[PATCH] gnu: ntfs-3g: Fix CVE-2017-0358.

[PATCH] gnu: ntfs-3g: Fix CVE-2017-0358.

[Kei Kebreau]

[-- Attachment #1.1: Type: text/plain, Size: 45 bytes --]

Reviewers, how does this patch look to you?


[-- Attachment #1.2: 0001-gnu-ntfs-3g-Fix-CVE-2017-0358.patch --]
[-- Type: text/plain, Size: 4031 bytes --]

From 2de5fc0267f94bf933f1e52dc8ef348bd3f78059 Mon Sep 17 00:00:00 2001
From: Kei Kebreau <kei@openmailbox.org>
Date: Thu, 9 Feb 2017 16:31:25 -0500
Subject: [PATCH] gnu: ntfs-3g: Fix CVE-2017-0358.

* gnu/packages/linux.scm (ntfs-3g)[source]: Add patch.
* gnu/packages/patches/ntfs-3g-CVE-2017-0358.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
---
 gnu/local.mk                                     |  3 +-
 gnu/packages/linux.scm                           |  1 +
 gnu/packages/patches/ntfs-3g-CVE-2017-0358.patch | 42 ++++++++++++++++++++++++
 3 files changed, 45 insertions(+), 1 deletion(-)
 create mode 100644 gnu/packages/patches/ntfs-3g-CVE-2017-0358.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index 63ce3af71..1fc49bbd6 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -4,7 +4,7 @@
 # Copyright © 2016 Mathieu Lirzin <mthl@gnu.org>
 # Copyright © 2013, 2014, 2015, 2016 Mark H Weaver <mhw@netris.org>
 # Copyright © 2016 Chris Marusich <cmmarusich@gmail.com>
-# Copyright © 2016 Kei Kebreau <kei@openmailbox.org>
+# Copyright © 2016, 2017 Kei Kebreau <kei@openmailbox.org>
 # Copyright © 2016 Rene Saavedra <rennes@openmailbox.org>
 # Copyright © 2016 Adonay "adfeno" Felipe Nogueira <https://libreplanet.org/wiki/User:Adfeno> <adfeno@openmailbox.org>
 # Copyright © 2016, 2017 Ricardo Wurmus <rekado@elephly.net>
@@ -777,6 +777,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/ninja-zero-mtime.patch			\
   %D%/packages/patches/node-9077.patch				\
   %D%/packages/patches/nss-pkgconfig.patch			\
+  %D%/packages/patches/ntfs-3g-CVE-2017-0358.patch		\
   %D%/packages/patches/nvi-assume-preserve-path.patch		\
   %D%/packages/patches/nvi-dbpagesize-binpower.patch		\
   %D%/packages/patches/nvi-db4.patch				\
diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm
index dc4d37920..f918680c3 100644
--- a/gnu/packages/linux.scm
+++ b/gnu/packages/linux.scm
@@ -2906,6 +2906,7 @@ from userspace.")
                (base32
                 "180y5y09h30ryf2vim8j30a2npwz1iv9ly5yjmh3wjdkwh2jrdyp"))
               (modules '((guix build utils)))
+              (patches (search-patches "ntfs-3g-CVE-2017-0358.patch"))
               (snippet
                ;; Install under $prefix.
                '(substitute* '("src/Makefile.in" "ntfsprogs/Makefile.in")
diff --git a/gnu/packages/patches/ntfs-3g-CVE-2017-0358.patch b/gnu/packages/patches/ntfs-3g-CVE-2017-0358.patch
new file mode 100644
index 000000000..e09e39ed8
--- /dev/null
+++ b/gnu/packages/patches/ntfs-3g-CVE-2017-0358.patch
@@ -0,0 +1,42 @@
+Fix CVE-2017-0358:
+http://seclists.org/oss-sec/2017/q1/259
+This patch was copied from the above URL.
+
+diff -ur ntfs-3g.old/src/lowntfs-3g.c ntfs-3g/src/lowntfs-3g.c
+--- ntfs-3g.old/src/lowntfs-3g.c	2017-02-09 15:01:04.074331542 -0500
++++ ntfs-3g/src/lowntfs-3g.c	2017-02-09 15:06:35.757580937 -0500
+@@ -3827,13 +3827,14 @@
+ 	struct stat st;
+ 	pid_t pid;
+ 	const char *cmd = "/sbin/modprobe";
++	char *env = (char*)NULL;
+ 	struct timespec req = { 0, 100000000 };   /* 100 msec */
+ 	fuse_fstype fstype;
+         
+ 	if (!stat(cmd, &st) && !geteuid()) {
+ 		pid = fork();
+ 		if (!pid) {
+-			execl(cmd, cmd, "fuse", NULL);
++			execle(cmd, cmd, "fuse", NULL, &env);
+ 			_exit(1);
+ 		} else if (pid != -1)
+ 			waitpid(pid, NULL, 0);
+diff -ur ntfs-3g.old/src/ntfs-3g.c ntfs-3g/src/ntfs-3g.c
+--- ntfs-3g.old/src/ntfs-3g.c	2017-02-09 15:01:04.074331542 -0500
++++ ntfs-3g/src/ntfs-3g.c	2017-02-09 15:06:26.077252571 -0500
+@@ -3612,13 +3612,14 @@
+ 	struct stat st;
+ 	pid_t pid;
+ 	const char *cmd = "/sbin/modprobe";
++	char *env = (char*)NULL;
+ 	struct timespec req = { 0, 100000000 };   /* 100 msec */
+ 	fuse_fstype fstype;
+ 	
+ 	if (!stat(cmd, &st) && !geteuid()) {
+ 		pid = fork();
+ 		if (!pid) {
+-			execl(cmd, cmd, "fuse", NULL);
++			execle(cmd, cmd, "fuse", NULL, &env);
+ 			_exit(1);
+ 		} else if (pid != -1)
+ 			waitpid(pid, NULL, 0);
-- 
2.11.1


