sysutils/screen*: MULTIUSER is now non-default
MULTIUSER requires a setuid root screen binary. Not many people use
this feature anymore so let's disable it by default. If people do want
MULTIUSER screen they should either set the option or manually add the
setuid bit to the screen binary.
Reported by: sjg
sysutils/screen: Fix upstream bug #67155, buffer overflow
Fix upstream bug #67155, buffer overflow due to `strncpy()`.
There is no CVE yet.
Obtained from: https://savannah.gnu.org/bugs/?67155
sysutils/screen*: Rename screen and introduce a meta port
This is in preparation for the import of screen 5.0.0. I've tried
screen-devel (5.0.0 prelrelease). There were some bugs and
inconsistencies with screen 4.9.1. So we move screen to screen49
to maintain a version of screen that is known to work.
This implements the concept of a master screen port by renaming it to
screen49 and creating a slave port called screen. The idea of this is
similar in concept used with the cfengine or krb5 family of ports.
Users should never need to change port origins when a new stable
version of screen is committed.
People can install the screen port or package as before. However if they
choose to use the other screen port/package they may remove screen and
install the versioned "master" port/package directly.
This is in preparation for import of screen 5.0.0 into the ports
collection. Unfortunately my initial testing of screen 5.0.0 using the
screen-devel port uncovered an annoying (to me) bug, which I have opened
an issue with our upstream. I have not found the time to test their
patches enough to feel comfortalbe replacing the existing screen 4.9.1
with 5.0.0. When 5.0.0 will be imported as sysutils/screen50, it will
not become the default master port until we believe it won't become
a source of many bugzilla bugs.
sysutils/screen*: Fix off-by-one buffer overflow
FreeBSD ncurses, as of c8b9c85ee5bb, does a strncpy() of 1024 bytes into
a 1023 byte buffer supplied by screen. This section of code in ncurses
was removed in 61f66a1f4403, and is not a problem since 14.0-RELEASE.
But it is still a problem in 13-STABLE.
Thank you to dim@ for detailed analysis and initial patch to
sysutils/screen. The same patch is also applied to sysutils/screen-devel
this commit.
PR: 280868
MFH: 2024Q3
sysutils/screen: Fix build on __FreeBSD_version >= 1500020
I haven't bisected the real cause but I believe this breakage was
likely caused by the recent ssp commits to 15-CURRENT.
sysutils/screen: Bump PORTREVISION to chase src 21817992b331
21817992b331 in FreeBSD/main installed ncurses 6.5 into 15-CURRENT.
This causes screen to display errors about duplicate entries in
termcap/terminfo. A rebuild of screen fixes the problem.
The errors are:
Name collision 'cdc456tst' between
cdc456tst
and cdc456tst
Cannot remove alias 'cdc456tst'
Name collision 'tab132w' between
tab132w
and tab132w
Cannot remove alias 'tab132w'
And many more errors like the above.
sysutils/screen: Ignore legacy pty (pty.ko) during build
screen built on a machine with pty.ko (legacy SYSVR4 pty support)
loaded will fail to run on machines without pty.ko loaded. It will
try to open /dev/ptmx and fail, crashing screen. This commit fixes
this by removing the test for /dev/ptmx (legacy SYSVR4 pty support).
Reported by: Jonathan Chen <jonc@chen.org.nz>
sysutils/screen: Update 4.9.0 --> 4.9.1
Version 4.9.1 (20/08/2023):
* Support stop/parity bits on serial port (#23952)
* Add needed system headers in checks and return values
for implicit function declarations
* Fixes:
- Avoid zombies after shell exit (#25089)
- Missed signal sending permission check on failed
query messages (CVE-2023-24626)
- manpage fixes
- source code fixes during cleanup
- UTF-8 encoding can emit invalid UTF-8 sequences
for out of range unicode values (#62097)
sysutils/screen: Add session creation time when list active sessions
Reimplement Debian patches to display screen session creation time and
sort the list of sessions by date.
Output example for 'screen -ls' command
---------------------------------------
There is a screen on:
14059.pts-7.1302amd64-head (08/15/23 10:02:52) (Attached)
1 Socket in /tmp/screens/S-root.
Reviewed by: cy
Differential Revision: https://reviews.freebsd.org/D41469
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
sysutils/screen: Socket directory location option
Allow the user to specify the location of the socket directory through a
make.conf or make command line option called SCREEN_SOCKET_DIR. Simply
add SCREEN_SOCKET_DIR= to make.conf or put it on the command line.
sysutils/screen: Option to disable socketdir
Some users may prefer not to have screen sockets in /tmp/screens (EUID== 0)
and /tmp/uscreens (EUID != 0), preferring instead to keep screen sockets in
the user's home directory. Enabling the NOSOCKETDIR option accomplishes
this.
Reported by: "John W. O'Brien" <john@saltant.com>
MFH: 2022Q2
sysutils/screen: Make MULTIUSER default
Setuid root screen uses /tmp/screen for its sockets while non-setuid root
screen uses /tmp/uscreens. This is too much of a POLA violation, therefore
make MULTUSER default. This commit reverts the intent of PR/262903. People
wishing to secure their screen must terminate all screen sessions before
rebuilding without the MULTIUSER option.
