Static builds are disabled - there is no reason to build both shared
and static versions of everything.
MAJOR/MINOR/MICRO variables changed to CDE_VERSION_MAJOR/MINOR/MICRO.
Make DtXinerama a shared (la) library.
Add DTCLIENTLIBS SUBST to replace the role of Imake DtClientLibs, DT
libs needed to link most CDE programs.
Add AC_PROG_RANDLIB.
At this stage, these certainly won't actually build yet.
Just fix up the relevent Makefile.am files so that autogen does not
emit errors and warnings for them.
Removed AIX/HPUX support in Makefile.am files. No point in
propogating that stuff when we've already removed much of that
unmaintained code from the codebase.
Commented out all of the Sun Pro stuff. Someone whos using that will
need to go through and fix it. This is mostly in dtmail and dthelp.
In fact, someone who does Solaris in general will need to go through
this stuff.
Next up, we'll replace any remaining 'if SUN' conditionals with 'if
SOLARIS' which is a more appropriate name and was already defined in
configure.ac.
Then we'll see about getting these new directories building.
First attempt at setting certain -Defines and compiler flags (like
-fno-strict-aliasing). Only linux for now.
Add CSRG_BASED to CPP_SOURCE_FLAGS rather than directly at CFLAGS.
This will be added to CFLAGS later on in the script along with other
gathered flags and options.
Set CFLAGS, CXXFLAGS, and CPPFLAGS at the end, composed of other env
variables we set earlier on.
cppfile.inc - don't set BUIT_SOURCES or CLEANFILES here as they
overwrite (or in case of the CLEANFILES +=...) ignore the settings.
Do those in the Makefile.am always.
We still need a better way to preprocess generic files. cppfile.inc
will only work for one file per Makefile...
There are/were two dproto.h files, one in DtSearch, one in raima. The
one in raima is the one we want, so replace the global Dt/dproto.h
with it. Also correct a prototype declaration error in that file.
Delete the dproto.h file in DtSearch, it's garbage and unused.
Next, redo the way yacc is used. Autotools does "the right thing" by
simply including the .y file in *_SOURCES and using
BUILT_SOURCES/CLEANFILES to manage it. No need for special rules to
handle yacc and lex.
These really need to go away and are primarily used by older
unsupported platforms.
Here we fake these for Linux (4.15), freebsd (10.0), openbsd (6.2),
netbsd (8.0), and solaris (5.10).
I'm not sure about the Solaris one as I don't have any of them.
Basically, anything after Solaris 5.10, which is pretty ancient.
These should be considered temporary - all uses of these macros in the
code should be removed in favor of functionality-specific checks in
configure.
Some files were trying to access the global includes directy in the
build area with things like #include <api/c/tt_c.h>, which is now
wrong. Se we fix all of those up. tt_c.h and tttk.h are now global,
so we no longer need to root around various build dirs to find them.
TT builds again.
Ok - so one of the steps in building CDE is an early phase called the
includes phase (make includes). At this point, all of the public
header files are exported to exports/include/Dt, DtI, ...
Then, the software is built using that include dir.
This of course does not work in autotools. Much of the software does
things like #include <Dt/something.h>, so in order for the build to
succeed, this behavior must be represented/replicated in some way.
It seems the usual way of dealing with this is to place all public
headers (and in some projects, ALL headers) into a toplevel include
directory.
We now do this for all public headers - they have been moved from
wherever they were and placed in the appropriate spot in includes/
This will break the Imake 'make includes' phase unless the Imakefiles
are fixed (remove the HEADERS = stuff, and the incdir defines). This
has not been done at this point since in reality, once autotools works
properly, there will be no need for the Imake stuff anymore, and I
intend to get rid of it.
This is just a warning for now - Imake builds in this tree will now
fail at the 'includes' stage.
This commit is only the migration. In upcoming commits, libtt will be
fixed so that the hack being used before to get around this problem is
removed as there will no longer be any need.
And then the autotools work continues...
