From debbugs-submit-bounces@debbugs.gnu.org Wed Jan 26 06:56:46 2022 Received: (at submit) by debbugs.gnu.org; 26 Jan 2022 11:56:46 +0000 Received: from localhost ([127.0.0.1]:51113 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nCguk-0004aa-Jo for submit@debbugs.gnu.org; Wed, 26 Jan 2022 06:56:46 -0500 Received: from lists.gnu.org ([209.51.188.17]:38360) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nCguh-0004aS-W7 for submit@debbugs.gnu.org; Wed, 26 Jan 2022 06:56:36 -0500 Received: from eggs.gnu.org ([209.51.188.92]:36320) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1nCguh-0001Bk-Ol for guix-patches@gnu.org; Wed, 26 Jan 2022 06:56:35 -0500 Received: from [2001:470:142:3::e] (port=57110 helo=fencepost.gnu.org) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1nCguh-0006XI-FA; Wed, 26 Jan 2022 06:56:35 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=MIME-Version:Date:Subject:To:From:in-reply-to: references; bh=LlFGjKWLbEByaf73i4fh+tMo9Rq+crJdWrXaN7N+yGw=; b=Yf1/ItgTHPWmRO STzBPWzYYnyS8chYzd5cGdZFjCLsBEMP7THtBwGY+mInwrBpHi4jkiNWH/j8OqifDLZxgozlO9Hwj wIaWT3r/5YUXhlT50x+yJr7v3g5Ed3uFcjKleJs7e7lJovu2vgpSBicpB09D9kuR9fHqTik1A38ig sYpgr7gUDMzbNAJur7UTcLhlVBUycNVIfLg9ZVa2LqJP2ZsEHgW9hPxEYUX8ZXKeXQUxqp7JRruJO RyXy3iBJKq8yz3sHhJawQVnKPjrrBxoPc9Ov4Cr+gumGkj4xGGtM8CAHpdWzMEwbwTxFJq/0cYtpm u/+nfLqSX8cQX+E0WY9w==; Received: from 91-160-117-201.subs.proxad.net ([91.160.117.201]:60146 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1nCgug-0005SU-EH; Wed, 26 Jan 2022 06:56:35 -0500 From: =?UTF-8?q?Ludovic=20Court=C3=A8s?= To: guix-patches@gnu.org Subject: [PATCH] gnu: polkit: Fix CVE-2021-4034. Date: Wed, 26 Jan 2022 12:56:24 +0100 Message-Id: <20220126115624.31260-1-ludo@gnu.org> X-Mailer: git-send-email 2.34.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: submit Cc: =?UTF-8?q?Ludovic=20Court=C3=A8s?= X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) * gnu/packages/patches/polkit-CVE-2021-4034.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it. * gnu/packages/polkit.scm (polkit-mozjs)[replacement]: New field. * gnu/packages/polkit.scm (polkit-mozjs/fixed): New variable. --- gnu/local.mk | 1 + .../patches/polkit-CVE-2021-4034.patch | 82 +++++++++++++++++++ gnu/packages/polkit.scm | 13 ++- 3 files changed, 95 insertions(+), 1 deletion(-) create mode 100644 gnu/packages/patches/polkit-CVE-2021-4034.patch Hi! We could avoid grafting and instead use 'polkit/fixed' in 'setuid-programs', but it seems safer and less error-prone to graft. Thoughts? Ludo'. diff --git a/gnu/local.mk b/gnu/local.mk index dceaa53145..eb07842775 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -1645,6 +1645,7 @@ dist_patch_DATA = \ %D%/packages/patches/plib-CVE-2011-4620.patch \ %D%/packages/patches/plib-CVE-2012-4552.patch \ %D%/packages/patches/plotutils-spline-test.patch \ + %D%/packages/patches/polkit-CVE-2021-4034.patch \ %D%/packages/patches/polkit-configure-elogind.patch \ %D%/packages/patches/polkit-use-duktape.patch \ %D%/packages/patches/portaudio-audacity-compat.patch \ diff --git a/gnu/packages/patches/polkit-CVE-2021-4034.patch b/gnu/packages/patches/polkit-CVE-2021-4034.patch new file mode 100644 index 0000000000..ca766cb3be --- /dev/null +++ b/gnu/packages/patches/polkit-CVE-2021-4034.patch @@ -0,0 +1,82 @@ +Fixes CVE-2021-4034, local privilege escalation with 'pkexec': + + https://www.openwall.com/lists/oss-security/2022/01/25/11 + +Patch from . + +From a2bf5c9c83b6ae46cbd5c779d3055bff81ded683 Mon Sep 17 00:00:00 2001 +From: Jan Rybar +Date: Tue, 25 Jan 2022 17:21:46 +0000 +Subject: [PATCH] pkexec: local privilege escalation (CVE-2021-4034) + +--- + src/programs/pkcheck.c | 5 +++++ + src/programs/pkexec.c | 23 ++++++++++++++++++++--- + 2 files changed, 25 insertions(+), 3 deletions(-) + +diff --git a/src/programs/pkcheck.c b/src/programs/pkcheck.c +index f1bb4e1..768525c 100644 +--- a/src/programs/pkcheck.c ++++ b/src/programs/pkcheck.c +@@ -363,6 +363,11 @@ main (int argc, char *argv[]) + local_agent_handle = NULL; + ret = 126; + ++ if (argc < 1) ++ { ++ exit(126); ++ } ++ + /* Disable remote file access from GIO. */ + setenv ("GIO_USE_VFS", "local", 1); + +diff --git a/src/programs/pkexec.c b/src/programs/pkexec.c +index 7698c5c..84e5ef6 100644 +--- a/src/programs/pkexec.c ++++ b/src/programs/pkexec.c +@@ -488,6 +488,15 @@ main (int argc, char *argv[]) + pid_t pid_of_caller; + gpointer local_agent_handle; + ++ ++ /* ++ * If 'pkexec' is called THIS wrong, someone's probably evil-doing. Don't be nice, just bail out. ++ */ ++ if (argc<1) ++ { ++ exit(127); ++ } ++ + ret = 127; + authority = NULL; + subject = NULL; +@@ -614,10 +623,10 @@ main (int argc, char *argv[]) + + path = g_strdup (pwstruct.pw_shell); + if (!path) +- { ++ { + g_printerr ("No shell configured or error retrieving pw_shell\n"); + goto out; +- } ++ } + /* If you change this, be sure to change the if (!command_line) + case below too */ + command_line = g_strdup (path); +@@ -636,7 +645,15 @@ main (int argc, char *argv[]) + goto out; + } + g_free (path); +- argv[n] = path = s; ++ path = s; ++ ++ /* argc<2 and pkexec runs just shell, argv is guaranteed to be null-terminated. ++ * /-less shell shouldn't happen, but let's be defensive and don't write to null-termination ++ */ ++ if (argv[n] != NULL) ++ { ++ argv[n] = path; ++ } + } + if (access (path, F_OK) != 0) + { diff --git a/gnu/packages/polkit.scm b/gnu/packages/polkit.scm index e4f4b1276f..1ae94be751 100644 --- a/gnu/packages/polkit.scm +++ b/gnu/packages/polkit.scm @@ -1,7 +1,7 @@ ;;; GNU Guix --- Functional package management for GNU ;;; Copyright © 2014 Andreas Enge ;;; Copyright © 2015 Andy Wingo -;;; Copyright © 2015, 2021 Ludovic Courtès +;;; Copyright © 2015, 2021-2022 Ludovic Courtès ;;; Copyright © 2015 Mark H Weaver ;;; Copyright © 2016 Efraim Flashner ;;; Copyright © 2017 Huang Ying @@ -54,6 +54,7 @@ (define-public polkit-mozjs (package (name "polkit") (version "0.120") + (replacement polkit-mozjs/fixed) (source (origin (method url-fetch) (uri (string-append @@ -146,6 +147,16 @@ (define-public polkit-mozjs for unprivileged applications.") (license lgpl2.0+))) +(define-public polkit-mozjs/fixed + (package + (inherit polkit-mozjs) + (version "0.121") + (source (origin + (inherit (package-source polkit-mozjs)) + (patches (cons (search-patch "polkit-CVE-2021-4034.patch") + (origin-patches + (package-source polkit-mozjs)))))))) + ;;; Variant of polkit built with Duktape, a lighter JavaScript engine compared ;;; to mozjs. (define-public polkit-duktape