untrusted comment: verify with openbsd-65-base.pub
RWSZaRmt1LEQT259PM1AAcZuaBttAcDYuG6LuuE+Vio/h3QKQpzuESujYBEPzjwnjrOeL6A/OoQ/6i/fcASc5ZMpCgzKDnPDwQs=
OpenBSD 6.5 errata 020, December 3, 2019:
Environment-provided paths are used for dlopen() in mesa, resulting in
escalation to the auth group in xlock(1).
Apply by doing:
signify -Vep /etc/signify/openbsd-65-base.pub -x 020_mesaxlock.patch.sig \
-m - | (cd /usr/xenocara && patch -p0)
And then compile and rebuild Mesa and xlock
cd /usr/xenocara/lib/mesa
make -f Makefile.bsd-wrapper obj
make -f Makefile.bsd-wrapper build
cd /usr/xenocara/app/xlockmore
make -f Makefile.bsd-wrapper obj
make -f Makefile.bsd-wrapper build
Index: lib/mesa/src/glx/dri_common.c
===================================================================
RCS file: /cvs/xenocara/lib/mesa/src/glx/dri_common.c,v
diff -u -p -u -r1.9 dri_common.c
--- lib/mesa/src/glx/dri_common.c 29 Jan 2019 11:52:21 -0000 1.9
+++ lib/mesa/src/glx/dri_common.c 3 Dec 2019 01:00:26 -0000
@@ -110,7 +110,7 @@ driOpenDriver(const char *driverName)
glhandle = dlopen(GL_LIB_NAME, RTLD_NOW | RTLD_GLOBAL);
libPaths = NULL;
- if (geteuid() == getuid()) {
+ if (issetugid() == 0 && geteuid() == getuid()) {
/* don't allow setuid apps to use LIBGL_DRIVERS_PATH */
libPaths = getenv("LIBGL_DRIVERS_PATH");
if (!libPaths)
Index: lib/mesa/src/loader/loader.c
===================================================================
RCS file: /cvs/xenocara/lib/mesa/src/loader/loader.c,v
diff -u -p -u -r1.6 loader.c
--- lib/mesa/src/loader/loader.c 29 Jan 2019 11:52:24 -0000 1.6
+++ lib/mesa/src/loader/loader.c 3 Dec 2019 01:00:26 -0000
@@ -441,7 +441,7 @@ loader_get_driver_for_fd(int fd)
* user's problem, but this allows vc4 simulator to run on an i965 host,
* and may be useful for some touch testing of i915 on an i965 host.
*/
- if (geteuid() == getuid()) {
+ if (issetugid() == 0 && geteuid() == getuid()) {
driver = getenv("MESA_LOADER_DRIVER_OVERRIDE");
if (driver)
return strdup(driver);
Index: app/xlockmore/Makefile.bsd-wrapper
===================================================================
RCS file: /cvs/xenocara/app/xlockmore/Makefile.bsd-wrapper,v
diff -u -p -u -r1.13 Makefile.bsd-wrapper
--- app/xlockmore/Makefile.bsd-wrapper 7 Mar 2017 21:35:57 -0000 1.13
+++ app/xlockmore/Makefile.bsd-wrapper 3 Dec 2019 01:00:34 -0000
@@ -17,6 +17,7 @@ config.status:
--enable-appdefaultdir=${X11BASE}/share/X11/app-defaults \
--enable-syslog --without-motif --without-ttf \
--without-gtk2 --without-gtk --without-esound \
- --without-rplay --without-ftgl
+ --without-rplay --without-ftgl \
+ --without-opengl --without-mesa
.include <bsd.xorg.mk>