Add patch 1205-Properly-check-authorization-on-incoming-guestOps-re.patch

to fix CVE-2022-31676 in open-vm-tools 12.0.5 tracked in PR 120976.
Correct build requirements - replace systemd-rpm-macros with systemd_udev.

1205-Properly-check-authorization-on-incoming-guestOps-re.patch

@@ -0,0 +1,36 @@
+From be635a7eaf7bd19177b7002aa2c793c78be77ecc Mon Sep 17 00:00:00 2001
+From: John Wolfe <jwolfe@vmware.com>
+Date: Wed, 10 Aug 2022 07:20:28 -0700
+Subject: [PATCH] Properly check authorization on incoming guestOps requests
+
+Fix public pipe request checks.  Only a SessionRequest type should
+be accepted on the public pipe.
+---
+ open-vm-tools/vgauth/serviceImpl/proto.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/open-vm-tools/vgauth/serviceImpl/proto.c b/open-vm-tools/vgauth/serviceImpl/proto.c
+index db7159e..c4f85b0 100644
+--- a/vgauth/serviceImpl/proto.c
++++ b/vgauth/serviceImpl/proto.c
+@@ -1,5 +1,5 @@
+ /*********************************************************
+- * Copyright (C) 2011-2016,2019-2021 VMware, Inc. All rights reserved.
++ * Copyright (c) 2011-2016,2019-2022 VMware, Inc. All rights reserved.
+  *
+  * This program is free software; you can redistribute it and/or modify it
+  * under the terms of the GNU Lesser General Public License as published
+@@ -1201,6 +1201,10 @@ Proto_SecurityCheckRequest(ServiceConnection *conn,
+    VGAuthError err;
+    gboolean isSecure = ServiceNetworkIsConnectionPrivateSuperUser(conn);
+ 
++   if (conn->isPublic && req->reqType != PROTO_REQUEST_SESSION_REQ) {
++      return VGAUTH_E_PERMISSION_DENIED;
++   }
++
+    switch (req->reqType) {
+       /*
+        * This comes over the public connection; alwsys let it through.
+-- 
+2.6.2
+

open-vm-tools.spec

@@ -32,7 +32,7 @@
 
 Name:             open-vm-tools
 Version:          %{toolsversion}
-Release:          2%{?dist}
+Release:          3%{?dist}
 Summary:          Open Virtual Machine Tools for virtual machines hosted on VMware
 License:          GPLv2
 URL:              https://github.com/vmware/%{name}
@@ -52,7 +52,7 @@ ExclusiveArch:    %{ix86} x86_64 aarch64
 %endif
 
 # Patches
-#Patch1:           <patch-name1>.patch
+Patch1:           1205-Properly-check-authorization-on-incoming-guestOps-re.patch
 
 BuildRequires:    autoconf
 BuildRequires:    automake
@@ -93,7 +93,7 @@ BuildRequires:    gtk3-devel >= 3.10.0
 BuildRequires:    gtkmm30-devel >= 3.10.0
 BuildRequires:    libtirpc-devel
 BuildRequires:    rpcgen
-BuildRequires:    systemd-rpm-macros
+BuildRequires:    systemd-udev
 %else
 BuildRequires:    gtk2-devel >= 2.4.0
 BuildRequires:    gtkmm24-devel
@@ -420,6 +420,11 @@ fi
 %{_bindir}/vmware-vgauth-smoketest
 
 %changelog
+* Sun Sept 4 2022 John Wolfe <jwolfe@vmware.com> - 12.0.5-3
+- Add patch 1205-Properly-check-authorization-on-incoming-guestOps-re.patch
+  to fix CVE-2022-31676 in open-vm-tools 12.0.5 tracked in PR 120976.
+- Correct build requirements - replace systemd-rpm-macros with systemd_udev.
+
 * Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 12.0.5-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild