Ondrej Holy · Kjartan Maraas · Milo Casagrande · Ondrej Holy · Ondrej Holy · Damjan Jovanovic
--- a/NEWS
+++ b/NEWS
+Major changes in 1.48.1
+=======================
+* build: Use install prefix in systemd files paths
+* client: Prevent socket leaks if socket dir is inaccessible from client
+* admin: Fix regressions caused by port to named sockets
+* udisks2: Report unmount progress after showing blocking processes
+* Translation updates
+
+Major changes in 1.48.0
+=======================
+* Translation updates
+
 Major changes in 1.47.91
 ========================
 * Translation updates

--- a/client/gvfsdaemondbus.c
+++ b/client/gvfsdaemondbus.c
@@ -31,12 +31,14 @@
 #include <errno.h>

 #include <glib/gi18n-lib.h>
+#include <glib/gstdio.h>

 #include <gio/gio.h>
 #include "gvfsdaemondbus.h"
 #include <gvfsdaemonprotocol.h>
 #include <gdaemonvfs.h>
 #include <gvfsdbus.h>
+#include <gvfsutils.h>

 /* Extra vfs-specific data for GDBusConnections */
 typedef struct {
@@ -156,6 +158,7 @@ set_connection_for_async (GDBusConnection *connection, const char *dbus_id)
 typedef struct {
  char *dbus_id;

+  GVfsDBusDaemon *proxy;
  GDBusConnection *connection;
  GCancellable *cancellable;

@@ -174,6 +177,7 @@ async_call_finish (AsyncDBusCall *async_call)
 			  async_call->io_error, 
 			  async_call->callback_data);

+  g_clear_object (&async_call->proxy);
  g_clear_object (&async_call->connection);
  g_clear_object (&async_call->cancellable);
  g_clear_error (&async_call->io_error);
@@ -260,32 +264,67 @@ async_get_connection_response (GVfsDBusDaemon *proxy,
  g_free (address1);
 }

+static void
+socket_dir_query_info_cb (GObject *source_object,
+                          GAsyncResult *res,
+                          gpointer user_data)
+{
+  AsyncDBusCall *async_call = user_data;
+  g_autoptr (GFileInfo) socket_dir_info = NULL;
+
+  socket_dir_info = g_file_query_info_finish (G_FILE (source_object),
+                                              res,
+                                              &async_call->io_error);
+  if (socket_dir_info == NULL ||
+      !g_file_info_get_attribute_boolean (socket_dir_info,
+                                          G_FILE_ATTRIBUTE_ACCESS_CAN_WRITE))
+    {
+      if (!async_call->io_error)
+        async_call->io_error = g_error_new_literal (G_IO_ERROR,
+                                                    G_IO_ERROR_PERMISSION_DENIED,
+                                                    _("Permission denied"));
+
+      async_call_finish (async_call);
+      return;
+    }
+
+  g_dbus_proxy_set_default_timeout (G_DBUS_PROXY (async_call->proxy), G_VFS_DBUS_TIMEOUT_MSECS);
+
+  gvfs_dbus_daemon_call_get_connection (async_call->proxy,
+                                        async_call->cancellable,
+                                        (GAsyncReadyCallback) async_get_connection_response,
+                                        async_call);
+}
+
 static void
 open_connection_async_cb (GObject *source_object,
                          GAsyncResult *res,
                          gpointer user_data)
 {
-  GVfsDBusDaemon *proxy;
  AsyncDBusCall *async_call = user_data;
  GError *error = NULL;
- 
-  proxy = gvfs_dbus_daemon_proxy_new_finish (res, &error);
-  if (proxy == NULL)
+  g_autofree gchar *socket_dir_path = NULL;
+  g_autoptr (GFile) socket_dir = NULL;
+
+  async_call->proxy = gvfs_dbus_daemon_proxy_new_finish (res, &error);
+  if (async_call->proxy == NULL)
    {
      async_call->io_error = g_error_copy (error);
      g_error_free (error);
      async_call_finish (async_call);
      return;
    }
-  
-  g_dbus_proxy_set_default_timeout (G_DBUS_PROXY (proxy), G_VFS_DBUS_TIMEOUT_MSECS);
-  
-  gvfs_dbus_daemon_call_get_connection (proxy,
-                                        async_call->cancellable,
-                                        (GAsyncReadyCallback) async_get_connection_response,
-                                        async_call);
-  
-  g_object_unref (proxy);
+
+  /* This is needed to prevent socket leaks. */
+  socket_dir_path = gvfs_get_socket_dir ();
+  socket_dir = g_file_new_for_path (socket_dir_path);
+  g_file_query_info_async (socket_dir,
+                           G_FILE_ATTRIBUTE_ACCESS_CAN_WRITE,
+                           G_FILE_QUERY_INFO_NONE,
+                           G_PRIORITY_DEFAULT,
+                           async_call->cancellable,
+                           socket_dir_query_info_cb,
+                           user_data);
 }