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

Re: [PATCH] gnu: ntfs-3g: Fix CVE-2017-0358.

[Marius Bakke]

[-- Attachment #1: Type: text/plain, Size: 327 bytes --]

Kei Kebreau <kei@openmailbox.org> writes:

> Reviewers, how does this patch look to you?

AFAIU from CVE-2017-0358, ntfs-3g is only vulnerable when installed
setuid root, which is not the case on guix.

FWIW Debian do not carry this patch, but have fixed the CVE according to
the changelog. So I doubt this patch is necessary.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: [PATCH] gnu: ntfs-3g: Fix CVE-2017-0358.

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 905 bytes --]

On Thu, Feb 09, 2017 at 11:39:42PM +0100, Marius Bakke wrote:
> Kei Kebreau <kei@openmailbox.org> writes:
> 
> > Reviewers, how does this patch look to you?
> 
> AFAIU from CVE-2017-0358, ntfs-3g is only vulnerable when installed
> setuid root, which is not the case on guix.
> 
> FWIW Debian do not carry this patch, but have fixed the CVE according to
> the changelog. So I doubt this patch is necessary.

There have been a couple security-related bugs publicized recently that
are only dangerous when the software is installed setuid root.

Although we don't do that by default, system administrators can do it on
GuixSD. I also think that Guix is valuable as a distribution mechanism
of free source code, and we should fix bugs for that use case.

So, I was thinking that we should fix these bugs unless they require
grafting, and then we should fix them in core-updates.

WDYT?

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH] gnu: ntfs-3g: Fix CVE-2017-0358.

[Marius Bakke]

[-- Attachment #1: Type: text/plain, Size: 1143 bytes --]

Leo Famulari <leo@famulari.name> writes:

> On Thu, Feb 09, 2017 at 11:39:42PM +0100, Marius Bakke wrote:
>> Kei Kebreau <kei@openmailbox.org> writes:
>> 
>> > Reviewers, how does this patch look to you?
>> 
>> AFAIU from CVE-2017-0358, ntfs-3g is only vulnerable when installed
>> setuid root, which is not the case on guix.
>> 
>> FWIW Debian do not carry this patch, but have fixed the CVE according to
>> the changelog. So I doubt this patch is necessary.
>
> There have been a couple security-related bugs publicized recently that
> are only dangerous when the software is installed setuid root.
>
> Although we don't do that by default, system administrators can do it on
> GuixSD. I also think that Guix is valuable as a distribution mechanism
> of free source code, and we should fix bugs for that use case.
>
> So, I was thinking that we should fix these bugs unless they require
> grafting, and then we should fix them in core-updates.
>
> WDYT?

That does make a lot of sense. Reading up on execl(3), it looks like
this patch does the right thing and can't hurt even when not setuid.

Mind=changed! :P 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: [PATCH] gnu: ntfs-3g: Fix CVE-2017-0358.