base-commit: 1402c6abe150ced4cbb4fa0721fe7c8796fe2c38 prerequisite-patch-id: 6ecfe5930fe8847a954c16425713d4a6ac515a04 -- 2.34.0 From debbugs-submit-bounces@debbugs.gnu.org Wed Jan 26 09:40:50 2022 Received: (at control) by debbugs.gnu.org; 26 Jan 2022 14:40:50 +0000 Received: from localhost ([127.0.0.1]:51467 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nCjTe-0000rX-MH for submit@debbugs.gnu.org; Wed, 26 Jan 2022 09:40:50 -0500 Received: from mail3-relais-sop.national.inria.fr ([192.134.164.104]:30333) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nCjTd-0000rA-Ha for control@debbugs.gnu.org; Wed, 26 Jan 2022 09:40:49 -0500 X-IronPort-AV: E=Sophos;i="5.88,318,1635199200"; d="scan'208";a="4151273" Received: from 91-160-117-201.subs.proxad.net (HELO ribbon) ([91.160.117.201]) by mail3-relais-sop.national.inria.fr with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 26 Jan 2022 15:40:43 +0100 Date: Wed, 26 Jan 2022 15:40:42 +0100 Message-Id: <87sftah85x.fsf@gnu.org> To: control@debbugs.gnu.org From: =?utf-8?Q?Ludovic_Court=C3=A8s?= Subject: control message for bug #53549 MIME-version: 1.0 Content-type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -1.3 (-) X-Debbugs-Envelope-To: control X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -2.3 (--) tags 53549 + security quit From debbugs-submit-bounces@debbugs.gnu.org Wed Jan 26 09:40:54 2022 Received: (at control) by debbugs.gnu.org; 26 Jan 2022 14:40:55 +0000 Received: from localhost ([127.0.0.1]:51469 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nCjTi-0000rh-Qq for submit@debbugs.gnu.org; Wed, 26 Jan 2022 09:40:54 -0500 Received: from mail3-relais-sop.national.inria.fr ([192.134.164.104]:30333) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nCjTe-0000rA-6Y for control@debbugs.gnu.org; Wed, 26 Jan 2022 09:40:50 -0500 X-IronPort-AV: E=Sophos;i="5.88,318,1635199200"; d="scan'208";a="4151277" Received: from 91-160-117-201.subs.proxad.net (HELO ribbon) ([91.160.117.201]) by mail3-relais-sop.national.inria.fr with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 26 Jan 2022 15:40:46 +0100 Date: Wed, 26 Jan 2022 15:40:44 +0100 Message-Id: <87r18uh85v.fsf@gnu.org> To: control@debbugs.gnu.org From: =?utf-8?Q?Ludovic_Court=C3=A8s?= Subject: control message for bug #53549 MIME-version: 1.0 Content-type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -1.3 (-) X-Debbugs-Envelope-To: control X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -2.3 (--) severity 53549 important quit From debbugs-submit-bounces@debbugs.gnu.org Wed Jan 26 10:14:58 2022 Received: (at 53549) by debbugs.gnu.org; 26 Jan 2022 15:14:58 +0000 Received: from localhost ([127.0.0.1]:53161 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nCk0g-0004Oy-6j for submit@debbugs.gnu.org; Wed, 26 Jan 2022 10:14:58 -0500 Received: from mailrelay.tugraz.at ([129.27.2.202]:60606) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nCk0a-0004OZ-NS for 53549@debbugs.gnu.org; Wed, 26 Jan 2022 10:14:53 -0500 Received: from lprikler-laptop.ist.intra (gw.ist.tugraz.at [129.27.202.101]) by mailrelay.tugraz.at (Postfix) with ESMTPSA id 4JkS206mJ0z1LZW8; Wed, 26 Jan 2022 16:14:48 +0100 (CET) DKIM-Filter: OpenDKIM Filter v2.11.0 mailrelay.tugraz.at 4JkS206mJ0z1LZW8 