 static void
@@ -522,6 +561,9 @@ _g_dbus_connection_get_sync (const char *dbus_id,
  gchar *address1;
  GVfsDBusDaemon *daemon_proxy;
  gboolean res;
+  g_autofree gchar *socket_dir_path = NULL;
+  g_autoptr (GFile) socket_dir = NULL;
+  g_autoptr (GFileInfo) socket_dir_info = NULL;

  if (g_cancellable_set_error_if_cancelled (cancellable, error))
    return NULL;
@@ -591,6 +633,26 @@ _g_dbus_connection_get_sync (const char *dbus_id,
  if (daemon_proxy == NULL)
    return NULL;

+  /* This is needed to prevent socket leaks. */
+  socket_dir_path = gvfs_get_socket_dir ();
+  socket_dir = g_file_new_for_path (socket_dir_path);
+  socket_dir_info = g_file_query_info (socket_dir,
+                                       G_FILE_ATTRIBUTE_ACCESS_CAN_WRITE,
+                                       G_FILE_QUERY_INFO_NONE,
+                                       cancellable,
+                                       error);
+  if (socket_dir_info == NULL ||
+      !g_file_info_get_attribute_boolean (socket_dir_info,
+                                          G_FILE_ATTRIBUTE_ACCESS_CAN_WRITE))
+    {
+      if (error && !*error)
+        *error = g_error_new_literal (G_IO_ERROR,
+                                      G_IO_ERROR_PERMISSION_DENIED,
+                                      _("Permission denied"));
+
+      return NULL;
+    }
+
  address1 = NULL;
  res = gvfs_dbus_daemon_call_get_connection_sync (daemon_proxy,
                                                   &address1,

--- a/common/gvfsutils.c
+++ b/common/gvfsutils.c
@@ -136,3 +136,9 @@ gvfs_is_ipv6 (const char *host)

  return TRUE;
 }
+
+gchar *
+gvfs_get_socket_dir (void)
+{
+  return g_build_filename (g_get_user_runtime_dir (), "gvfsd", NULL);
+}
--- a/common/gvfsutils.h
+++ b/common/gvfsutils.h
@@ -31,6 +31,7 @@ void         gvfs_set_debug                         (gboolean          debugging
 void         gvfs_setup_debug_handler               (void);

 gboolean     gvfs_is_ipv6                           (const char       *host);
+gchar *      gvfs_get_socket_dir                    (void);

 G_END_DECLS


--- a/daemon/admin.mount.in
+++ b/daemon/admin.mount.in
 [Mount]
 Type=admin
 # Add a dummy argument after pkexec, or '/bin/sh -c' will eat the first argument in '$@'
-Exec=/bin/sh -c 'pkexec @libexecdir@/gvfsd-admin "$@" --address $DBUS_SESSION_BUS_ADDRESS' gvfsd-admin
+Exec=/bin/sh -c 'pkexec @libexecdir@/gvfsd-admin "$@" --address $DBUS_SESSION_BUS_ADDRESS --dir $XDG_RUNTIME_DIR' gvfsd-admin
 AutoMount=false
 DBusName=org.gtk.vfs.mountpoint_admin
 MountPerClient=true
--- a/daemon/gvfsbackendadmin.c
+++ b/daemon/gvfsbackendadmin.c
@@ -95,6 +95,15 @@ check_permission (GVfsBackendAdmin *self,
  invocation = dbus_job->invocation;
  connection = g_dbus_method_invocation_get_connection (invocation);
  credentials = g_dbus_connection_get_peer_credentials (connection);
+  if (!credentials)
+    {
+      g_warning ("The admin backend doesn't work with the session bus "
+                 "fallback. Your application is probably missing "
+                 "--filesystem=xdg-run/gvfsd privileges.");
+      g_vfs_job_failed_literal (job, G_IO_ERROR, G_IO_ERROR_NOT_SUPPORTED,
+                                _("Operation not supported"));
+      return FALSE;
+    }

