[PATCH] gnu: xorg-server: Update to 21.1.2.

Done

Details

3 participants

Josselin Poiret
Kaelyn Takata
Leo Famulari

Owner: unassigned

Submitted by: Kaelyn Takata

Severity: normal

Kaelyn Takata wrote on 17 Dec 2021 00:29

Recipients:(address . guix-patches@gnu.org)(name . Kaelyn Takata)(address . kaelyn.alexi@protonmail.com)

Message-ID:20211216232942.31686-1-kaelyn.alexi@protonmail.com

* gnu/packages/xorg.scm (xorg-server): Update to 21.1.2.

---

gnu/packages/xorg.scm | 4 ++--

1 file changed, 2 insertions(+), 2 deletions(-)

Toggle diff (26 lines)diff --git a/gnu/packages/xorg.scm b/gnu/packages/xorg.scm
index 85a93dee30..204fd857c0 100644
--- a/gnu/packages/xorg.scm
+++ b/gnu/packages/xorg.scm
@@ -5234,7 +5234,7 @@ (define-public libxcvt
 (define-public xorg-server
   (package
     (name "xorg-server")
-    (version "21.1.1")
+    (version "21.1.2")
     (source
      (origin
        (method url-fetch)
@@ -5243,7 +5243,7 @@ (define-public xorg-server
                            "/xserver/xorg-server-" version ".tar.xz"))
        (sha256
         (base32
-         "0md7dqsc5qb30gym06c4zc2cjsdc5ps8nywk1bkcpix05kppybkq"))
+         "1c4dgvpv3kib8rhw37b00vc056nlb1z66c2lwzs4prz8kxmg82y2"))
        (patches
         (list
          ;; See:

base-commit: b329c2139b9f0818f27107bec5226cb98cfe1446
-- 
2.34.0

Kaelyn wrote on 18 Dec 2021 16:23

Recipients:(name . 52562@debbugs.gnu.org)(address . 52562@debbugs.gnu.org)

Message-ID:1TLx-BB6bhdDHzb94K1wEwUZ3u_Jx7vsum6ZYXR2sX1QGz_VbPV8zwa3iY0RVtW334pSUabJUEbcPbOCUi6CMKzzquTQJ5oybQxyHeD5GZ0=@protonmail.com

Hi,

I would like to propose this update for the 1.4.0 branch as well, as xorg-server 21.1.2 fixes four recently reported security vulnerabilities that can lead to priviledge escalation: https://lists.x.org/archives/xorg/2021-December/060842.html

Cheers,

Kaelyn

Leo Famulari wrote on 18 Dec 2021 21:40

Recipients:(name . Kaelyn Takata via Guix-patches via)(address . guix-patches@gnu.org)

Message-ID:Yb5HIcyvDP0bvbfb@jasmine.lan

On Thu, Dec 16, 2021 at 11:29:50PM +0000, Kaelyn Takata via Guix-patches via wrote:

Toggle quote (2 lines)

> * gnu/packages/xorg.scm (xorg-server): Update to 21.1.2.

Thanks! I am reviewing this patch now. It's not quite as simple as it

seems because we must take care to avoid changing xorg-server-for-tests,

or almost every package will have to be rebuilt.

See section 8 here for more information about how many package rebuilds are okay

for the master branch:

https://guix.gnu.org/manual/en/html_node/Submitting-Patches.html#Submitting-Patches

Kaelyn wrote on 19 Dec 2021 02:49

Recipients:(name . Leo Famulari)(address . leo@famulari.name)

Message-ID:X2K7fDPef43waXVWdE4c5FYoFwOdlU-yqTmE_odSCpsI797b3Ac5AkuS6n6yk97nWYlw2VFxgiUWmZfRDMLhlQucqSH1wiUCtsWgJ-X7zuU=@protonmail.com

??????? Original Message ???????

On Saturday, December 18th, 2021 at 12:40 PM, Leo Famulari <leo@famulari.name> wrote:

Toggle quote (16 lines)> On Thu, Dec 16, 2021 at 11:29:50PM +0000, Kaelyn Takata via Guix-patches via wrote:
>
> > -   gnu/packages/xorg.scm (xorg-server): Update to 21.1.2.
>
> Thanks! I am reviewing this patch now. It's not quite as simple as it
>
> seems because we must take care to avoid changing xorg-server-for-tests,
>
> or almost every package will have to be rebuilt.
>
> See section 8 here for more information about how many package rebuilds are okay
>
> for the master branch:
>
> https://guix.gnu.org/manual/en/html_node/Submitting-Patches.html#Submitting-Patches

No worries, and take your time! I just wanted to ping the patch so that the security fixes could land before the 1.4 release. :)

When I first sent it, on my machine "guix refresh --list-dependent xorg-serv" said it was 80-something packages that would be rebuilt (just checked again after typing that, and it says 82 packages would be built to ensure 137 dependet packages are rebuilt).

