From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kei Kebreau Subject: Re: [PATCH] gnu: ntfs-3g: Fix CVE-2017-0358. Date: Thu, 09 Feb 2017 19:42:44 -0500 Message-ID: <877f4yq3jv.fsf@openmailbox.org> References: <87bmuboxqf.fsf@openmailbox.org> <878tpft2dt.fsf@kirby.i-did-not-set--mail-host-address--so-tickle-me> <20170209224346.GA20362@jasmine> <87o9ybrmiw.fsf@kirby.i-did-not-set--mail-host-address--so-tickle-me> Mime-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:48134) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cbzIo-0005pu-4C for guix-devel@gnu.org; Thu, 09 Feb 2017 19:43:07 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cbzIk-0007ui-4O for guix-devel@gnu.org; Thu, 09 Feb 2017 19:43:06 -0500 Received: from lb1.openmailbox.org ([5.79.108.160]:34161 helo=mail.openmailbox.org) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1cbzIj-0007uF-TY for guix-devel@gnu.org; Thu, 09 Feb 2017 19:43:02 -0500 In-Reply-To: <87o9ybrmiw.fsf@kirby.i-did-not-set--mail-host-address--so-tickle-me> (Marius Bakke's message of "Fri, 10 Feb 2017 00:07:35 +0100") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Marius Bakke Cc: guix-devel@gnu.org --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Marius Bakke writes: > Leo Famulari writes: > >> On Thu, Feb 09, 2017 at 11:39:42PM +0100, Marius Bakke wrote: >>> Kei Kebreau writes: >>>=20 >>> > Reviewers, how does this patch look to you? >>>=20 >>> AFAIU from CVE-2017-0358, ntfs-3g is only vulnerable when installed >>> setuid root, which is not the case on guix. >>>=20 >>> FWIW Debian do not carry this patch, but have fixed the CVE according to >>> the changelog. So I doubt this patch is necessary. >> >> There have been a couple security-related bugs publicized recently that >> are only dangerous when the software is installed setuid root. >> >> Although we don't do that by default, system administrators can do it on >> GuixSD. I also think that Guix is valuable as a distribution mechanism >> of free source code, and we should fix bugs for that use case. >> >> So, I was thinking that we should fix these bugs unless they require >> grafting, and then we should fix them in core-updates. >> >> WDYT? > > That does make a lot of sense. Reading up on execl(3), it looks like > this patch does the right thing and can't hurt even when not setuid. > > Mind=3Dchanged! :P=20 Are we all agreed on pushing this change? --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEg7ZwOtzKO2lLzi2m5qXuPBlGeg0FAlidDIUACgkQ5qXuPBlG eg3gZRAAs/JQ08c2LpWXfrudFWTtCx9DQyxOK1udGlcbDLrs+JcoQ2US5oRw5Opo kolyWG3AVlXXzw/TOKfD/VJwpb/nGf5kNkdqu+qbDNGrrezI1KvfhwlwzTDtsoQF EAbvULdIvvDxeqTyQmHMw/8/R4M+OVy5n9TvXvDDDig8YDCoT6hVNnP8o7/1WPHX JNK+o3/Oj5NTJB/NxlOnoOoF8EMCZSGROeiZt7YY2GteNo4aWGpquHNDtUzzNuUW dFqAC0dfqyK4pX2T2mzB+c+RttcA+wRmw2Mnd1Anku1XU70kJ6jKMPw/fQwFRby4 2Ig042wao9seV0iG3AdjskfVz7LKLraPrZoqSCaBC3/NtGIz+0O9JoOw/N4ORBaH NWS9450MAxczrBL5w8spXDGmbQGwUJo0s4T0Z2XIBZAQCknvSUbsY7Cnc9ROC/MV chH5ENbIX72S0mjUu9o9SLisAdTrZBDkStgapq1gbrQYaKTvlDi87mSD2UCGRII/ McPXDiLtipCtsWDkIK3N+tOZ1IWUHAYDBYNDOKIK73TaNTz4hyMU1qaE1MnK4I5f c+DubhlbY4r85nsTykH41LC9Ha7N1guNledZiMaF/g/+Tfe0OU9WrgsTMWEfvH6m wtEZC73oF9yqStO1yaGYw0rYOKJkgbKTxTqqPhCnHsC8YAcYg1k= =+mN+ -----END PGP SIGNATURE----- --=-=-=--