  pid = g_credentials_get_unix_pid (credentials, &error);
  if (error != NULL)
@@ -1094,8 +1103,10 @@ acquire_caps (uid_t uid)
 }

 static char *session_address = NULL;
+static char *runtime_dir = NULL;
 static GOptionEntry entries[] = {
  { "address", 0, 0, G_OPTION_ARG_STRING, &session_address, "DBus session address", NULL },
+  { "dir", 0, 0, G_OPTION_ARG_STRING, &runtime_dir, "Runtime dir", NULL },
  { NULL }
 };

@@ -1134,4 +1145,7 @@ g_vfs_backend_admin_pre_setup (int *argc,

  acquire_caps (uid);
  g_setenv ("DBUS_SESSION_BUS_ADDRESS", session_address, TRUE);
+
+  if (runtime_dir)
+    g_setenv ("XDG_RUNTIME_DIR", runtime_dir, TRUE);
 }
--- a/daemon/gvfsdaemon.c
+++ b/daemon/gvfsdaemon.c
@@ -87,14 +87,6 @@ struct _GVfsDaemon
  gboolean lost_main_daemon;
 };

-typedef struct {
-  GVfsDaemon *daemon;
-  char *socket_dir;
-  GDBusServer *server;
-  
-  GDBusConnection *conn;
-} NewConnectionData;
-
 static guint signals[LAST_SIGNAL] = { 0 };

 static void              g_vfs_daemon_get_property (GObject        *object,
@@ -652,25 +644,6 @@ g_vfs_daemon_queue_job (GVfsDaemon *daemon,
    }
 }

-static void
-new_connection_data_free (void *memory)
-{
-  NewConnectionData *data = memory;
-  gchar *socket;
-  
-  /* Remove the socket and dir after connected */
-  if (data->socket_dir)
-    {
-      socket = g_strdup_printf ("%s/socket", data->socket_dir);
-      g_unlink (socket);
-      g_free (socket);
-      rmdir (data->socket_dir);
-      g_free (data->socket_dir);
-    }
-
-  g_free (data);
-}
-
 static void
 peer_unregister_skeleton (const gchar *obj_path,
                          RegisteredPath *reg_path,
@@ -721,21 +694,19 @@ peer_connection_closed (GDBusConnection *connection,
  daemon_skeleton = g_object_get_data (G_OBJECT (connection), "daemon_skeleton");
  /* daemon_skeleton should be always valid in this case */
  g_dbus_interface_skeleton_unexport (G_DBUS_INTERFACE_SKELETON (daemon_skeleton));
-  
-  g_hash_table_remove (daemon->client_connections, connection);

  /* Unexport the registered interface skeletons */
  g_hash_table_foreach (daemon->registered_paths, (GHFunc) peer_unregister_skeleton, connection);

  /* The peer-to-peer connection was disconnected */
  g_signal_handlers_disconnect_by_data (connection, user_data);
-  g_object_unref (connection);
+
+  g_hash_table_remove (daemon->client_connections, connection);
 }

 static void
 daemon_peer_connection_setup (GVfsDaemon *daemon,
-                              GDBusConnection *dbus_conn,
-			      NewConnectionData *data)
+                              GDBusConnection *dbus_conn)
 {
  GVfsDBusDaemon *daemon_skeleton;
  GError *error;
@@ -752,35 +723,34 @@ daemon_peer_connection_setup (GVfsDaemon *daemon,
      g_warning ("Failed to accept client: %s, %s (%s, %d)", "object registration failed", 
                 error->message, g_quark_to_string (error->domain), error->code);
      g_error_free (error);
-      g_object_unref (data->conn);
-      goto error_out;
+      return;
    }
-  g_object_set_data_full (G_OBJECT (data->conn), "daemon_skeleton", daemon_skeleton, (GDestroyNotify) g_object_unref);
-  
+  g_object_set_data_full (G_OBJECT (dbus_conn), "daemon_skeleton",
+                          daemon_skeleton, (GDestroyNotify) g_object_unref);
+
  /* Export registered interface skeletons on this new connection */
  g_hash_table_foreach (daemon->registered_paths, (GHFunc) peer_register_skeleton, dbus_conn);
  
  g_hash_table_insert (daemon->client_connections, g_object_ref (dbus_conn), NULL);

