commit ecryptfs-utils for openSUSE:11.4
Hello community,
here is the log from the commit of package ecryptfs-utils for openSUSE:11.4
checked in at Wed Dec 14 17:56:33 CET 2011.
--- old-versions/11.4/UPDATES/all/ecryptfs-utils/ecryptfs-utils.changes
2011-08-11 18:07:00.0 +0200
+++ 11.4/ecryptfs-utils/ecryptfs-utils.changes 2011-12-14 15:48:00.0
+0100
@@ -1,0 +2,6 @@
+Wed Dec 14 15:26:04 CET 2011 - meiss...@suse.de
+
+- Fixed umask of /etc/mtab.tmp and get / drop group rights
+ before/after failed mounting. bnc#735342 / CVE-2011-3145
+
+---
calling whatdependson for 11.4-i586
New:
ecryptfs-utils-CVE-2011-3145.patch
Other differences:
--
++ ecryptfs-utils.spec ++
--- /var/tmp/diff_new_pack.gvtA9i/_old 2011-12-14 17:55:59.0 +0100
+++ /var/tmp/diff_new_pack.gvtA9i/_new 2011-12-14 17:55:59.0 +0100
@@ -25,13 +25,14 @@
AutoReqProv:on
Summary:Userspace Utilities for ecryptfs
Version:83
-Release:6.RELEASE7
+Release:6.RELEASE9
Source0:
http://launchpad.net/ecryptfs/trunk/%version/+download/ecryptfs-utils_%version.orig.tar.gz
Source1:baselibs.conf
Patch0: CVE-2011-1831,1832,1834.patch
Patch1: CVE-2011-1833.patch
Patch2: CVE-2011-1835.patch
Patch4: CVE-2011-1837.patch
+Patch5: ecryptfs-utils-CVE-2011-3145.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-build
BuildRequires: gtk2-devel intltool keyutils-devel keyutils-libs
libgcrypt-devel mozilla-nss-devel openssl-devel pam-devel pkcs11-helper-devel
python-devel trousers-devel
BuildRequires: update-desktop-files
@@ -55,6 +56,7 @@
%patch1 -p1
%patch2 -p1
%patch4 -p1
+%patch5 -p1
%build
export RPM_OPT_FLAGS=$RPM_OPT_FLAGS -fno-strict-aliasing
++ ecryptfs-utils-CVE-2011-3145.patch ++
Index: ecryptfs-utils-83/src/utils/mount.ecryptfs_private.c
===
--- ecryptfs-utils-83.orig/src/utils/mount.ecryptfs_private.c
+++ ecryptfs-utils-83/src/utils/mount.ecryptfs_private.c
@@ -221,12 +221,14 @@ int update_mtab(char *dev, char *mnt, ch
int fd;
FILE *old_mtab, *new_mtab;
struct mntent *old_ent, new_ent;
+ mode_t old_umask;
/* Make an attempt to play nice with other mount helpers
* by creating an /etc/mtab~ lock file. Of course this
* only works if those other helpers actually check for
* this.
*/
+ old_umask = umask(0333);
fd = open(/etc/mtab~, O_RDONLY | O_CREAT | O_EXCL, 0644);
if (fd 0) {
perror(open);
@@ -279,6 +281,8 @@ int update_mtab(char *dev, char *mnt, ch
unlink(/etc/mtab~);
+ umask(old_umask);
+
return 0;
fail:
@@ -288,6 +292,7 @@ fail_late:
fail_early:
endmntent(old_mtab);
unlink(/etc/mtab~);
+ umask(old_umask);
return 1;
}
@@ -424,7 +429,7 @@ int zero(FILE *fh) {
* c) updating /etc/mtab
*/
int main(int argc, char *argv[]) {
- int uid, mounting;
+ int uid, gid, mounting;
int force = 0;
int fnek = 1;
struct passwd *pwd;
@@ -433,6 +438,7 @@ int main(int argc, char *argv[]) {
FILE *fh_counter = NULL;
uid = getuid();
+ gid = getgid();
/* Non-privileged effective uid is sufficient for all but the code
* that mounts, unmounts, and updates /etc/mtab.
* Run at a lower privilege until we need it.
@@ -549,7 +555,16 @@ int main(int argc, char *argv[]) {
* the real uid to be that of the user.
* And we need the effective uid to be root in order to mount.
*/
- setreuid(-1, 0);
+ if (setreuid(-1, 0) 0) {
+ perror(setreuid);
+ return 1;
+ }
+ if (setregid(-1, 0) 0) {
+ perror(setregid);
+ setreuid(uid, uid);
+ return 1;
+ }
+
/* Perform mount */
if (mount(dev, ., FSTYPE, 0, opt) == 0) {
if (update_mtab(dev, mnt, opt) != 0) {
@@ -561,6 +576,9 @@ int main(int argc, char *argv[]) {
if (setreuid(uid, uid) 0) {
perror(setreuid);
}
+ if (setregid(gid, gid) 0) {
+ perror(setregid);
+ }
goto fail;
}
} else {
@@ -581,6 +599,7 @@ int main(int argc, char *argv[]) {
* Do not use the umount.ecryptfs helper (-i).
*/
setresuid(0,0,0);
+ setresgid(0,0,0);
execl(/bin/umount, umount, -i, -l, ., NULL);
commit ecryptfs-utils for openSUSE:11.4
Hello community,
here is the log from the commit of package ecryptfs-utils for openSUSE:11.4
checked in at Thu Aug 11 21:01:08 CEST 2011.
