~ubuntu-branches/ubuntu/maverick/xorg-server/maverick-security

« back to all changes in this revision

Viewing changes to Xext/security.c

  • Committer: Bazaar Package Importer
  • Author(s): Christopher James Halse Rogers
  • Date: 2010-08-05 11:25:14 UTC
  • mfrom: (1.1.35 upstream) (0.1.14 experimental)
  • Revision ID: james.westby@ubuntu.com-20100805112514-q4efdgj3nblevos2
Tags: 2:1.8.99.905-1ubuntu1
* Merge from (unreleased) Debian experimental.  Remaining Ubuntu changes:
  - rules, control:
    + Disable SELinux, libaudit-dev is not in main yet (LP 406226).
      Drop libaudit-dev from build-deps.
  - rules: Enable xcsecurity (LP 247537).
  - local/xvfb-run*: Add correct docs about error codes (LP 328205)
  - rules: Add --with-extra-module-dir to support GL alternatives.
  - control: Xvfb depends on xauth, x11-xkb-utils. (LP 500102)
  - rules, local/64-xorg-xkb.rules: Don't use keyboard-configuration
    until it's available.
  - control: Update some versioned Breaks for Ubuntu versions.
  - debian/patches:
    + 100_rethrow_signals.patch:
      When aborting, re-raise signals for apport
    + 109_fix-swcursor-crash.patch:
      Avoid dereferencing null pointer while reloading cursors during
      resume. (LP 371405)
    + 111_armel-drv-fallbacks.patch:
      Add support for armel driver fallbacks.
    + 121_only_switch_vt_when_active.diff:
      Add a check to prevent the X server from changing the VT when killing
      GDM from the console.
    + 122_xext_fix_card32_overflow_in_xauth.patch:
      Fix server crash when “xauth generate” is called with large timeout.
    + 157_check_null_modes.patch, 162_null_crtc_in_rotation.patch,
      166_nullptr_xinerama_keyrepeat.patch, 167_nullptr_xisbread.patch
      169_mipointer_nullptr_checks.patch,
      172_cwgetbackingpicture_nullptr_check.patch:
      Fix various segfaults in xserver by checking pointers for NULL
      values before dereferencing them.
    + 165_man_xorg_conf_no_device_ident.patch
      Correct man page
    + 168_glibc_trace_to_stderr.patch:
      Report abort traces to stderr instead of terminal
    + 184_virtual_devices_autodetect.patch:
      Use vesa for qemu device, which is not supported by cirrus
    + 187_edid_quirk_hp_nc8430.patch:
      Quirk for another LPL monitor (LP 380009)
    + 188_default_primary_to_first_busid.patch:
      Pick the first device and carry on (LP 459512)
    + 189_xserver_1.5.0_bg_none_root.patch:
      Create a root window with no background.
    + 190_cache-xkbcomp_output_for_fast_start_up.patch:
      Cache keyboard settings.
    + 191-Xorg-add-an-extra-module-path.patch:
      Add support for the alternatives module path.
    + 197_xvfb-randr.patch:
      Adds xrandr support to xvfb. (LP 516123)
    + 198_nohwaccess.patch:
      Adds a -nohwaccess argument to make X not access the hardware
      ports directly.
    + 200_randr-null.patch:
      Clarify a pointer initialization.
* Update changelog entries for 1.8.1.902-1 which became 1.8.99.904-1
* Drop 196_xvfbscreeninit-handling.patch: it's semantically empty, and now 
  doesn't apply.  Merge remaining #include change into 197_xvfb-randr.patch
* New upstream version will start correctly when no outputs are connected,
  as long as the video driver can dynamically resize the framebuffer
  (true for all KMS drivers) (LP: #337889)
* New upstream version fixes crash on non-admin logout with KDE (LP: #569879)
* Refresh 111_armel-drv-fallbacks.patch to fix the build on armel

Show diffs side-by-side

added added

removed removed

Lines of Context:
51
51
static CallbackListPtr SecurityValidateGroupCallback = NULL;
52
52
 
53
53
/* Private state record */
54
 
static int stateKeyIndex;
55
 
static DevPrivateKey stateKey = &stateKeyIndex;
 
54
static DevPrivateKeyRec stateKeyRec;
 
55
#define stateKey (&stateKeyRec)
56
56
 
57
57
/* This is what we store as client security state */
58
58
typedef struct {
198
198
    while ((pEventClient = pAuth->eventClients))
199
199
    {
200
200
        /* send revocation event event */
201
 
        ClientPtr client = rClient(pEventClient);
202
 
 
203
 
        if (!client->clientGone)
204
 
        {
205
 
            xSecurityAuthorizationRevokedEvent are;
206
 
            are.type = SecurityEventBase + XSecurityAuthorizationRevoked;
207
 
            are.sequenceNumber = client->sequence;
208
 
            are.authId = pAuth->id;
209
 
            WriteEventsToClient(client, 1, (xEvent *)&are);
210
 
        }
 
201
        xSecurityAuthorizationRevokedEvent are;
 
202
        are.type = SecurityEventBase + XSecurityAuthorizationRevoked;
 
203
        are.authId = pAuth->id;
 