-  g_signal_connect (data->conn, "closed", G_CALLBACK (peer_connection_closed), data->daemon);
-
- error_out:
-  new_connection_data_free (data);
+  g_signal_connect (dbus_conn, "closed", G_CALLBACK (peer_connection_closed), daemon);
 }

 static void
-generate_address (char **address,
-                  char **socket_dir)
+generate_address (gchar **address, gchar **socket_path)
 {
-  gchar tmp[9];
+  gchar tmp[16] = "socket-";
+  gchar *socket_dir;

-  *socket_dir = g_build_filename (g_get_user_runtime_dir (), "gvfsd", NULL);
-  g_mkdir (*socket_dir, 0700);
+  gvfs_randomize_string (tmp + 7, 8);
+  tmp[15] = '\0';

-  gvfs_randomize_string (tmp, 8);
-  tmp[8] = '\0';
+  socket_dir = gvfs_get_socket_dir ();

-  *address = g_strdup_printf ("unix:path=%s/socket-%s", *socket_dir, tmp);
+  *socket_path = g_build_filename (socket_dir, tmp, NULL);
+  *address = g_strdup_printf ("unix:path=%s", *socket_path);
+
+  g_free (socket_dir);
 }

 static gboolean
@@ -788,14 +758,9 @@ daemon_new_connection_func (GDBusServer *server,
                            GDBusConnection *connection,
                            gpointer user_data)
 {
-  NewConnectionData *data;
-
-  data = user_data;
+  GVfsDaemon *daemon = user_data;

-  /* Take ownership */
-  data->conn = g_object_ref (connection);
-
-  daemon_peer_connection_setup (data->daemon, data->conn, data);
+  daemon_peer_connection_setup (daemon, connection);

  /* Kill the server, no more need for it */
  g_dbus_server_stop (server);
@@ -813,16 +778,11 @@ handle_get_connection (GVfsDBusDaemon *object,
  GDBusServer *server;
  GError *error;
  gchar *address1;
-  NewConnectionData *data;
-  char *socket_dir;
+  gchar *socket_path;
  gchar *guid;
-  
-  generate_address (&address1, &socket_dir);
+  const char *pkexec_uid;

-  data = g_new (NewConnectionData, 1);
-  data->daemon = daemon;
-  data->socket_dir = socket_dir;
-  data->conn = NULL;
+  generate_address (&address1, &socket_path);

  guid = g_dbus_generate_guid ();
  error = NULL;
@@ -843,21 +803,34 @@ handle_get_connection (GVfsDBusDaemon *object,
    }

  g_dbus_server_start (server);
-  data->server = server;

-  g_signal_connect (server, "new-connection", G_CALLBACK (daemon_new_connection_func), data);
-  
+  /* This is needed for gvfsd-admin to ensure correct ownership. */
+  pkexec_uid = g_getenv ("PKEXEC_UID");
+  if (pkexec_uid != NULL)
+    {
+      uid_t uid;
+
+      uid = strtol (pkexec_uid, NULL, 10);
+      if (uid != 0)
+        if (chown (socket_path, uid, (gid_t)-1) < 0)
+          g_warning ("Failed to change socket ownership: %s", g_strerror (errno));
+    }
+
+  g_signal_connect (server, "new-connection", G_CALLBACK (daemon_new_connection_func), daemon);
+
  gvfs_dbus_daemon_complete_get_connection (object,
                                            invocation,
                                            address1,
                                            "");

  g_free (address1);
+  g_free (socket_path);
  return TRUE;

 error_out:
-  new_connection_data_free (data);
  g_free (address1);
+  g_unlink (socket_path);
+  g_free (socket_path);
  return TRUE;
 }


--- a/daemon/main.c
+++ b/daemon/main.c
@@ -143,6 +143,7 @@ main (int argc, char *argv[])
  guint name_owner_id;
  GBusNameOwnerFlags flags;
  GOptionContext *context;
+  gchar *socket_dir;
  const GOptionEntry options[] = {
    { "replace", 'r', 0, G_OPTION_ARG_NONE, &replace,  N_("Replace old daemon."), NULL },
    { "no-fuse", 0, 0, G_OPTION_ARG_NONE, &no_fuse,  N_("Don’t start fuse."), NULL },
@@ -212,6 +213,11 @@ main (int argc, char *argv[])
  if (daemon == NULL)
    return 1;

