accountsservice (22.07.5-2ubuntu1.6) jammy-security; urgency=medium

  * SECURITY UPDATE: SetLanguage leads to local privilege escalation and
    root code execution (LP: #2157985)
    - d/p/0001-user-Fully-drop-privileges-when-running-locale-helpe.patch: user:
      Fully drop privileges when running locale helpers in src/user.c,
      src/util.c, src/util.h.
    - debian/patches/0002-langtools-Handle-input-as-untrusted.patch: langtools:
      Handle input as untrusted in data/langtools/save-to-pam-env,
      data/langtools/set-language-helper, data/langtools/update-langlist.
    - CVE-2026-61897
    - CVE-2026-61898

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 13 Jul 2026 12:48:53 -0400

accountsservice (22.07.5-2ubuntu1.5) jammy-security; urgency=medium

  * SECURITY UPDATE: possible encrypted password disclosure
    - debian/patches/CVE-2012-6655.patch: replace usermod -p with
      chpasswd -e in src/user.c, src/util.c, src/util.h.
    - CVE-2012-6655

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 08 Mar 2024 11:55:23 -0500

accountsservice (22.07.5-2ubuntu1.4) jammy-security; urgency=medium

  * SECURITY UPDATE: use-after-free in user.c (LP: #2024182)
    - debian/patches/0010-set-language.patch: updated to properly return
      from functions after throw_error() has been called.
    - CVE-2023-3297

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 20 Jun 2023 07:25:34 -0400

accountsservice (22.07.5-2ubuntu1.3) jammy-security; urgency=medium

  * SECURITY UPDATE: accountsservice incorrect privilege dropping
    (LP: #1974250)
    - debian/patches/0009-language-tools.patch: updated to not reset
      effective uid, and migrate root-owned .pam_environment file.
    - This change was originally known as CVE-2020-16126 and got reverted
      by mistake in 0.6.55-3ubuntu1.
    - CVE-2022-1804
  * Fix FTBFS with a newer python-dbusmock package:
    - debian/patches/adduser_invocation.patch: fix invocation of AddUser in
      tests/dbusmock/accounts_service.py.
    - debian/patches/setlocked_signature.patch: fix the signature for the
      SetLocked call in tests/dbusmock/accounts_service.py.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 19 May 2022 20:02:04 -0400

accountsservice (22.07.5-2ubuntu1) jammy; urgency=medium

  * Merge with Debian, remaining Ubuntu changes:
  * debian/control:
    - Add build-depends on dh-translations
  * debian/rules:
    - Build with translations to update POT file.
    - set -Dextra_admin_groups to add admin users to the same groups than
      user-setup is using for the initial account
    - We use custom.conf, not daemon.conf
  * debian/libaccountsservice0.symbols:
    - Add symbols added from patches.
  * debian/patches/0001-formats-locale-property.patch:
    - Addition of FormatsLocale property and SetFormatsLocale method.
  * debian/patches/0005-gdm_config_file_path.patch:
    - Disabled, as we are using custom.conf.
  * debian/patches/0010-set-language.patch:
    - Save user language and regional formats settings to ~/.pam_environment.
  * debian/patches/0011-add-background-file-support.patch:
    - Add support for a BackgroundFile property, similar to IconFile.
  * debian/patches/0012-add-keyboard-layout-support.patch:
    - Add XKeyboardLayouts property to report a user's keyboard layouts.
  * debian/patches/0013-add-has-message-support.patch:
    - Add XHasMessages property to report if a user had unread messages.
  * debian/patches/0016-add-input-sources-support.patch:
    - Store input sources in the user object.
  * debian/patches/0021-support-extrausers.patch:
    - In addition to watching /etc/{passwd,shadow,group}, also watch those
      same files in /var/lib/extrausers/, if they exist.
  * debian/patches/gitlab_change_types.patch:
    - fix changing account types failing on missing groups
  * debian/patches/gitlab_shared_tmp.patch:
    - don't use a private tmp since API clients sometime store files there

 -- Sebastien Bacher <seb128@ubuntu.com>  Tue, 22 Feb 2022 16:27:56 +0100

accountsservice (22.07.5-2) unstable; urgency=medium

  * d/p/0002-create-and-manage-groups-like-on-a-debian-system.patch:
    - change back to error out if adding the user to a group fails but
      don't try to use a non existant group instead
  * d/p/0009-language-tools.patch:
    - restore permission marker that got lost by doing a quilt refresh,
      without those the script lack +x permission