Thanks,

Kaelyn

Leo Famulari wrote on 19 Dec 2021 05:56

Recipients:(name . Kaelyn)(address . kaelyn.alexi@protonmail.com)

Message-ID:Yb67lQnYTJGwpz7i@jasmine.lan

On Sun, Dec 19, 2021 at 01:49:08AM +0000, Kaelyn wrote:

Toggle quote (2 lines)

> No worries, and take your time! I just wanted to ping the patch so that the security fixes could land before the 1.4 release. :)

Sure, I intend to land the patch in the next day or so.

Toggle quote (2 lines)

> When I first sent it, on my machine "guix refresh --list-dependent xorg-serv" said it was 80-something packages that would be rebuilt (just checked again after typing that, and it says 82 packages would be built to ensure 137 dependet packages are rebuilt).

Right, that's correct. But there is a also a package
'xorg-server-for-tests', which is used basically for package test
suites. The idea is that it's never used "for real" and so security
issues matter less. And we update that package less often.

You can check on that package like this:

                                Scheme syntax for working with "hidden" packages
-----                           ?
$ guix refresh -l --expression='(@@ (gnu packages xorg) xorg-server-for-tests)'
Building the following 1419 packages would ensure 3063 dependent packages are rebuilt:
[...]
------

Leo Famulari wrote on 19 Dec 2021 21:30

Recipients:(name . Kaelyn)(address . kaelyn.alexi@protonmail.com)

Message-ID:Yb+Wgyi8foI1xAIT@jasmine.lan

On Sat, Dec 18, 2021 at 11:56:53PM -0500, Leo Famulari wrote:

Toggle quote (2 lines)

> Sure, I intend to land the patch in the next day or so.

Alright, with the attached patch, X works in my tests, and

xorg-server-for-tests is unchanged.

It would be great to get some more testing from other X users.

I tested with QEMU, using our VM image template:

`guix environment guix -- ./pre-inst-env guix system vm-image --image-size=20G -t qcow2 gnu/system/examples/vm-image.tmpl`

I can't test on bare metal due to https://issues.guix.gnu.org/52051.

From 2b597e7887be70a0faaa04b9dabd69030dca6614 Mon Sep 17 00:00:00 2001
From: Leo Famulari <leo@famulari.name>
Date: Sat, 18 Dec 2021 15:30:41 -0500
Subject: [PATCH] gnu: xorg-server: Update to 21.1.2.

* gnu/packages/xorg.scm (xorg-server): Update to 21.1.2.
(xorg-server-for-tests): Use version 21.1.1.
---
 gnu/packages/xorg.scm | 30 ++++++++++++++++++++++++++----
 1 file changed, 26 insertions(+), 4 deletions(-)

Toggle diff (57 lines)diff --git a/gnu/packages/xorg.scm b/gnu/packages/xorg.scm
index 9a854bcbf8..b09d95f770 100644
--- a/gnu/packages/xorg.scm
+++ b/gnu/packages/xorg.scm
@@ -5235,16 +5235,15 @@ (define-public libxcvt
 (define-public xorg-server
   (package
     (name "xorg-server")
-    (version "21.1.1")
+    (version "21.1.2")
     (source
      (origin
        (method url-fetch)
-
        (uri (string-append "https://xorg.freedesktop.org/archive/individual"
                            "/xserver/xorg-server-" version ".tar.xz"))
        (sha256
         (base32
-         "0md7dqsc5qb30gym06c4zc2cjsdc5ps8nywk1bkcpix05kppybkq"))
+         "1c4dgvpv3kib8rhw37b00vc056nlb1z66c2lwzs4prz8kxmg82y2"))
        (patches
         (list
          ;; See:
@@ -5361,7 +5360,30 @@ (define-public xorg-server
 (define-public xorg-server-for-tests
   (hidden-package
    (package
-     (inherit xorg-server))))
+     (inherit xorg-server)
+     (version "21.1.1")
+     (source
+      (origin
+        (method url-fetch)
+        (uri (string-append "https://xorg.freedesktop.org/archive/individual"
+                            "/xserver/xorg-server-" version ".tar.xz"))
+        (sha256
+         (base32
+          "0md7dqsc5qb30gym06c4zc2cjsdc5ps8nywk1bkcpix05kppybkq"))
+        (patches
+         (list
+          ;; See:
+          ;;   https://lists.fedoraproject.org/archives/list/devel@lists.
+          ;;      fedoraproject.org/message/JU655YB7AM4OOEQ4MOMCRHJTYJ76VFOK/
+          (origin
+            (method url-fetch)
+            (uri (string-append
+                  "http://pkgs.fedoraproject.org/cgit/rpms/xorg-x11-server.git"
+                  "/plain/06_use-intel-only-on-pre-gen4.diff"))
+            (sha256
+             (base32
+              "0mm70y058r8s9y9jiv7q2myv0ycnaw3iqzm7d274410s0ik38w7q"))
+            (file-name "xorg-server-use-intel-only-on-pre-gen4.diff")))))))))
 
 (define-public eglexternalplatform
   (package
-- 
2.34.0

Leo Famulari wrote on 21 Dec 2021 18:36

Recipients:(name . Kaelyn)(address . kaelyn.alexi@protonmail.com)

Message-ID:YcIQp5rRrA0MBM04@jasmine.lan

On Sun, Dec 19, 2021 at 03:30:59PM -0500, Leo Famulari wrote:

Toggle quote (2 lines)

> It would be great to get some more testing from other X users.

