To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to debian/changelog
- browse files at revision 697
- compare with another revision
- download diff
- download tarball
- view history from revision 697
- Committer: Teddy Hogeborn
- Date: 2014-06-08 03:10:08 UTC
- Revision ID: teddy@recompile.se-20140608031008-mc9bd7b024a3q0y0
Address a very theoretical possible security issue in mandos-client.
If there were to run some sort of "cleaner" process for /run/tmp (or
/tmp), and mandos-client were to run for long enough for that cleaner
process to remove the temporary directory for GPGME, there was a
possibility that another unprivileged process could trick the (also
unprivileged) mandos-client process to remove other files or symlinks
which the unprivileged mandos-client process was allowed to remove.
This is not currently known to have been exploitable, since there are
no known initramfs environments running such cleaner processes.
* plugins.d/mandos-client.c (main): Use O_NOFOLLOW when opening
tempdir for cleaning.
If there were to run some sort of "cleaner" process for /run/tmp (or
/tmp), and mandos-client were to run for long enough for that cleaner
process to remove the temporary directory for GPGME, there was a
possibility that another unprivileged process could trick the (also
unprivileged) mandos-client process to remove other files or symlinks
which the unprivileged mandos-client process was allowed to remove.
This is not currently known to have been exploitable, since there are
no known initramfs environments running such cleaner processes.
* plugins.d/mandos-client.c (main): Use O_NOFOLLOW when opening
tempdir for cleaning.
- files added:
- .bzr-builddeb
- debian
- debian/po
- debian/source
- debian/upstream
- network-hooks.d
- files removed:
- plugins.d/usplash
- files renamed:
- plugins.d/password-request.c => plugins.d/mandos-client.c
- plugins.d/password-request.xml => plugins.d/mandos-client.xml
- files modified:
- .bzrignore
added
removed
debian/changelog
1
mandos (1.6.5-3) unstable; urgency=medium
2
3
* debian/control (mandos-client/Depends): Add "dpkg-dev (>=1.16.0)";
4
initramfs-tools-hook runs "dpkg-architecture -qDEB_HOST_MULTIARCH".
5
(Closes: #750221)
6
7
-- Teddy Hogeborn <teddy@recompile.se> Fri, 06 Jun 2014 04:27:15 +0200
8
9
mandos (1.6.5-2) unstable; urgency=medium
10
11
* debian/rules (override_dh_auto_test-arch): New; does nothing. Fixes
12
FTBFS for build-indep.
13
14
-- Teddy Hogeborn <teddy@recompile.se> Tue, 13 May 2014 08:08:31 +0200
15
16
mandos (1.6.5-1) unstable; urgency=medium
17
18
* New upstream release.
19
* debian/copyright: Change year to "2014".
20
* debian/control (Build-Depends, Build-Depends-Indep): Moved build
21
dependencies of "mandos" package to "Build-Depends-Indep".
22
* debian/upstream/signing-key.asc: New; upstream source public key.
23
* debian/control (Standards-Version): Updated to "3.9.5".
24
* debian/control (mandos/Depends): Remove the dependency on
25
"avahi-daemon (>= 0.6.31-3) | systemd-sysv". It is unnecessary
26
since we have a workaround in debian/mandos.postinst anyway.
27
28
-- Teddy Hogeborn <teddy@recompile.se> Sun, 11 May 2014 22:16:33 +0200
29
30
mandos (1.6.4-1) unstable; urgency=medium
31
32
* New upstream release.
33
* debian/control (Build-Depends): Add Python dependencies to
34
successfully run self-tests.
35
* debian/copyright: GPLv3 now has its own license file - use it.
36
* debian/watch: Set PGP signature URL.
37
38
-- Teddy Hogeborn <teddy@recompile.se> Sun, 16 Feb 2014 14:09:25 +0100
39
40
mandos (1.6.3-1) unstable; urgency=low
41
42
* New upstream release.
43
* debian/control (Build-Depends): Added "systemd".
44
* debian/mandos.dirs (lib/systemd/system): New.
45
* debian/mandos-client.README.Debian: Refer to architecture libdir.
46
* debian/control (mandos/Depends): Add "avahi-daemon (>= 0.6.31-3) |
47
systemd-sysv".
48
* debian/mandos.postinst: If avahi-daemon is version 0.6.31-2 or older,
49
edit /etc/init.d script headers Required-Start
50
and Required-Stop to have "avahi" instead of
51
"avahi-daemon", before insserv(8) sees it.
52
* debian/mandos-client.lintian-overrides: Libdir changes.