 -- Sebastien Bacher <seb128@ubuntu.com>  Tue, 22 Feb 2022 12:10:38 +0100

accountsservice (22.07.5-1) unstable; urgency=medium

  * New upstream version
  * Remove the patches which are included in the update
  * d/p/0002-create-and-manage-groups-like-on-a-debian-system.patch:
    - changed to warn when trying to add the user to non existant
      groups rather than erroring out since the list is static and some
      default groups are created by optional packages.
  * debian/accountsservice.install:
    - install the new user-templates
  * debian/control, debian/compat:
    - include the build-depends needed for the tests and the vapis
    - updated libglib and meson requirements
    - use current debhelper and standards versions
  * debian/libaccountsservice0.symbols:
    - updated for the new version, the consolekit option has been removed
      but those symbols were not part of the public API
  * debian/libaccountsservice-dev.install:
    - install the vapis
  * debian/rules:
    - don't try to install the NEWS file which isn't provided anymore
    - remove the non existant systemd option

 -- Sebastien Bacher <seb128@ubuntu.com>  Mon, 21 Feb 2022 20:50:26 +0100

accountsservice (0.6.55-3) unstable; urgency=medium

  * Team upload
  * d/rules: Enable libsystemd dependency, for logind integration.
    This appears to have got lost in the switch to the Meson build system,
    where both libsystemd and libelogind support for communicating with a
    logind implementation are disabled by default (they are mutually exclusive).
    In particular, this fixes the "Switch User..." menu option in GNOME
    Shell, which disappeared because libaccountsservice didn't tell GNOME
    Shell that user-switching was possible.
    This should work equally well for elogind due to libelogind's libsystemd
    ABI compatibility, although I haven't tried that configuration.
    (Closes: #968394)
  * d/control: accountsservice Recommends default-logind | logind.
    About half of accountsservice's functionality is a higher-level API
    over either systemd-logind, or something like elogind that is compatible
    enough to be a reasonable substitute (or ConsoleKit, but that's
    dead upstream and no longer in Debian).
  * d/rules: Explicitly enable GObject-Introspection.
    It's enabled by default, but explicit is better than implicit for this
    sort of thing.
  * d/rules: Simplify how we choose whether to enable gtk-doc.
    Enable it if and only if we are building the libaccountsservice-doc
    package.
  * d/p/build-Add-missing-pkg-config-Requires.private-dependencie.patch:
    Add patch to fix missing pkg-config dependencies
  * d/tests/build: Add a smoke-test for building against
    libaccountsservice with pkg-config
  * d/tests/pygi.py: Add a smoke-test.
    When run from a full desktop session, this should produce
    reasonable-looking results. We don't make any assertions about its
    output because we can't know how an automated test system will be
    configured, but it should at least run successfully and exit 0.

 -- Simon McVittie <smcv@debian.org>  Fri, 14 Aug 2020 15:31:50 +0100

accountsservice (0.6.55-2) unstable; urgency=medium

  [ Laurent Bigonville ]
  * Move the daemon to /usr/libexec now that's allowed in the policy

  [ Philip Withnall ]
  * Update group management patches to respect `extra_admin_groups` option.

  [ Iain Lane ]
  * Add patch to not crash in the library when the daemon goes away
    (Closes: #948228) (LP: #1843982)

 -- Iain Lane <laney@debian.org>  Tue, 05 May 2020 16:31:00 +0100

accountsservice (0.6.55-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 0.6.55 (Closes: #901308)
  * Bump build-dependencies and switch to meson
  * d/p/0002-create-and-manage-groups-like-on-a-debian-system.patch,
    d/p/0005-gdm_config_file_path.patch: Refreshed
  * d/patches/0007-add-lightdm-support.patch,
    d/patches/0009-language-tools.patch: Refreshed using ubuntu patches
  * Drop d/p/1002-dont-override-standardoutput.patch, applied upstream
  * d/p/0015-debian-nologin-path.patch: Dropped not needed anymore
  * d/p/0016-user-fix-insufficient-path-prefix-check.patch: Dropped, applied
    upstream
  * debian/libaccountsservice0.symbols: Add newly exported symbols
  * debian/gir1.2-accountsservice-1.0.install: Install the .typelib file in a
    multiarch directory
  * debian/libaccountsservice0.symbols: Add the Build-Depends-Package field
  * debian/rules: There are no tests defined, so stop overriding dh_auto_test
    as it's useless
  * libaccountsservice-doc: Install the documentation in /usr/share/gtk-doc/
  * Support the nodoc build-profile
  * Bump debhelper compatibility to 12
  * Bump Standards-Version to 4.4.1 (no further changes)
  * debian/accountsservice.postinst: Do not restart accounts-daemon in
    postinst (Closes: #866507)
  * debian/watch: Use https://
  * Stop using dh-exec
  * d/p/1001-move-dbus-conf-file.patch: Move D-Bus conf file to
    /usr/share/dbus-1/system.d
  * debian/control, debian/rules: Remove ancient Breaks/Replaces

 -- Laurent Bigonville <bigon@debian.org>  Sat, 12 Oct 2019 13:12:38 +0200

# For older changelog entries, run 'apt-get changelog libaccountsservice-doc'