+  /* This is needed for gvfsd-admin to ensure correct ownership. */
+  socket_dir = gvfs_get_socket_dir ();
+  g_mkdir (socket_dir, 0700);
+  g_free (socket_dir);
+
  g_signal_connect (daemon, "shutdown",
 		    G_CALLBACK (daemon_shutdown), loop);


--- a/debian/changelog
+++ b/debian/changelog
-gvfs (1.47.91-1ubuntu1) hirsute; urgency=medium
+gvfs (1.48.1-2ubuntu1) impish; urgency=medium

-  * Merge with debian. Remaining changes:
+  * New stable version resynchronized on debian. 
+    - includes fix for the admin backend (lp: #1935734)
+    Remaining changes:
    - Revert upstream changes to port to fuse 3. This is in universe in Ubuntu
      and we'll need to work out a plan to transition away from fuse 2
      + debian/control{,.in}
      + debian/patches/Revert-fuse-Remove-max_write-limit.patch
      + debian/patches/Revert-fuse-Adapt-gvfsd-fuse-to-use-fuse-3.x.patch

- -- Sebastien Bacher <seb128@debian.org>  Mon, 15 Mar 2021 10:53:07 +0100
+ -- Sebastien Bacher <seb128@ubuntu.com>  Wed, 06 Oct 2021 10:39:37 +0200
+
+gvfs (1.48.1-2) unstable; urgency=medium
+
+  * Team upload
+  * Release to unstable
+
+ -- Simon McVittie <smcv@debian.org>  Tue, 24 Aug 2021 13:53:46 +0100
+
+gvfs (1.48.1-1) experimental; urgency=medium
+
+  [ Simon McVittie ]
+  * New upstream stable release
+    - Prevent socket leaks if socket dir is inaccessible from client
+    - admin: Fix regressions caused by port to named sockets
+    - udisks2: Report unmount progress after showing blocking processes
+    - Translation updates
+  * d/p/admin-Make-the-privileged-group-configurable.patch:
+    Add patch from upstream to make the privileged group
+    build-time-configurable
+  * d/rules: Configure 'sudo' to be the privileged group
+  * d/p/02_polkit_sudo_group.patch:
+    Remove patch previously used to replace hard-coded 'wheel' group with
+    'sudo', no longer needed
+  * d/p/admin-Fix-mount-operation-hang-caused-by-pkexec-failure.patch:
+    Fix a hang if the authentication prompt for pkexec is cancelled while
+    trying to mount the admin:// backend
+  * d/extra: Fix "whatis" entry for generated man pages
+  * Override Lintian breakout-link false positives.
+    We still need these symlinks for now (at least gvfsd-archive, because
+    nemo hard-codes it), and Lintian is being over-zealous to diagnose a
+    symlink from /usr/lib into /usr/libexec as an error.
+
+  [ Laurent Bigonville ]
+  * Do not BD on polkit on non-linux architectures, admin backend is disabled
+  * debian/gvfs-common.install: tmpfiles.d file is only installed on linux
+    archs
+  * debian/control.in: Mark libgphoto2-dev, libcdio-paranoia-dev and
+    libmtp-dev BD as linux-any
+  * Disable USB support on kfreebsd as well as it requires a newer libusb
+
+ -- Simon McVittie <smcv@debian.org>  Mon, 16 Aug 2021 10:58:38 +0100

