From ead27a932e3a0be2769b4eb13f39d473862a310e Mon Sep 17 00:00:00 2001
From: Anita Zhang <the.anitazha@gmail.com>
Date: Apr 15 2021 23:31:30 +0000
Subject: 2.32.1-27.1: backport setpriv --reset-env and remove kernel headers


---

diff --git a/SOURCES/1000-setpriv-add-reset-env.patch b/SOURCES/1000-setpriv-add-reset-env.patch
new file mode 100644
index 0000000..a8b97c6
--- /dev/null
+++ b/SOURCES/1000-setpriv-add-reset-env.patch
@@ -0,0 +1,162 @@
+From 0150f21be9739ad3fc8d5ce7cee2a2ff4a09326f Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Wed, 22 Aug 2018 11:43:32 +0200
+Subject: [PATCH] setpriv: add --reset-env
+
+Clear environment in way like su(1), but PATH is set to hard-coded
+defaults and /etc/login.defs is not used at all (I guess we want to
+keep setpriv(1) simple).
+
+If you need anything more advanced than use env(1).
+
+Addresses: https://github.com/karelzak/util-linux/issues/325
+Signed-off-by: Karel Zak <kzak@redhat.com>
+---
+ sys-utils/setpriv.1 |  9 ++++++++
+ sys-utils/setpriv.c | 54 ++++++++++++++++++++++++++++++++++++++++++++-
+ 2 files changed, 62 insertions(+), 1 deletion(-)
+
+diff --git a/sys-utils/setpriv.1 b/sys-utils/setpriv.1
+index b900f6e08..45bc5a23b 100644
+--- a/sys-utils/setpriv.1
++++ b/sys-utils/setpriv.1
+@@ -159,6 +159,15 @@ to abort if AppArmor is not in use, and the transition may be ignored or cause
+ .BR execve (2)
+ to fail at AppArmor's whim.
+ .TP
++.BI \-\-reset\-env
++Clears all the environment variables except TERM; initializes the environment variables HOME, SHELL, USER, LOGNAME
++according to the user's passwd entry; sets PATH to \fI/usr/local/bin:/bin:/usr/bin\fR for a regual user and to
++\fI/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin\fR for root.
++.sp
++The environment variable PATH may be different on systems where /bin and /sbin
++are merged into /usr.  The environment variable SHELL defaults to \fI/bin/sh\fR if none is given in the user's
++passwd entry.
++.TP
+ .BR \-V , " \-\-version"
+ Display version information and exit.
+ .TP
+diff --git a/sys-utils/setpriv.c b/sys-utils/setpriv.c
+index 4147978cc..30f8f9b15 100644
+--- a/sys-utils/setpriv.c
++++ b/sys-utils/setpriv.c
+@@ -38,6 +38,7 @@
+ #include "strutils.h"
+ #include "xalloc.h"
+ #include "pathnames.h"
++#include "env.h"
+ 
+ #ifndef PR_SET_NO_NEW_PRIVS
+ # define PR_SET_NO_NEW_PRIVS 38
+@@ -55,6 +56,9 @@
+ 
+ #define SETPRIV_EXIT_PRIVERR 127	/* how we exit when we fail to set privs */
+ 
++/* The shell to set SHELL env.variable if none is given in the user's passwd entry.  */
++#define DEFAULT_SHELL "/bin/sh"
++
+ enum cap_type {
+ 	CAP_TYPE_EFFECTIVE   = CAPNG_EFFECTIVE,
+ 	CAP_TYPE_PERMITTED   = CAPNG_PERMITTED,
+@@ -82,6 +86,7 @@ struct privctx {
+ 		keep_groups:1,		/* keep groups */
+ 		clear_groups:1,		/* remove groups */
+ 		init_groups:1,		/* initialize groups */
++		reset_env:1,		/* reset environment */
+ 		have_securebits:1;	/* remove groups */
+ 
+ 	/* uids and gids */
+@@ -137,6 +142,8 @@ static void __attribute__((__noreturn__)) usage(void)
+ 	fputs(_(" --securebits <bits>         set securebits\n"), out);
+ 	fputs(_(" --selinux-label <label>     set SELinux label\n"), out);
+ 	fputs(_(" --apparmor-profile <pr>     set AppArmor profile\n"), out);
++	fputs(_(" --reset-env                 clear all environment and initialize\n"
++		"                               HOME, SHELL, USER, LOGNAME and PATH\n"), out);
+ 
+ 	fputs(USAGE_SEPARATOR, out);
+ 	printf(USAGE_HELP_OPTIONS(29));
+@@ -643,6 +650,36 @@ static void do_apparmor_profile(const char *label)
+ 		    _("write failed: %s"), _PATH_PROC_ATTR_EXEC);
+ }
+ 
++
++static void do_reset_environ(struct passwd *pw)
++{
++	char *term = getenv("TERM");
++
++	if (term)
++		term = xstrdup(term);
++#ifdef HAVE_CLEARENV
++	clearenv();
++#else
++	environ = NULL;
++#endif
++	if (term)
++		xsetenv("TERM", term, 1);
++
++	if (pw->pw_shell && *pw->pw_shell)
++		xsetenv("SHELL", pw->pw_shell, 1);
++	else
++		xsetenv("SHELL", DEFAULT_SHELL, 1);
++
++	xsetenv("HOME", pw->pw_dir, 1);
++	xsetenv("USER", pw->pw_name, 1);
++	xsetenv("LOGNAME", pw->pw_name, 1);
++
++	if (pw->pw_uid)
++		xsetenv("PATH", _PATH_DEFPATH, 1);
++	else
++		xsetenv("PATH", _PATH_DEFPATH_ROOT, 1);
++}
++
+ static uid_t get_user(const char *s, const char *err)
+ {
+ 	struct passwd *pw;
+@@ -712,7 +749,8 @@ int main(int argc, char **argv)
+ 		CAPBSET,
+ 		SECUREBITS,
+ 		SELINUX_LABEL,
+-		APPARMOR_PROFILE
++		APPARMOR_PROFILE,
++		RESET_ENV
+ 	};
+ 
+ 	static const struct option longopts[] = {
+@@ -737,6 +775,7 @@ int main(int argc, char **argv)
+ 		{ "selinux-label",    required_argument, NULL, SELINUX_LABEL    },
+ 		{ "apparmor-profile", required_argument, NULL, APPARMOR_PROFILE },
+ 		{ "help",             no_argument,       NULL, 'h'              },
++		{ "reset-env",        no_argument,       NULL, RESET_ENV,       },
+ 		{ "version",          no_argument,       NULL, 'V'              },
+ 		{ NULL, 0, NULL, 0 }
+ 	};
+@@ -883,6 +922,9 @@ int main(int argc, char **argv)
+ 				     _("duplicate --apparmor-profile option"));
+ 			opts.apparmor_profile = optarg;
+ 			break;
++		case RESET_ENV:
++			opts.reset_env = 1;
++			break;
+ 		case 'h':
+ 			usage();
+ 		case 'V':
+@@ -928,6 +970,16 @@ int main(int argc, char **argv)
+ 		       "can be found on the system"),
+ 		     (long) opts.ruid);
+ 
++	if (opts.reset_env) {
++		if (opts.have_passwd)
++			/* pwd according to --ruid or --reuid */
++			pw = &opts.passwd;
++		else
++			/* pwd for the current user */
++			pw = getpwuid(getuid());
++		do_reset_environ(pw);
++	}
++
+ 	if (opts.nnp && prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1)
+ 		err(EXIT_FAILURE, _("disallow granting new privileges failed"));
+ 
+-- 
+2.30.2
+
diff --git a/SPECS/util-linux.spec b/SPECS/util-linux.spec
index 436b898..a53e178 100644
--- a/SPECS/util-linux.spec
+++ b/SPECS/util-linux.spec
@@ -2,7 +2,7 @@
 Summary: A collection of basic system utilities
 Name: util-linux
 Version: 2.32.1
-Release: 27%{?dist}
+Release: 27.1%{?dist}
 License: GPLv2 and GPLv2+ and LGPLv2+ and BSD with advertising and Public Domain
 Group: System Environment/Base
 URL: http://en.wikipedia.org/wiki/Util-linux
@@ -45,7 +45,6 @@ BuildRequires: automake
 BuildRequires: libtool
 BuildRequires: bison
 BuildRequires: git-core
-BuildRequires: kernel-headers >= 5.6.13
 
