Update to gdm 3.0.4 to fix CVE-2011-1709

.gitignore

@@ -8,3 +8,4 @@ gdm-2.30.2.tar.bz2
 /gdm-2.91.93.tar.bz2
 /gdm-2.91.94.tar.bz2
 /gdm-3.0.0.tar.bz2
+/gdm-3.0.4.tar.bz2

fix-dconf-db-thing.patch

@@ -0,0 +1,76 @@
+From c820ecd211396c50b44d418b85c6510cad69b373 Mon Sep 17 00:00:00 2001
+From: Ray Strode <rstrode@redhat.com>
+Date: Wed, 1 Jun 2011 10:49:18 -0400
+Subject: [PATCH 1/2] Revert "dconf: set XDG_CACHE_HOME along with
+ XDG_CONFIG_HOME"
+
+This reverts commit 0b34e0e1414dd5f51329f31b199e21d9fc6824a7.
+
+It was wrong.  dconf uses both XDG_CACHE_HOME and
+XDG_CONFIG_HOME.
+
+They both need to exist and be distinct.
+---
+ data/make-dconf-override-db.sh |    1 -
+ 1 files changed, 0 insertions(+), 1 deletions(-)
+
+diff --git a/data/make-dconf-override-db.sh b/data/make-dconf-override-db.sh
+index acffbfa..8f4dc6d 100755
+--- a/data/make-dconf-override-db.sh
++++ b/data/make-dconf-override-db.sh
+@@ -3,7 +3,6 @@
+ set -e
+ 
+ export XDG_CONFIG_HOME=$(mktemp -d --tmpdir="$PWD")
+-export XDG_CACHE_HOME="$XDG_CONFIG_HOME"
+ eval `dbus-launch --sh-syntax`
+ 
+ trap 'rm -rf $XDG_CONFIG_HOME; kill $DBUS_SESSION_BUS_PID' ERR
+-- 
+1.7.5.1
+
+
+From d8d5455c617a22f79934f5351b8d8072e202e52a Mon Sep 17 00:00:00 2001
+From: Ray Strode <rstrode@redhat.com>
+Date: Wed, 1 Jun 2011 10:45:04 -0400
+Subject: [PATCH 2/2] dconf: set XDG_CACHE_HOME in addition to XDG_CONFIG_HOME
+
+If we don't set this, it will use the default which can
+cause weird behavior when building in a logged in session.
+(cherry picked from commit 7f6cc6b06d401cf466ed56ea8a0f849c619ab176)
+---
+ data/make-dconf-override-db.sh |   10 +++++++---
+ 1 files changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/data/make-dconf-override-db.sh b/data/make-dconf-override-db.sh
+index 8f4dc6d..ca04852 100755
+--- a/data/make-dconf-override-db.sh
++++ b/data/make-dconf-override-db.sh
+@@ -2,10 +2,14 @@
+ 
+ set -e
+ 
+-export XDG_CONFIG_HOME=$(mktemp -d --tmpdir="$PWD")
++export TMPDIR=$(mktemp -d --tmpdir="$PWD")
++export XDG_CONFIG_HOME="$TMPDIR/config"
++export XDG_CACHE_HOME="$TMPDIR/cache"
++mkdir -p $XDG_CONFIG_HOME $XDG_CACHE_HOME
++
+ eval `dbus-launch --sh-syntax`
+ 
+-trap 'rm -rf $XDG_CONFIG_HOME; kill $DBUS_SESSION_BUS_PID' ERR
++trap 'rm -rf $TMPDIR; kill $DBUS_SESSION_BUS_PID' ERR
+ 
+ gsettings set org.gnome.power-manager show-actions false
+ 
+@@ -51,6 +55,6 @@ gsettings set org.gnome.settings-daemon.plugins.xrandr active true
+ gsettings set org.gnome.settings-daemon.plugins.xsettings active true
+ 
+ mv $XDG_CONFIG_HOME/dconf/user dconf-override-db
+-rm -rf $XDG_CONFIG_HOME
++rm -rf $TMPDIR
+ 
+ kill $DBUS_SESSION_BUS_PID
+-- 
+1.7.5.1
+

gdm.spec

@@ -14,8 +14,8 @@
 
 Summary: The GNOME Display Manager
 Name: gdm
-Version: 3.0.0
-Release: 2%{?dist}
+Version: 3.0.4
+Release: 1%{?dist}
 Epoch: 1
 License: GPLv2+
 Group: User Interface/X
@@ -98,6 +98,7 @@ Requires: audit-libs >= %{libauditver}
 Requires: system-icon-theme
 
 Patch2: plymouth.patch
+Patch3: fix-dconf-db-thing.patch
 
 Patch96: gdm-multistack.patch
 # Fedora-specific
@@ -128,6 +129,7 @@ The GDM fingerprint plugin provides functionality necessary to use a fingerprint
 %prep
 %setup -q
 %patch2 -p1 -b .plymouth
+%patch3 -p1 -b .fix-dconf-db-thing
 %patch96 -p1 -b .multistack
 %patch99 -p1 -b .fedora-logo
 
@@ -337,6 +339,8 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor >&/dev/ull || :
 %attr(1770, root, gdm) %dir %{_localstatedir}/gdm
 %attr(1777, root, gdm) %dir %{_localstatedir}/run/gdm
 %attr(1755, root, gdm) %dir %{_localstatedir}/cache/gdm
+%{_localstatedir}/lib/gdm/.local/share/applications/mime-dummy-handler.desktop
+%{_localstatedir}/lib/gdm/.local/share/applications/mimeapps.list
 %{_sysconfdir}/dconf/profile/gdm
 %{_sysconfdir}/dconf/db/gdm
 
@@ -356,6 +360,10 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor >&/dev/ull || :
 %{_libdir}/gdm/simple-greeter/plugins/fingerprint.so
 
 %changelog
+* Mon Jun 06 2011 Ray Strode <rstrode@redhat.com> 3.0.4-1
+- Update to latest version
+  Resolves CVE-2011-1709
+
 * Fri Apr 15 2011 Matthias Clasen <mclasen@redhat.com> - 3.0.0-2
 - Put the Fedora logo back in the greeter
 

sources

@@ -1 +1 @@
-186ee9a2413ee8eed42699b7119e5624  gdm-3.0.0.tar.bz2
+020ca5a250a8bb1856e73aee5728a112  gdm-3.0.4.tar.bz2