204
        WriteEventsToClient(rClient(pEventClient), 1, (xEvent *)&are);
211
205
        FreeResource(pEventClient->resource, RT_NONE);
212
206
    }
213
207
 
222
216
        }
223
217
 
224
218
    SecurityAudit("revoked authorization ID %d\n", pAuth->id);
225
 
    xfree(pAuth);
 
219
    free(pAuth);
226
220
    return Success;
227
221
 
228
222
} /* SecurityDeleteAuthorization */
247
241
                prev->next = pEventClient->next;
248
242
            else
249
243
                pAuth->eventClients = pEventClient->next;
250
 
            xfree(pEventClient);
251
 
            return(Success);
 
244
            free(pEventClient);
 
245
            return Success;
252
246
        }
253
247
        prev = pEventClient;
254
248
    }
383
377
    }
384
378
    (void)WriteToClient(client, SIZEOF(xSecurityQueryVersionReply),
385
379
                        (char *)&rep);
386
 
    return (client->noClientException);
 
380
    return Success;
387
381
} /* ProcSecurityQueryVersion */
388
382
 
389
383
 
409
403
        }
410
404
    }
411
405
    
412
 
    pEventClient = xalloc(sizeof(OtherClients));
 
406
    pEventClient = malloc(sizeof(OtherClients));
413
407
    if (!pEventClient)
414
408
        return BadAlloc;
415
409
    pEventClient->mask = mask;
418
412
    if (!AddResource(pEventClient->resource, RTEventClient,
419
413
                     (pointer)pAuth))
420
414
    {
421
 
        xfree(pEventClient);
 
415
        free(pEventClient);
422
416
        return BadAlloc;
423
417
    }
424
418
    pAuth->eventClients = pEventClient;
541
535
 
542
536
    /* associate additional information with this auth ID */
543
537
 
544
 
    pAuth = xalloc(sizeof(SecurityAuthorizationRec));
 
538
    pAuth = malloc(sizeof(SecurityAuthorizationRec));
545
539
    if (!pAuth)
546
540
    {
547
541
        err = BadAlloc;
604
598
                  pAuth->group, eventMask);
605
599
 
606
600
    /* the request succeeded; don't call RemoveAuthorization or free pAuth */
607
 
 
608
 
    removeAuth = FALSE;
609
 
    pAuth = NULL;
610
 
    err = client->noClientException;
 
601
    return Success;
611
602
 
612
603
bailout:
613
604
    if (removeAuth)
614
605
        RemoveAuthorization(stuff->nbytesAuthProto, protoname,
615
606
                            authdata_len, pAuthdata);
616
 
    if (pAuth) xfree(pAuth);
 
607
    free(pAuth);
617
608
    return err;
618
609
 
619
610
} /* ProcSecurityGenerateAuthorization */
632
623
                                 SecurityAuthorizationResType, client,
633
624
                                 DixDestroyAccess);
634
625
    if (rc != Success)
635
 
        return (rc == BadValue) ?
636
 
            SecurityErrorBase + XSecurityBadAuthorization : rc;
 
626
        return rc;
637
627
 
638
628
    FreeResource(stuff->authId, RT_NONE);
639
629
    return Success;
815
805
    Mask allowed = SecurityResourceMask;
816
806
 
817
807
    subj = dixLookupPrivate(&rec->client->devPrivates, stateKey);
818
 
    obj = dixLookupPrivate(&clients[cid]->devPrivates, stateKey);
819
808
 
820
809
    /* disable background None for untrusted windows */
821
810
    if ((requested & DixCreateAccess) && (rec->rtype == RT_WINDOW))
841
830
            allowed |= DixReadAccess;
842
831
    }
843
832
 
844
 
    if (SecurityDoCheck(subj, obj, requested, allowed) == Success)
845
 
        return;
 
833
    if (clients[cid] != NULL) {
 
834
        obj = dixLookupPrivate(&clients[cid]->devPrivates, stateKey);
 
835
        if (SecurityDoCheck(subj, obj, requested, allowed) == Success)
 
836
            return;
 
837
    }
846
838
 
847
839
    SecurityAudit("Security: denied client %d access %x to resource 0x%x "
848
840
                  "of client %d on request %s\n", rec->client->index,
1118
1110
    RTEventClient |= RC_NEVERRETAIN;
1119
1111
 
1120
1112
    /* Allocate the private storage */
1121
 
    if (!dixRequestPrivate(stateKey, sizeof(SecurityStateRec)))
 
1113
    if (!dixRegisterPrivateKey(stateKey, PRIVATE_CLIENT, sizeof(SecurityStateRec)))
1122
1114
        FatalError("SecurityExtensionSetup: Can't allocate client private.\n");
1123
1115
 
1124
1116
    /* Register callbacks */
1149
1141
    EventSwapVector[SecurityEventBase + XSecurityAuthorizationRevoked] =
1150
1142
        (EventSwapPtr)SwapSecurityAuthorizationRevokedEvent;
1151
1143
 
 
1144
    SetResourceTypeErrorValue(SecurityAuthorizationResType, SecurityErrorBase + XSecurityBadAuthorization);
 
1145
 
1152
1146
    /* Label objects that were created before we could register ourself */
1153
1147
    SecurityLabelInitial();
1154
1148
}