53
* debian/rules (override_dh_fixperms): - '' -
54
55
-- Teddy Hogeborn <teddy@recompile.se> Tue, 21 Jan 2014 22:01:30 +0100
56
57
mandos (1.6.2-1) unstable; urgency=low
58
59
* New upstream release.
60
* debian/compat: Changed to "9".
61
* debian/control (Build-Depends): Changed debhelper version to (>= 9).
62
(Standards-Version): Updated to "3.9.4".
63
(DM-Upload-Allowed): Removed.
64
(mandos/Depends): Add "initscripts (>= 2.88dsf-13.3)" to be able to
65
use the "/run" directory (for mandos.pid).
66
* debian/copyright (Copyright): Update year.
67
* Fix "Mandos/gnutls fails to establish connection, "an algorithm that
68
is not enabled was negotiated"" fixed by upstream. (Closes: #702120)
69
70
-- Teddy Hogeborn <teddy@recompile.se> Thu, 24 Oct 2013 22:33:40 +0200
71
72
mandos (1.6.1-1) unstable; urgency=low
73
74
* New upstream release.
75
* debian/control (mandos/Depends): No longer depends on
76
python-gnupginterface, but does
77
depend on gnupg (<< 2).
78
(Build-Depends): Depend on debhelper 8.9.7 for using "override-*-arch"
79
and "override-*-indep" targets in debian/rules.
80
* debian/mandos-client.README: Update Linux documentation link.
81
* debian/rules: Completely rewritten to use debhelper v7.
82
* initramfs-tools-hook: Bug fix: Make sure the right version of GnuPG is
83
copied into the initramfs image. Always assume that GPGME is used to
84
avoid searching for it since the path might not be /usr/lib. Thanks
85
to Félix Sipma <felix+debian@gueux.org> for the initial bug report,
86
and also thanks to Dick Middleton <dick@lingbrae.com> for some more
87
debugging. (Closes: #721903)
88
* Fix "bashism in /bin/sh script" fixed by upstream. (Closes: #690639)
89
90
-- Teddy Hogeborn <teddy@recompile.se> Sun, 13 Oct 2013 19:03:23 +0200
91
92
mandos (1.6.0-1) unstable; urgency=low
93
94
* New upstream release.
95
* debian/copyright (Copyright): Join the two lines to a single line.
96
* debian/mandos-client.README.Debian: Update to refer to the new
97
location of the example network hooks, and the new feature of using
98
all network interfaces.
99
* debian/mandos-client.docs (network-hooks.d): Removed.
100
* debian/mandos-client.examples (network-hooks.d): New.
101
* debian/rules (binary-common): Added "dh_installexamples".
102
(binary-common/dh_fixperms): Exclude new location of
103
"network-hooks.d".
104
105
-- Teddy Hogeborn <teddy@recompile.se> Mon, 18 Jun 2012 00:15:23 +0200
106
107
mandos (1.5.5-1) unstable; urgency=low
108
109
* New upstream release.
110
* debian/copyright (Format): Updated to
111
"http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/".
112
* debian/control (Build-Depends): Removed "man, locales-all".
113
114
-- Teddy Hogeborn <teddy@recompile.se> Fri, 01 Jun 2012 20:30:41 +0200
115
116
mandos (1.5.4-1) unstable; urgency=low
117
118
* New upstream release.
119
120
-- Teddy Hogeborn <teddy@recompile.se> Sun, 20 May 2012 15:38:34 +0200
121
122
mandos (1.5.3-1.2) unstable; urgency=low
123
124
* Non-maintainer upload.
125
* Set Architecture to linux-any. (Closes: #647670)
126
127
-- Robert Millan <rmh@debian.org> Sun, 22 Apr 2012 16:22:01 +0200
128
129
mandos (1.5.3-1.1) unstable; urgency=low
130
131
* Non-maintainer upload.
132
* Fix "mandos FTBFS on buildds": add build-dependency on locales-all and
133
pass LC_ALL to dh_auto_build to make sure we have and use the en_US.UTF-8
134
locale for manpage creation.
135
(Closes: #656178)
136
137
-- gregor herrmann <gregoa@debian.org> Tue, 31 Jan 2012 17:56:05 +0100
138
139
mandos (1.5.3-1) unstable; urgency=low
140
141
* New upstream release.
142
143
-- Teddy Hogeborn <teddy@recompile.se> Sun, 15 Jan 2012 22:05:54 +0100
144
145
mandos (1.5.2-1) unstable; urgency=low
146
147
* New upstream release.
148
149
-- Teddy Hogeborn <teddy@recompile.se> Sun, 08 Jan 2012 11:17:20 +0100
150
151
mandos (1.5.1-1) unstable; urgency=low
152
153
* New upstream release.
