From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp1 ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms0.migadu.com with LMTPS id aDjWKQGawmAs6wAAgWs5BA (envelope-from ) for ; Fri, 11 Jun 2021 01:02:25 +0200 Received: from aspmx1.migadu.com ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp1 with LMTPS id yLQwJQGawmCuEAAAbx9fmQ (envelope-from ) for ; Thu, 10 Jun 2021 23:02:25 +0000 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 11AA221D1C for ; Fri, 11 Jun 2021 01:02:25 +0200 (CEST) Received: from localhost ([::1]:50362 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1lrTgt-0000Ui-PU for larch@yhetil.org; Thu, 10 Jun 2021 19:02:23 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:50950) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lrTfa-0006g1-DI for guix-devel@gnu.org; Thu, 10 Jun 2021 19:01:02 -0400 Received: from mailrelay.tugraz.at ([129.27.2.202]:63342) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lrTfW-0006pD-R6 for guix-devel@gnu.org; Thu, 10 Jun 2021 19:01:01 -0400 Received: from [10.0.0.4] (62-116-34-49.adsl.highway.telekom.at [62.116.34.49]) by mailrelay.tugraz.at (Postfix) with ESMTPSA id 4G1KFt1ggmz3wXB; Fri, 11 Jun 2021 01:00:49 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tugraz.at; s=mailrelay; t=1623366050; bh=2KFYLiJnzWV/y+H8zwqGBCRxwpLslv5z/fmdaCFHfRA=; h=Subject:From:To:Cc:Date:In-Reply-To; b=sZe203CJbkKOR0+gik5J6ohOYCgRjAKAZs2rIn4lZvHcHCPcMrIJMkZn0BQ0Pynws VmIl7lvKtQ4rSzbmdOonYhavjr0HxdT93pm7yHpoxm7BzuB34NFu0Er5piGmi0YHwi JWzEkhLwHa1lox4wXqRA5+2PedfbMv4OFozvhCCY= Message-ID: Subject: Is Guix vulnerable to this polkit CVE? From: Leo Prikler To: jbranso@dismail.de Date: Fri, 11 Jun 2021 01:00:24 +0200 In-Reply-To: fec72ae9477f1606cbec32d8cf532044@dismail.de Content-Type: text/plain; charset="UTF-8" User-Agent: Evolution 3.34.2 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-TUG-Backscatter-control: bt4lQm5Tva3SBgCuw0EnZw X-Spam-Scanner: SpamAssassin 3.003001 X-Spam-Score-relay: -1.9 X-Scanned-By: MIMEDefang 2.74 on 129.27.10.116 Received-SPF: pass client-ip=129.27.2.202; envelope-from=leo.prikler@student.tugraz.at; helo=mailrelay.tugraz.at X-Spam_score_int: -42 X-Spam_score: -4.3 X-Spam_bar: ---- X-Spam_report: (-4.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: guix-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: guix-devel@gnu.org Errors-To: guix-devel-bounces+larch=yhetil.org@gnu.org Sender: "Guix-devel" X-Migadu-Flow: FLOW_IN ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1623366145; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:list-id:list-help:list-unsubscribe: list-subscribe:list-post:dkim-signature; bh=2KFYLiJnzWV/y+H8zwqGBCRxwpLslv5z/fmdaCFHfRA=; b=dFN9fhvei4tZtDBbuPBEE6bLgRT0EbEUfOEC8M4x5/vKlf1jq/hoMdlvhpOt9qNoiOeBD8 QsKB8PZGzJTTPLurfITIvXjwZS8KoIefgUqSXGmkqolZe/8/e3AAQE65ufe3MZ0znOadq+ FSZqOdDix9RpRKXYs4flI7N4yMPgHABVNVa9eJXXSGQxkt1JAFgwtOHSRSLsw6mCYGWJmX jtnDWrvrS8l/fu1I2mBXrIQhgFvx7VN8pxCRWWNLlUXWZBa6gnVcWbNopnTDbNK6CT9cMX i++wLNGShDLJZYFBW0F4lcZlzFESDd4V1N/uUqz9bBALGlLZY8Lc7uQHJ0v+0A== ARC-Seal: i=1; s=key1; d=yhetil.org; t=1623366145; a=rsa-sha256; cv=none; b=ENjg5151J5BPn75M5j5nDvrb5MjfcBAwyxy4UbyEY4GHceSxE2nXzabwLbnpRMpwdC4iwJ ZXoGTMg/XznQoDjasfaLtQiekS/cyQd/Pnn2uCoqvX5iL+J0YW6mCJDiIhYZU06FGYZZwo eQZsdKZpS6RKf+m33yZ9u9sA0h8qOxFgGCXmvoOoQtRovWDIxaCc3r94a1iAp/FIIIiFTO mDa8/dXuV+z2h9hGAbjkTkdpSc7uDJZ8ir7XC2JDu+4l5fe1TeoaB4xD5kaIGDqYx64UJE ZjAOqAPWciXYefE05f4twNOZaPdkD4S9fLQZqwu4YC/Zk3CEY09zkSkqFXeOtQ== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=pass header.d=tugraz.at header.s=mailrelay header.b=sZe203CJ; dmarc=pass (policy=none) header.from=student.tugraz.at; spf=pass (aspmx1.migadu.com: domain of guix-devel-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=guix-devel-bounces@gnu.org X-Migadu-Spam-Score: -2.13 Authentication-Results: aspmx1.migadu.com; dkim=pass header.d=tugraz.at header.s=mailrelay header.b=sZe203CJ; dmarc=pass (policy=none) header.from=student.tugraz.at; spf=pass (aspmx1.migadu.com: domain of guix-devel-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=guix-devel-bounces@gnu.org X-Migadu-Queue-Id: 11AA221D1C X-Spam-Score: -2.13 X-Migadu-Scanner: scn1.migadu.com X-TUID: 0CdcaymGkFdt Guix commit 9178566954cc7f34d2d991d31df4565adad93508 ought to fix this with a patch and graft. If you haven't updated already, consider doing so. If you want to play with polkit, you can always roll back :P