--- old-versions/11.4/all/ecryptfs-utils/ecryptfs-utils.changes 2010-04-10
17:40:48.0 +0200
+++ 11.4/ecryptfs-utils/ecryptfs-utils.changes 2011-08-11 18:07:00.0
+0200
@@ -1,0 +2,13 @@
+Thu Aug 11 18:05:51 CEST 2011 - meiss...@suse.de
+
+- Various security fixes (bnc#709771)
+ CVE-2011-1831 - Race condition when checking mountpoint during mount.
+ CVE-2011-1832 - Race condition when checking mountpoint during unmount.
+ CVE-2011-1833 - Race condition when checking source during mount.
+ CVE-2011-1834 - Improper mtab handling allowing corruption due to resource
+ limits, signals, etc.
+ CVE-2011-1835 - Key poisoning in ecryptfs-setup-private due to insecure temp
+ directory.
+ CVE-2011-1837 - Predictable lock counter name and associated races.
+
+---
Package does not exist at destination yet. Using Fallback
old-versions/11.4/all/ecryptfs-utils
Destination is old-versions/11.4/UPDATES/all/ecryptfs-utils
calling whatdependson for 11.4-i586
New:
CVE-2011-1831,1832,1834.patch
CVE-2011-1833.patch
CVE-2011-1835.patch
CVE-2011-1837.patch
Other differences:
--
++ ecryptfs-utils.spec ++
--- /var/tmp/diff_new_pack.jXcGnt/_old 2011-08-11 21:00:39.0 +0200
+++ /var/tmp/diff_new_pack.jXcGnt/_new 2011-08-11 21:00:39.0 +0200
@@ -1,7 +1,7 @@
#
-# spec file for package ecryptfs-utils (Version 83)
+# spec file for package ecryptfs-utils
#
-# Copyright (c) 2010 SUSE LINUX Products GmbH, Nuernberg, Germany.
+# Copyright (c) 2011 SUSE LINUX Products GmbH, Nuernberg, Germany.
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -25,9 +25,13 @@
AutoReqProv:on
Summary:Userspace Utilities for ecryptfs
Version:83
-Release:2
+Release:6.RELEASE7
Source0:
http://launchpad.net/ecryptfs/trunk/%version/+download/ecryptfs-utils_%version.orig.tar.gz
Source1:baselibs.conf
+Patch0: CVE-2011-1831,1832,1834.patch
+Patch1: CVE-2011-1833.patch
+Patch2: CVE-2011-1835.patch
+Patch4: CVE-2011-1837.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-build
BuildRequires: gtk2-devel intltool keyutils-devel keyutils-libs
libgcrypt-devel mozilla-nss-devel openssl-devel pam-devel pkcs11-helper-devel
python-devel trousers-devel
BuildRequires: update-desktop-files
@@ -47,6 +51,10 @@
%prep
%setup -q
+%patch0 -p1
+%patch1 -p1
+%patch2 -p1
+%patch4 -p1
%build
export RPM_OPT_FLAGS=$RPM_OPT_FLAGS -fno-strict-aliasing
++ CVE-2011-1831,1832,1834.patch ++
Description: fix privilege escalation via mountpoint race conditions
Author: Dan Rosenberg
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/ecryptfs-utils/+bug/732628
Index: ecryptfs-utils-83/src/utils/mount.ecryptfs_private.c
===
--- ecryptfs-utils-83.orig/src/utils/mount.ecryptfs_private.c
+++ ecryptfs-utils-83/src/utils/mount.ecryptfs_private.c
@@ -152,6 +152,47 @@ char *fetch_sig(char *pw_dir, int entry)
return sig;
}
+int check_ownership_mnt(int uid, char **mnt) {
+/* Check ownership of mount point, chdir into it, and
+ * canonicalize the path for use in mtab updating.
+ * Return 0 if everything is in order, 1 on error.
+ */
+ struct stat s;
+ char *cwd;
+
+ /* From here on, we'll refer to . as our mountpoint, to avoid
+* races.
+*/
+ if (chdir(*mnt) != 0) {
+ fputs(Cannot chdir into mountpoint.\n, stderr);
+ return 1;
+ }
+ if (stat(., s) != 0) {
+ fputs(Cannot examine mountpoint.\n, stderr);
+ return 1;
+ }
+ if (!S_ISDIR(s.st_mode)) {
+ fputs(Mountpoint is not a directory.\n, stderr);
+ return 1;
+ }
+ if (s.st_uid != uid) {
+ fputs(You do not own that mountpoint.\n, stderr);
+ return 1;
+ }
+
+ /* Canonicalize our pathname based on the current directory to
+* avoid races.
+*/
+ cwd = getcwd(NULL, 0);
+ if (!cwd) {
+ fputs(Failed to get current directory\n, stderr);
+ return 1;
+ }
+ *mnt = cwd;
+ return 0;
+}
+
+
int check_ownerships(int uid, char *path) {
/* Check ownership of device and mount point.
* Return 0 if everything is in order, 1 on error.
@@ -177,31 +218,77 @@ int update_mtab(char *dev, char *mnt, ch
/* Update /etc/mtab with new mount entry.
* Return 0 on success, 1 on failure.
*/
- FILE *fh;
- struct mntent m;
- fh =