 gvfs (1.47.91-1) experimental; urgency=medium


--- a/debian/control
+++ b/debian/control
@@ -6,7 +6,7 @@ Source: gvfs
 Section: gnome
 Priority: optional
 Maintainer: Debian GNOME Maintainers <pkg-gnome-maintainers@lists.alioth.debian.org>
-Uploaders: Iain Lane <laney@debian.org>, Jeremy Bicha <jbicha@debian.org>, Laurent Bigonville <bigon@debian.org>
+Uploaders: Iain Lane <laney@debian.org>, Jeremy Bicha <jbicha@debian.org>, Laurent Bigonville <bigon@debian.org>, Sebastien Bacher <seb128@debian.org>
 Build-Depends: debhelper-compat (= 12),
               dh-exec (>= 0.13),
               gnome-pkg-tools (>= 0.7),
@@ -18,7 +18,7 @@ Build-Depends: debhelper-compat (= 12),
               libbluetooth-dev (>= 4.0) [linux-any],
               libbluray-dev,
               libcap-dev [linux-any],
-               libcdio-paranoia-dev (>= 0.78.2),
+               libcdio-paranoia-dev (>= 0.78.2) [linux-any],
               libdbus-1-dev,
               libexpat1-dev,
               libfuse-dev [!hurd-any],
@@ -27,24 +27,25 @@ Build-Depends: debhelper-compat (= 12),
               libgdata-dev (>= 0.18),
               libglib2.0-dev (>= 2.65.1),
               libgoa-1.0-dev (>= 3.17.1),
-               libgphoto2-dev (>= 2.5.0),
+               libgphoto2-dev (>= 2.5.0) [linux-any],
               libgudev-1.0-dev (>= 147) [linux-any],
               libimobiledevice-dev (>= 1.2) [!hurd-any],
               libltdl-dev,
-               libmtp-dev (>= 1.1.6),
+               libmtp-dev (>= 1.1.6) [linux-any],
               libnfs-dev (>= 1.9.7),
               libplist-dev,
-               libpolkit-gobject-1-dev,
+               libpolkit-gobject-1-dev [linux-any],
               libsecret-1-dev,
               libsmbclient-dev (>= 3.4.0) [!hurd-any],
               libsoup2.4-dev (>= 2.58.0),
               libsystemd-dev [linux-any],
               libudisks2-dev (>= 1.97) [linux-any],
+               libusb-1.0-0-dev (>= 1.0.21) [linux-any],
               libxml2-dev,
               meson (>= 0.53),
               openssh-client,
               pkg-config,
-               policykit-1 (>= 0.105-18~),
+               policykit-1 (>= 0.105-18~) [linux-any],
               systemd (>= 206) [linux-any]
 Rules-Requires-Root: no
 Standards-Version: 4.5.1

--- a/debian/control.in
+++ b/debian/control.in
@@ -14,7 +14,7 @@ Build-Depends: debhelper-compat (= 12),
               libbluetooth-dev (>= 4.0) [linux-any],
               libbluray-dev,
               libcap-dev [linux-any],
-               libcdio-paranoia-dev (>= 0.78.2),
+               libcdio-paranoia-dev (>= 0.78.2) [linux-any],
               libdbus-1-dev,
               libexpat1-dev,
               libfuse-dev [!hurd-any],
@@ -23,24 +23,25 @@ Build-Depends: debhelper-compat (= 12),
               libgdata-dev (>= 0.18),
               libglib2.0-dev (>= 2.65.1),
               libgoa-1.0-dev (>= 3.17.1),
-               libgphoto2-dev (>= 2.5.0),
+               libgphoto2-dev (>= 2.5.0) [linux-any],
               libgudev-1.0-dev (>= 147) [linux-any],
               libimobiledevice-dev (>= 1.2) [!hurd-any],
               libltdl-dev,
-               libmtp-dev (>= 1.1.6),
+               libmtp-dev (>= 1.1.6) [linux-any],
               libnfs-dev (>= 1.9.7),
               libplist-dev,
-               libpolkit-gobject-1-dev,
+               libpolkit-gobject-1-dev [linux-any],
               libsecret-1-dev,
               libsmbclient-dev (>= 3.4.0) [!hurd-any],
               libsoup2.4-dev (>= 2.58.0),
               libsystemd-dev [linux-any],
               libudisks2-dev (>= 1.97) [linux-any],
+               libusb-1.0-0-dev (>= 1.0.21) [linux-any],
               libxml2-dev,
               meson (>= 0.53),
               openssh-client,
               pkg-config,
-               policykit-1 (>= 0.105-18~),
+               policykit-1 (>= 0.105-18~) [linux-any],
               systemd (>= 206) [linux-any]
 Rules-Requires-Root: no
 Standards-Version: 4.5.1