 ### Sources
 Source0: ftp://ftp.kernel.org/pub/linux/utils/util-linux/v%{upstream_major}/util-linux-%{upstream_version}.tar.xz
@@ -206,6 +205,10 @@ Patch55: 0055-lscpu-arm-read-vendor-and-model-from-BIOS.patch
 # 1900498 - libfdisk/libmount: backport two patches for upstream systemd
 Patch56: 0056-tests-update-sfdisk-resize.patch
 
+### Hyperscale (1000-9999)
+###
+Patch1000: 1000-setpriv-add-reset-env.patch
+
 
 %description
 The util-linux package contains a large variety of low-level system
@@ -1071,6 +1074,11 @@ fi
 %{_libdir}/python*/site-packages/libmount/
 
 %changelog
+* Thu Apr 15 2021 Anita Zhang <anitazha@redhat.com> 2.32.1-27.1
+- Backport https://github.com/karelzak/util-linux/commit/89f95425746e0371c033260c2bc0ef176eba6a37
+  for setpriv --reset-env support
+- Remove FB kernel headers BuildRequires since RH kernel has them
+
 * Tue Jan 19 2021 Karel Zak <kzak@redhat.com> 2.32.1-27
 - update lscpu-show-physical-socket-on-aarch64-without-ACPI-P.patch (#1882740)