pinentry: make use of proc_lock_memory

Andreas Wacknitz

2024-01-12 2647a59afe105fd731a4e06e88d6423f52a42181

pinentry: make use of proc_lock_memory

 components/sysutils/pinentry/Makefile

@@ -29,6 +29,7 @@

COMPONENT_NAME=        pinentry
COMPONENT_VERSION=    1.2.1
COMPONENT_REVISION=    1
COMPONENT_SUMMARY=    A small utility for entering passwords.
COMPONENT_DESCRIPTION=    A small collection of dialog programs that allow GnuPG to read passphrases and PIN numbers in a secure manner.
COMPONENT_SRC=        $(COMPONENT_NAME)-$(COMPONENT_VERSION)
@@ -36,14 +37,15 @@
COMPONENT_ARCHIVE=    $(COMPONENT_SRC).tar.bz2
COMPONENT_ARCHIVE_HASH=    sha256:457a185e5a85238fb945a955dc6352ab962dc8b48720b62fc9fa48c7540a4067
COMPONENT_ARCHIVE_URL=    https://www.gnupg.org/ftp/gcrypt/pinentry/$(COMPONENT_ARCHIVE)
COMPONENT_CLASSIFICATION=    Applications/System Utilities
COMPONENT_FMRI=        security/pinentry
COMPONENT_CLASSIFICATION=    Applications/System Utilities
COMPONENT_LICENSE=    GPLv2
COMPONENT_LICENSE_FILE=    COPYING

TEST_TARGET=    $(NO_TESTS)
TEST_TARGET= $(NO_TESTS)
include $(WS_MAKE_RULES)/common.mk

PATH=$(PATH.gnu)
PATH= $(PATH.gnu)

CFLAGS += $(CPP_LARGEFILES)
CFLAGS += $(XPG6MODE)
@@ -55,8 +57,8 @@
LDFLAGS += -lsocket -lnsl -lpkcs11
LIBS = -lsocket -lnsl -lpkcs11

CONFIGURE_ENV +=    INSTALL="$(INSTALL)"
CONFIGURE_ENV +=    LIBS="$(LIBS)"
CONFIGURE_ENV += INSTALL="$(INSTALL)"
CONFIGURE_ENV += LIBS="$(LIBS)"
# Following line is required if FLTK pinentry is to be shipped
# CONFIGURE_ENV +=    FLTK_CONFIG="$(USRBINDIR.$(BITS))/fltk-config"


 components/sysutils/pinentry/files/exec_attr.pinentry

New file
@@ -0,0 +1,2 @@
Secure Memory:solaris:cmd:RO::/usr/lib/pinentry-gtk-2:privs=proc_lock_memory
Secure Memory:solaris:cmd:RO::/usr/lib/pinentry-curses:privs=proc_lock_memory

 components/sysutils/pinentry/manifests/sample-manifest.p5m

@@ -10,7 +10,7 @@
#

#
# Copyright 2022 <contributor>
# Copyright 2024 <contributor>
#

set name=pkg.fmri value=pkg:/$(COMPONENT_FMRI)@$(IPS_COMPONENT_VERSION),$(BUILD_VERSION)

 components/sysutils/pinentry/pinentry.license

File was deleted

 components/sysutils/pinentry/pinentry.p5m

@@ -11,7 +11,7 @@
# Copyright (c) 2013, Colin Ellis. All rights reserved.
# Copyright (c) 2011, 2013, Oracle and/or its affiliates. All rights reserved.
# Copyright (c) 2018, Michal Nowak
# Copyright (c) 2021, Andreas Wacknitz
# Copyright (c) 2021, 2024, Andreas Wacknitz
#

set name=pkg.fmri value=pkg:/$(COMPONENT_FMRI)@$(IPS_COMPONENT_VERSION),$(BUILD_VERSION)
@@ -25,8 +25,16 @@

license $(COMPONENT_LICENSE_FILE) license='$(COMPONENT_LICENSE)'

file files/exec_attr.pinentry path=etc/security/exec_attr.d/pinentry

link path=usr/bin/pinentry target=../lib/pinentry
link path=usr/lib/pinentry target=pinentry-gtk-2
file path=usr/lib/pinentry-curses mode=0555
file path=usr/lib/pinentry-gtk-2 mode=0555
# pinentry needs the proc_lock_memory privilege in order to be able to lock a
# memory segment. If it can't do that, it utters
#    pinentry: Warning: using insecure memory!
# Using the illumos forced privileges feature, we afford it the additional
# privilege by making it setuid (really needed here) root and installing an
# exec_attr entry to add just the necessary privilege. See files/exec_attr.
file path=usr/lib/pinentry-curses owner=root mode=04555
file path=usr/lib/pinentry-gtk-2 owner=root mode=04555
file path=usr/share/info/pinentry.info

 components/sysutils/pinentry/pkg5

@@ -1,17 +1,15 @@
{
    "dependencies": [
        "SUNWcs",
        "library/desktop/gtk2",
        "library/glib2",
        "library/libsecret",
        "library/ncurses",
        "library/security/libassuan",
        "library/security/libgpg-error",
        "shell/ksh93",
        "system/library"
    ],
    "fmris": [
        "security/pinentry"
    ],
    "name": "pinentry"
}
}