Version in base suite: 247.3-7+deb11u1 Base version: systemd_247.3-7+deb11u1 Target version: systemd_247.3-7+deb11u2 Base file: /srv/ftp-master.debian.org/ftp/pool/main/s/systemd/systemd_247.3-7+deb11u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/s/systemd/systemd_247.3-7+deb11u2.dsc changelog | 15 patches/ata_id-Fixed-getting-Response-Code-from-SCSI-Sense-Data-2.patch | 37 patches/coredump-do-not-allow-user-to-access-coredumps-with-chang.patch | 388 ++++++++++ patches/logind-fix-getting-property-OnExternalPower-via-D-Bus.patch | 36 patches/machined-varlink-fix-double-free.patch | 22 patches/series | 6 patches/time-util-fix-buffer-over-run.patch | 55 + patches/udev-always-create-device-symlinks-for-USB-disks.patch | 111 ++ 8 files changed, 670 insertions(+) diff: /srv/release.debian.org/tmp/Ls2HdHH0kR/systemd-247.3/test/testdata: recursive directory loop diff -Nru systemd-247.3/debian/changelog systemd-247.3/debian/changelog --- systemd-247.3/debian/changelog 2022-08-07 13:25:09.000000000 +0000 +++ systemd-247.3/debian/changelog 2022-12-22 11:55:42.000000000 +0000 @@ -1,3 +1,18 @@ +systemd (247.3-7+deb11u2) bullseye; urgency=medium + + [ Michael Biebl ] + * ata_id: fix getting Response Code from SCSI Sense Data. + (Closes: #1021579) + * logind: fix getting property OnExternalPower via D-Bus (Closes: + #1021644) + + [ Luca Boccassi ] + * Backport patch to fix CVE-2022-4415 (Closes: #1026831) + * Backport patch to fix CVE-2022-3821 + * Backport patch to fix crash in systemd-machined (Closes: #1023567) + + -- Luca Boccassi Thu, 22 Dec 2022 12:55:42 +0100 + systemd (247.3-7+deb11u1) bullseye; urgency=medium * Drop bundled copy of linux/if_arp.h. diff -Nru systemd-247.3/debian/patches/ata_id-Fixed-getting-Response-Code-from-SCSI-Sense-Data-2.patch systemd-247.3/debian/patches/ata_id-Fixed-getting-Response-Code-from-SCSI-Sense-Data-2.patch --- systemd-247.3/debian/patches/ata_id-Fixed-getting-Response-Code-from-SCSI-Sense-Data-2.patch 1970-01-01 00:00:00.000000000 +0000 +++ systemd-247.3/debian/patches/ata_id-Fixed-getting-Response-Code-from-SCSI-Sense-Data-2.patch 2022-12-22 11:55:42.000000000 +0000 @@ -0,0 +1,37 @@ +From: Aleksey Vasenev +Date: Wed, 5 Oct 2022 22:33:53 +0300 +Subject: ata_id: Fixed getting Response Code from SCSI Sense Data (#24921) + +The Response Code is contained in the first byte of the SCSI Sense Data. +Bit number 7 is reserved or has a different meaning for some Response Codes +and is set to 1 for some drives. + +(cherry picked from commit 2be1ae54badf7a3a12908a8094ebaba8f91887ca) +--- + src/udev/ata_id/ata_id.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/src/udev/ata_id/ata_id.c b/src/udev/ata_id/ata_id.c +index ce0bf5d..c86e40b 100644 +--- a/src/udev/ata_id/ata_id.c ++++ b/src/udev/ata_id/ata_id.c +@@ -162,8 +162,8 @@ static int disk_identify_command( + return ret; + } + +- if (!(sense[0] == 0x72 && desc[0] == 0x9 && desc[1] == 0x0c) && +- !(sense[0] == 0x70 && sense[12] == 0x00 && sense[13] == 0x1d)) { ++ if (!((sense[0] & 0x7f) == 0x72 && desc[0] == 0x9 && desc[1] == 0x0c) && ++ !((sense[0] & 0x7f) == 0x70 && sense[12] == 0x00 && sense[13] == 0x1d)) { + errno = EIO; + return -1; + } +@@ -240,7 +240,7 @@ static int disk_identify_packet_device_command( + return ret; + } + +- if (!(sense[0] == 0x72 && desc[0] == 0x9 && desc[1] == 0x0c)) { ++ if (!((sense[0] & 0x7f) == 0x72 && desc[0] == 0x9 && desc[1] == 0x0c)) { + errno = EIO; + return -1; + } diff -Nru systemd-247.3/debian/patches/coredump-do-not-allow-user-to-access-coredumps-with-chang.patch systemd-247.3/debian/patches/coredump-do-not-allow-user-to-access-coredumps-with-chang.patch --- systemd-247.3/debian/patches/coredump-do-not-allow-user-to-access-coredumps-with-chang.patch 1970-01-01 00:00:00.000000000 +0000 +++ systemd-247.3/debian/patches/coredump-do-not-allow-user-to-access-coredumps-with-chang.patch 2022-12-22 11:55:42.000000000 +0000 @@ -0,0 +1,388 @@ +From: Zbigniew Jędrzejewski-Szmek +Date: Mon, 28 Nov 2022 12:12:55 +0100 +Subject: coredump: do not allow user to access coredumps with changed + uid/gid/capabilities + +When the user starts a program which elevates its permissions via setuid, +setgid, or capabilities set on the file, it may access additional information +which would then be visible in the coredump. We shouldn't make the the coredump +visible to the user in such cases. + +Reported-by: Matthias Gerstner + +This reads the /proc//auxv file and attaches it to the process metadata as +PROC_AUXV. Before the coredump is submitted, it is parsed and if either +at_secure was set (which the kernel will do for processes that are setuid, +setgid, or setcap), or if the effective uid/gid don't match uid/gid, the file +is not made accessible to the user. If we can't access this data, we assume the +file should not be made accessible either. In principle we could also access +the auxv data from a note in the core file, but that is much more complex and +it seems better to use the stand-alone file that is provided by the kernel. + +Attaching auxv is both convient for this patch (because this way it's passed +between the stages along with other fields), but I think it makes sense to save +it in general. + +We use the information early in the core file to figure out if the program was +32-bit or 64-bit and its endianness. This way we don't need heuristics to guess +whether the format of the auxv structure. This test might reject some cases on +fringe architecutes. But the impact would be limited: we just won't grant the +user permissions to view the coredump file. If people report that we're missing +some cases, we can always enhance this to support more architectures. + +I tested auxv parsing on amd64, 32-bit program on amd64, arm64, arm32, and +ppc64el, but not the whole coredump handling. + +(cherry picked from commit 3e4d0f6cf99f8677edd6a237382a65bfe758de03) +(cherry picked from commit 9b75a3d0502d6741c8ecb7175794345f8eb3827c) +(cherry picked from commit efca5283dc791a07171f80eef84e14fdb58fad57) +(cherry picked from commit 1d5e0e9910500f3c3584485f77bfc35e601036e3) +(cherry picked from commit 8215e1527d859e77dd1378fd7e42bbd32130edb3) +(cherry picked from commit 786df410b1cb3a2294c9a5d118c958525e7439e6) +--- + src/basic/io-util.h | 9 +++ + src/coredump/coredump.c | 200 ++++++++++++++++++++++++++++++++++++++++++++---- + 2 files changed, 194 insertions(+), 15 deletions(-) + +diff --git a/src/basic/io-util.h b/src/basic/io-util.h +index d817714..dacec71 100644 +--- a/src/basic/io-util.h ++++ b/src/basic/io-util.h +@@ -85,7 +85,16 @@ struct iovec_wrapper *iovw_new(void); + struct iovec_wrapper *iovw_free(struct iovec_wrapper *iovw); + struct iovec_wrapper *iovw_free_free(struct iovec_wrapper *iovw); + void iovw_free_contents(struct iovec_wrapper *iovw, bool free_vectors); ++ + int iovw_put(struct iovec_wrapper *iovw, void *data, size_t len); ++static inline int iovw_consume(struct iovec_wrapper *iovw, void *data, size_t len) { ++ /* Move data into iovw or free on error */ ++ int r = iovw_put(iovw, data, len); ++ if (r < 0) ++ free(data); ++ return r; ++} ++ + int iovw_put_string_field(struct iovec_wrapper *iovw, const char *field, const char *value); + int iovw_put_string_field_free(struct iovec_wrapper *iovw, const