154
155
-- Teddy Hogeborn <teddy@recompile.se> Sun, 01 Jan 2012 21:53:31 +0100
156
157
mandos (1.5.0-1) unstable; urgency=low
158
159
* New upstream release.
160
* debian/control (mandos-client/Depends): Added "initramfs-tools".
161
* debian/mandos-client.README.Debian: Corrected mail address and adjust
162
wording.
163
* debian/rules (binary-common): Exclude new nework-hooks.d directory
164
from dh_fixperms.
165
* debian/mandos-client.README.Debian: Document network hook facility.
166
* debian/mandos-client.docs (network-hooks.d): Added.
167
* debian/mandos.dirs (var/lib/mandos): Added.
168
* debian/mandos.postinst: Fix ownership of /var/lib/mandos.
169
* debian/control (mandos/Depends): Added "python-gnupginterface".
170
171
-- Teddy Hogeborn <teddy@recompile.se> Sun, 01 Jan 2012 05:58:11 +0100
172
173
mandos (1.4.1-1) unstable; urgency=low
174
175
* New upstream release.
176
* debian/control (Build-Depends): Added "man".
177
* debian/control (Conflicts): Changed to "Breaks:".
178
* debian/copyright: Updated format.
179
* debian/mandos-client.postinst: Use "set -e" instead of "#!/bin/sh -e".
180
* debian/mandos-client.postrm: - '' -
181
* debian/mandos.postinst: - '' -
182
* debian/mandos.prerm: Consistent magic.
183
184
-- Björn Påhlsson <belorn@fukt.bsnet.se> Sat, 15 Oct 2011 18:18:52 +0200
185
186
mandos (1.4.0-1) unstable; urgency=low
187
188
* New upstream release.
189
* Fix "FTBFS with binutils-gold": Added "-Xlinker --as-needed" to
190
LDFLAGS in Makefile. (Closes: #632145)
191
* Fix "/run transition: uses obsolete /dev/.initramfs": Try both old and
192
new PID file locations. (Closes: #643554)
193
* debian/source/local-options: New; contains "--single-debian-patch".
194
* debian/control (Standards-Version): Upgraded to "3.9.2".
195
(DM-Upload-Allowed): New; set to "yes".
196
* debian/control: Changed domain from "fukt.bsnet.se" to "recompile.se".
197
* debian/copyright: - '' -
198
* debian/mandos-client.README.Debian: - '' -
199
* debian/mandos.README.Debian: - '' -
200
* debian/watch: - '' -
201
* debian/control (mandos/Description): Fix language to placate lintian.
202
203
-- Teddy Hogeborn <teddy@recompile.se> Sun, 09 Oct 2011 19:15:08 +0200
204
205
mandos (1.3.1-1) unstable; urgency=low
206
207
* New upstream release.
208
* Conflict with correct version of dropbear.
209
* New version uses argparse; depend on python (<=2.7) | python-argparse.
210
211
-- Teddy Hogeborn <teddy@fukt.bsnet.se> Wed, 27 Jul 2011 19:47:17 +0200
212
213
mandos (1.3.0-1) unstable; urgency=low
214
215
* New upstream release.
216
* debian/control (mandos): Depend on Python 2.6, remove dependency on
217
python-multiprocessing.
218
(mandos-client): Conflict with dropbear (<< 0.52-5).
219
* debian/mandos-client.postrm (purge): Bug fix: update initramfs also on
220
purge.
221
* debian/mandos-client.lintian-overrides: Added plugins.d/plymouth.
222
223
-- Teddy Hogeborn <teddy@fukt.bsnet.se> Tue, 08 Mar 2011 20:22:57 +0100
224
225
mandos (1.2.3-1) experimental; urgency=low
226
227
* New upstream release.
228
229
-- Teddy Hogeborn <teddy@fukt.bsnet.se> Mon, 11 Oct 2010 19:37:31 +0200
230
231
mandos (1.2.2-1) experimental; urgency=low
232
233
* New upstream release.
234
* plugins.d/splashy.c: Only use ELIBBAD if defined. (Closes: #599256)
235
236
-- Teddy Hogeborn <teddy@fukt.bsnet.se> Thu, 07 Oct 2010 20:27:54 +0200
237
238
mandos (1.2.1-3) experimental; urgency=low
239
240
* debian/changelog: Include entry for NMU of version 1.0.14-1.1.
241
242
-- Teddy Hogeborn <teddy@fukt.bsnet.se> Tue, 05 Oct 2010 20:58:38 +0200
243
244
mandos (1.2.1-2) unstable; urgency=low
245
246
* debian/source/format: New; contains "3.0 (quilt)". Really.
