Your message dated Sat, 25 Oct 2014 11:00:07 +0000 with message-id <[email protected]> and subject line Bug#611659: fixed in cfengine3 3.6.2-1 has caused the Debian Bug report #611659, regarding cfengine seems to dislike Debian's symlinks to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 611659: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=611659 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: cfengine3 Version: 3.0.5+dfsg-1 To reproduce: # aptitude install cfengine3 # cp /usr/share/doc/cfengine3/examples/* /etc/cfengine3 # cfengine-server:/etc/cfengine3# cf-agent -nI SERIOUS SECURITY ALERT: path race exploited in recursion to/from /var/lib/cfengine3/inputs. Not safe for agent to continue - aborting Received signal 15 (SIGTERM) while doing [] A search for the problem yielded little information, hinting that cfengine may be taking exception to /var/lib/cfengine3/inputs being a symbolic link. Cursory inspection of the source code involved in printing that message seems to imply that it indeed wouldn't like symlinks (in src/recursion.c): void CheckLinkSecurity(struct stat *sb,char *name) { struct stat security; Debug("Checking the inode and device to make sure we are where we think we are...\n"); if (cfstat(".",&security) == -1) { CfOut(cf_error,"stat","Could not stat directory %s after entering!",name); return; } if ((sb->st_dev != security.st_dev) || (sb->st_ino != security.st_ino)) { CfOut(cf_error,"","SERIOUS SECURITY ALERT: path race exploited in recursion to/from %s. Not safe for agent to continue - aborting",name); HandleSignals(SIGTERM); /* Exits */ } } It is not clear to me why cfengine would have such a bad attitude towards symlinks in its work area. I am also amazed that people seem to be using cfengine3 on Debian, yet this has gone unreported. This is running on Squeeze.
--- End Message ---
--- Begin Message ---Source: cfengine3 Source-Version: 3.6.2-1 We believe that the bug you reported is fixed in the latest version of cfengine3, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Antonio Radici <[email protected]> (supplier of updated cfengine3 package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.8 Date: Tue, 21 Oct 2014 14:49:40 +0000 Source: cfengine3 Binary: cfengine3 cfengine3-dbg libpromises3 Architecture: source amd64 Version: 3.6.2-1 Distribution: unstable Urgency: low Maintainer: Antonio Radici <[email protected]> Changed-By: Antonio Radici <[email protected]> Description: cfengine3 - tool for configuring and maintaining network machines cfengine3-dbg - debugging symbols for cfengine3 libpromises3 - libpromises library for cfengine3 binaries Closes: 602404 609366 611659 641319 699809 Changes: cfengine3 (3.6.2-1) unstable; urgency=low . * New upstream release (Closes: 609366, 699809) + big thanks to Brian Bennett, Bas van der Vlies and [email protected]! + no longer using /etc/cfengine3 as repository for the state files; documented that in NEWS.Debian * Multi-tar package, it also includes the masterfiles (Closes: 641319) * debian/postinst: + added code to migrate the files contained in /etc/cfengine3 to /var/lib/cfengine3 if and only if the latter is a symlink to the directory in /etc (Closes: 611659) + added the code to move the masterfiles into /var/lib/cfengine3/masterfiles if the directory is empty * debian/control: + added libpromises3 as output of the build process + Standards-Version updated to 3.9.6 * debian/rules: + got rid of the info and html docs, they are not shipped anymore * debian/patches: + major cleanup done, some patches adapted to the new code * debian/NEWS: + added this file to announce the demise of the inputs symlink * debian/cfengine3.default: + Brian fixed the variable names sourced by the init scirpt (Closes: 602404) * debian/watch: + updated to pick up the source from the right URL Checksums-Sha1: 5dcaea37f388f4d5fdde1b61e57b1176f6a45564 1774 cfengine3_3.6.2-1.dsc 96f6d11b95d791ac12f150f2793b956eacc5407b 197320 cfengine3_3.6.2.orig-masterfiles.tar.gz 036dae35dfce559f5807a13f4de2985f28d3e5d1 1966966 cfengine3_3.6.2.orig.tar.gz 7d0b298f692af56ac60df5b3453d0bf6d2878fc9 14588 cfengine3_3.6.2-1.debian.tar.xz 2fe83493e11d8bb6236f4bcc248fb10d8d5fdd7b 315414 cfengine3_3.6.2-1_amd64.deb e9756b204578745dc88725ff626d98b643c154fc 1109338 cfengine3-dbg_3.6.2-1_amd64.deb 11b7493481e028c6d182b64a3dd2a553faa1477a 310900 libpromises3_3.6.2-1_amd64.deb Checksums-Sha256: 6ee055fbc04d78051da276d5dc586447ee65f38bad0896ca7570afb7f4d4ea26 1774 cfengine3_3.6.2-1.dsc a7ff2c0a8cbed67d0cf087dbec55105a967e76d41162df18b89bd8396647787e 197320 cfengine3_3.6.2.orig-masterfiles.tar.gz 0e0195c1998fc261d4ef2e47e9cc50b273d204bc8b221d469bb83071933c4a09 1966966 cfengine3_3.6.2.orig.tar.gz 3cb46676cc65d180ac5b0aec44435c99677a2cf7578c5c87971fe1f39c87b056 14588 cfengine3_3.6.2-1.debian.tar.xz 5a358d7231456a373bf925d277e8ec5f097db8b43662dfe3d4cd02b5be527590 315414 cfengine3_3.6.2-1_amd64.deb 69ab73ee5069fe725c7cf14db523f3424e3068e5b151e8d7ada6fc182de62a39 1109338 cfengine3-dbg_3.6.2-1_amd64.deb 1fbdd97276fab99f8924af3ca25122aa8e5208a02c7f0a498e49b2d5e16fa768 310900 libpromises3_3.6.2-1_amd64.deb Files: 93b48b34d4e7416b5b7c2ba821df6171 1774 admin optional cfengine3_3.6.2-1.dsc 097ca60f4538a68cff7be6a4c916734c 197320 admin optional cfengine3_3.6.2.orig-masterfiles.tar.gz 250587da81f80906afbb1abd80437a48 1966966 admin optional cfengine3_3.6.2.orig.tar.gz abfabd516a2cb5cd278d0c43537d2c26 14588 admin optional cfengine3_3.6.2-1.debian.tar.xz 658caef9ee4e53965555600d6ec6e5ed 315414 admin optional cfengine3_3.6.2-1_amd64.deb cf4d1383c3642c632dd31e6dc47646d1 1109338 debug extra cfengine3-dbg_3.6.2-1_amd64.deb 30af5b47aa19b169526f5ed68683ecf4 310900 libs optional libpromises3_3.6.2-1_amd64.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iEYEARECAAYFAlRKuKQACgkQ6Tq8aae+WrBPGACeKWeMtLuHmTxttlTrj8rmPncD 2SAAn3EdWKCg5th/nJG/YJ9JXOiy06hQ =cR0K -----END PGP SIGNATURE-----
--- End Message ---
