post-patch:

	@${REINPLACE_CMD} -e 's,socat,nc,' -e 's,/security,,' \

		${WRKSRC}/CMakeLists.txt

	@${REINPLACE_CMD} 's,/usr/bin/kwalletd,${LOCALBASE}/bin/kwalletd,' \

		${WRKSRC}/pam_kwallet.c

From 8da1a47035fc92bc1496059583772bc4bd6e8ba6 Mon Sep 17 00:00:00 2001

From: Maximiliano Curia <maxy@gnuservers.com.ar>

Date: Fri, 4 May 2018 22:06:06 +0200

Subject: [PATCH] Avoid giving an stderr to kwallet

Summary:

The fixes for CVE-2018-10380 introduced a regression for most users not

using kde, and some for kde sessions. In particular the reorder of the

close calls and creating a new socket caused that the socket is always

assigned the file descriptor 2, aka stderr.

BUG: 393856

Test Plan: It works

Reviewers: #plasma, aacid

Reviewed By: aacid

Subscribers: asturmlechner, rdieter, davidedmundson, plasma-devel

Tags: #plasma

Differential Revision: https://phabricator.kde.org/D12702

---

 pam_kwallet.c | 5 ++++-

 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pam_kwallet.c b/pam_kwallet.c

index b9c984a..661ed8d 100644

--- pam_kwallet.c

+++ pam_kwallet.c

@@ -375,7 +375,8 @@ static int drop_privileges(struct passwd *userInfo)

 static void execute_kwallet(pam_handle_t *pamh, struct passwd *userInfo, int toWalletPipe[2], char *fullSocket)

 {

     //In the child pam_syslog does not work, using syslog directly

-    int x = 2;

+    //keep stderr open so socket doesn't returns us that fd

+    int x = 3;

     //Close fd that are not of interest of kwallet

     for (; x < 64; ++x) {

         if (x != toWalletPipe[0]) {

@@ -424,6 +425,8 @@ static void execute_kwallet(pam_handle_t *pamh, struct passwd *userInfo, int toW

         pam_syslog(pamh, LOG_INFO, "%s-kwalletd: Couldn't listen in socket\n", logPrefix);

         return;

     }

+    //finally close stderr

+    close(2);

     // Fork twice to daemonize kwallet

     setsid();

--- pam_kwallet.c.orig	2018-05-01 12:51:31 UTC

+++ pam_kwallet.c

@@ -118,7 +118,7 @@ static void parseArguments(int argc, const char **argv

     }

 #else

     if (kdehome == NULL) {

-        kdehome = ".kde";

+        kdehome = ".kde4";

     }

     if (kwalletd == NULL) {

         kwalletd = "/usr/bin/kwalletd";

@@ -486,7 +486,7 @@ static void start_kwallet(pam_handle_t *pamh, struct p

     struct sockaddr_un local;

     local.sun_family = AF_UNIX;

-    if (strlen(fullSocket) > sizeof(local.sun_path)) {

+    if (strlen(fullSocket) >= sizeof(local.sun_path)) {

         pam_syslog(pamh, LOG_ERR, "%s: socket path %s too long to open",

                    logPrefix, fullSocket);

         free(fullSocket);

@@ -499,8 +499,7 @@ static void start_kwallet(pam_handle_t *pamh, struct p

     pam_syslog(pamh, LOG_INFO, "%s: final socket path: %s", logPrefix, local.sun_path);

-    size_t len = strlen(local.sun_path) + sizeof(local.sun_family);

-    if (bind(envSocket, (struct sockaddr *)&local, len) == -1) {

+    if (bind(envSocket, (struct sockaddr *)&local, sizeof(local)) == -1) {

         pam_syslog(pamh, LOG_INFO, "%s-kwalletd: Couldn't bind to local file\n", logPrefix);

         return;

     }

--- pam_kwallet_init.orig	2018-05-01 12:51:31 UTC

+++ pam_kwallet_init

@@ -1,10 +1,10 @@

 #!/bin/sh

 if test -n "$PAM_KWALLET_LOGIN" ; then

-    env | socat STDIN UNIX-CONNECT:$PAM_KWALLET_LOGIN

+    env | nc -U "$PAM_KWALLET_LOGIN" | :

 fi

 if test -n "$PAM_KWALLET5_LOGIN" ; then

-    env | socat STDIN UNIX-CONNECT:$PAM_KWALLET5_LOGIN

+    env | nc -U "$PAM_KWALLET5_LOGIN" | :

 fi