Redo the way the main CDE libs are specified in configure.ac... The
current way could not work due to evaluation issues, and the fact that
variables like $srcdir and the like are only valid in Makefiles, not
configure.
Use @LIBNAME@ rather then $(LIBNAME) in Makefile.am files - this way
the location is always evaluated when it's run, not in configure -
which can't work for a variety of reasons.
Got some of the TT binaries to build.
Made a new include/cppfile.inc file that can be used to pre-process
files. The downside is that currently you can only pre-process one
file at a time per Makefile. Something more robust is needed, but at
least tt/bin/shell now builds. Will need to come up with a better way.
We create autotools_config.h instead of config.h to make it clear and
avoid collisions.
We use a different method to define CSRG_BASED on BSD systems, and fix
a bug in definition of XTOOLLIB.
XTOOLLIB should probably be checked out - we should get some info from
AC_PATH_X and AC_PATH_XTRA instead of hardcoding it. To be looked at
later.
This should allow an autoregen and ./confiure to work. We only
generate Makefiles for lib/* and ./Makefile for now. We'll ad more as
we go along.
Make still fails as we need to figure out TT - tirpc lib, rpcgen,
etc. But it's a start!
This program should not be SUID root. If you need it's services, just
run
sudo dtprintinfo -populate
TODO: dtprintinfo should only create it's actions (if ever) in a
user's .dt/types/ directory and not in any system-wide dirs. No need
for root access at all.
This fixes a potentially exploitable buffer overrun in dtprintinfo.
This was brought to my attention based on a 0day exploit released for
Solaris CDE.
The exploit code does not work (or build) on linux, and the overrun is
in the heap rather than the stack as on Solaris, but it's easy to see
how this could be exploited.
The following is the content of the advisory:
8<-----------------------------------------------------------
@Mediaservice.net (Cybaze Group) Security Advisory #2019-01 (2019-05-07)
Title: Local privilege escalation via CDE dtprintinfo
Application: Common Desktop Environment 2.3.0 and earlier
Platforms: Oracle Solaris 10 1/13 (Update 11) and earlier
Description: A local attacker can gain root privileges by exploiting
a buffer overflow in CDE dtprintinfo
Author: Marco Ivaldi <marco.ivaldi@mediaservice.net>
Contributor: Dave Aitel <dave.aitel@cyxtera.com> (original discovery)
Vendor Status: <secalert_us@oracle.com> notified on 2019-05-05
<cdesktopenv-devel@lists.sourceforge.net> notified on 2019-05-05
CVE: The Common Vulnerabilities and Exposures project has not assigned
a name to this issue yet
References: https://lab.mediaservice.net/advisory/2019-01-cde-dtprintinfo.txthttps://github.com/0xdea/raptor_infiltrate19https://sourceforge.net/p/cdesktopenv/wiki/Home/https://www.oracle.com/technetwork/server-storage/solaris10/https://www.mediaservice.net/https://infiltratecon.com/
1. Abstract.
A buffer overflow in the DtPrinterAction::PrintActionExists() function in the
Common Desktop Environment 2.3.0 and earlier, as used in Oracle Solaris 10 1/13
(Update 11) and earlier, allows local users to gain root privileges via a long
printer name passed to dtprintinfo by a malicious lpstat program.
This is a 0day vulnerability demonstrated at #INFILTRATE19 on May 2nd, 2019 in
the talk "A bug's life: story of a Solaris 0day".
2. Example Attack Session.
bash-3.2$ cat /etc/release
Oracle Solaris 10 1/13 s10x_u11wos_24a X86
Copyright (c) 1983, 2013, Oracle and/or its affiliates. All rights reserved.