char *field, char *value); + void iovw_rebase(struct iovec_wrapper *iovw, char *old, char *new); +diff --git a/src/coredump/coredump.c b/src/coredump/coredump.c +index 0a1cb91..b60dff3 100644 +--- a/src/coredump/coredump.c ++++ b/src/coredump/coredump.c +@@ -3,6 +3,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -96,6 +97,7 @@ enum { + + META_EXE = _META_MANDATORY_MAX, + META_UNIT, ++ META_PROC_AUXV, + _META_MAX + }; + +@@ -110,10 +112,12 @@ static const char * const meta_field_names[_META_MAX] = { + [META_COMM] = "COREDUMP_COMM=", + [META_EXE] = "COREDUMP_EXE=", + [META_UNIT] = "COREDUMP_UNIT=", ++ [META_PROC_AUXV] = "COREDUMP_PROC_AUXV=", + }; + + typedef struct Context { + const char *meta[_META_MAX]; ++ size_t meta_size[_META_MAX]; + pid_t pid; + bool is_pid1; + bool is_journald; +@@ -175,14 +179,17 @@ static uint64_t storage_size_max(void) { + return 0; + } + +-static int fix_acl(int fd, uid_t uid) { +- +-#if HAVE_ACL +- int r; +- ++static int fix_acl(int fd, uid_t uid, bool allow_user) { + assert(fd >= 0); + assert(uid_is_valid(uid)); + ++#if HAVE_ACL ++ int r; ++ ++ /* We don't allow users to read coredumps if the uid or capabilities were changed. */ ++ if (!allow_user) ++ return 0; ++ + if (uid_is_system(uid) || uid_is_dynamic(uid) || uid == UID_NOBODY) + return 0; + +@@ -242,7 +249,8 @@ static int fix_permissions( + const char *filename, + const char *target, + const Context *context, +- uid_t uid) { ++ uid_t uid, ++ bool allow_user) { + + int r; + +@@ -252,7 +260,7 @@ static int fix_permissions( + + /* Ignore errors on these */ + (void) fchmod(fd, 0640); +- (void) fix_acl(fd, uid); ++ (void) fix_acl(fd, uid, allow_user); + (void) fix_xattr(fd, context); + + if (fsync(fd) < 0) +@@ -323,6 +331,153 @@ static int make_filename(const Context *context, char **ret) { + return 0; + } + ++static int parse_auxv64( ++ const uint64_t *auxv, ++ size_t size_bytes, ++ int *at_secure, ++ uid_t *uid, ++ uid_t *euid, ++ gid_t *gid, ++ gid_t *egid) { ++ ++ assert(auxv || size_bytes == 0); ++ ++ if (size_bytes % (2 * sizeof(uint64_t)) != 0) ++ return log_warning_errno(SYNTHETIC_ERRNO(EIO), "Incomplete auxv structure (%zu bytes).", size_bytes); ++ ++ size_t words = size_bytes / sizeof(uint64_t); ++ ++ /* Note that we set output variables even on error. */ ++ ++ for (size_t i = 0; i + 1 < words; i += 2) ++ switch (auxv[i]) { ++ case AT_SECURE: ++ *at_secure = auxv[i + 1] != 0; ++ break; ++ case AT_UID: ++ *uid = auxv[i + 1]; ++ break; ++ case AT_EUID: ++ *euid = auxv[i + 1]; ++ break; ++ case AT_GID: ++ *gid = auxv[i + 1]; ++ break; ++ case AT_EGID: ++ *egid = auxv[i + 1]; ++ break; ++ case AT_NULL: ++ if (auxv[i + 1] != 0) ++ goto error; ++ return 0; ++ } ++ error: ++ return log_warning_errno(SYNTHETIC_ERRNO(ENODATA), ++ "AT_NULL terminator not found, cannot parse auxv structure."); ++} ++ ++static int parse_auxv32( ++ const uint32_t *auxv, ++ size_t size_bytes, ++ int *at_secure, ++ uid_t *uid, ++ uid_t *euid, ++ gid_t *gid, ++ gid_t *egid) { ++ ++ assert(auxv || size_bytes == 0); ++ ++ size_t words = size_bytes / sizeof(uint32_t); ++ ++ if (size_bytes % (2 * sizeof(uint32_t)) != 0) ++ return log_warning_errno(SYNTHETIC_ERRNO(EIO), "Incomplete auxv structure (%zu bytes).", size_bytes); ++ ++ /* Note that we set output variables even on error. */ ++ ++ for (size_t i = 0; i + 1 < words; i += 2) ++ switch (auxv[i]) { ++ case AT_SECURE: ++ *at_secure = auxv[i + 1] != 0; ++ break; ++ case AT_UID: ++ *uid = auxv[i + 1]; ++ break; ++ case AT_EUID: ++ *euid = auxv[i + 1]; ++ break; ++ case AT_GID: ++ *gid = auxv[i + 1]; ++ break; ++ case AT_EGID: ++ *egid = auxv[i + 1]; ++ break; ++ case AT_NULL: ++ if (auxv[i + 1] != 0) ++ goto error; ++ return 0; ++ } ++ error: ++ return log_warning_errno(SYNTHETIC_ERRNO(ENODATA), ++ "AT_NULL terminator not found, cannot parse auxv structure."); ++} ++ ++static int grant_user_access(int core_fd, const Context *context) { ++ int at_secure = -1; ++ uid_t uid = UID_INVALID, euid = UID_INVALID; ++ uid_t gid = GID_INVALID, egid = GID_INVALID; ++ int r; ++ ++ assert(core_fd >= 0); ++ assert(context); ++ ++ if (!context->meta[META_PROC_AUXV]) ++ return log_warning_errno(SYNTHETIC_ERRNO(ENODATA), "No auxv data, not adjusting permissions."); ++ ++ uint8_t elf[EI_NIDENT]; ++ errno = 0; ++ if (pread(core_fd, &elf, sizeof(elf), 0) != sizeof(elf)) ++ return log_warning_errno(errno_or_else(EIO), ++ "Failed to pread from coredump fd: %s", errno != 0 ? strerror_safe(errno) : "Unexpected EOF"); ++ ++ if (elf[EI_MAG0] != ELFMAG0 || ++ elf[EI_MAG1] != ELFMAG1 || ++ elf[EI_MAG2] != ELFMAG2 || ++ elf[EI_MAG3] != ELFMAG3 || ++ elf[EI_VERSION] != EV_CURRENT) ++ return log_info_errno(SYNTHETIC_ERRNO(EUCLEAN), ++ "Core file does not have ELF header, not adjusting permissions."); ++ if (!IN_SET(elf[EI_CLASS], ELFCLASS32, ELFCLASS64) || ++ !IN_SET(elf[EI_DATA], ELFDATA2LSB, ELFDATA2MSB)) ++ return log_info_errno(SYNTHETIC_ERRNO(EUCLEAN), ++ "Core file has strange ELF class, not adjusting permissions."); ++ ++ if ((elf[EI_DATA] == ELFDATA2LSB) != (__BYTE_ORDER == __LITTLE_ENDIAN)) ++ return log_info_errno(SYNTHETIC_ERRNO(EUCLEAN), ++ "Core file has non-native endianness, not adjusting permissions."); ++ ++ if (elf[EI_CLASS] == ELFCLASS64) ++ r = parse_auxv64((const uint64_t*) context->meta[META_PROC_AUXV], ++ context->meta_size[META_PROC_AUXV], ++ &at_secure, &uid, &euid, &gid, &egid); ++ else ++ r = parse_auxv32((const uint32_t*) context->meta[META_PROC_AUXV], ++ context->meta_size[META_PROC_AUXV], ++ &at_secure, &uid, &euid, &gid, &egid); ++ if (r < 0) ++ return r; ++ ++ /* We allow access if we got all the data and at_secure is not set and ++ * the uid/gid matches euid/egid. */ ++ bool ret = ++ at_secure == 0 && ++ uid != UID_INVALID && euid != UID_INVALID && uid == euid && ++ gid != GID_INVALID && egid != GID_INVALID && gid == egid; ++ log_debug("Will %s access (uid="UID_FMT " euid="UID_FMT " gid="GID_FMT " egid="GID_FMT " at_secure=%s)", ++ ret ? "permit" : "restrict", ++ uid, euid, gid, egid, yes_no(at_secure)); ++ return ret; ++} ++ + static int save_external_coredump( + const Context *context, + int input_fd, +@@ -403,6 +558,8 @@ static int save_external_coredump( + goto fail; + } + ++ bool allow_user = grant_user_access(fd, context) > 0; ++ + #if HAVE_COMPRESSION + /* If we will remove the coredump anyway, do not compress. */ + if (arg_compress && !maybe_remove_external_coredump(NULL, st.st_size)) { +@@ -428,7 +585,7 @@ static int save_external_coredump( + goto fail_compressed; + } + +- r = fix_permissions(fd_compressed, tmp_compressed, fn_compressed, context, uid); ++ r = fix_permissions(fd_compressed, tmp_compressed, fn_compressed, context, uid, allow_user); + if (r < 0) + goto fail_compressed; + +@@ -451,7 +608,7 @@ static int save_external_coredump( + uncompressed: + #endif + +- r = fix_permissions(fd, tmp, fn, context, uid); ++ r = fix_permissions(fd, tmp, fn, context, uid, allow_user); + if (r < 0) + goto fail; + +@@ -700,7 +857,7 @@ static int change_uid_gid(const Context *context) { + } + + static int submit_coredump( +- Context *context, ++ const Context *context, + struct iovec_wrapper *iovw, + int input_fd) { + +@@ -822,16 +979,15 @@ static int save_context(Context *context, const struct iovec_wrapper *iovw) { + struct iovec *iovec = iovw->iovec + n; + + for (i = 0; i < ELEMENTSOF(meta_field_names); i++) { +- char *p; +- + /* Note that these strings are NUL terminated, because we made sure that a + * trailing NUL byte is in the buffer, though not included in the iov_len + * count (see process_socket() and gather_pid_metadata_*()) */ + assert(((char*) iovec->iov_base)[iovec->iov_len] == 0); + +- p = startswith(iovec->iov_base, meta_field_names[i]); ++ const char *p = startswith(iovec->iov_base, meta_field_names[i]); + if (p) { + context->meta[i] = p; ++ context->meta_size[i] = iovec->iov_len - strlen(meta_field_names[i]); + count++; + break; + } +@@ -1074,6 +1230,7 @@ static int gather_pid_metadata(struct iovec_wrapper *iovw, Context *context) { + uid_t owner_uid; + pid_t pid; + char *t; ++ size_t size; + const char *p; + int r; + +@@ -1139,13 +1296,26 @@ static int gather_pid_metadata(struct iovec_wrapper *iovw, Context *context) { + (void) iovw_put_string_field_free(iovw, "COREDUMP_PROC_LIMITS=", t); + + p = procfs_file_alloca(pid, "cgroup"); +- if (read_full_file(p, &t, NULL) >=0) ++ if (read_full_file(p, &t, NULL) >= 0) + (void) iovw_put_string_field_free(iovw, "COREDUMP_PROC_CGROUP=", t); + + p = procfs_file_alloca(pid, "mountinfo"); +- if (read_full_file(p, &t, NULL) >=0) ++ if (read_full_file(p, &t, NULL) >= 0) + (void) iovw_put_string_field_free(iovw, "COREDUMP_PROC_MOUNTINFO=", t); + ++ /* We attach /proc/auxv here. ELF coredumps also contain a note for this (NT_AUXV), see elf(5). */ ++ p = procfs_file_alloca(pid, "auxv"); ++ if (read_full_virtual_file(p, &t, &size) >= 0) { ++ char *buf = malloc(strlen("COREDUMP_PROC_AUXV=") + size + 1); ++ if (buf) { ++ /* Add a dummy terminator to make save_context() happy. */ ++ *((uint8_t*) mempcpy(stpcpy(buf, "COREDUMP_PROC_AUXV="), t, size)) = '\0'; ++ (void) iovw_consume(iovw, buf, size + strlen("COREDUMP_PROC_AUXV=")); ++ } ++ ++ free(t); ++ } ++ + if (get_process_cwd(pid, &t) >= 0) + (void) iovw_put_string_field_free(iovw, "COREDUMP_CWD=", t); + diff -Nru systemd-247.3/debian/patches/logind-fix-getting-property-OnExternalPower-via-D-Bus.patch systemd-247.3/debian/patches/logind-fix-getting-property-OnExternalPower-via-D-Bus.patch --- systemd-247.3/debian/patches/logind-fix-getting-property-OnExternalPower-via-D-Bus.patch 1970-01-01 00:00:00.000000000 +0000 +++ systemd-247.3/debian/patches/logind-fix-getting-property-OnExternalPower-via-D-Bus.patch 2022-12-22 11:55:42.000000000 +0000 @@ -0,0 +1,36 @@ +From: Michael Biebl +Date: Wed, 12 Oct 2022 11:07:57 +0200 +Subject: logind: fix getting property OnExternalPower via D-Bus + +The BUS_DEFINE_PROPERTY_GET_GLOBAL macro requires a value as third +argument, so we need to call manager_is_on_external_power(). Otherwise +the function pointer is interpreted as a boolean and always returns +true: + +``` +$ busctl get-property org.freedesktop.login1 /org/freedesktop/login1 org.freedesktop.login1.Manager OnExternalPower +b true +$ /lib/systemd/systemd-ac-power --verbose +no +``` + +Thanks: Helmut Grohne +Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1021644 +(cherry picked from commit 63168cb517a556b2f4f175b365f5a4b4c7e85150) +--- + src/login/logind-dbus.