247
248
-- Björn Påhlsson <belorn@fukt.bsnet.se> Sat, 02 Oct 2010 19:46:59 +0200
249
250
mandos (1.2.1-1) unstable; urgency=low
251
252
* New upstream release.
253
* debian/source/format: New; contains "3.0 (quilt)".
254
255
-- Björn Påhlsson <belorn@fukt.bsnet.se> Sat, 02 Oct 2010 19:03:58 +0200
256
257
mandos (1.2-1) unstable; urgency=low
258
259
* New upstream release.
260
* Makefile (LINK_FORTIFY_LD): Remove "-fPIE". (Closes: #557076)
261
* debian/control: Add gnupg dependency to "mandos-client" and removed it
262
from "mandos". Added dependency on "python-urwid" "mandos" since the
263
new "mandos-monitor" utility needs it, and on "python (>=2.6) |
264
python-multiprocessing" since the Mandos server now uses it.
265
* debian/rules: Set BROKEN_PIE on mips and mipsel if a known buggy
266
version of binutils is used.
267
* debian/mandos.docs: Also install "/usr/share/doc/mandos/DBUS-API".
268
* debian/mandos.dirs: Added "etc/dbus-1/system.d".
269
* debian/mandos-client.README.Debian: Update info about DEVICE setting
270
of initramfs.conf.
271
* debian/mandos-client.README.Debian: Remove warning about --connect not
272
looping, since it now does.
273
274
-- Teddy Hogeborn <teddy@fukt.bsnet.se> Tue, 28 Sep 2010 20:46:11 +0200
275
276
mandos (1.0.14-1.1) unstable; urgency=low
277
278
* Non-maintainer upload.
279
* Rebuild against libavahi-core-dev (>= 0.6.26-1).
280
281
-- Michael Biebl <biebl@debian.org> Mon, 12 Jul 2010 16:34:34 +0200
282
283
mandos (1.0.14-1) unstable; urgency=low (HIGH on mips and mipsel)
284
285
* New upstream release.
286
* debian/rules: Build with BROKEN_PIE set on mips and mipsel
287
architectures - fixes FTBFS there.
288
289
-- Teddy Hogeborn <teddy@fukt.bsnet.se> Sun, 25 Oct 2009 20:10:09 +0100
290
291
mandos (1.0.13-1) unstable; urgency=high
292
293
* New upstream release.
294
* Do not copy unnecessary files to initrd (Closes: #551907)
295
296
-- Teddy Hogeborn <teddy@fukt.bsnet.se> Thu, 22 Oct 2009 00:53:21 +0200
297
298
mandos (1.0.12-1) unstable; urgency=low
299
300
* New upstream release.
301
* init.d-mandos: Correct dependencies (Closes: #546928)
302
* debian/control (Standards-Version): Changed to "3.8.3".
303
* debian/mandos-client.README.Debian: Improved wording and formatting.
304
Updated location of nfsroot.txt.
305
* debian/mandos.README.Debian: Improved wording and formatting.
306
* debian/mandos-client.postinst (configure): Don't look for user and
307
group with the old name if upgrading from a new enough version.
308
* debian/mandos.postinst (configure): - '' -
309
* debian/mandos-client.README.Debian: Added text about non-usability of
310
pseudo-network interfaces.
311
312
-- Teddy Hogeborn <teddy@fukt.bsnet.se> Thu, 17 Sep 2009 15:03:59 +0200
313
314
mandos (1.0.11-1) unstable; urgency=low
315
316
* debian/control (Standards-Version): Changed to "3.8.1".
317
* Makefile (GNUTLS_CFLAGS, GNUTLS_CFLAGS): Use "pkg-config" instead of
318
the old "libgnutls-config" script. (Closes: #529836)
319
320
-- Teddy Hogeborn <teddy@fukt.bsnet.se> Sat, 23 May 2009 07:12:20 +0200
321
322
mandos (1.0.10-1) unstable; urgency=low
323
324
* New upstream release.
325
* debian/mandos-client.postinst (update_initramfs): Fix permissions of
326
old initrd.img-*.bak files.
327
328
-- Teddy Hogeborn <teddy@fukt.bsnet.se> Sun, 17 May 2009 04:56:35 +0200
329
330
mandos (1.0.9-1) unstable; urgency=low
331
332
* New upstream release.
333
334
-- Teddy Hogeborn <teddy@fukt.bsnet.se> Sun, 17 May 2009 02:59:45 +0200
335
336
mandos (1.0.8-1) unstable; urgency=low
337
338
* New upstream release.