Assembled 17 January 2013
bash-3.2$ uname -a
SunOS nostalgia 5.10 Generic_147148-26 i86pc i386 i86pc
bash-3.2$ id
uid=54322(raptor) gid=1(other)
bash-3.2$ gcc raptor_dtprintname_intel.c -o raptor_dtprintname_intel -Wall
bash-3.2$ ./raptor_dtprintname_intel 192.168.1.1:0
raptor_dtprintname_intel.c - dtprintinfo 0day, Solaris/Intel
Copyright (c) 2004-2019 Marco Ivaldi <raptor@0xdeadbeef.info>
Using SI_PLATFORM : i86pc (5.10)
Using stack base : 0x8047fff
Using rwx_mem address : 0xfeffa004
Using sc address : 0x8047f60
Using strcpy() address : 0xfefe26a0
lpstat called with -v
lpstat called with -v
lpstat called with -d
uid=0(root) gid=1(other)
3. Affected Platforms.
All platforms shipping the Common Desktop Environment are potentially
affected. This includes:
* Oracle Solaris 10 1/13 (Update 11) and earlier [default installation]
According to the CDE Wiki, the following platforms are officially supported:
* All Official Ubuntu variants 12.04 - 18.04
* Debian 6, 7, 8, 9
* Fedora 17 at least
* Archlinux
* Red Hat
* Slackware 14.0
* OpenBSD
* NetBSD
* FreeBSD 9.2, 10.x, 11.x
* openSUSE Tumbleweed (gcc7)
* openSUSE Leap 4.2 (gcc4)
* SUSE 12 SP3 (gcc4)
* Solaris, OpenIndiana
4. Fix.
The upstream CDE maintainers have issued a patch for this vulnerability. Oracle
is investigating the issue via tracking# S1153109 and is expected to release a
fix for all affected-supported versions of Solaris via their quarterly Critical
Patch Update (CPU) program.
As a temporary workaround, it is possible to remove the setuid bit from the
dtprintinfo executable as follows:
bash-3.2# chmod -s /usr/dt/bin/dtprintinfo
5. Proof of Concept.
A working exploit for Oracle Solaris 10 1/13 (Update 11) Intel has been
developed as a proof of concept. Exploits for other Solaris versions and for
the SPARC architecture are also available. All exploits can be downloaded at:
https://github.com/0xdea/raptor_infiltrate19/https://github.com/0xdea/exploits/
8<-----------------------------------------------------------
dtcalc compiled with clang segfaulted when switched
to a different mode like Deg to Rad or Financial to
Scientific. Was reproducable at least under FreeBSD/AMD64.
Fixed now.
For some reason, the #include of iconv.h was removed, and dummy stubs
were put in place on linux systems (only). This caused iconv() calls
to be completely ignored.
Now we use iconv() just like very other OS we support.
Localization seems to work. The main help viewer dies though. Other
parts of help seem to work. Index causes a crash too.
Crash:
*** Error in `/usr/dt/bin/dthelpview': malloc(): memory corruption (fast): 0x00000000021fefb0 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7f61814917e5]
/lib/x86_64-linux-gnu/libc.so.6(+0x82651)[0x7f618149c651]
/lib/x86_64-linux-gnu/libc.so.6(__libc_malloc+0x54)[0x7f618149e184]
/usr/lib/x86_64-linux-gnu/libxcb.so.1(+0xc2ab)[0x7f617f71d2ab]
/usr/lib/x86_64-linux-gnu/libxcb.so.1(+0x9ed1)[0x7f617f71aed1]
/usr/lib/x86_64-linux-gnu/libxcb.so.1(+0xa31d)[0x7f617f71b31d]
/usr/lib/x86_64-linux-gnu/libxcb.so.1(xcb_writev+0x45)[0x7f617f71b3a5]
/usr/lib/x86_64-linux-gnu/libX11.so.6(_XSend+0x19e)[0x7f6181b2a54e]
/usr/lib/x86_64-linux-gnu/libX11.so.6(_XReply+0x82)[0x7f6181b2aa42]
/usr/lib/x86_64-linux-gnu/libX11.so.6(XSync+0x4d)[0x7f6181b2652d]
/usr/lib/x86_64-linux-gnu/libXm.so.4(XmUpdateDisplay+0x49)[0x7f61821c1d89]
/usr/dt/lib/libDtHelp.so.2(+0x2cf1d)[0x7f6182ae8f1d]
/usr/dt/lib/libDtHelp.so.2(+0x2d66d)[0x7f6182ae966d]
