mirrors/flatcar-scripts
1
0
Fork 0
mirror of https://github.com/flatcar/scripts.git synced 2025-08-17 09:56:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

app-crypt/trousers: Apply Flatcar modifications

Browse Source
This commit is contained in:
Krzesimir Nowak 2021-12-15 18:34:24 +01:00
parent b0603768b4
commit d126cac468
5 changed files with 91 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
sdk_container/src/third_party/coreos-overlay/app-crypt/trousers/files/system.data vendored Normal file
View File

@ -0,0 +1 @@
/

3
sdk_container/src/third_party/coreos-overlay/app-crypt/trousers/files/tcsd.service vendored
View File

@ -1,8 +1,11 @@
[Unit]
Description=TCG Core Services Daemon
ConditionPathExists=/dev/tpm0
ConditionSecurity=!tpm2
[Service]
User=tss
ExecCondition=/bin/bash -c "/usr/bin/test $(cat /sys/class/tpm/*/tpm_version_major | grep -m 1 1 || echo 0) -eq 1"
ExecStart=/usr/sbin/tcsd -f
[Install]

3
sdk_container/src/third_party/coreos-overlay/app-crypt/trousers/files/tmpfiles.d/trousers.conf vendored Normal file
View File

@ -0,0 +1,3 @@
d /var/lib/tpm 0755 tss tss - -
C /etc/tcsd.conf 0640 root tss - /usr/share/trousers/tcsd.conf
C /var/lib/tpm/system.data 0600 tss tss - /usr/share/trousers/system.data

58
sdk_container/src/third_party/coreos-overlay/app-crypt/trousers/files/trousers-0.3.14-CVE-2020-24330_CVE-2020-24331_CVE-2020-24332.patch vendored Normal file
View File

@ -0,0 +1,58 @@
Index: trousers-0.3.14/src/tcs/ps/tcsps.c
===================================================================
--- trousers-0.3.14.orig/src/tcs/ps/tcsps.c
+++ trousers-0.3.14/src/tcs/ps/tcsps.c
@@ -72,7 +72,7 @@ get_file()
}
/* open and lock the file */
- system_ps_fd = open(tcsd_options.system_ps_file, O_CREAT|O_RDWR, 0600);
+ system_ps_fd = open(tcsd_options.system_ps_file, O_CREAT|O_RDWR|O_NOFOLLOW, 0600);
if (system_ps_fd < 0) {
LogError("system PS: open() of %s failed: %s",
tcsd_options.system_ps_file, strerror(errno));
Index: trousers-0.3.14/src/tcsd/svrside.c
===================================================================
--- trousers-0.3.14.orig/src/tcsd/svrside.c
+++ trousers-0.3.14/src/tcsd/svrside.c
@@ -473,6 +473,7 @@ main(int argc, char **argv)
}
return TCSERR(TSS_E_INTERNAL_ERROR);
}
+ setgid(pwd->pw_gid);
setuid(pwd->pw_uid);
#endif
#endif
Index: trousers-0.3.14/src/tcsd/tcsd_conf.c
===================================================================
--- trousers-0.3.14.orig/src/tcsd/tcsd_conf.c
+++ trousers-0.3.14/src/tcsd/tcsd_conf.c
@@ -743,7 +743,7 @@ conf_file_init(struct tcsd_config *conf)
#ifndef SOLARIS
struct group *grp;
struct passwd *pw;
- mode_t mode = (S_IRUSR|S_IWUSR);
+ mode_t mode = (S_IRUSR|S_IWUSR|S_IRGRP);
#endif /* SOLARIS */
TSS_RESULT result;
@@ -798,15 +798,15 @@ conf_file_init(struct tcsd_config *conf)
}
/* make sure user/group TSS owns the conf file */
- if (pw->pw_uid != stat_buf.st_uid || grp->gr_gid != stat_buf.st_gid) {
+ if (stat_buf.st_uid != 0 || grp->gr_gid != stat_buf.st_gid) {
LogError("TCSD config file (%s) must be user/group %s/%s", tcsd_config_file,
- TSS_USER_NAME, TSS_GROUP_NAME);
+ "root", TSS_GROUP_NAME);
return TCSERR(TSS_E_INTERNAL_ERROR);
}
- /* make sure only the tss user can manipulate the config file */
+ /* make sure only the tss user can read (but not manipulate) the config file */
if (((stat_buf.st_mode & 0777) ^ mode) != 0) {
- LogError("TCSD config file (%s) must be mode 0600", tcsd_config_file);
+ LogError("TCSD config file (%s) must be mode 0640", tcsd_config_file);
return TCSERR(TSS_E_INTERNAL_ERROR);
}
#endif /* SOLARIS */

29
sdk_container/src/third_party/coreos-overlay/app-crypt/trousers/trousers-0.3.14-r2.ebuild vendored
View File

@ -1,9 +1,15 @@
# Flatcar modifications:
# - added "Flatcar:" customizations
# - added condition to files/tcsd.service
# - created files/tmpfiles.d/trousers.conf
# - created files/system.data
# Copyright 1999-2020 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
EAPI=7
inherit autotools linux-info readme.gentoo-r1 systemd udev
TMPFILES_OPTIONAL=1
inherit autotools linux-info readme.gentoo-r1 systemd tmpfiles udev
DESCRIPTION="An open-source TCG Software Stack (TSS) v1.1 implementation"
HOMEPAGE="http://trousers.sf.net"
@ -31,6 +37,7 @@ PATCHES=(
"${FILESDIR}/${P}-libressl.patch"
"${FILESDIR}/${P}-fno-common.patch"
"${FILESDIR}/${P}-Makefile.am-Mark-tddl.a-nodist.patch"
"${FILESDIR}/${P}-CVE-2020-24330_CVE-2020-24331_CVE-2020-24332.patch"
)
DOCS="AUTHORS ChangeLog NICETOHAVES README TODO"
@ -59,10 +66,26 @@ src_install() {
keepdir /var/lib/tpm
use doc && dodoc doc/*
newinitd "${FILESDIR}"/tcsd.initd tcsd
newconfd "${FILESDIR}"/tcsd.confd tcsd
# Flatcar: Comment out the openrc stuff.
# newinitd "${FILESDIR}"/tcsd.initd tcsd
# newconfd "${FILESDIR}"/tcsd.confd tcsd
fowners root:tss /etc/tcsd.conf
systemd_dounit "${FILESDIR}"/tcsd.service
# Flatcar:
systemd_enable_service multi-user.target tcsd.service
udev_dorules "${FILESDIR}"/61-trousers.rules
fowners tss:tss /var/lib/tpm
readme.gentoo_create_doc
# Flatcar:
insinto /usr/share/trousers/
doins "${FILESDIR}"/system.data
# stash a copy of the config so we can restore it from tmpfiles
doins "${D}"/etc/tcsd.conf
fowners tss:tss /usr/share/trousers/system.data
fowners root:tss /usr/share/trousers/tcsd.conf
dotmpfiles "${FILESDIR}"/tmpfiles.d/trousers.conf
}