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/login/logind-dbus.c b/src/login/logind-dbus.c +index b95af1a..cf2be79 100644 +--- a/src/login/logind-dbus.c ++++ b/src/login/logind-dbus.c +@@ -352,7 +352,7 @@ static int property_get_scheduled_shutdown( + static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_handle_action, handle_action, HandleAction); + static BUS_DEFINE_PROPERTY_GET(property_get_docked, "b", Manager, manager_is_docked_or_external_displays); + static BUS_DEFINE_PROPERTY_GET(property_get_lid_closed, "b", Manager, manager_is_lid_closed); +-static BUS_DEFINE_PROPERTY_GET_GLOBAL(property_get_on_external_power, "b", manager_is_on_external_power); ++static BUS_DEFINE_PROPERTY_GET_GLOBAL(property_get_on_external_power, "b", manager_is_on_external_power()); + static BUS_DEFINE_PROPERTY_GET_GLOBAL(property_get_compat_user_tasks_max, "t", CGROUP_LIMIT_MAX); + static BUS_DEFINE_PROPERTY_GET_REF(property_get_hashmap_size, "t", Hashmap *, (uint64_t) hashmap_size); + diff -Nru systemd-247.3/debian/patches/machined-varlink-fix-double-free.patch systemd-247.3/debian/patches/machined-varlink-fix-double-free.patch --- systemd-247.3/debian/patches/machined-varlink-fix-double-free.patch 1970-01-01 00:00:00.000000000 +0000 +++ systemd-247.3/debian/patches/machined-varlink-fix-double-free.patch 2022-12-22 11:55:42.000000000 +0000 @@ -0,0 +1,22 @@ +From: David Tardon +Date: Mon, 2 Aug 2021 13:31:04 +0200 +Subject: machined-varlink: fix double free + +Fixes: #18599 +--- + src/machine/machined-varlink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/machine/machined-varlink.c b/src/machine/machined-varlink.c +index 2d6c199..8c2e456 100644 +--- a/src/machine/machined-varlink.c ++++ b/src/machine/machined-varlink.c +@@ -297,7 +297,7 @@ static int group_lookup_name(Manager *m, const char *name, gid_t *ret_gid, char + desc = mfree(desc); + + *ret_gid = converted_gid; +- *ret_description = desc; ++ *ret_description = TAKE_PTR(desc); + return 0; + } + diff -Nru systemd-247.3/debian/patches/series systemd-247.3/debian/patches/series --- systemd-247.3/debian/patches/series 2022-08-07 13:25:09.000000000 +0000 +++ systemd-247.3/debian/patches/series 2022-12-22 11:55:42.000000000 +0000 @@ -28,6 +28,12 @@ virt-Support-detection-for-ARM64-Hyper-V-guests.patch virt-Fix-the-detection-for-Hyper-V-VMs.patch virt-detect-OpenStack-Nova-instance.patch +ata_id-Fixed-getting-Response-Code-from-SCSI-Sense-Data-2.patch +udev-always-create-device-symlinks-for-USB-disks.patch +logind-fix-getting-property-OnExternalPower-via-D-Bus.patch +coredump-do-not-allow-user-to-access-coredumps-with-chang.patch +time-util-fix-buffer-over-run.patch +machined-varlink-fix-double-free.patch debian/Use-Debian-specific-config-files.patch debian/Bring-tmpfiles.d-tmp.conf-in-line-with-Debian-defaul.patch debian/Make-run-lock-tmpfs-an-API-fs.patch diff -Nru systemd-247.3/debian/patches/time-util-fix-buffer-over-run.patch systemd-247.3/debian/patches/time-util-fix-buffer-over-run.patch --- systemd-247.3/debian/patches/time-util-fix-buffer-over-run.patch 1970-01-01 00:00:00.000000000 +0000 +++ systemd-247.3/debian/patches/time-util-fix-buffer-over-run.patch 2022-12-22 11:55:42.000000000 +0000 @@ -0,0 +1,55 @@ +From: Yu Watanabe +Date: Thu, 7 Jul 2022 18:27:02 +0900 +Subject: time-util: fix buffer-over-run + +Fixes #23928. + +(cherry picked from commit 9102c625a673a3246d7e73d8737f3494446bad4e) +(cherry picked from commit 72d4c15a946d20143cd4c6783c802124bc894dc7) +(cherry picked from commit c32530f5bdd11c74e8f5a86eecd7c36b3bae739f) +(cherry picked from commit b2a25b5e64345bd0bb7697a956d33afd6980286a) +(cherry picked from commit 858dc1ad609290cc4ca288acf87046ee295c3d51) +--- + src/basic/time-util.c | 2 +- + src/test/test-time-util.c | 8 ++++++++ + 2 files changed, 9 insertions(+), 1 deletion(-) + +diff --git a/src/basic/time-util.c b/src/basic/time-util.c +index 5318d63..1909710 100644 +--- a/src/basic/time-util.c ++++ b/src/basic/time-util.c +@@ -574,7 +574,7 @@ char *format_timespan(char *buf, size_t