rpms/firewalld
7
0
Fork 0
Code Issues Pull Requests Releases Activity

fix(policy): use PK_ACTION_CONFIG for set{ZoneSettings2,PolicySettings}

Browse Source 
Resolves: RHEL-235485
This commit is contained in:
Eric Garver 2026-08-20 11:46:05 -04:00
parent f8c396d090
commit 5c6365f5bd
2 changed files with 42 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
0038-v2.5.0-fix-policy-use-PK_ACTION_CONFIG-for-set-ZoneS.patch Normal file
View File

@ -0,0 +1,37 @@
From c8203ab631007126f6f50f2c424db48c662b0711 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Tue, 31 Mar 2026 20:46:50 +0800
Subject: [PATCH] v2.5.0: fix(policy): use PK_ACTION_CONFIG for
set{ZoneSettings2,PolicySettings}
Reference: https://access.redhat.com/security/cve/cve-2026-4948
(cherry picked from commit 5fb3914ad830feff6cb2b0670457c60a323c6c6c)
---
src/firewall/server/firewalld.py | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/firewall/server/firewalld.py b/src/firewall/server/firewalld.py
index f74e6e6ae6ff..da7fc1ca6965 100644
--- a/src/firewall/server/firewalld.py
+++ b/src/firewall/server/firewalld.py
@@ -925,7 +925,7 @@ class FirewallD(slip.dbus.service.Object):
log.debug1("getZoneSettings2(%s)", zone)
return self.fw.zone.get_config_with_settings_dict(zone)
- @slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
+ @slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sa{sv}')
@dbus_handle_exceptions
def setZoneSettings2(self, zone, settings, sender=None):
@@ -949,7 +949,7 @@ class FirewallD(slip.dbus.service.Object):
log.debug1("policy.getPolicySettings(%s)", policy)
return self.fw.policy.get_config_with_settings_dict(policy)
- @slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
+ @slip.dbus.polkit.require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_POLICY, in_signature='sa{sv}')
@dbus_handle_exceptions
def setPolicySettings(self, policy, settings, sender=None):
--
2.53.0

6
firewalld.spec
View File

@ -1,7 +1,7 @@
Summary: A firewall daemon with D-Bus interface providing a dynamic firewall
Name: firewalld
Version: 0.9.11
Release: 12%{?dist}
Release: 13%{?dist}
URL: http://www.firewalld.org
License: GPLv2+
Source0: https://github.com/firewalld/firewalld/releases/download/v%{version}/firewalld-%{version}.tar.gz
@ -42,6 +42,7 @@ Patch34: 0034-v2.4.0-chore-nftables-simplify-icmp-match-fragments.patch
Patch35: 0035-v2.4.0-chore-nftables-move-_icmp_types_fragments-ins.patch
Patch36: 0036-v2.4.0-chore-ipXtables-simplify-icmp-match-fragments.patch
Patch37: 0037-v2.4.0-fix-policy-allow-host-ipv6-allow-MLD-packets.patch
Patch38: 0038-v2.5.0-fix-policy-use-PK_ACTION_CONFIG-for-set-ZoneS.patch
BuildArch: noarch
BuildRequires: autoconf
@ -243,6 +244,9 @@ desktop-file-install --delete-original \
%{_mandir}/man1/firewall-config*.1*
%changelog
* Thu Aug 20 2026 Eric Garver <egarver@redhat.com> - 0.9.11-13
- fix(policy): use PK_ACTION_CONFIG for set{ZoneSettings2,PolicySettings}
* Tue Jul 28 2026 Eric Garver <egarver@redhat.com> - 0.9.11-12
- bump NVR