--- a/debian/gvfs-backends.lintian-overrides
+++ b/debian/gvfs-backends.lintian-overrides
+breakout-link usr/lib/gvfs/gvfs* -> usr/libexec/gvfs*
--- a/debian/gvfs-common.install
+++ b/debian/gvfs-common.install
@@ -2,4 +2,4 @@
 usr/share/locale
 usr/share/man/man1
 usr/share/man/man7
-usr/lib/tmpfiles.d/gvfsd-fuse-tmpfiles.conf	[!hurd-any]
+usr/lib/tmpfiles.d/gvfsd-fuse-tmpfiles.conf	[linux-any]
--- a/debian/gvfs-daemons.lintian-overrides
+++ b/debian/gvfs-daemons.lintian-overrides
+breakout-link usr/lib/gvfs/gvfs* -> usr/libexec/gvfs*
--- a/debian/gvfs-fuse.lintian-overrides
+++ b/debian/gvfs-fuse.lintian-overrides
+breakout-link usr/lib/gvfs/gvfs* -> usr/libexec/gvfs*
--- a/debian/patches/0008-Skip-the-umockdev-test.patch
+++ b/debian/patches/0008-Skip-the-umockdev-test.patch
@@ -12,7 +12,7 @@ Bug-Upstream: https://bugzilla.gnome.org/show_bug.cgi?id=794488
 1 file changed, 3 insertions(+), 2 deletions(-)

 diff --git a/test/gvfs-test b/test/gvfs-test
-index 3038923..5fc335b 100755
+index 8beb726..eafa3de 100755
 --- a/test/gvfs-test
 +++ b/test/gvfs-test
 @@ -1725,8 +1725,9 @@ class Trash(GvfsTestCase):

--- a/debian/patches/0009-gvfs-test-Increase-timeout-to-10s.patch
+++ b/debian/patches/0009-gvfs-test-Increase-timeout-to-10s.patch
@@ -13,7 +13,7 @@ Forwarded: https://bugzilla.gnome.org/show_bug.cgi?id=794487
 1 file changed, 3 insertions(+), 3 deletions(-)

 diff --git a/test/gvfs-test b/test/gvfs-test
-index 5fc335b..c689b9a 100755
+index eafa3de..b8929cc 100755
 --- a/test/gvfs-test
 +++ b/test/gvfs-test
 @@ -176,7 +176,7 @@ class GvfsTestCase(unittest.TestCase):

--- a/debian/patches/02_polkit_sudo_group.patch
+++ b/debian/patches/02_polkit_sudo_group.patch
-From: Laurent Bigonville <bigon@debian.org>
-Date: Tue, 8 Nov 2016 19:44:47 +0100
-Subject: Use sudo group instead of the wheel one
-
-since the wheel group doesn't exist on Debian
-
-Forwarded: not-needed
---
- daemon/org.gtk.vfs.file-operations.rules | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/daemon/org.gtk.vfs.file-operations.rules b/daemon/org.gtk.vfs.file-operations.rules
-index 6e528e9..e71656f 100644
--- a/daemon/org.gtk.vfs.file-operations.rules
-+++ b/daemon/org.gtk.vfs.file-operations.rules
-@@ -7,7 +7,7 @@ polkit.addRule(function(action, subject) {
-         if ((action.id == "org.gtk.vfs.file-operations-helper") &&
-             subject.local &&
-             subject.active &&
-            subject.isInGroup ("wheel")) {
-+            subject.isInGroup ("sudo")) {
-             return polkit.Result.YES;
-         }
- });
--- a/debian/patches/Remove-version-from-polkit-gobject-dependency.patch
+++ b/debian/patches/Remove-version-from-polkit-gobject-dependency.patch
@@ -11,10 +11,10 @@ Forwarded: not-needed, Debian-specific
 1 file changed, 1 insertion(+), 1 deletion(-)

 diff --git a/meson.build b/meson.build
-index a758eb6..24de0d4 100644
+index af80b29..5410bbe 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -302,7 +302,7 @@ config_h.set('HAVE_GCR', enable_gcr)
+@@ -303,7 +303,7 @@ privileged_group = get_option('privileged_group')
 enable_admin = get_option('admin')
 if enable_admin
   libcap_dep = dependency('libcap')

--- a/debian/patches/Revert-fuse-Adapt-gvfsd-fuse-to-use-fuse-3.x.patch
+++ b/debian/patches/Revert-fuse-Adapt-gvfsd-fuse-to-use-fuse-3.x.patch
@@ -285,7 +285,7 @@ Index: gvfs/meson.build
 ===================================================================
 --- gvfs.orig/meson.build
 +++ gvfs/meson.build
-@@ -330,7 +330,7 @@ config_h.set('HAVE_GUDEV', enable_gudev)
+@@ -331,7 +331,7 @@ config_h.set('HAVE_GUDEV', enable_gudev)
 # *** Check for FUSE ***
 enable_fuse = get_option('fuse')
 if enable_fuse