From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: Re: [PATCH] gnu: ntfs-3g: Fix CVE-2017-0358. Date: Thu, 9 Feb 2017 23:43:46 +0100 Message-ID: <20170209224346.GA20362@jasmine> References: <87bmuboxqf.fsf@openmailbox.org> <878tpft2dt.fsf@kirby.i-did-not-set--mail-host-address--so-tickle-me> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="vkogqOf2sHV7VnPd" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:48448) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cbxRe-00034R-N4 for guix-devel@gnu.org; Thu, 09 Feb 2017 17:44:07 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cbxRa-0001Yv-R2 for guix-devel@gnu.org; Thu, 09 Feb 2017 17:44:06 -0500 Received: from out4-smtp.messagingengine.com ([66.111.4.28]:42146) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cbxRa-0001YV-K6 for guix-devel@gnu.org; Thu, 09 Feb 2017 17:44:02 -0500 Content-Disposition: inline In-Reply-To: <878tpft2dt.fsf@kirby.i-did-not-set--mail-host-address--so-tickle-me> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Marius Bakke Cc: guix-devel@gnu.org --vkogqOf2sHV7VnPd Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Feb 09, 2017 at 11:39:42PM +0100, Marius Bakke wrote: > Kei Kebreau writes: >=20 > > Reviewers, how does this patch look to you? >=20 > AFAIU from CVE-2017-0358, ntfs-3g is only vulnerable when installed > setuid root, which is not the case on guix. >=20 > FWIW Debian do not carry this patch, but have fixed the CVE according to > the changelog. So I doubt this patch is necessary. There have been a couple security-related bugs publicized recently that are only dangerous when the software is installed setuid root. Although we don't do that by default, system administrators can do it on GuixSD. I also think that Guix is valuable as a distribution mechanism of free source code, and we should fix bugs for that use case. So, I was thinking that we should fix these bugs unless they require grafting, and then we should fix them in core-updates. WDYT? --vkogqOf2sHV7VnPd Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlic8J4ACgkQJkb6MLrK fwj3KBAAsh4sI96YzzzYvwJh3jCRLsr5bIPD5jzGvBl2V7I+u6+/Im+h5ZhvYiCz btnkqaYKrynavT6VsHLmGIXZySt13Tj/xBERh4PfkPnn03XglI96l1iujPGSJMFi emIJdXFuJ5y6pnKFlyBnT+1DEqUjKOD1PV88SVgWQQ996/wx8nToQfRRRkyq291G 0xlJ5bO5g1MnlMQI8pKRxyEWzdDwrOO2ofJA8vpHySlDcIGOWY6lKZn+crINBt9C LLr9xBltOJ4jacSIp0W9tBzvFnp1RFLAdFLs/UFnqUDPGmSZwV90+d8Bd2QpX1w1 qD1EetXjVehzQJeqwpKnOYVUj1tqU+EXejHT5IO5iKs4lOBksw9HvxfIuT4PPiJY xpjZpNXdfS8PWFReA+7hDQd7cg4fruECyQKE1IJExyi8ioyGxYoZZmQiXlrWK1vZ 4oT0ZMjDi7I6RPWugRn+hx1uGfBio8htzLUpQzjZU6Mr+dIK9fBwwiiQv1iYs/LZ 7IRtnVl8nw1XDKam3Ov+3x+JX04nQ97eqGL5kFD+jZ+QK8z0tr7hXTbW95TvQ0Q+ jRqcQvaKUH8ZquZgbJg3HgcviUpNDXxK19kF5Mna3UhIi43m/3R6MqCfqTDwJzCn 6vJfAl4utZHEQKrZjmamqDx3sDsDSTNIlJ8s0OYfK4fiTngZn9w= =U9A2 -----END PGP SIGNATURE----- --vkogqOf2sHV7VnPd--