l, usec_t t, usec_t accuracy) { + t = b; + } + +- n = MIN((size_t) k, l); ++ n = MIN((size_t) k, l-1); + + l -= n; + p += n; +diff --git a/src/test/test-time-util.c b/src/test/test-time-util.c +index cc391e8..877b24c 100644 +--- a/src/test/test-time-util.c ++++ b/src/test/test-time-util.c +@@ -243,6 +243,13 @@ static void test_format_timespan(usec_t accuracy) { + test_format_timespan_one(USEC_INFINITY, accuracy); + } + ++static void test_format_timespan2(void) { ++ /* See issue #23928. */ ++ _cleanup_free_ char *buf; ++ assert_se(buf = new(char, 5)); ++ assert_se(buf == format_timespan(buf, 5, 100005, 1000)); ++} ++ + static void test_timezone_is_valid(void) { + log_info("/* %s */", __func__); + +@@ -533,6 +540,7 @@ int main(int argc, char *argv[]) { + test_format_timespan(1); + test_format_timespan(USEC_PER_MSEC); + test_format_timespan(USEC_PER_SEC); ++ test_format_timespan2(); + test_timezone_is_valid(); + test_get_timezones(); + test_usec_add(); diff -Nru systemd-247.3/debian/patches/udev-always-create-device-symlinks-for-USB-disks.patch systemd-247.3/debian/patches/udev-always-create-device-symlinks-for-USB-disks.patch --- systemd-247.3/debian/patches/udev-always-create-device-symlinks-for-USB-disks.patch 1970-01-01 00:00:00.000000000 +0000 +++ systemd-247.3/debian/patches/udev-always-create-device-symlinks-for-USB-disks.patch 2022-12-22 11:55:42.000000000 +0000 @@ -0,0 +1,111 @@ +From: Yu Watanabe +Date: Sun, 30 Oct 2022 09:43:05 +0900 +Subject: udev: always create device symlinks for USB disks + +Previously, ata_id might not be able to retrieve attributes correctly, +and properties from usb_id were used as a fallback. See issue #24921 +and PR #24923. To keep backward compatibility, still we need to create +symlinks based on USB serial. + +Fixes #25179. +--- + rules.d/60-persistent-storage.rules | 10 +++++-- + src/udev/udev-builtin-usb_id.c | 55 +++++++++++++++++++++++++++++-------- + 2 files changed, 51 insertions(+), 14 deletions(-) + +diff --git a/rules.d/60-persistent-storage.rules b/rules.d/60-persistent-storage.rules +index fc7f733..99e0c9a 100644 +--- a/rules.d/60-persistent-storage.rules ++++ b/rules.d/60-persistent-storage.rules +@@ -59,14 +59,20 @@ KERNEL=="sd*[!0-9]|sr*", ENV{ID_SERIAL}!="?*", SUBSYSTEMS=="scsi", ATTRS{type}== + # Run ata_id on non-removable USB Mass Storage (SATA/PATA disks in enclosures) + KERNEL=="sd*[!0-9]|sr*", ENV{ID_SERIAL}!="?*", ATTR{removable}=="0", SUBSYSTEMS=="usb", IMPORT{program}="ata_id --export $devnode" + +-# Fall back usb_id for USB devices +-KERNEL=="sd*[!0-9]|sr*", ENV{ID_SERIAL}!="?*", SUBSYSTEMS=="usb", IMPORT{builtin}="usb_id" ++# Also import properties from usb_id for USB devices ++KERNEL=="sd*[!0-9]|sr*", SUBSYSTEMS=="usb", IMPORT{builtin}="usb_id" + + # SCSI devices + KERNEL=="sd*[!0-9]|sr*", ENV{ID_SERIAL}!="?*", IMPORT{program}="scsi_id --export --whitelisted -d $devnode", ENV{ID_BUS}="scsi" + KERNEL=="cciss*", ENV{DEVTYPE}=="disk", ENV{ID_SERIAL}!="?*", IMPORT{program}="scsi_id --export --whitelisted -d $devnode", ENV{ID_BUS}="cciss" + KERNEL=="sd*|sr*|cciss*", ENV{DEVTYPE}=="disk", ENV{ID_SERIAL}=="?*", SYMLINK+="disk/by-id/$env{ID_BUS}-$env{ID_SERIAL}" + KERNEL=="sd*|cciss*", ENV{DEVTYPE}=="partition", ENV{ID_SERIAL}=="?*", SYMLINK+="disk/by-id/$env{ID_BUS}-$env{ID_SERIAL}-part%n" ++# Previously, ata_id in the above might not be able to retrieve attributes correctly, ++# and properties from usb_id were used as a fallback. See issue #24921 and PR #24923. ++# To keep backward compatibility, still we need to create symlinks based on USB serial. ++# See issue #25179. ++KERNEL=="sd*|sr*|cciss*", ENV{DEVTYPE}=="disk", ENV{ID_USB_SERIAL}=="?