From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marius Bakke Subject: Re: [PATCH] gnu: ntfs-3g: Fix CVE-2017-0358. Date: Fri, 10 Feb 2017 02:30:35 +0100 Message-ID: <87a89usuh0.fsf@kirby.i-did-not-set--mail-host-address--so-tickle-me> References: <87bmuboxqf.fsf@openmailbox.org> <878tpft2dt.fsf@kirby.i-did-not-set--mail-host-address--so-tickle-me> <20170209224346.GA20362@jasmine> <87o9ybrmiw.fsf@kirby.i-did-not-set--mail-host-address--so-tickle-me> <877f4yq3jv.fsf@openmailbox.org> Mime-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:57526) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cc02t-0001gk-Ce for guix-devel@gnu.org; Thu, 09 Feb 2017 20:30:44 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cc02p-00088U-FP for guix-devel@gnu.org; Thu, 09 Feb 2017 20:30:43 -0500 Received: from out4-smtp.messagingengine.com ([66.111.4.28]:54795) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cc02p-00088F-6s for guix-devel@gnu.org; Thu, 09 Feb 2017 20:30:39 -0500 In-Reply-To: <877f4yq3jv.fsf@openmailbox.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Kei Kebreau Cc: guix-devel@gnu.org --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Kei Kebreau writes: > Marius Bakke writes: > >> Leo Famulari writes: >> >>> On Thu, Feb 09, 2017 at 11:39:42PM +0100, Marius Bakke wrote: >>>> Kei Kebreau writes: >>>>=20 >>>> > Reviewers, how does this patch look to you? >>>>=20 >>>> AFAIU from CVE-2017-0358, ntfs-3g is only vulnerable when installed >>>> setuid root, which is not the case on guix. >>>>=20 >>>> FWIW Debian do not carry this patch, but have fixed the CVE according = to >>>> the changelog. So I doubt this patch is necessary. >>> >>> There have been a couple security-related bugs publicized recently that >>> are only dangerous when the software is installed setuid root. >>> >>> Although we don't do that by default, system administrators can do it on >>> GuixSD. I also think that Guix is valuable as a distribution mechanism >>> of free source code, and we should fix bugs for that use case. >>> >>> So, I was thinking that we should fix these bugs unless they require >>> grafting, and then we should fix them in core-updates. >>> >>> WDYT? >> >> That does make a lot of sense. Reading up on execl(3), it looks like >> this patch does the right thing and can't hurt even when not setuid. >> >> Mind=3Dchanged! :P=20 > > Are we all agreed on pushing this change? I agree with Leo that we should try to cover for all use cases of software from Guix, so this change LGTM. --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEu7At3yzq9qgNHeZDoqBt8qM6VPoFAlidF7wACgkQoqBt8qM6 VPox5wgAwsQTFgNGpQNksKag+WLYhgJipVXDtY/JzYnguJxOJ3yL5BcgROMsdeHM 6/yVjRHNHe6j7twXPIRhtOx1Ls+hWz5IL0LTGPbVFHPbnrvoMkxBiImfauI58uMY Um9QYE+DedSRo80yHGW3gPULawxPAELAvhIhm/+T1we1J817nqjLcv7+EoFVBOjQ sSSGKX1sywNCKtd62SLw8ctz0s22H/N48On5X5umxyPgQ84ksU+tQXOuIX9b99XN zv+OxoFr2PW0WNzA3fIGPA0rL9ES28cHHFdSrdJJeZorXJ1SZZ56oSfteC3ZzNUE 7c+D5BKUciJ5H80OKO5Kx+3FDpHzfA== =ertt -----END PGP SIGNATURE----- --=-=-=--