In case anybody is wondering about the security issues, the commit

message has been amended like this in my tree:

------

gnu: xorg-server: Update to 21.1.2 [fixes CVE-2021-{4008,4009,4010,4011}].

* gnu/packages/xorg.scm (xorg-server): Update to 21.1.2.

(xorg-server-for-tests): Use version 21.1.1.

------

Leo Famulari wrote on 21 Dec 2021 18:47

Recipients:(name . Kaelyn)(address . kaelyn.alexi@protonmail.com)

Message-ID:YcITOmsz3q3Jsc5G@jasmine.lan

On Tue, Dec 21, 2021 at 12:36:39PM -0500, Leo Famulari wrote:

Toggle quote (6 lines)

> On Sun, Dec 19, 2021 at 03:30:59PM -0500, Leo Famulari wrote:

> > It would be great to get some more testing from other X users.

> In case anybody is wondering about the security issues, the commit

> message has been amended like this in my tree:

And, we may have a solution for the login timeout that has been

preventing testing for many of us. A patch for #52051 has been proposed:

https://issues.guix.gnu.org/issue/52051#29

Leo Famulari wrote on 21 Dec 2021 20:09

Recipients:(name . Kaelyn)(address . kaelyn.alexi@protonmail.com)

Message-ID:YcImT1VJWtHYvHUC@jasmine.lan

On Tue, Dec 21, 2021 at 12:47:38PM -0500, Leo Famulari wrote:

Toggle quote (12 lines)> On Tue, Dec 21, 2021 at 12:36:39PM -0500, Leo Famulari wrote:
> > On Sun, Dec 19, 2021 at 03:30:59PM -0500, Leo Famulari wrote:
> > > It would be great to get some more testing from other X users.
> > 
> > In case anybody is wondering about the security issues, the commit
> > message has been amended like this in my tree:
> 
> And, we may have a solution for the login timeout that has been
> preventing testing for many of us. A patch for #52051 has been proposed:
> 
> https://issues.guix.gnu.org/issue/52051#29

Alright, with the fix for #52051, I successfully used xorg-server 21.1.2

on my laptop.

Josselin Poiret wrote on 22 Dec 2021 14:56

Recipients:(address . 52562@debbugs.gnu.org)

Message-ID:875yrgg2v0.fsf@jpoiret.xyz

Hello,

Leo Famulari <leo@famulari.name> writes:

Toggle quote (10 lines)> In case anybody is wondering about the security issues, the commit
> message has been amended like this in my tree:
>
> ------
> gnu: xorg-server: Update to 21.1.2 [fixes CVE-2021-{4008,4009,4010,4011}].
>
> * gnu/packages/xorg.scm (xorg-server): Update to 21.1.2.
> (xorg-server-for-tests): Use version 21.1.1.
> ------

Just pitching in to say that those CVE numbers should be fully typed
instead of using shell expansion-style, so that one can run `git log
--grep=CVE-2021-4008`.  Note that these can be in the commit message
body.

-- 
Josselin Poiret

Leo Famulari wrote on 22 Dec 2021 18:19

Recipients:(name . Josselin Poiret)(address . dev@jpoiret.xyz)

Message-ID:YcNeKc8ARgKGZDoX@jasmine.lan

On Wed, Dec 22, 2021 at 02:56:19PM +0100, Josselin Poiret wrote:

Toggle quote (5 lines)

> Just pitching in to say that those CVE numbers should be fully typed

> instead of using shell expansion-style, so that one can run `git log

> --grep=CVE-2021-4008`. Note that these can be in the commit message

> body.

Okay. Can you help test the patch itself?

Leo Famulari wrote on 23 Dec 2021 00:38

Recipients:(name . Kaelyn)(address . kaelyn.alexi@protonmail.com)

Message-ID:YcO3DU/okbXS5fyI@jasmine.lan

On Tue, Dec 21, 2021 at 12:36:39PM -0500, Leo Famulari wrote:

Toggle quote (7 lines)

> ------

> gnu: xorg-server: Update to 21.1.2 [fixes CVE-2021-{4008,4009,4010,4011}].

> * gnu/packages/xorg.scm (xorg-server): Update to 21.1.2.

> (xorg-server-for-tests): Use version 21.1.1.

> ------

Pushed as 0751451ae3a77977916b67577837349219d482ec

Your comment

This issue is archived.

To comment on this conversation send an email to 52562@debbugs.gnu.org

To respond to this issue using the mumi CLI, first switch to it

mumi current 52562

Then, you may apply the latest patchset in this issue (with sign off)

mumi am -- -s

Or, compose a reply to this issue

mumi compose

Or, send patches to this issue

mumi send-email *.patch

is:open	open issues
is:done	closed issues
submitter:<who>	search issue submitter
author:<who>	search by message author
date:yesterday..now	search by issue date
mdate:3m..2d	search by message date