/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to debian/control

  • Committer: Teddy Hogeborn
  • Date: 2014-06-08 03:10:08 UTC
  • mto: (237.7.272 trunk)
  • mto: This revision was merged to the branch mainline in revision 317.
  • Revision ID: teddy@recompile.se-20140608031008-mc9bd7b024a3q0y0
Address a very theoretical possible security issue in mandos-client.

If there were to run some sort of "cleaner" process for /run/tmp (or
/tmp), and mandos-client were to run for long enough for that cleaner
process to remove the temporary directory for GPGME, there was a
possibility that another unprivileged process could trick the (also
unprivileged) mandos-client process to remove other files or symlinks
which the unprivileged mandos-client process was allowed to remove.
This is not currently known to have been exploitable, since there are
no known initramfs environments running such cleaner processes.

* plugins.d/mandos-client.c (main): Use O_NOFOLLOW when opening
                                    tempdir for cleaning.

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/control
5
5
Uploaders: Teddy Hogeborn <teddy@recompile.se>,
6
6
           Björn Påhlsson <belorn@recompile.se>
7
7
Build-Depends: debhelper (>= 9), docbook-xml, docbook-xsl,
8
 
        libavahi-core-dev, libgpgme11-dev, libgnutls28-dev
9
 
        | gnutls-dev, xsltproc, pkg-config
10
 
Build-Depends-Indep: systemd, python2.7, python2.7-gnutls,
11
 
        python2.7-dbus, python2.7-avahi, python2.7-gobject
12
 
Standards-Version: 3.9.6
 
8
        libavahi-core-dev, libgpgme11-dev, libgnutls-dev, xsltproc,
 
9
        pkg-config
 
10
Build-Depends-Indep: systemd, python (>=2.6), python-gnutls,
 
11
        python-dbus, python-avahi, python-gobject,
 
12
        python (>=2.7) | python-argparse
 
13
Standards-Version: 3.9.5
13
14
Vcs-Bzr: http://ftp.recompile.se/pub/mandos/trunk
14
15
Vcs-Browser: http://bzr.recompile.se/loggerhead/mandos/trunk/files
15
16
Homepage: http://www.recompile.se/mandos
16
17
 
17
18
Package: mandos
18
19
Architecture: all
19
 
Depends: ${misc:Depends}, python (>= 2.7), python2.7, python-gnutls,
20
 
        python2.7-gnutls, python-dbus, python2.7-dbus, python-avahi,
21
 
        python2.7-avahi, python-gobject, python2.7-gobject,
22
 
        avahi-daemon, adduser, python-urwid, python2.7-urwid,
23
 
        gnupg (<< 2), initscripts (>= 2.88dsf-13.3)
24
 
Recommends: ssh-client | fping
 
20
Depends: ${misc:Depends}, python (>=2.6), python-gnutls, python-dbus,
 
21
        python-avahi, python-gobject, avahi-daemon, adduser,
 
22
        python-urwid, python (>=2.7) | python-argparse, gnupg (<< 2),
 
23
        initscripts (>= 2.88dsf-13.3)
 
24
Recommends: fping
25
25
Description: server giving encrypted passwords to Mandos clients
26
26
 This is the server part of the Mandos system, which allows
27
27
 computers to have encrypted root file systems and at the
41
41
Architecture: linux-any
42
42
Depends: ${shlibs:Depends}, ${misc:Depends}, adduser, cryptsetup,
43
43
        gnupg (<< 2), initramfs-tools, dpkg-dev (>=1.16.0)
44
 
Recommends: ssh
45
44
Breaks: dropbear (<= 0.53.1-1)
46
45
Enhances: cryptsetup
47
46
Description: do unattended reboots with an encrypted root file system