc/pki/ca-trust/ca-legacy.conf::
+ A configuration file that will be used and modified by the ca-legacy command.
+ The contents of the configuration file will be read on package upgrades.
+
+AUTHOR
+------
+Written by Kai Engert.
diff --git a/ca-legacy.conf b/ca-legacy.conf
index e45c4a1..56f028f 100644
--- a/ca-legacy.conf
+++ b/ca-legacy.conf
@@ -1,9 +1,24 @@
-# legacy=enable :
-# Certain legacy certs, that have been removed by upstream Mozilla,
-# are still marked as trusted, if required for backwards compatibility
-# with cryptographic libraries like openssl or gnutls.
+# The upstream Mozilla.org project tests all changes to the root CA
+# list with the NSS (Network Security Services) library.
+#
+# Occassionally, changes might cause compatibility issues with
+# other cryptographic libraries, such as openssl or gnutls.
+#
+# The package maintainers of the CA certificates package might decide
+# to temporarily keep certain (legacy) root CA certificates trusted,
+# until incompatibility issues can be resolved.
+#
+# Using this configuration file it is possible to opt-out of the
+# compatibility choices made by the package maintainer.
+#
+# legacy=default :
+# This configuration uses the choices made by the package maintainer.
+# It may keep root CA certificate as trusted, which the upstream
+# Mozilla.org project has already marked as no longer trusted.
+# The set of CA certificates that are being kept enabled may change
+# between package versions.
#
# legacy=disable :
-# Follow all removal decisions of upstream Mozilla CA maintainers
+# Follow all removal decisions made by Mozilla.org
#
-legacy=enable
+legacy=default
diff --git a/certdata2pem.py b/certdata2pem.py
index 23d3fd6..44cc9e0 100644
--- a/certdata2pem.py
+++ b/certdata2pem.py
@@ -196,7 +196,7 @@ for tobj in objects:
is_legacy = 1
if obj == None:
raise NotImplementedError, 'found legacy trust without certificate.\n' + line
- legacy_fname = "legacy-enable/" + fname
+ legacy_fname = "legacy-default/" + fname
f = open(legacy_fname, 'w')
f.write("# alias=%s\n"%tobj['CKA_LABEL'])
f.write("# trust=" + " ".join(legacy_trustbits) + "\n")
--
cgit v0.10.2
http://pkgs.fedoraproject.org/cgit/ca-certificates.git/commit/?h=f20&id=b...
7Â years, 10Â months