/mandos/trunk : changes

» Changes from revision 1291

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

From Revision 702 to 683

expand all

Rev	Summary	Authors	Date
702	In plugin-runner, protect against a larger FD_SETSIZE than f... In plugin-runner, protect against a larger FD_SETSIZE than fd_set. * plugin-runner.c (main): Before forking, check that the first FD from pipe() does not exceed FD_SETSIZE.	Teddy Hogeborn	11 years ago
701	plugin-runner: Restore resources correctly if fork() fails. plugin-runner: Restore resources correctly if fork() fails. * plugin-runner.c (main): If fork() fails, close pipe FD's and restore signal mask for SIGCHLD.	Teddy Hogeborn	11 years ago
700	plugin-runner: Do not leak file descriptors on certain error... plugin-runner: Do not leak file descriptors on certain errors. * plugin-runner.c (main): If set_cloexec_flag fails, close pipe FD's.	Teddy Hogeborn	11 years ago
699	Fix free() of possibly uninitialized pointer in mandos-clien... Fix free() of possibly uninitialized pointer in mandos-client. * plugins.d/mandos-client (main): Initialize "direntries" to NULL so it can be free()'d even if scandir() fails.	Teddy Hogeborn	11 years ago
698	Fix mandos server "--servicename" option, broken since 1.6.4... Fix mandos server "--servicename" option, broken since 1.6.4. * mandos (initlogger): Make "syslogger" a global variable again.	Teddy Hogeborn	11 years ago
697	Address a very theoretical possible security issue in mandos... Address a very theoretical possible security issue in mandos-client. If there were to run some sort of "cleaner" process for /run/tmp (or /tmp), and mandos-client were to run for long enough for that cleaner process to remove the temporary directory for GPGME, there was a possibility that another unprivileged process could trick the (also unprivileged) mandos-client process to remove other files or symlinks which the unprivileged mandos-client process was allowed to remove. This is not currently known to have been exploitable, since there are no known initramfs environments running such cleaner processes. * plugins.d/mandos-client.c (main): Use O_NOFOLLOW when opening tempdir for cleaning.	Teddy Hogeborn	11 years ago
696	Bug fix for mandos-client: Run the network hook, not the dir... Bug fix for mandos-client: Run the network hook, not the directory. * plugins.d/mandos-client.d (set_cloexec_flag): Removed. (run_network_hooks): Do not set O_CLOEXEC on "hookdir_fd". Instead, open hook to new "hook_fd" and simply close(hookdir_fd) before fexecve().	Teddy Hogeborn	11 years ago
695	Make mandos-client use more scandirat(). Make mandos-client use more scandirat(). * plugins.d/mandos-client.d (main): Use scandirat() when removing GPGME temp directory.	Teddy Hogeborn	11 years ago
694	Make mandos-client use unlinkat() instead of remove(). Make mandos-client use unlinkat() instead of remove(). * plugins.d/mandos-client.d (main): Replace remove() with unlinkat().	Teddy Hogeborn	11 years ago
693	Make mandos-client use fstatat(). Make mandos-client use fstatat(). * plugins.d/mandos-client.d (runnable_hook): Use fstatat().	Teddy Hogeborn	11 years ago
692	Make mandos-client use fexecve(). Make mandos-client use fexecve(). * plugins.d/mandos-client.d (run_network_hooks): Use fexecve().	Teddy Hogeborn	11 years ago
691	Make mandos-client use scandirat() if it exists. Make mandos-client use scandirat() if it exists. * plugins.d/mandos-client.d (hookdir_fd): File descriptor for hookdir. (set_cloexec_flag): Define this function if O_CLOEXEC is undefined. (run_network_hooks): Open hookdir_fd. Use scandirat() if it exists.	Teddy Hogeborn	11 years ago
690	Fix typo in code comment. Fix typo in code comment. * debian/mandos.postinst: Fix typo in comment.	Teddy Hogeborn	11 years ago
689	Minor bug fix in mandos-client: Remove memory leak for netwo... Minor bug fix in mandos-client: Remove memory leak for network hooks. * plugins.d/mandos-client.c (runnable_hook): Call free() on full file name of network hook.	Teddy Hogeborn	11 years ago
688	Minor bug fix in mandos-client: Allow periods in network hoo... Minor bug fix in mandos-client: Allow periods in network hook names. * plugins.d/mandos-client.c (runnable_hook): Add "." to strspn() call to match documentation.	Teddy Hogeborn	11 years ago
687	White space fix only. White space fix only. * plugins.d/mandos-client.c (main): Indent unindented blank lines.	Teddy Hogeborn	11 years ago
686	Merge from release branch. Merge from release branch.	Teddy Hogeborn	11 years ago
685	Depend on new enough version of dpkg-dev. Depend on new enough version of dpkg-dev. * debian/control (mandos-client/Depends): Add "dpkg-dev (>=1.16.0)"; initramfs-tools-hook runs "dpkg-architecture -qDEB_HOST_MULTIARCH".	Teddy Hogeborn	11 years ago
684	Merge from release branch. Merge from release branch.	Teddy Hogeborn	11 years ago
683	Do not run self-tests when building arch-indep Debian packag... Do not run self-tests when building arch-indep Debian package. * debian/rules (override_dh_auto_test-arch): New; does nothing.	Teddy Hogeborn	11 years ago