339
340
-- Teddy Hogeborn <teddy@fukt.bsnet.se> Wed, 25 Feb 2009 02:26:57 +0100
341
342
mandos (1.0.7-1) unstable; urgency=low
343
344
* New upstream release.
345
346
-- Teddy Hogeborn <teddy@fukt.bsnet.se> Tue, 24 Feb 2009 12:58:06 +0100
347
348
mandos (1.0.6-1) unstable; urgency=low
349
350
* New upstream release.
351
* debian/mandos-client.postinst: Converted to Bourne shell. Also
352
minor message change.
353
* debian/mandos-client.postrm: Minor message change.
354
* debian/mandos.postinst: Converted to Bourne shell. Also minor
355
message change.
356
* debian/mandos.prerm: Minor message change.
357
* debian/rules (install-indep): Removed "--no-start" from
358
dh_installinit.
359
* debian/mandos-client.lintian-overrides: Remove obsolete override for
360
unbreakable line in plugin-runner manual page.
361
* debian/control (mandos/Depends): Added "python-gobject".
362
* debian/mandos-client.dirs: Change
363
"usr/share/initramfs-tools/scripts/local-top" to
364
"usr/share/initramfs-tools/scripts/init-premount".
365
* debian/mandos-client.README.Debian: Add reference to initramfs.conf
366
and nfsroot.txt. New section about the new non-local connection
367
feature.
368
369
-- Teddy Hogeborn <teddy@fukt.bsnet.se> Fri, 13 Feb 2009 09:27:25 +0100
370
371
mandos (1.0.5-1) unstable; urgency=low
372
373
* New upstream release.
374
375
-- Teddy Hogeborn <teddy@fukt.bsnet.se> Sat, 17 Jan 2009 02:26:00 +0100
376
377
mandos (1.0.4-1) unstable; urgency=low
378
379
* New upstream release.
380
* debian/watch: New file.
381
* debian/mandos-client.README.Debian: Document new "mandos=off" kernel
382
parameter.
383
384
-- Teddy Hogeborn <teddy@fukt.bsnet.se> Thu, 15 Jan 2009 05:49:22 +0100
385
386
mandos (1.0.3-2) unstable; urgency=low
387
388
* Removed some now-unused debconf files.
389
* Changed postinst scripts to not source debconf/confmodule.
390
* Removed po-debconf from build-depends.
391
392
-- Teddy Hogeborn <teddy@fukt.bsnet.se> Tue, 06 Jan 2009 21:28:20 +0100
393
394
mandos (1.0.3-1) unstable; urgency=low
395
396
* New upstream release.
397
* Add -Xlinker to linker flags to fix FTBFS for some architectures.
398
Thanks to Thiemo Seufer <ths@networkno.de> for the report and
399
fix. (Closes: #509398)
400
* Remove debconf use altogether, thereby stopping debconf abuse. Thanks
401
to Christian Perrier <bubulle@debian.org>. (Closes: #509653)
402
* Add NEWS file to /usr/share/doc directories.
403
* Use and create "_mandos" user+group. Rename old user+group created by
404
older versions of this package.
405
* Fix manual pages by adding build-depend on "docbook-xml".
406
407
-- Teddy Hogeborn <teddy@fukt.bsnet.se> Tue, 06 Jan 2009 01:21:20 +0100
408
409
mandos (1.0.2-1) unstable; urgency=low
410
411
* New upstream release.
412
* debian/copyright: Rewritten to conform to
413
<http://wiki.debian.org/Proposals/CopyrightFormat?action=recall&rev=233>.
414
415
-- Teddy Hogeborn <teddy@fukt.bsnet.se> Fri, 17 Oct 2008 20:42:12 +0200
416
417
mandos (1.0.1-1) unstable; urgency=low
418
419
* New upstream release.
420
* Separate /usr/share/doc/mandos-client/README.Debian into sections with
421
headlines. Add instructions on how to test the server and verify the
422
password.
423
424
-- Teddy Hogeborn <teddy@fukt.bsnet.se> Tue, 07 Oct 2008 23:07:23 +0200
425
426
mandos (1.0-2) unstable; urgency=low
427
428
* Added comments in debian/*.lintian-overrides files. Added Debian
429
revison number to version number.
430
431
-- Teddy Hogeborn <teddy@fukt.bsnet.se> Wed, 01 Oct 2008 17:23:35 +0200
432
433
mandos (1.0-1) unstable; urgency=low
434
435
* Initial Release. (Closes: #500727).
436
437
-- Teddy Hogeborn <teddy@fukt.bsnet.se> Tue, 30 Sep 2008 21:58:43 +0200
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0