[Kei Kebreau]

[-- Attachment #1: Type: text/plain, Size: 1267 bytes --]

Marius Bakke <mbakke@fastmail.com> writes:

> Leo Famulari <leo@famulari.name> writes:
>
>> On Thu, Feb 09, 2017 at 11:39:42PM +0100, Marius Bakke wrote:
>>> Kei Kebreau <kei@openmailbox.org> writes:
>>> 
>>> > Reviewers, how does this patch look to you?
>>> 
>>> AFAIU from CVE-2017-0358, ntfs-3g is only vulnerable when installed
>>> setuid root, which is not the case on guix.
>>> 
>>> FWIW Debian do not carry this patch, but have fixed the CVE according to
>>> the changelog. So I doubt this patch is necessary.
>>
>> There have been a couple security-related bugs publicized recently that
>> are only dangerous when the software is installed setuid root.
>>
>> Although we don't do that by default, system administrators can do it on
>> GuixSD. I also think that Guix is valuable as a distribution mechanism
>> of free source code, and we should fix bugs for that use case.
>>
>> So, I was thinking that we should fix these bugs unless they require
>> grafting, and then we should fix them in core-updates.
>>
>> WDYT?
>
> That does make a lot of sense. Reading up on execl(3), it looks like
> this patch does the right thing and can't hurt even when not setuid.
>
> Mind=changed! :P 

Are we all agreed on pushing this change?

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

Re: [PATCH] gnu: ntfs-3g: Fix CVE-2017-0358.

[Marius Bakke]

[-- Attachment #1: Type: text/plain, Size: 1458 bytes --]

Kei Kebreau <kei@openmailbox.org> writes:

> Marius Bakke <mbakke@fastmail.com> writes:
>
>> Leo Famulari <leo@famulari.name> writes:
>>
>>> On Thu, Feb 09, 2017 at 11:39:42PM +0100, Marius Bakke wrote:
>>>> Kei Kebreau <kei@openmailbox.org> writes:
>>>> 
>>>> > Reviewers, how does this patch look to you?
>>>> 
>>>> AFAIU from CVE-2017-0358, ntfs-3g is only vulnerable when installed
>>>> setuid root, which is not the case on guix.
>>>> 
>>>> FWIW Debian do not carry this patch, but have fixed the CVE according to
>>>> the changelog. So I doubt this patch is necessary.
>>>
>>> There have been a couple security-related bugs publicized recently that
>>> are only dangerous when the software is installed setuid root.
>>>
>>> Although we don't do that by default, system administrators can do it on
>>> GuixSD. I also think that Guix is valuable as a distribution mechanism
>>> of free source code, and we should fix bugs for that use case.
>>>
>>> So, I was thinking that we should fix these bugs unless they require
>>> grafting, and then we should fix them in core-updates.
>>>
>>> WDYT?
>>
>> That does make a lot of sense. Reading up on execl(3), it looks like
>> this patch does the right thing and can't hurt even when not setuid.
>>
>> Mind=changed! :P 
>
> Are we all agreed on pushing this change?

I agree with Leo that we should try to cover for all use cases of
software from Guix, so this change LGTM.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: [PATCH] gnu: ntfs-3g: Fix CVE-2017-0358.

[Kei Kebreau]

[-- Attachment #1: Type: text/plain, Size: 1607 bytes --]

Marius Bakke <mbakke@fastmail.com> writes:

> Kei Kebreau <kei@openmailbox.org> writes:
>
>> Marius Bakke <mbakke@fastmail.com> writes:
>>
>>> Leo Famulari <leo@famulari.name> writes:
>>>
>>>> On Thu, Feb 09, 2017 at 11:39:42PM +0100, Marius Bakke wrote:
>>>>> Kei Kebreau <kei@openmailbox.org> writes:
>>>>> 
>>>>> > Reviewers, how does this patch look to you?
>>>>> 
>>>>> AFAIU from CVE-2017-0358, ntfs-3g is only vulnerable when installed
>>>>> setuid root, which is not the case on guix.
>>>>> 
>>>>> FWIW Debian do not carry this patch, but have fixed the CVE according to
>>>>> the changelog. So I doubt this patch is necessary.
>>>>
>>>> There have been a couple security-related bugs publicized recently that
>>>> are only dangerous when the software is installed setuid root.
>>>>
>>>> Although we don't do that by default, system administrators can do it on
>>>> GuixSD. I also think that Guix is valuable as a distribution mechanism
>>>> of free source code, and we should fix bugs for that use case.
>>>>
>>>> So, I was thinking that we should fix these bugs unless they require
>>>> grafting, and then we should fix them in core-updates.
>>>>
>>>> WDYT?
>>>
>>> That does make a lot of sense. Reading up on execl(3), it looks like
>>> this patch does the right thing and can't hurt even when not setuid.
>>>
>>> Mind=changed! :P 
>>
>> Are we all agreed on pushing this change?
>
> I agree with Leo that we should try to cover for all use cases of
> software from Guix, so this change LGTM.

Great! Pushed as 1a82ba660e88e731841882523084e5d878267b53.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]