policykit-1 (0.105-33ubuntu0.1) jammy-security; urgency=medium

  * SECURITY UPDATE: OOB write via nested elements in XML policy
    - debian/patches/CVE-2025-7519.patch: check depth in
      src/polkitbackend/polkitbackendactionpool.c.
    - CVE-2025-7519
  * SECURITY UPDATE: DoS via excessively long input
    - debian/patches/CVE-2026-4897.patch: fix getline() string overflow in
      src/polkitagent/polkitagenthelperprivate.c.
    - CVE-2026-4897

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 10 Apr 2026 06:59:20 -0400

policykit-1 (0.105-33) unstable; urgency=medium

  * d/p/0.121/CVE-2021-4115-GHSL-2021-077-fix.patch:
    Attribute CVE-2021-4115 patch to its author.
    Move it into debian/patches/0.121 to indicate that it is a backport from
    upstream git, expected to be included in 0.121.
  * d/p/Fix-a-crash-when-authorization-is-implied.patch:
    Add patch to fix a crash when one authorization implies another

 -- Simon McVittie <smcv@debian.org>  Sat, 26 Feb 2022 11:11:57 +0000

policykit-1 (0.105-32) unstable; urgency=medium

  * Use upstream patch for CVE-2021-3560.
    This patch was included in 0.119, so move it into the 0.119/ directory
    in the patch series.
  * d/patches: Use upstream's finalized patch for CVE-2021-4034.
    The patch that was provided to distributors under embargo was not the
    final version: it used a different exit status, and made an attempt to
    show help. The version that was actually committed after the embargo
    period ended interprets argc == 0 as an attack rather than a mistake,
    and does not attempt to show the help message.
  * Move some Debian-specific patches into d/p/debian/.
    This makes it more obvious that they are not intended to go upstream.
  * d/control: Split the package.
    pkexec is a setuid program, which makes it a higher security risk than
    the more typical IPC-based uses of polkit. If we separate out pkexec
    into its own package, then only packages that rely on being able to run
    pkexec will have to depend on it, reducing attack surface for users
    who are able to remove the pkexec package.
  * d/control: policykit-1 Provides polkitd-pkla.
    This will give us a migration path to the separate per-backend packages
    currently available in experimental.
  * Add patch from Fedora to fix denial of service via fd exhaustion.
    CVE-2021-4115 (Closes: #1005784)
  * Standards-Version: 4.6.0 (no changes required)
  * Build-depend on dbus-daemon instead of dbus.
    We only need dbus-run-session at build time; we don't need a
    fully-working system bus.
  * Use d/watch format version 4
  * d/rules: Create localauthority configuration with install(1), not
    echo(1). This aligns the packaging a bit more closely with experimental.
  * Always configure the sudo group as root-equivalent.
    This avoids Debian derivatives getting an unexpected change in behaviour
    when they switch from inheriting Debian's policykit-1 package to
    building their own policykit-1 package, perhaps as a result of wanting
    to apply an unrelated patch.
    The sudo group is defined to be root-equivalent in base-passwd, so this
    should be equally true for all Debian derivatives.
    Thanks to Arnaud Rebillout.
  * d/polkitd.links: Create more polkit-agent-helper-1 symlinks.
    This executable has moved several times, and its path gets compiled
    into the libpolkit-agent-1-0 shared library. Making the executable
    available in all the locations it has previously had is helpful when
    swapping between versions during testing.
  * Acknowledge CVE-2021-4034 NMU. Thanks to Salvatore Bonaccorso.

 -- Simon McVittie <smcv@debian.org>  Fri, 18 Feb 2022 12:45:14 +0000

policykit-1 (0.105-31.1) unstable; urgency=high

  * Non-maintainer upload.
  * Local Privilege Escalation in polkit's pkexec (CVE-2021-4034)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 13 Jan 2022 06:34:44 +0100

policykit-1 (0.105-31) unstable; urgency=medium

  [ Salvatore Bonaccorso ]
  * d/p/CVE-2021-3560.patch:
    Fix local privilege escalation involving
    polkit_system_bus_name_get_creds_sync() (CVE-2021-3560)
    (Closes: #989429)

 -- Simon McVittie <smcv@debian.org>  Thu, 03 Jun 2021 17:06:34 +0100

policykit-1 (0.105-30) unstable; urgency=medium

  [ Helmut Grohne ]
  * Annotate Build-Depends: dbus <!nocheck> (Closes: #980998)

 -- Simon McVittie <smcv@debian.org>  Thu, 04 Feb 2021 13:56:09 +0000

policykit-1 (0.105-29) unstable; urgency=medium

  * Add symlink for polkit-agent-helper-1 after the move to /usr/libexec.
    If a process still has an old copy of libpolkit-agent-1.so.0 loaded, it
    will fail to find the binary at the new location. So create a symlink to
    prevent authentication failures on upgrades. (Closes: #965210)

