Bug#686484: chowning pid directory and writing there as root may lead to security issue

2012-10-22 Thread Jonathan Nieder
Hi, Simon Kelley wrote: dnsmasq (2.63-4) unstable; urgency=low . * Make pid-file creation immune to symlink attacks. (closes: #686484) How about this patch to fix the same in squeeze? Thanks, Jonathan --- debian/changelog | 7 +++ src/dnsmasq.c| 45

Bug#686484: chowning pid directory and writing there as root may lead to security issue

2012-09-02 Thread Michael Tokarev
Package: dnsmasq Version: 2.55-2 Severity: serious Tags: security The initscript (and postinst script) of dnsmasq creates /var/run/dnsmasq directory and chowns it to dnsmasq:nogroup. However, dnsmasq daemon writes the pidfile (which apparently is the only file there) as root user. Here's the

Bug#686484: chowning pid directory and writing there as root may lead to security issue

2012-09-02 Thread Simon Kelley
On 02/09/12 08:44, Michael Tokarev wrote: Package: dnsmasq Version: 2.55-2 Severity: serious Tags: security The initscript (and postinst script) of dnsmasq creates /var/run/dnsmasq directory and chowns it to dnsmasq:nogroup. However, dnsmasq daemon writes the pidfile (which apparently is the

Bug#686484: chowning pid directory and writing there as root may lead to security issue

2012-09-02 Thread Simon Kelley
On 02/09/12 08:44, Michael Tokarev wrote: Package: dnsmasq Version: 2.55-2 Severity: serious Tags: security Ignore my previous question: currently educating myself about O_EXCL Simon. -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe.

Bug#686484: chowning pid directory and writing there as root may lead to security issue

2012-09-02 Thread Michael Tokarev
On 02.09.2012 13:40, Simon Kelley wrote: [] The explanation for the current state of affairs is here: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508560 Oh. I tried to find why/when this subdir appeared, but failed. The changelog mentions PID in uppercase ;) I'm sorry about this,