/usr/dt/lib/libDtHelp.so.2(_DtHelpGlobSrchDisplayDialog+0x2205)[0x7f6182aebca5]
/usr/dt/lib/libDtHelp.so.2(_DtHelpDisplayIndexCB+0x26)[0x7f6182af07e6]
/usr/lib/x86_64-linux-gnu/libXm.so.4(+0xde9d5)[0x7f618216e9d5]
/usr/lib/x86_64-linux-gnu/libXm.so.4(+0xdf0c5)[0x7f618216f0c5]
/usr/lib/x86_64-linux-gnu/libXm.so.4(_XmDispatchGadgetInput+0x113)[0x7f6182140683]
/usr/lib/x86_64-linux-gnu/libXm.so.4(_XmGadgetActivate+0x22)[0x7f61821ef0b2]
/usr/lib/x86_64-linux-gnu/libXt.so.6(+0x48965)[0x7f6181e6f965]
/usr/lib/x86_64-linux-gnu/libXt.so.6(_XtTranslateEvent+0x31a)[0x7f6181e7090a]
/usr/lib/x86_64-linux-gnu/libXt.so.6(XtDispatchEventToWidget+0x4cb)[0x7f6181e4921b]
/usr/lib/x86_64-linux-gnu/libXt.so.6(+0x228dd)[0x7f6181e498dd]
/usr/lib/x86_64-linux-gnu/libXt.so.6(XtDispatchEvent+0xc9)[0x7f6181e499b9]
/usr/lib/x86_64-linux-gnu/libXt.so.6(XtAppProcessEvent+0x1d7)[0x7f6181e555d7]
/usr/lib/x86_64-linux-gnu/libXt.so.6(XtAppMainLoop+0x2d)[0x7f6181e49d9d]
/usr/dt/bin/dthelpview[0x401b77]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7f618143a830]
/usr/dt/bin/dthelpview[0x401c89]
Docs (help and the dtinfo guides) are now always built using the
ISO8859-1 locale. To support UTF-8, our docbook needs to be updated
to something from this century, ideally this decade. In addition, a
conversion to XML would also be required as a result. So, until that
happens, use ISO8859-1 for docs.
However, other locale information, like message catalogs, resource
files, and the like are now converted to UTF-8.
All supported languages are now built by default on linux again.
This patch fixes some wierd word splicing that occured with the importing of
the sources, which caused the last letter of many bugs to be cut off, with
some of them cutting off more, I made my best judgement on what was supposed
to be there.
This patch also gets rid of old bugs and software that CDE no longer includes.
In this commit, we convert FreeBSD and OpenBSD to use a system version
of TCL (8.6).
We also get rid of the hairy and buggy "CompareI18NStrings" custom Tcl
function and use the newer Tcl's builtin dictionary sort mechanism for
generating the Indexes and Glossaries, which were silently broken in
previous commits.
It was just not possible to use the same Tcl code in modern versions
of Tcl in addition to the ancient version included with CDE - so, now
we will always depend on the system version. It's been tested with
8.6 and 8.7 versions of Tcl with great results.
dtdocbook/instant has been modified to use a more modern Tcl (8.6),
which means certain functions are not present when we are using the
dtdocbook/tcl (7.5) version of tcl instead of a modern system version.
So, create some defines that should work around this problem.
One issue that came up was attempting to read array values indexed by
a key that didn't exist when generating indexes and glossaries.
I am not sure why this hasn't been a problem before, but for now, we
simply won't try to emit array values for non-existant array indexes.
Remove calls to bogus utility functions in cases where the user is
root and the filesystem in question is an NFS filesystem.
For now, __linux___ and CSRG_BASED machines will use statfs to
determine whether to test delete-ability. For other systems, just do
the create/delete test always if the user is root.
dtfile makes use of ustat(2) on certain systems. This call has been
deprecated in glibc for a while and now, as of glibc-2.28, it has been
removed. The recommended replacement is to use statfs(2).
Jon Trulson