From 0a363374355c5489b0809c3cce8c5e5a9728a616 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Dan=20Hor=C3=A1k?= <dhorak@redhat.com>
Date: Tue, 7 Feb 2023 09:15:32 +0100
Subject: [PATCH] - fix permissions for shared memory segments (#2167364)

- Resolves: #2167364
---
 libica-4.1.1-shmem.patch | 35 +++++++++++++++++++++++++++++++++++
 libica.spec              |  9 ++++++++-
 2 files changed, 43 insertions(+), 1 deletion(-)
 create mode 100644 libica-4.1.1-shmem.patch

diff --git a/libica-4.1.1-shmem.patch b/libica-4.1.1-shmem.patch
new file mode 100644
index 0000000..0343471
--- /dev/null
+++ b/libica-4.1.1-shmem.patch
@@ -0,0 +1,35 @@
+From cd5b2b75554875111bf375b555ebd3b185cff1a0 Mon Sep 17 00:00:00 2001
+From: Joerg Schmidbauer <jschmidb@de.ibm.com>
+Date: Wed, 1 Feb 2023 10:54:33 +0100
+Subject: [libica PATCH] bugfix: permission denied on shared memory segments
+
+A change to the Linux kernel in 4.19 for added security is
+changing the behavior when opening shared memory segments.
+The O_CREAT flag must not be used for existing segments.
+
+Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
+---
+ src/icastats_shared.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/src/icastats_shared.c b/src/icastats_shared.c
+index bbc8d0e..8290239 100644
+--- a/src/icastats_shared.c
++++ b/src/icastats_shared.c
+@@ -54,9 +54,10 @@ int stats_mmap(int user)
+ 	sprintf(shm_id, "icastats_%d",
+ 		user == -1 ? geteuid() : (uid_t)user);
+ 
+-	stats_shm_handle = shm_open(shm_id,
+-				    O_CREAT | O_RDWR,
+-				    S_IRUSR | S_IWUSR);
++	stats_shm_handle = shm_open(shm_id, O_RDWR,  S_IRUSR | S_IWUSR);
++
++	if (stats_shm_handle == -1)
++		stats_shm_handle = shm_open(shm_id, O_CREAT | O_RDWR, S_IRUSR | S_IWUSR);
+ 
+ 	if (stats_shm_handle == -1)
+ 		return rc;
+-- 
+2.39.1
+
diff --git a/libica.spec b/libica.spec
index 6ea7dd8..5aed378 100644
--- a/libica.spec
+++ b/libica.spec
@@ -3,7 +3,7 @@
 Summary: Library for accessing ICA hardware crypto on IBM z Systems
 Name: libica
 Version: 4.1.1
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: CPL
 URL: https://github.com/opencryptoki/
 Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
@@ -11,6 +11,9 @@ Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{v
 # https://bugzilla.redhat.com/show_bug.cgi?id=1630582
 # https://github.com/opencryptoki/libica/pull/24
 Patch0: %{name}-4.0.0-annotate.patch
+# fix permissions for shared memory segments
+# https://bugzilla.redhat.com/show_bug.cgi?id=2167364
+Patch1: %{name}-4.1.1-shmem.patch
 BuildRequires: gcc
 BuildRequires: openssl-devel
 BuildRequires: openssl
@@ -107,6 +110,10 @@ fi
 
 
 %changelog
+* Tue Feb 07 2023 Dan Horák <dhorak@redhat.com> - 4.1.1-2
+- fix permissions for shared memory segments (#2167364)
+- Resolves: #2167364
+
 * Mon Oct 24 2022 Dan Horák <dhorak@redhat.com> - 4.1.1-1
 - updated to 4.1.1 (#2110374)
 - Resolves: #2110374