Package: release.debian.org Severity: normal User: release.debian.org@packages.debian.org Usertags: unblock Please unblock package kakoune to fix a grave bug that makes it unusable if it is started via "su" before being started from a normal user account. [ Reason ] See #990635 for more information: if, after the system has been restarted, kakoune is invoked via "su" before it has been invoked from the session user's account, it will create its runtime /run/user/<uid>/kakoune directory owned by root. This will prevent later instances of kakoune, started with normal user rights, from running at all. [ Impact ] If the user runs `su -c 'kak ...'` before running `kak ...`, they will be unable to run `kak ...` until they remove the runtime directory or the system is restarted. [ Tests ] None. [ Risks ] Leaf package, not widely used. The upstream fix is pretty straightforward - check user IDs, verify directory ownership, use a different directory if necessary. Hopefully very low risk. [ Checklist ] [x] all changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in testing unblock kakoune/2020.01.16-3
diff -Nru kakoune-2020.01.16/debian/changelog kakoune-2020.01.16/debian/changelog
--- kakoune-2020.01.16/debian/changelog 2020-07-26 01:56:44.000000000 +0300
+++ kakoune-2020.01.16/debian/changelog 2021-07-05 22:15:28.000000000 +0300
@@ -1,3 +1,12 @@
+kakoune (2020.01.16-3) unstable; urgency=medium
+
+ * Add the 13-upstream-check-dir-owner and 14-upstream-rework-dir-logic
+ patches from the upstream Git repository to stop kakoune started as
+ root from making its runtime directory inaccessible to the normal
+ user account of the session user. Closes: #990635
+
+ -- Peter Pentchev <roam@debian.org> Mon, 05 Jul 2021 22:15:28 +0300
+
kakoune (2020.01.16-2) unstable; urgency=medium
* Add some files to debian/clean to allow kakoune to be built twice in
diff -Nru kakoune-2020.01.16/debian/patches/13-upstream-check-dir-owner.patch kakoune-2020.01.16/debian/patches/13-upstream-check-dir-owner.patch
--- kakoune-2020.01.16/debian/patches/13-upstream-check-dir-owner.patch 1970-01-01 02:00:00.000000000 +0200
+++ kakoune-2020.01.16/debian/patches/13-upstream-check-dir-owner.patch 2021-07-05 22:05:35.000000000 +0300
@@ -0,0 +1,22 @@
+Description: Check XDG_RUNTIME_DIR owner before creating session directory
+ This avoids an issue when using `su` and running Kakoune which creates
+ a session directory owned by root and prevents the user from creating
+ more sessions.
+Origin: upstream; https://github.com/mawww/kakoune/commit/7751c7e188bfc7b2f7e4a70e33032677d84597e5
+Author: Maxime Coste <mawww@kakoune.org>
+Bug-Debian: https://bugs.debian.org/990635
+Last-Update: 2021-07-05
+
+--- a/src/remote.cc
++++ b/src/remote.cc
+@@ -554,6 +554,10 @@
+ // set sticky bit on the shared kakoune directory
+ make_directory(format("{}/kakoune", tmpdir()), 01777);
+ }
++ else if (struct stat st;
++ stat(xdg_runtime_dir.zstr(), &st) == 0 && st.st_uid != geteuid())
++ throw runtime_error("XDG_RUNTIME_DIR is not owned by current user");
++
+ make_directory(session_directory(), 0711);
+ }
+
diff -Nru kakoune-2020.01.16/debian/patches/14-upstream-rework-dir-logic.patch kakoune-2020.01.16/debian/patches/14-upstream-rework-dir-logic.patch
--- kakoune-2020.01.16/debian/patches/14-upstream-rework-dir-logic.patch 1970-01-01 02:00:00.000000000 +0200
+++ kakoune-2020.01.16/debian/patches/14-upstream-rework-dir-logic.patch 2021-07-05 22:15:28.000000000 +0300
@@ -0,0 +1,77 @@
+Description: Rework session directory logic
+ Do not use a shared kakoune/ directory for all users to avoid the
+ complexity of having to set the sticky bit on that dir, resolve the
+ session directory only once by using a static variable and an
+ immediately evaluated lambda.
+ .
+ This fixes an annoyance whenever using `su` and having Kakoune refuse
+ to start due to XDG_RUNTIME_DIR still being set.
+Origin: upstream; https://github.com/mawww/kakoune/commit/db9ef82398a08bdf985ff26bfb230fb0cd1221a5
+Author: Maxime Coste <mawww@kakoune.org>
+Bug-Debian: https://bugs.debian.org/990635
+Last-Update: 2021-07-05
+
+--- a/src/remote.cc
++++ b/src/remote.cc
+@@ -537,28 +537,20 @@
+ return getenv("USER");
+ }
+
+-String session_directory()
++const String& session_directory()
+ {
+- StringView xdg_runtime_dir = getenv("XDG_RUNTIME_DIR");
+- if (xdg_runtime_dir.empty())
+- return format("{}/kakoune/{}", tmpdir(), get_user_name());
+- else
+- return format("{}/kakoune", xdg_runtime_dir);
+-}
+-
+-void make_session_directory()
+-{
+- StringView xdg_runtime_dir = getenv("XDG_RUNTIME_DIR");
+- if (xdg_runtime_dir.empty())
+- {
+- // set sticky bit on the shared kakoune directory
+- make_directory(format("{}/kakoune", tmpdir()), 01777);
+- }
+- else if (struct stat st;
+- stat(xdg_runtime_dir.zstr(), &st) == 0 && st.st_uid != geteuid())
+- throw runtime_error("XDG_RUNTIME_DIR is not owned by current user");
+-
+- make_directory(session_directory(), 0711);
++ static String session_dir = [] {
++ StringView xdg_runtime_dir = getenv("XDG_RUNTIME_DIR");
++ if (not xdg_runtime_dir.empty())
++ {
++ if (struct stat st; stat(xdg_runtime_dir.zstr(), &st) == 0 && st.st_uid == geteuid())
++ return format("{}/kakoune", xdg_runtime_dir);
++ else
++ write_to_debug_buffer("XDG_RUNTIME_DIR does not exist or not owned by current user, using tmpdir");
++ }
++ return format("{}/kakoune-{}", tmpdir(), get_user_name());
++ }();
++ return session_dir;
+ }
+
+ String session_path(StringView session)
+@@ -808,7 +800,7 @@
+ fcntl(listen_sock, F_SETFD, FD_CLOEXEC);
+ sockaddr_un addr = session_addr(m_session);
+
+- make_session_directory();
++ make_directory(session_directory(), 0711);
+
+ // Do not give any access to the socket to other users by default
+ auto old_mask = umask(0077);
+--- a/src/remote.hh
++++ b/src/remote.hh
+@@ -45,7 +45,7 @@
+
+ void send_command(StringView session, StringView command);
+ String get_user_name();
+-String session_directory();
++const String& session_directory();
+ String session_path(StringView session);
+
+ struct Server : public Singleton<Server>
diff -Nru kakoune-2020.01.16/debian/patches/series kakoune-2020.01.16/debian/patches/series
--- kakoune-2020.01.16/debian/patches/series 2020-07-26 00:53:08.000000000 +0300
+++ kakoune-2020.01.16/debian/patches/series 2021-07-05 20:54:47.000000000 +0300
@@ -8,3 +8,5 @@
10-upstream-empty-strings.patch
11-upstream-deleted-line.patch
12-upstream-empty-register.patch
+13-upstream-check-dir-owner.patch
+14-upstream-rework-dir-logic.patch
Attachment:
signature.asc
Description: PGP signature