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tugraz.at; s=mailrelay; t=1643210089; bh=ZNST4h8H1HN4lRLqh31l/RbzzM7jFtM7++s8FbnGoQo=; h=Subject:From:To:Date:In-Reply-To:References:From; b=Pn27beFVfRc6R4EZJ1fc0JZShDuM7Kphmh/p8m0odIKRTvmOkvNcqHHenoNUcas09 5/fRAn52LWVngByk5sjjPkRA4uZpdZ4XlgBYDEwMPfrTJnFKOiAQnL5gVee97tlhl0 yoV36odnn426727eI+DEMNJ5SCcjvSIutxlSs4OA= Message-ID: Subject: Re: [PATCH] gnu: polkit: Fix CVE-2021-4034. From: Liliana Marie Prikler To: Ludovic =?ISO-8859-1?Q?Court=E8s?= , 53549@debbugs.gnu.org Date: Wed, 26 Jan 2022 16:14:48 +0100 In-Reply-To: <20220126115624.31260-1-ludo@gnu.org> References: <20220126115624.31260-1-ludo@gnu.org> Content-Type: text/plain; charset="UTF-8" User-Agent: Evolution 3.42.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-TUG-Backscatter-control: waObeELIUl4ypBWmcn/8wQ X-Spam-Scanner: SpamAssassin 3.003001 X-Spam-Score-relay: -1.9 X-Scanned-By: MIMEDefang 2.74 on 129.27.10.117 X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 53549 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) Hi Ludo, Am Mittwoch, dem 26.01.2022 um 12:56 +0100 schrieb Ludovic Courtès: > * gnu/packages/patches/polkit-CVE-2021-4034.patch: New file. > * gnu/local.mk (dist_patch_DATA): Add it. > * gnu/packages/polkit.scm (polkit-mozjs)[replacement]: New field. > * gnu/packages/polkit.scm (polkit-mozjs/fixed): New variable. > --- >  gnu/local.mk                                  |  1 + >  .../patches/polkit-CVE-2021-4034.patch        | 82 > +++++++++++++++++++ >  gnu/packages/polkit.scm                       | 13 ++- >  3 files changed, 95 insertions(+), 1 deletion(-) >  create mode 100644 gnu/packages/patches/polkit-CVE-2021-4034.patch > > Hi! > > We could avoid grafting and instead use 'polkit/fixed' in 'setuid- > programs', but it seems safer and less error-prone to graft. > > Thoughts? Given that there is also a duktape variant, a graft is necessary, no? On a related note, polit-duktape inherits polkit-mozjs in a way that does not require adding a separate graft for it, right? Assuming both of the above hold, LGTM. Cheers From debbugs-submit-bounces@debbugs.gnu.org Wed Jan 26 11:56:49 2022 Received: (at 53549-done) by debbugs.gnu.org; 26 Jan 2022 16:56:49 +0000 Received: from localhost ([127.0.0.1]:53304 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nClbE-0003EU-Od for submit@debbugs.gnu.org; Wed, 26 Jan 2022 11:56:48 -0500 Received: from hera.aquilenet.fr ([185.233.100.1]:44478) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nClbB-0003EF-Qa for 53549-done@debbugs.gnu.org; Wed, 26 Jan 2022 11:56:47 -0500 Received: from localhost (localhost [127.0.0.1]) by hera.aquilenet.fr (Postfix) with ESMTP id 26A30284; Wed, 26 Jan 2022 17:56:39 +0100 (CET) X-Virus-Scanned: Debian amavisd-new at aquilenet.fr Received: from hera.aquilenet.fr ([127.0.0.1]) by localhost (hera.aquilenet.fr [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I_0MfUuLM2oH; Wed, 26 Jan 2022 17:56:38 +0100 (CET) Received: from ribbon (91-160-117-201.subs.proxad.net [91.160.117.201]) by hera.aquilenet.fr (Postfix) with ESMTPSA id F082E9E; Wed, 26 Jan 2022 17:56:37 +0100 (CET) From: =?utf-8?Q?Ludovic_Court=C3=A8s?