/mandos/trunk : changes

» Changes from revision 1123

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

From Revision 697 to 678

expand all

Rev	Summary	Authors	Date
697	Address a very theoretical possible security issue in mandos... Address a very theoretical possible security issue in mandos-client. If there were to run some sort of "cleaner" process for /run/tmp (or /tmp), and mandos-client were to run for long enough for that cleaner process to remove the temporary directory for GPGME, there was a possibility that another unprivileged process could trick the (also unprivileged) mandos-client process to remove other files or symlinks which the unprivileged mandos-client process was allowed to remove. This is not currently known to have been exploitable, since there are no known initramfs environments running such cleaner processes. * plugins.d/mandos-client.c (main): Use O_NOFOLLOW when opening tempdir for cleaning.	Teddy Hogeborn	11 years ago
696	Bug fix for mandos-client: Run the network hook, not the dir... Bug fix for mandos-client: Run the network hook, not the directory. * plugins.d/mandos-client.d (set_cloexec_flag): Removed. (run_network_hooks): Do not set O_CLOEXEC on "hookdir_fd". Instead, open hook to new "hook_fd" and simply close(hookdir_fd) before fexecve().	Teddy Hogeborn	11 years ago
695	Make mandos-client use more scandirat(). Make mandos-client use more scandirat(). * plugins.d/mandos-client.d (main): Use scandirat() when removing GPGME temp directory.	Teddy Hogeborn	11 years ago
694	Make mandos-client use unlinkat() instead of remove(). Make mandos-client use unlinkat() instead of remove(). * plugins.d/mandos-client.d (main): Replace remove() with unlinkat().	Teddy Hogeborn	11 years ago
693	Make mandos-client use fstatat(). Make mandos-client use fstatat(). * plugins.d/mandos-client.d (runnable_hook): Use fstatat().	Teddy Hogeborn	11 years ago
692	Make mandos-client use fexecve(). Make mandos-client use fexecve(). * plugins.d/mandos-client.d (run_network_hooks): Use fexecve().	Teddy Hogeborn	11 years ago
691	Make mandos-client use scandirat() if it exists. Make mandos-client use scandirat() if it exists. * plugins.d/mandos-client.d (hookdir_fd): File descriptor for hookdir. (set_cloexec_flag): Define this function if O_CLOEXEC is undefined. (run_network_hooks): Open hookdir_fd. Use scandirat() if it exists.	Teddy Hogeborn	11 years ago
690	Fix typo in code comment. Fix typo in code comment. * debian/mandos.postinst: Fix typo in comment.	Teddy Hogeborn	11 years ago
689	Minor bug fix in mandos-client: Remove memory leak for netwo... Minor bug fix in mandos-client: Remove memory leak for network hooks. * plugins.d/mandos-client.c (runnable_hook): Call free() on full file name of network hook.	Teddy Hogeborn	11 years ago
688	Minor bug fix in mandos-client: Allow periods in network hoo... Minor bug fix in mandos-client: Allow periods in network hook names. * plugins.d/mandos-client.c (runnable_hook): Add "." to strspn() call to match documentation.	Teddy Hogeborn	11 years ago
687	White space fix only. White space fix only. * plugins.d/mandos-client.c (main): Indent unindented blank lines.	Teddy Hogeborn	11 years ago
686	Merge from release branch. Merge from release branch.	Teddy Hogeborn	11 years ago
685	Depend on new enough version of dpkg-dev. Depend on new enough version of dpkg-dev. * debian/control (mandos-client/Depends): Add "dpkg-dev (>=1.16.0)"; initramfs-tools-hook runs "dpkg-architecture -qDEB_HOST_MULTIARCH".	Teddy Hogeborn	11 years ago
684	Merge from release branch. Merge from release branch.	Teddy Hogeborn	11 years ago
683	Do not run self-tests when building arch-indep Debian packag... Do not run self-tests when building arch-indep Debian package. * debian/rules (override_dh_auto_test-arch): New; does nothing.	Teddy Hogeborn	11 years ago
682	Merge from release branch. Merge from release branch.	Teddy Hogeborn	11 years ago
681	Do not depend on new version of avahi-daemon or systemd. Do not depend on new version of avahi-daemon or systemd. * debian/control (Package: mandos/Depends:): Remove the dependency on "avahi-daemon (>= 0.6.31-3) \| systemd-sysv". It is unnecessary since we have a workaround in debian/mandos.postinst anyway.	Teddy Hogeborn	11 years ago
680	Minor changes to minimize diff from last release. Minor changes to minimize diff from last release. * plugins.d/mandos-client.c: Minor changes (mostly white space).	Teddy Hogeborn	11 years ago
679	Update copyright year. Update copyright year. * mandos-keygen: Update copyright year. * plugin-runner.c: - '' - * plugins.d/askpass-fifo.c: - '' - * plugins.d/mandos-client.c: - '' - * plugins.d/password-prompt.c: - '' - * plugins.d/plymouth.c: - '' - * plugins.d/splashy.c: - '' - * plugins.d/usplash.c: - '' -	Teddy Hogeborn	11 years ago
678	Fix location and format of signing key file. Fix location and format of signing key file. * debian/upstream/signing-key.asc: Added. * debian/upstream-signing-key.pgp: Removed.	Teddy Hogeborn	11 years ago