Merge lp:~lucyllewy/ubuntu/raring/vsftpd/bug-1160372 into lp:ubuntu/raring/vsftpd

[Lucy Llewellyn]

[Sebastien Bacher (seb128)]

Thank you for your work, I've reformated slightly the change (updated the version number, set the release, listed the patch name and change the url to the bugzilla which is shorter to read and cause no extra wrapping) and uploaded to saucy and raring

review: Approve

=== modified file 'debian/changelog'
--- debian/changelog	2012-12-18 19:59:37 +0000
+++ debian/changelog	2013-05-08 13:47:27 +0000
@@ -1,3 +1,11 @@
+vsftpd (3.0.2-1ubuntu1) UNRELEASED; urgency=low
+
+  * patch to remove CLONE_NEWPID syscall
+    see: https://build.opensuse.org/package/view_file?file=vsftpd-drop-newpid-from-clone.patch&package=vsftpd&project=openSUSE%3AFactory&rev=3ed24d12e1827ea673331e213ab3d477
+    Fixes LP: #1160372
+
+ -- Daniel Llewellyn (Bang Communications) <[e-mail]>  Wed, 08 May 2013 14:08:53 +0100
+
 vsftpd (3.0.2-1ubuntu1) raring; urgency=low
 
   * Merge from debian unstable (LP: #1092076), remaining changes:

=== added file 'debian/patches/13-disable-clone-newpid.patch'
--- debian/patches/13-disable-clone-newpid.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/13-disable-clone-newpid.patch	2013-05-08 13:47:27 +0000
@@ -0,0 +1,35 @@
+From: Michal Vyskocil <[e-mail]>
+Subject: Drop CLONE_NEWPID from clone call
+
+Kernel autid system prohibits the processes created with CLONE_NEWPID, so an
+attempt to log into ftp server ends with
+
+audit_log_acct_message() failed: Operation not permitted
+
+https://bugzilla.novell.com/show_bug.cgi?id=786024#c38
+
+identified-by: Tony Jones <[e-mail]>
+fixes: bnc#786024
+
+Index: vsftpd-3.0.2/sysdeputil.c
+===================================================================
+--- vsftpd-3.0.2.orig/sysdeputil.c
++++ vsftpd-3.0.2/sysdeputil.c
+@@ -1272,7 +1272,7 @@ vsf_sysutil_fork_isolate_all_failok()
+   if (cloneflags_work)
+   {
+     int ret = syscall(__NR_clone,
+-                      CLONE_NEWPID | CLONE_NEWIPC | CLONE_NEWNET | SIGCHLD,
++                      CLONE_NEWIPC | CLONE_NEWNET | SIGCHLD,
+                       NULL);
+     if (ret != -1 || (errno != EINVAL && errno != EPERM))
+     {
+@@ -1295,7 +1295,7 @@ vsf_sysutil_fork_isolate_failok()
+   static int cloneflags_work = 1;
+   if (cloneflags_work)
+   {
+-    int ret = syscall(__NR_clone, CLONE_NEWPID | CLONE_NEWIPC | SIGCHLD, NULL);
++    int ret = syscall(__NR_clone, CLONE_NEWIPC | SIGCHLD, NULL);
+     if (ret != -1 || (errno != EINVAL && errno != EPERM))
+     {
+       if (ret == 0)

=== modified file 'debian/patches/series'
--- debian/patches/series	2012-12-18 19:59:37 +0000
+++ debian/patches/series	2013-05-08 13:47:27 +0000
@@ -12,3 +12,4 @@
 12-buildflags.patch
 09-disable-anonymous.patch
 12-ubuntu-use-snakeoil-ssl.patch
+13-disable-clone-newpid.patch