From d1375b79291f19062dffc87f51f3998ac42a1deb Mon Sep 17 00:00:00 2001
From: phluo <luopihui@ncti-gba.cn>
Date: Wed, 15 Feb 2023 15:08:24 +0800
Subject: [PATCH] Fix CVE-2022-3560

(cherry picked from commit 2eff56f0ebd0a89e59d489bf97b1be3d8cc87c97)
---
 Fix-CVE-2022-3560.patch | 61 +++++++++++++++++++++++++++++++++++++++++
 pesign.spec             |  6 +++-
 2 files changed, 66 insertions(+), 1 deletion(-)
 create mode 100644 Fix-CVE-2022-3560.patch

diff --git a/Fix-CVE-2022-3560.patch b/Fix-CVE-2022-3560.patch
new file mode 100644
index 0000000..c99e336
--- /dev/null
+++ b/Fix-CVE-2022-3560.patch
@@ -0,0 +1,61 @@
+--- a/src/pesign-authorize	2023-02-14 16:34:30.937317398 +0800
++++ b/src/pesign-authorize	2023-02-14 16:36:55.343001392 +0800
+@@ -2,55 +2,11 @@
+ set -e
+ set -u
+ 
+-#
+-# With /run/pesign/socket on tmpfs, a simple way of restoring the
+-# acls for specific users is useful
+-#
+-#  Compare to: http://infrastructure.fedoraproject.org/cgit/ansible.git/tree/roles/bkernel/tasks/main.yml?id=17198dadebf59d8090b7ed621bc8ab22152d2eb6
+-#
+-
+ # License: GPLv2
+-declare -a fileusers=()
+-declare -a dirusers=()
+-for user in $(cat /etc/pesign/users); do
+-	dirusers[${#dirusers[@]}]=-m
+-	dirusers[${#dirusers[@]}]="u:$user:rwx"
+-	fileusers[${#fileusers[@]}]=-m
+-	fileusers[${#fileusers[@]}]="u:$user:rw"
+-done
+-
+-declare -a filegroups=()
+-declare -a dirgroups=()
+-for group in $(cat /etc/pesign/groups); do
+-	dirgroups[${#dirgroups[@]}]=-m
+-	dirgroups[${#dirgroups[@]}]="g:$group:rwx"
+-	filegroups[${#filegroups[@]}]=-m
+-	filegroups[${#filegroups[@]}]="g:$group:rw"
+-done
+-
+-update_subdir() {
+-	subdir=$1 && shift
+ 
+-	setfacl -bk "${subdir}"
+-	setfacl "${dirusers[@]}" "${dirgroups[@]}" "${subdir}"
+-	for x in "${subdir}"* ; do
+-		if [ -d "${x}" ]; then
+-			setfacl -bk ${x}
+-			setfacl "${dirusers[@]}" "${dirgroups[@]}" ${x}
+-			update_subdir "${x}/"
+-		elif [ -e "${x}" ]; then
+-			setfacl -bk ${x}
+-			setfacl "${fileusers[@]}" "${filegroups[@]}" ${x}
+-		else
+-			:;
+-		fi
+-	done
+-}
++# This script is deprecated and will be removed in a future release.
+ 
+ for x in /var/run/pesign/ /etc/pki/pesign*/ ; do
+-	if [ -d "${x}" ]; then
+-		update_subdir "${x}"
+-	else
+-		:;
+-	fi
++	chown -R pesign:pesign "${x}" || true
++	chmod -R ug+rwX "${x}" || true
+ done
diff --git a/pesign.spec b/pesign.spec
index 9fb6e65..8e41494 100644
--- a/pesign.spec
+++ b/pesign.spec
@@ -2,7 +2,7 @@
 Name:          pesign
 Summary:       Signing utility for UEFI binaries
 Version:       0.113
-Release:       5
+Release:       6
 License:       GPLv2
 URL:           https://github.com/vathpela/pesign
 Source0:       https://github.com/rhboot/pesign/archive/113.tar.gz
@@ -18,6 +18,7 @@ BuildRequires: python3-rpm-macros python3 systemd python3-devel gcc
 
 Patch0001:     Fix-the-build-with-nss-3.44.patch
 Patch0002:     remove-superfluous-type-settings.patch
+Patch0003:     Fix-CVE-2022-3560.patch
 
 %description
 pesign is a command line tool for manipulating signatures and
@@ -94,6 +95,9 @@ exit 0
 %{_mandir}/man*/*
 
 %changelog
+* Tue Feb 14 2023 luopihui <luopihui@ncti-gba.cn> - 0.113-6
+- Fix CVE-2022-3560
+
 * Sat July 31 2021 Shenmei Tu <tushenmei@huawei.com> - 0.113-5
 - remove-superfluous-type-settings.patch
 
-- 
Gitee