Bug#405006: libgphoto2: mistake in udev rules gives permissions to non-gphoto2 devices

2007-01-21 Thread Steve Langasek
On Wed, Jan 17, 2007 at 01:17:32PM +0100, Frederic Peters wrote: Now, the package you've uploaded to unstable seems to offer an alternative fix, but I have some trouble understanding it so I'm still hesitant to accept it into etch. How does print-camera-list.c interface with udev to

Bug#405006: libgphoto2: mistake in udev rules gives permissions to non-gphoto2 devices

2007-01-21 Thread Steve Langasek
On Wed, Jan 17, 2007 at 01:00:42PM +0100, Nicolas George wrote: L'octidi 28 nivôse, an CCXV, Steve Langasek a écrit : I'm actually fairly disinclined to accept this change for etch since as you mention it is a regression, and moreover I haven't heard anything back from the bug submitter

Bug#405006: libgphoto2: mistake in udev rules gives permissions to non-gphoto2 devices

2007-01-17 Thread Nicolas George
L'octidi 28 nivôse, an CCXV, Steve Langasek a écrit : I'm actually fairly disinclined to accept this change for etch since as you mention it is a regression, and moreover I haven't heard anything back from the bug submitter about what actually gets broken on his system with this bug since it

Bug#405006: libgphoto2: mistake in udev rules gives permissions to non-gphoto2 devices

2007-01-17 Thread Steve Langasek
Hi Frederic, On Fri, Jan 12, 2007 at 04:30:21PM +0100, Frederic Peters wrote: Package: libgphoto2-2 Version: 2.2.1-12 Severity: grave Tags: security In /etc/udev/libgphoto2_generic_ptp_support.rules, there is the following rule: ACTION==add, SUBSYSTEM==usb_device,

Bug#405006: libgphoto2: mistake in udev rules gives permissions to non-gphoto2 devices

2007-01-17 Thread Frederic Peters
Nicolas George wrote: L'octidi 28 nivôse, an CCXV, Steve Langasek a écrit : I'm actually fairly disinclined to accept this change for etch since as you mention it is a regression, and moreover I haven't heard anything back from the bug submitter about what actually gets broken on his

Bug#405006: libgphoto2: mistake in udev rules gives permissions to non-gphoto2 devices

2007-01-17 Thread Frederic Peters
Steve Langasek wrote: Now, the package you've uploaded to unstable seems to offer an alternative fix, but I have some trouble understanding it so I'm still hesitant to accept it into etch. How does print-camera-list.c interface with udev to trigger calling check_ptp_camera?

Bug#405006: libgphoto2: mistake in udev rules gives permissions to non-gphoto2 devices

2007-01-17 Thread Nicolas George
L'octidi 28 nivôse, an CCXV, Frederic Peters a écrit : I believe things such as crypto USB devices would be affected by the bug. I do not understand what you call a crypto USB device. On the computer I discovered the bug, I had write access to the raw devices corresponding to the printer and

Bug#405006: libgphoto2: mistake in udev rules gives permissions to non-gphoto2 devices

2007-01-17 Thread Nicolas George
L'octidi 28 nivôse, an CCXV, Frederic Peters a écrit : It doesn't set appropriate group for devices which are PTP cameras but not explicitely known by libgphoto2. That would be a problem, indeed. I do not have any of those myself, so I can not test. But I use the following rule for udev: $ cat

Bug#405006: libgphoto2: mistake in udev rules gives permissions to non-gphoto2 devices

2007-01-17 Thread Frederic Peters
Nicolas George wrote: L'octidi 28 nivôse, an CCXV, Frederic Peters a écrit : I believe things such as crypto USB devices would be affected by the bug. I do not understand what you call a crypto USB device. On the computer I discovered the bug, I had write access to the raw devices

Bug#405006: libgphoto2: mistake in udev rules gives permissions to non-gphoto2 devices

2007-01-12 Thread Frederic Peters
Nicolas George wrote: Package: libgphoto2-2 Version: 2.2.1-12 Severity: grave Tags: security In /etc/udev/libgphoto2_generic_ptp_support.rules, there is the following rule: ACTION==add, SUBSYSTEM==usb_device, ENV{INTERFACE}=6/1/1, \ PROGRAM=/bin/sh -c 'K=%k; K=$${K#usbdev}; printf

Bug#405006: libgphoto2: mistake in udev rules gives permissions to non-gphoto2 devices

2006-12-30 Thread Nicolas George
Package: libgphoto2-2 Version: 2.2.1-12 Severity: grave Tags: security In /etc/udev/libgphoto2_generic_ptp_support.rules, there is the following rule: ACTION==add, SUBSYSTEM==usb_device, ENV{INTERFACE}=6/1/1, \ PROGRAM=/bin/sh -c 'K=%k; K=$${K#usbdev}; printf bus/usb/%%03i/%%03i $${K.*}

Bug#405006: libgphoto2: mistake in udev rules gives permissions to non-gphoto2 devices

2006-12-30 Thread Steve Langasek
On Sat, Dec 30, 2006 at 10:49:26AM +0100, Nicolas George wrote: Package: libgphoto2-2 Version: 2.2.1-12 Severity: grave Tags: security In /etc/udev/libgphoto2_generic_ptp_support.rules, there is the following rule: ACTION==add, SUBSYSTEM==usb_device, ENV{INTERFACE}=6/1/1, \

Bug#405006: libgphoto2: mistake in udev rules gives permissions to non-gphoto2 devices

2006-12-30 Thread Nicolas George
Le decadi 10 nivôse, an CCXV, Steve Langasek a écrit : Isn't the plugdev group empty by default? This is obviously a bug, but I'm not sure it qualifies as a grave security bug. The administrator is encouraged to add to this group users that need to access cameras and similar devices. I believe