From 354f539407e336532a429aead7d2249b26611653 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicol=C3=A1s=20Reynolds?= Date: Wed, 30 May 2012 17:43:28 -0300 Subject: Adding systemd as a subtree merge from another branch This is under testing! --- libre/systemd | 1 - 1 file changed, 1 deletion(-) delete mode 160000 libre/systemd (limited to 'libre/systemd/0001-util-never-follow-symlinks-in-rm_rf_children.patch') diff --git a/libre/systemd b/libre/systemd deleted file mode 160000 index dd743ddf0..000000000 --- a/libre/systemd +++ /dev/null @@ -1 +0,0 @@ -Subproject commit dd743ddf0d2297079591f90dc75938de160ac554 -- cgit v1.2.3-2-g168b From 8530dec3776239e8e5c2b2d065861083011f46cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Fabian=20Silva=20Delgado?= Date: Wed, 30 May 2012 21:06:44 -0300 Subject: systemd-44-7: added rePKGBUILD --- ...l-never-follow-symlinks-in-rm_rf_children.patch | 31 ++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 libre/systemd/0001-util-never-follow-symlinks-in-rm_rf_children.patch (limited to 'libre/systemd/0001-util-never-follow-symlinks-in-rm_rf_children.patch') diff --git a/libre/systemd/0001-util-never-follow-symlinks-in-rm_rf_children.patch b/libre/systemd/0001-util-never-follow-symlinks-in-rm_rf_children.patch new file mode 100644 index 000000000..9bf84dda6 --- /dev/null +++ b/libre/systemd/0001-util-never-follow-symlinks-in-rm_rf_children.patch @@ -0,0 +1,31 @@ +From 5ebff5337594d690b322078c512eb222d34aaa82 Mon Sep 17 00:00:00 2001 +From: Michal Schmidt +Date: Fri, 2 Mar 2012 10:39:10 +0100 +Subject: [PATCH] util: never follow symlinks in rm_rf_children() + +The function checks if the entry is a directory before recursing, but +there is a window between the check and the open, during which the +directory could be replaced with a symlink. + +CVE-2012-1174 +https://bugzilla.redhat.com/show_bug.cgi?id=803358 +--- + src/util.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/util.c b/src/util.c +index 20cbc2b..dfc1dc6 100644 +--- a/src/util.c ++++ b/src/util.c +@@ -3593,7 +3593,8 @@ static int rm_rf_children(int fd, bool only_dirs, bool honour_sticky) { + if (is_dir) { + int subdir_fd; + +- if ((subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC)) < 0) { ++ subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW); ++ if (subdir_fd < 0) { + if (ret == 0 && errno != ENOENT) + ret = -errno; + continue; +-- +1.7.9.4 -- cgit v1.2.3-2-g168b