[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
bug#28751: GuixSD setuid-programs handling creates setuid binaries in th
bug#28751: GuixSD setuid-programs handling creates setuid binaries in the store
Fri, 29 Dec 2017 18:09:53 -0500
On Sun, Oct 08, 2017 at 09:54:22PM +0200, Ludovic Courtès wrote:
> address@hidden (Ludovic Courtès) skribis:
> > address@hidden (Ludovic Courtès) skribis:
> >> On GuixSD, ‘activate-setuid-programs’ in (gnu build activation) would
> >> create setuid-root binaries under /gnu/store for all the programs listed
> >> under ‘setuid-programs’ in the ‘operating-system’ declaration.
> > Fixed by
> > <https://git.savannah.gnu.org/cgit/guix.git/commit/?id=5e66574a128937e7f2fcf146d146225703ccfd5d>.
> Detailed announcement at:
FYI, this was assigned CVE-2017-1000455.
I just received the attached JSON from the Distributed Weakness Filing
project (DWF) in response to my CVE application.
I assume it will show up in the regular places (MITRE etc) eventually.
Having thought about this bug for a while, I think it was not too bad in
practice. The setuid executable files could be copied or preserved
somehow by an attacker whether they were in the store or in
Description: Text document
Description: PGP signature
- bug#28751: GuixSD setuid-programs handling creates setuid binaries in the store,
Leo Famulari <=