From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.io!.POSTED.blaine.gmane.org!not-for-mail From: Stefan Kangas Newsgroups: gmane.emacs.bugs Subject: bug#66245: [PATCH] ; Silence macOS 14 warning Date: Fri, 29 Sep 2023 02:34:52 -0700 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Injection-Info: ciao.gmane.io; posting-host="blaine.gmane.org:116.202.254.214"; logging-data="35090"; mail-complaints-to="usenet@ciao.gmane.io" Cc: 66245@debbugs.gnu.org, eliz@gnu.org, Eshel Yaron To: Alan Third Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Fri Sep 29 11:36:22 2023 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane-mx.org Original-Received: from lists.gnu.org ([209.51.188.17]) by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1qm9v4-0008nK-7u for geb-bug-gnu-emacs@m.gmane-mx.org; Fri, 29 Sep 2023 11:36:22 +0200 Original-Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qm9uh-00084P-2B; Fri, 29 Sep 2023 05:35:59 -0400 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qm9uV-0007rb-Td for bug-gnu-emacs@gnu.org; Fri, 29 Sep 2023 05:35:49 -0400 Original-Received: from debbugs.gnu.org ([2001:470:142:5::43]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1qm9uV-0007mm-LO for bug-gnu-emacs@gnu.org; Fri, 29 Sep 2023 05:35:47 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1qm9uj-0005Jo-O2 for bug-gnu-emacs@gnu.org; Fri, 29 Sep 2023 05:36:01 -0400 X-Loop: help-debbugs@gnu.org Resent-From: Stefan Kangas Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Fri, 29 Sep 2023 09:36:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 66245 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: patch Original-Received: via spool by 66245-submit@debbugs.gnu.org id=B66245.169598011720381 (code B ref 66245); Fri, 29 Sep 2023 09:36:01 +0000 Original-Received: (at 66245) by debbugs.gnu.org; 29 Sep 2023 09:35:17 +0000 Original-Received: from localhost ([127.0.0.1]:55350 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1qm9u1-0005If-2h for submit@debbugs.gnu.org; Fri, 29 Sep 2023 05:35:17 -0400 Original-Received: from mail-lj1-x230.google.com ([2a00:1450:4864:20::230]:50686) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1qm9tx-0005IL-H4 for 66245@debbugs.gnu.org; Fri, 29 Sep 2023 05:35:15 -0400 Original-Received: by mail-lj1-x230.google.com with SMTP id 38308e7fff4ca-2c189dabcc3so45074991fa.1 for <66245@debbugs.gnu.org>; Fri, 29 Sep 2023 02:34:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1695980093; x=1696584893; darn=debbugs.gnu.org; h=cc:to:subject:message-id:date:mime-version:references:in-reply-to :from:from:to:cc:subject:date:message-id:reply-to; bh=+CE0CVJk6DjKuLRJuSejKruOCj8ebptFXeRDdIbvNrw=; b=Ht0Bp28gM5slXEVtgQQvpbvsRibrC5hgPk4g4diAHgLvsSobXqjrJsyWstVWDTioXH SOcyWwmpEX/E4JLXCixGwMufNN2ZClUhutBvlY0jG/VXrQbIbUmChu8E+JkALFwPvILP EkAcSWg80L3TkOa8GPMP8cH5nPoz/LbpGHsoZMOxCR9HAvkys1I6COhxYcAzLDmpGAW3 PiYB/As8n+RjBgx6kAZu8IaYozyBTemTO+pv20y+UzovUf/U53AYYCRofByqSJbcMTUd XtukVEftbMzOoGv79/csdBUe3BgUx9c/lcd94Z1FbuiaxwGskXTT/FhgrojEpEoQUvsx KCeQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1695980093; x=1696584893; h=cc:to:subject:message-id:date:mime-version:references:in-reply-to :from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=+CE0CVJk6DjKuLRJuSejKruOCj8ebptFXeRDdIbvNrw=; b=NgbSWjO0E34wzXPu33JbajymbG07PtxKfaxoIft8ySjOx+gMH3QUCxPiVixuglXwsl 0fdEvb45gNSfB85BcPWKi6fKlxO+FozjIFgwJBND2L1htWzUu3NaY70fT6xQhbxDKF2Z UNVC8W9BugmeMVyqZhg5F7LZcsDi8mnzQi7OEEDmWnneUjv9ri+qoqwCXcJWlTnhMYPu fpUJLNHEJfF3FqaXspMlNyDHBra6Y4u8Mue9+li/cDgSmZEK3eRnCS4eA5ds9P/7OdHq 8YIVlrXuJ7yUCBvQLUf+fYbVeFGEaJxBYzUW3bXAzWzdxjNPsgtzjwnzksu4c0uuSZaf JHJw== X-Gm-Message-State: AOJu0YwwwpxjyaEgxJ73dIYUMJ1pg6VnFYQYEOxRz+UbWrBq1n1BHUB2 mbcZfuIoFGs/aIcEtbB7K71csOSG0SseBsBPvOo= X-Google-Smtp-Source: AGHT+IFt1ADTqVr5t6kznrq/m8r5Q8ewpkaCcPmb/zwBvnITPSicyEErf00lkT1FsIOTdmNxv45rBw87x9V8lhAS130= X-Received: by 2002:a2e:780f:0:b0:2bf:e65d:e816 with SMTP id t15-20020a2e780f000000b002bfe65de816mr2895443ljc.36.1695980092685; Fri, 29 Sep 2023 02:34:52 -0700 (PDT) Original-Received: from 753933720722 named unknown by gmailapi.google.com with HTTPREST; Fri, 29 Sep 2023 02:34:52 -0700 In-Reply-To: X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Original-Sender: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Xref: news.gmane.io gmane.emacs.bugs:271474 Archived-At: Alan Third writes: > I'm not sure that Emacs has any particularly noteworthy privileges, > though. The example they give is an application that has installer > type privileges, which I doubt Emacs would ever have or need. One thing we do commonly have, I think, is access to the Documents directory. OTOH, on GNU/Linux we typically don't really have any special protection for user files. >> The full exploit chain there is not very easy to understand, but it >> seems like several techniques are used for some of the more nasty stuff, >> and some of the steps have been fixed already. There can be other ways >> to do the same thing of course. So I'm not sure what to say about the >> urgency of fixing this; it could be urgent, or it could wait until 29.2. >> What is your view? > > I'm not sure either. Is there a rough timeline for the release of > 29.2? I feel like this is perhaps not very urgent, but if we're > talking, say, three or four months or more we maybe don't want to wait > that long. I don't think we have a rough timeline for 29.2 as of now. I'm leaning towards just including this in the next release as usual, since the bug only affects the macOS port, and anyways, and IIUC, depends on other things being vulnerable to be exploited. But I'm very open to being convinced otherwise, if anyone sees any problems with that. Eli, do you have any comments here?