[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2021-04-13 Thread amodra at gmail dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 --- Comment #23 from Alan Modra --- (In reply to John Dong from comment #22) > Hi, can we backport this patch to binutils-2_34-branch ? You can of course do what you like with your own copy of binutils, but I don't consider this series of

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2021-04-12 Thread dongjianqiang2 at huawei dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 John Dong changed: What|Removed |Added CC||dongjianqiang2 at huawei dot com ---

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2021-02-25 Thread cvs-commit at gcc dot gnu.org
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 --- Comment #21 from cvs-commit at gcc dot gnu.org --- The binutils-2_36-branch branch has been updated by Alan Modra : https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=d3edaa91d4cf7202ec14342410194841e2f67f12 commit

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2021-02-03 Thread amodra at gmail dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 Alan Modra changed: What|Removed |Added Status|ASSIGNED|RESOLVED Resolution|---

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2021-02-03 Thread amodra at gmail dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 Bug 26945 depends on bug 27270, which changed state. Bug 27270 Summary: ar segfaults trying to build virtualbox guest additions https://sourceware.org/bugzilla/show_bug.cgi?id=27270 What|Removed |Added

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2021-02-03 Thread amodra at gmail dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 Bug 26945 depends on bug 27284, which changed state. Bug 27284 Summary: ar: wrong permissions on output file https://sourceware.org/bugzilla/show_bug.cgi?id=27284 What|Removed |Added

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2021-02-03 Thread cvs-commit at gcc dot gnu.org
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 --- Comment #19 from cvs-commit at gcc dot gnu.org --- The binutils-2_36-branch branch has been updated by Alan Modra : https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=6184480d7ce1bcd57669a62867efc68418d0de7c commit

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2021-02-02 Thread cvs-commit at gcc dot gnu.org
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 --- Comment #18 from cvs-commit at gcc dot gnu.org --- The master branch has been updated by Alan Modra : https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=95b91a043aeaeb546d2fea556d84a2de1e917770 commit

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2021-01-30 Thread siddhesh at sourceware dot org
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 Siddhesh Poyarekar changed: What|Removed |Added Status|REOPENED|ASSIGNED --- Comment #17 from

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2021-01-30 Thread amodra at gmail dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 Alan Modra changed: What|Removed |Added Depends on||27270, 27284 Resolution|FIXED

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2021-01-26 Thread carnil at debian dot org
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 Salvatore Bonaccorso changed: What|Removed |Added Alias||CVE-2021-20197

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2021-01-10 Thread siddhesh at sourceware dot org
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 Siddhesh Poyarekar changed: What|Removed |Added Resolution|--- |FIXED

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2020-12-03 Thread siddhesh at sourceware dot org
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 --- Comment #14 from Siddhesh Poyarekar --- I've posted a patch series on the list[1][2][3][4] that should resolve this. In summary, smart_rename now takes an FD for the file to rename and a struct describing the ownership and timestamps to

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2020-12-01 Thread bugdal at aerifal dot cx
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 --- Comment #13 from Rich Felker --- This patch keeps expanding way beyond the scope of what I can commit to review, and I don't think it's nearing something that fixes the problem. It's not clear to me if bfd_stat uses fstat on the open file

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2020-12-01 Thread nickc at redhat dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 Nick Clifton changed: What|Removed |Added Attachment #13007|0 |1 is obsolete|

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2020-11-30 Thread bugdal at aerifal dot cx
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 --- Comment #11 from Rich Felker --- Yes, see my footnote in comment 4. That works just as well. -- You are receiving this mail because: You are on the CC list for the bug.

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2020-11-30 Thread nickc at redhat dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 Nick Clifton changed: What|Removed |Added Assignee|unassigned at sourceware dot org |nickc at redhat dot com --

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2020-11-30 Thread nickc at redhat dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 Nick Clifton changed: What|Removed |Added Status|NEW |ASSIGNED --- Comment #10 from Nick

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2020-11-30 Thread bugdal at aerifal dot cx
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 --- Comment #9 from Rich Felker --- > > 1. make_tempname with fd_return==NULL is *always* a bug, > Well, I would argue that it is only a bug if the temporary file is going to be manipulated by other system functions. Are you going to create

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2020-11-30 Thread nickc at redhat dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 Nick Clifton changed: What|Removed |Added Attachment #13006|0 |1 is obsolete|

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2020-11-30 Thread nickc at redhat dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 Nick Clifton changed: What|Removed |Added Attachment #13004|0 |1 is obsolete|

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2020-11-30 Thread nickc at redhat dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 --- Comment #6 from Nick Clifton --- Created attachment 13005 --> https://sourceware.org/bugzilla/attachment.cgi?id=13005=edit Proposed patch Siddhesh Poyarekar pointed out a bug in the previous patches. I was calling fchmod() and

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2020-11-30 Thread nickc at redhat dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 Nick Clifton changed: What|Removed |Added Attachment #13003|0 |1 is obsolete|

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2020-11-27 Thread bugdal at aerifal dot cx
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 --- Comment #4 from Rich Felker --- That's a lot to review without being familiar with the code, but a couple things I can tell you right off: 1. make_tempname with fd_return==NULL is *always* a bug, and defeats the whole purpose of mkstemp.

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2020-11-27 Thread nickc at redhat dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 --- Comment #3 from Nick Clifton --- Created attachment 13003 --> https://sourceware.org/bugzilla/attachment.cgi?id=13003=edit Proposed patch Hi Rich, Ok - here is my first attempt at creating a patch. Please could you give it a look

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2020-11-26 Thread bugdal at aerifal dot cx
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 --- Comment #2 from Rich Felker --- It's not that smart_rename should open it and use fchown+fchmod on the result; indeed as you figured that has the same race. The problem is that you threw away the only safe way to perform modifications on

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2020-11-26 Thread nickc at redhat dot com
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 Nick Clifton changed: What|Removed |Added CC||nickc at redhat dot com Last

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2020-11-26 Thread siddhesh at sourceware dot org
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 Siddhesh Poyarekar changed: What|Removed |Added Flags||security+ -- You are receiving

[Bug binutils/26945] Unsafe chown+chmod in smart_rename, possibly elsewhere

2020-11-25 Thread bugdal at aerifal dot cx
https://sourceware.org/bugzilla/show_bug.cgi?id=26945 Rich Felker changed: What|Removed |Added CC||siddhesh at sourceware dot org -- You