 -- Michael Biebl <biebl@debian.org>  Mon, 03 Aug 2020 11:05:29 +0200

policykit-1 (0.105-28) unstable; urgency=medium

  [ TANIGUCHI Takaki ]
  * postinst: Fix polkit-agent-helper-1 path

  [ Michael Biebl ]
  * Fix polkitd path in polkit.service (Closes: #965164)
  * Use --restart-after-upgrade.
    With debhelper 13.1, --no-start will disable --restart-after-upgrade.
    Since we want the service to be restarted on upgrades, request that
    explicitly.
  * Remove old maintscript migration code from pre-oldstable

 -- Michael Biebl <biebl@debian.org>  Fri, 17 Jul 2020 10:49:51 +0200

policykit-1 (0.105-27) unstable; urgency=medium

  * Switch to /usr/libexec now that it is allowed by debian policy
  * Bump debhelper-compat to 13
  * Bump Standards-Version to 4.5.0
  * Try harder to look up the right localization.
    Fixes out-of-bounds read in _localize. (Closes: #956223)

 -- Michael Biebl <biebl@debian.org>  Fri, 17 Jul 2020 00:50:43 +0200

policykit-1 (0.105-26) unstable; urgency=medium

  [ Mark Hindley ]
  * Depend on new virtual packages default-logind and logind
    (Closes: #923240)

  [ Simon McVittie ]
  * Apply most changes from upstream release 0.116
    - d/p/0.116/Elaborate-message-printed-by-polkit-when-disconnecting-fr.patch,
      d/p/0.116/Error-message-raised-on-every-systemctl-start-in-emergenc.patch:
      Reduce messages to stderr from polkit agents, in particular when using
      "systemctl reboot" on a ssh connection or when using "systemctl start"
      in systemd emergency mode
    - d/p/0.116/Fix-a-critical-warning-on-calling-polkit_permission_new_s.patch:
      Fix critical warnings when calling polkit_permission_new_sync() with
      no D-Bus system bus
    - d/p/0.116/Possible-resource-leak-found-by-static-analyzer.patch:
      Fix a potential use-after-free in polkit agents
    - d/p/0.116/pkttyagent-PolkitAgentTextListener-leaves-echo-tty-disabl.patch:
      Re-enable echo if the tty agent is killed by SIGINT or SIGTERM
      or suspended with SIGTSTP
  * Add more bug fixes backported from earlier upstream releases
    - d/p/0.108/PolkitAgent-Avoid-crashing-if-initializing-the-server-obj.patch:
      Fix a segfault when a library user like flatpak attempts to register
      a polkit agent with no system bus available (Closes: #923046)
    - d/p/0.111/Add-a-FIXME-to-polkitprivate.h.patch:
      Make it more obvious that polkitprivate.h was never intended to be API
    - d/p/0.114/polkitpermission-Fix-a-memory-leak-on-authority-changes.patch:
      Fix a memory leak
    - d/p/0.113/PolkitSystemBusName-Retrieve-both-pid-and-uid.patch:
      Avoid a use of the deprecated polkit_unix_process_new()
  * d/*.symbols: Add Build-Depends-Package metadata
  * d/policykit-1.lintian-overrides: Override systemd unit false positives.
    The systemd unit is only for on-demand D-Bus activation, and is not
    intended to be started during boot, so an [Install] section and a
    parallel LSB init script are not necessary.
  * Stop building libpolkit-backend as a shared library.
    Its API was never declared stable before upstream removed it in
    0.106. Nothing in Debian depended on it, except for polkitd itself,
    which now links the same code statically.
    This is a step towards being able to use the current upstream release of
    polkit and patch in the old localauthority backend as an alternative to
    the JavaScript backend, instead of using the old 0.105 codebase and
    patching in essentially every change except the JavaScript backend,
    which is becoming unmanageable.
    - Remove the example null backend, which is pointless now that we've
      removed the ability to extend polkit.
    - Remove obsolete conffile 50-nullbackend.conf on upgrade
    - Remove the directory that previously contained 50-nullbackend.conf
      after upgrading or removing policykit-1
    - Remove obsolete dh_makeshlibs override for the null backend
  * d/policykit-1.bug-control: Add systemd, elogind versions to bug reports.
    reportbug doesn't currently seem to interpret
    "Depends: default-logind | logind" as implying that it should include
    the version number of the package that Provides logind in bug reports.
    Workaround for #934472.
  * Change the policykit-1 package from Architecture: any to
    Architecture: linux-any, and remove the consolekit [!linux-any]
    dependency. consolekit is no longer available in any Debian or
    debian-ports architecture, even those for non-Linux kernels.
    (Closes: #918446)
  * Standards-Version: 4.4.0 (no changes required)
  * Switch to debhelper-compat 12
    - d/control: Add ${misc:Pre-Depends}
  * Switch to dh_missing and abort on uninstalled files
    (patch taken from experimental, thanks to Michael Biebl)

 -- Simon McVittie <smcv@debian.org>  Sun, 11 Aug 2019 19:09:35 +0100

# For older changelog entries, run 'apt-get changelog policykit-1-doc'
