From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: Re: 03/03: gnu: borg: Update to 1.0.7. Date: Fri, 19 Aug 2016 18:46:58 -0400 Message-ID: <20160819224658.xrdfzho4vdsnq6iv@jasmine> References: <20160819224218.25362.83274@vcs.savannah.gnu.org> <20160819224219.5260F22015B@vcs.savannah.gnu.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:55230) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1basZG-0008MH-OK for guix-devel@gnu.org; Fri, 19 Aug 2016 18:47:15 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1basZC-0001B9-Ld for guix-devel@gnu.org; Fri, 19 Aug 2016 18:47:13 -0400 Received: from out2-smtp.messagingengine.com ([66.111.4.26]:53650) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1basZ9-0001Aj-Ex for guix-devel@gnu.org; Fri, 19 Aug 2016 18:47:10 -0400 Received: from localhost (c-73-188-17-148.hsd1.pa.comcast.net [73.188.17.148]) by mail.messagingengine.com (Postfix) with ESMTPA id 45F4FF2986 for ; Fri, 19 Aug 2016 18:46:59 -0400 (EDT) Content-Disposition: inline In-Reply-To: <20160819224219.5260F22015B@vcs.savannah.gnu.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: guix-devel@gnu.org On Fri, Aug 19, 2016 at 10:42:19PM +0000, Leo Famulari wrote: > lfam pushed a commit to branch master > in repository guix. > > commit d760a2fc18c2ba89a183c9071133b8a113279f8a > Author: Leo Famulari > Date: Mon Aug 8 01:37:11 2016 -0400 > > gnu: borg: Update to 1.0.7. > > * gnu/packages/backup.scm (borg): Update to 1.0.7. FYI this update contains a security fix that may require you to change the flags you pass when invoking Borg on a remote server. >From the release announcement [0]: borg serve: fix security issue with remote repository access, #1428 If you used e.g. --restrict-to-path /path/client1/ (with or without trailing slash does not make a difference), it acted like a path prefix match using /path/client1 (note the missing trailing slash) - the code then also allowed working in e.g. /path/client13 or /path/client1000. As this could accidentally lead to major security/privacy issues depending on the pathes you use, the behaviour was changed to be a strict directory match. That means --restrict-to-path /path/client1 (with or without trailing slash does not make a difference) now uses /path/client1/ internally (note the trailing slash here!) for matching and allows precisely that path AND any path below it. So, /path/client1 is allowed, /path/client1/repo1 is allowed, but not /path/client13 or /path/client1000. If you willingly used the undocumented (dangerous) previous behaviour, you may need to rearrange your --restrict-to-path pathes now. We are sorry if that causes work for you, but we did not want a potentially dangerous behaviour in the software (not even using a for-backwards-compat option). [0] https://github.com/borgbackup/borg/blob/1.0.7/docs/changes.rst#version-107-2016-08-19