Package: emacs23
Version: 23.4+1-4
Severity: normal
It looks like emacs actually changes permissions on any file that it
edits which as an ACL set. This is potentially a security concern,
since it can grant access to a file for a user that was explicitly
denied access:
0 dkg@pip:~$ chmod 0644 test.txt
0 dkg@pip:~$ setfacl -m u:wt215:- test.txt
0 dkg@pip:~$ getfacl test.txt
# file: test.txt
# owner: dkg
# group: dkg
user::rw-
user:wt215:---
group::r--
mask::r--
other::r--
0 dkg@pip:~$ emacs -nw test.txt
0 dkg@pip:~$ getfacl test.txt
# file: test.txt
# owner: dkg
# group: dkg
user::rw-
group::r--
other::r--
0 dkg@pip:~$
It also looks like it changes the group permissions on a file with an
ACL, making it more permissive than it was before, if anyone else is
in the relevant group:
0 dkg@pip:~$ chmod 0600 test.txt
0 dkg@pip:~$ setfacl -m u:wt215:r test.txt
0 dkg@pip:~$ getfacl test.txt
# file: test.txt
# owner: dkg
# group: dkg
user::rw-
user:wt215:r--
group::---
mask::r--
other::---
0 dkg@pip:~$ emacs -nw test.txt
0 dkg@pip:~$ getfacl test.txt
# file: test.txt
# owner: dkg
# group: dkg
user::rw-
group::r--
other::---
0 dkg@pip:~$
This seems like an information disclosure vulnerability. It's also
really frustrating to users who have tried to use ACLs to grant access
and suddenly find it removed.
--dkg
-- System Information:
Debian Release: wheezy/sid
APT prefers testing
APT policy: (500, 'testing'), (200, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)
Foreign Architectures: powerpc
Kernel: Linux 3.2.0-4-686-pae (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Versions of packages emacs23 depends on:
ii emacs23-bin-common 23.4+1-4
ii gconf-service 3.2.5-1+build1
ii libasound2 1.0.25-4
ii libatk1.0-0 2.4.0-2
ii libc6 2.13-35
ii libcairo2 1.12.2-2
ii libdbus-1-3 1.6.8-1
ii libfontconfig1 2.9.0-7
ii libfreetype6 2.4.9-1
ii libgconf-2-4 3.2.5-1+build1
ii libgdk-pixbuf2.0-0 2.26.1-1
ii libgif4 4.1.6-10
ii libglib2.0-0 2.33.12+really2.32.4-3
ii libgpm2 1.20.4-6
ii libgtk2.0-0 2.24.10-2
ii libice6 2:1.0.8-2
ii libjpeg8 8d-1
ii libm17n-0 1.6.3-2
ii libncurses5 5.9-10
ii libotf0 0.9.12-2
ii libpango1.0-0 1.30.0-1
ii libpng12-0 1.2.49-1
ii librsvg2-2 2.36.1-1
ii libsm6 2:1.2.1-2
ii libtiff4 3.9.6-9
ii libtinfo5 5.9-10
ii libx11-6 2:1.5.0-1
ii libxft2 2.3.1-1
ii libxpm4 1:3.5.10-1
ii libxrender1 1:0.9.7-1
ii zlib1g 1:1.2.7.dfsg-13
emacs23 recommends no packages.
Versions of packages emacs23 suggests:
pn emacs23-common-non-dfsg <none>
-- no debconf information
--
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]