= To: Liliana Marie Prikler Subject: Re: bug#53549: [PATCH] gnu: polkit: Fix CVE-2021-4034. References: <20220126115624.31260-1-ludo@gnu.org> Date: Wed, 26 Jan 2022 17:56:37 +0100 In-Reply-To: (Liliana Marie Prikler's message of "Wed, 26 Jan 2022 16:14:48 +0100") Message-ID: <8735lah1ve.fsf_-_@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spamd-Bar: / Authentication-Results: hera.aquilenet.fr; none X-Rspamd-Server: hera X-Rspamd-Queue-Id: 26A30284 X-Spamd-Result: default: False [-0.10 / 15.00]; ARC_NA(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; FROM_HAS_DN(0.00)[]; TO_DN_SOME(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; MIME_GOOD(-0.10)[text/plain]; RCPT_COUNT_TWO(0.00)[2]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+]; RCVD_COUNT_TWO(0.00)[2]; RCVD_TLS_ALL(0.00)[]; MID_RHS_MATCH_FROM(0.00)[] X-Spam-Score: 1.0 (+) X-Debbugs-Envelope-To: 53549-done Cc: 53549-done@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.0 (/) Hi, Liliana Marie Prikler skribis: > Am Mittwoch, dem 26.01.2022 um 12:56 +0100 schrieb Ludovic Court=C3=A8s: >> * gnu/packages/patches/polkit-CVE-2021-4034.patch: New file. >> * gnu/local.mk (dist_patch_DATA): Add it. >> * gnu/packages/polkit.scm (polkit-mozjs)[replacement]: New field. >> * gnu/packages/polkit.scm (polkit-mozjs/fixed): New variable. >> --- >> =C2=A0gnu/local.mk=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 |=C2= =A0 1 + >> =C2=A0.../patches/polkit-CVE-2021-4034.patch=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 | 82 >> +++++++++++++++++++ >> =C2=A0gnu/packages/polkit.scm=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 | 13 ++- >> =C2=A03 files changed, 95 insertions(+), 1 deletion(-) >> =C2=A0create mode 100644 gnu/packages/patches/polkit-CVE-2021-4034.patch >>=20 >> Hi! >>=20 >> We could avoid grafting and instead use 'polkit/fixed' in 'setuid- >> programs', but it seems safer and less error-prone to graft. >>=20 >> Thoughts? > Given that there is also a duktape variant, a graft is necessary, no?=20 > On a related note, polit-duktape inherits polkit-mozjs in a way that > does not require adding a separate graft for it, right? Assuming both > of the above hold, LGTM. The duktape variant is defined with =E2=80=98package/inherit=E2=80=99 and t= hus it automatically gets a replacement with the patch: --8<---------------cut here---------------start------------->8--- $ ./pre-inst-env guix build polkit-duktape --no-grafts /gnu/store/z92ymaf84ij8f37cm1wrkkmgrw2slrym-polkit-duktape-0.120 $ ./pre-inst-env guix build polkit-duktape=20 /gnu/store/3g55nhkcbc0a4l7b26gxsalxq0rq1cs7-polkit-duktape-0.121 $ guix gc -R $(./pre-inst-env guix build polkit-duktape -d) |grep polkit-C= VE /gnu/store/lxms944bda56ll590dsrkkhc9n2h3xws-polkit-CVE-2021-4034.patch --8<---------------cut here---------------end--------------->8--- Pushed as 3993d33d1c0129b1ca6f0fd122fe2bbe48e4f093. Thanks for taking a look! Ludo=E2=80=99. From unknown Thu Jun 19 16:24:36 2025 Received: (at fakecontrol) by fakecontrolmessage; To: internal_control@debbugs.gnu.org From: Debbugs Internal Request Subject: Internal Control Message-Id: bug archived. Date: Thu, 24 Feb 2022 12:24:08 +0000 User-Agent: Fakemail v42.6.9 # This is a fake control message. # # The action: # bug archived. thanks # This fakemail brought to you by your local debbugs # administrator