[bug#53549] [PATCH] gnu: polkit: Fix CVE-2021-4034.

[Liliana Marie Prikler]

Hi Ludo,

Am Mittwoch, dem 26.01.2022 um 12:56 +0100 schrieb Ludovic Courtès:
> * gnu/packages/patches/polkit-CVE-2021-4034.patch: New file.
> * gnu/local.mk (dist_patch_DATA): Add it.
> * gnu/packages/polkit.scm (polkit-mozjs)[replacement]: New field.
> * gnu/packages/polkit.scm (polkit-mozjs/fixed): New variable.
> ---
>  gnu/local.mk                                  |  1 +
>  .../patches/polkit-CVE-2021-4034.patch        | 82
> +++++++++++++++++++
>  gnu/packages/polkit.scm                       | 13 ++-
>  3 files changed, 95 insertions(+), 1 deletion(-)
>  create mode 100644 gnu/packages/patches/polkit-CVE-2021-4034.patch
> 
> Hi!
> 
> We could avoid grafting and instead use 'polkit/fixed' in 'setuid-
> programs', but it seems safer and less error-prone to graft.
> 
> Thoughts?
Given that there is also a duktape variant, a graft is necessary, no? 
On a related note, polit-duktape inherits polkit-mozjs in a way that
does not require adding a separate graft for it, right?  Assuming both
of the above hold, LGTM.

Cheers