Reported by: many
Fixes: 2022Q2
sysutils/screen: Varioius fixups
Make interprets PLIST variable names too. Choose a variable name
different enough not to be interpreted by make.
Fix a typo.
Use default executable permissions of 555, same as if permissions
weren't set in the first place. We're only interested in the setuid
bit. This requries a PORTREVISION bump.
sysutils/screen: Fix plist
PLIST doesn't like "_" in variable names. Fix by renaming
MULTIUSER_SCREEN to MULTIUSER.
PR: 262903
Reported by: sunpoet, Michael Butler <imb@protected-networks.net>
Fixes: 8f528507e9ca
Pointy hat to: cy
sysutils/screen: Disable multiuser mode by default
Multiuser mode is a handy way to share a screen among people who do
not reside in the same location. Unforutnately it requires that screen
be setuid root. GNU screen has had a number of CVEs over the years.
See https://www.cvedetails.com/vulnerability-list/vendor_id-72/\
product_id-1860/GNU-Screen.html. Removing the setuid bit mitigates this
at the expense of breaking the multuser feature.
Red Hat removed GNU screen's setuid bit over a dozen years ago. Their
rationale is documented in their bugzilla bug 580339, where they stated
that most users don't use the multiuser feature. (Personally, I'm the only
person I know of who uses that feature.)
Users who use the multuser feature should enable the MUILTUSER option
prior to building screen or using poudriere-options. Alternatively, users
can chmod the setuid bit on when needed.
PR: 262903
Submitted by: david@isnic.is (mostly)
Reported by: david@isnic.is
sysutils/screen: Fix SHOWENC build
The SHOWENC optional patch is now included in screen 4.9.0. We simply
enable the option now and build. The patch is redundant.
PR: 262641
Reported by: Trond.Endrestol@ximalas.info, sunpoet, many others
Fixes: 9bdc78861688
sysutils/screen: Update to 4.9.0
Update screen to 4.9.0. From the release announcement:
New in this release:
* Hardstatus option for used encoding (escape string '%e')
* Fixes:
- fix combining char handling that could lead to a segfault
- CVE-2021-26937: possible denial of service via a crafted UTF-8
character sequence (bug #60030)
- make screen exit code be 0 when checking --help
- session names limit is 80 symbols (bug #61534)
- option -X ignores specified user in multiuser env (bug #37437)
- a lot of reformations/fixes/cleanups (man page and source code)
For full list of changes see
https://git.savannah.gnu.org/cgit/screen.git/log/?h=v.4.9.0
Note that CVE-2021-26937 was fixed in the FreeBSD port in 2021.
Fix CVE-2021-26937 for real: segfaults by displaying some UTF-8 characters
This is a recommit of r565281 fixing a typo in r565281, causing
a regression.
CVE-2021-26937 segfaults when displayingsome UTF-8 characters
described in
https://lists.gnu.org/archive/html/screen-devel/2021-02/msg00000.html.
PR: 253515
Reported by: daniel.engberg.lists at pyret.net
Obtained from: https://build.opensuse.org/request/show/871482
MFH: 2020Q1
Security: CVE-2021-26937
Memory constrained i386 is affected on all versions of FreeBSD. Though I am not able to reproduce this locally, it is reported that the hang also occurs on -CURRENT i386 on a memory constrained Intel Pentium III. (I am not able to reproduce this hang on my sandbox machine, with multiple boot partitions, one of which is i386 -CURRENT, because it has plenty of memory.)
Reported by: Michael Butler <imb@protected-networks.net>
Circumvent a hang on FreeBSD 11 i386 caused by an unreported (only visible through truss) stack assertion.
This is a temporary fix which will require further investigation to
determine the cause.
PR: 241750
Reported by: Victor Sudakov <vas@sibptus.ru> (in the PR)
Paul Beard <paulbeard@gmail.com> (via direct email)
Correctly identify utmpx support in FreeBSD.
- FreeBSD's utmpx is incorrectly identified in ./configure.
- Because of the falsely identified utmpx support in the ./configure
script, a previously applied patch, which didn't work, is no longer
needed.
PR: 241530
Reported by: Henry David Bartholomew <PopularMoment@protonmail.com>
Daniel Drinnon <ddrinnon@cdor.net>
sysutils/screen: fix coredump on xterm/rxvt variants without Km
On xterm- and rxvt-variants (and in some other cases) screen's
InitTermcap() tries to strdup() the terminals "Km" ("key_mouse")
termcap attribute - but that might be NULL, as some of these
terminals (notably rxvt and xterm-color) do not have "Km". Trying
to strdup() NULL results in segfault and coredump.
Catch that NULL and prevent the segfault.
PR: 241538
Reported by: Marcin Cieślak, Gareth de Vaux
Approved by: cy@
Always install the manpage and let the user decide if they do want to install groff(1) as advised by man(1) if they want.
Reviewed by: cy
Approved by: cy (maintainer)
Differential Revision: https://reviews.freebsd.org/D21463
Remove building man page by default. It's currently broken on HEAD and requires to build textproc/groff which requires devel/llvm80 which is an overkill for using screen.