/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to debian/control

  • Committer: Teddy Hogeborn
  • Date: 2014-06-08 03:10:08 UTC
  • mto: (237.7.272 trunk)
  • mto: This revision was merged to the branch mainline in revision 317.
  • Revision ID: teddy@recompile.se-20140608031008-mc9bd7b024a3q0y0
Address a very theoretical possible security issue in mandos-client.

If there were to run some sort of "cleaner" process for /run/tmp (or
/tmp), and mandos-client were to run for long enough for that cleaner
process to remove the temporary directory for GPGME, there was a
possibility that another unprivileged process could trick the (also
unprivileged) mandos-client process to remove other files or symlinks
which the unprivileged mandos-client process was allowed to remove.
This is not currently known to have been exploitable, since there are
no known initramfs environments running such cleaner processes.

* plugins.d/mandos-client.c (main): Use O_NOFOLLOW when opening
                                    tempdir for cleaning.

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/control
4
4
Maintainer: Mandos Maintainers <mandos@recompile.se>
5
5
Uploaders: Teddy Hogeborn <teddy@recompile.se>,
6
6
           Björn Påhlsson <belorn@recompile.se>
7
 
Build-Depends: debhelper (>= 7), docbook-xml, docbook-xsl,
 
7
Build-Depends: debhelper (>= 9), docbook-xml, docbook-xsl,
8
8
        libavahi-core-dev, libgpgme11-dev, libgnutls-dev, xsltproc,
9
9
        pkg-config
10
 
Standards-Version: 3.9.3
 
10
Build-Depends-Indep: systemd, python (>=2.6), python-gnutls,
 
11
        python-dbus, python-avahi, python-gobject,
 
12
        python (>=2.7) | python-argparse
 
13
Standards-Version: 3.9.5
11
14
Vcs-Bzr: http://ftp.recompile.se/pub/mandos/trunk
12
15
Vcs-Browser: http://bzr.recompile.se/loggerhead/mandos/trunk/files
13
16
Homepage: http://www.recompile.se/mandos
14
 
DM-Upload-Allowed: yes
15
17
 
16
18
Package: mandos
17
19
Architecture: all
18
20
Depends: ${misc:Depends}, python (>=2.6), python-gnutls, python-dbus,
19
21
        python-avahi, python-gobject, avahi-daemon, adduser,
20
 
        python-urwid, python (>=2.7) | python-argparse,
21
 
        python-gnupginterface
 
22
        python-urwid, python (>=2.7) | python-argparse, gnupg (<< 2),
 
23
        initscripts (>= 2.88dsf-13.3)
22
24
Recommends: fping
23
25
Description: server giving encrypted passwords to Mandos clients
24
26
 This is the server part of the Mandos system, which allows
38
40
Package: mandos-client
39
41
Architecture: linux-any
40
42
Depends: ${shlibs:Depends}, ${misc:Depends}, adduser, cryptsetup,
41
 
        gnupg (<< 2), initramfs-tools
 
43
        gnupg (<< 2), initramfs-tools, dpkg-dev (>=1.16.0)
42
44
Breaks: dropbear (<= 0.53.1-1)
43
45
Enhances: cryptsetup
44
46
Description: do unattended reboots with an encrypted root file system