*", SYMLINK+="disk/by-id/usb-$env{ID_USB_SERIAL}" ++KERNEL=="sd*|cciss*", ENV{DEVTYPE}=="partition", ENV{ID_USB_SERIAL}=="?*", SYMLINK+="disk/by-id/usb-$env{ID_USB_SERIAL}-part%n" + + # PMEM devices + KERNEL=="pmem*", ENV{DEVTYPE}=="disk", ATTRS{uuid}=="?*", SYMLINK+="disk/by-id/pmem-$attr{uuid}" +diff --git a/src/udev/udev-builtin-usb_id.c b/src/udev/udev-builtin-usb_id.c +index fa554e7..3910ffa 100644 +--- a/src/udev/udev-builtin-usb_id.c ++++ b/src/udev/udev-builtin-usb_id.c +@@ -430,21 +430,52 @@ fallback: + if (!isempty(instance_str)) + strpcpyl(&s, l, "-", instance_str, NULL); + +- udev_builtin_add_property(dev, test, "ID_VENDOR", vendor_str); +- udev_builtin_add_property(dev, test, "ID_VENDOR_ENC", vendor_str_enc); +- udev_builtin_add_property(dev, test, "ID_VENDOR_ID", vendor_id); +- udev_builtin_add_property(dev, test, "ID_MODEL", model_str); +- udev_builtin_add_property(dev, test, "ID_MODEL_ENC", model_str_enc); +- udev_builtin_add_property(dev, test, "ID_MODEL_ID", product_id); +- udev_builtin_add_property(dev, test, "ID_REVISION", revision_str); +- udev_builtin_add_property(dev, test, "ID_SERIAL", serial); ++ if (sd_device_get_property_value(dev, "ID_BUS", NULL) >= 0) ++ log_device_debug(dev, "ID_BUS property is already set, setting only properties prefixed with \"ID_USB_\"."); ++ else { ++ udev_builtin_add_property(dev, test, "ID_BUS", "usb"); ++ ++ udev_builtin_add_property(dev, test, "ID_MODEL", model_str); ++ udev_builtin_add_property(dev, test, "ID_MODEL_ENC", model_str_enc); ++ udev_builtin_add_property(dev, test, "ID_MODEL_ID", product_id); ++ ++ udev_builtin_add_property(dev, test, "ID_SERIAL", serial); ++ if (!isempty(serial_str)) ++ udev_builtin_add_property(dev, test, "ID_SERIAL_SHORT", serial_str); ++ ++ udev_builtin_add_property(dev, test, "ID_VENDOR", vendor_str); ++ udev_builtin_add_property(dev, test, "ID_VENDOR_ENC", vendor_str_enc); ++ udev_builtin_add_property(dev, test, "ID_VENDOR_ID", vendor_id); ++ ++ udev_builtin_add_property(dev, test, "ID_REVISION", revision_str); ++ ++ if (!isempty(type_str)) ++ udev_builtin_add_property(dev, test, "ID_TYPE", type_str); ++ ++ if (!isempty(instance_str)) ++ udev_builtin_add_property(dev, test, "ID_INSTANCE", instance_str); ++ } ++ ++ /* Also export the same values in the above by prefixing ID_USB_. */ ++ udev_builtin_add_property(dev, test, "ID_USB_MODEL", model_str); ++ udev_builtin_add_property(dev, test, "ID_USB_MODEL_ENC", model_str_enc); ++ udev_builtin_add_property(dev, test, "ID_USB_MODEL_ID", product_id); ++ udev_builtin_add_property(dev, test, "ID_USB_SERIAL", serial); + if (!isempty(serial_str)) +- udev_builtin_add_property(dev, test, "ID_SERIAL_SHORT", serial_str); ++ udev_builtin_add_property(dev, test, "ID_USB_SERIAL_SHORT", serial_str); ++ ++ udev_builtin_add_property(dev, test, "ID_USB_VENDOR", vendor_str); ++ udev_builtin_add_property(dev, test, "ID_USB_VENDOR_ENC", vendor_str_enc); ++ udev_builtin_add_property(dev, test, "ID_USB_VENDOR_ID", vendor_id); ++ ++ udev_builtin_add_property(dev, test, "ID_USB_REVISION", revision_str); ++ + if (!isempty(type_str)) +- udev_builtin_add_property(dev, test, "ID_TYPE", type_str); ++ udev_builtin_add_property(dev, test, "ID_USB_TYPE", type_str); ++ + if (!isempty(instance_str)) +- udev_builtin_add_property(dev, test, "ID_INSTANCE", instance_str); +- udev_builtin_add_property(dev, test, "ID_BUS", "usb"); ++ udev_builtin_add_property(dev, test, "ID_USB_INSTANCE", instance_str); ++ + if (!isempty(packed_if_str)) + udev_builtin_add_property(dev, test, "ID_USB_INTERFACES", packed_if_str); + if (ifnum)