Skip to contentSkip to conversation

policycoreutils: sandbox: FIXME rewrite /tmp handling

PATCH In review Daniel J Walsh 2 participants 3 messages Sep 15, 2011 – Sep 16, 2011 SELinux security module

lore
Share & tools
lore

Daniel J Walsh

author
#0 lore raw

PATCH 33/67 policycoreutils: sandbox: FIXME rewrite /tmp handling

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This patch looks good to me. acked.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk5yVRIACgkQrlYvE4MpobNTogCaA/XBPxA2GRq8Mux9nab3urM8 ivwAoKLZXJs4tVfbRBNTpQMXnlEgnDYs
=3GvE
-----END PGP SIGNATURE-----

#1 lore raw
Quoted 15 lines · Daniel J Walsh

From 54ed5929b8f8ffac7bdc48d589c5cb38f6798530 Mon Sep 17 00:00:00 2001
From: Eric Paris <[email protected]>
Date: Mon, 15 Aug 2011 19:58:08 -0400
Subject: [PATCH 33/67] policycoreutils: sandbox: FIXME rewrite /tmp handling

seunshare now creates a runtime temporary directory owned by root and with the sticky bit set properly. Files from the user-specified directory
are copied to the runtime directory and the changes synced back (using rsync)
at the end of the seunshare run.

review needed to changelog correctness/completeness

Quoted 8 lines
Signed-off-by Eric Paris <[email protected]>
Acked-by Dan Walsh <[email protected]>
---
 policycoreutils/sandbox/sandbox     |    8 +-
 policycoreutils/sandbox/seunshare.8 |    2 +-
 policycoreutils/sandbox/seunshare.c |  488
+++++++++++++++++++++++++++--------
 3 files changed, 386 insertions(+), 112 deletions(-)

Is the above perhaps meant to fix CVE-2011-1011 ?

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

author
#2 lore raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 14 lines · Guido Trentalancia
Quoted 13 lines · Daniel J Walsh

From 54ed5929b8f8ffac7bdc48d589c5cb38f6798530 Mon Sep 17 00:00:00 2001 From: Eric Paris <[email protected]> Date: Mon, 15 Aug 2011 19:58:08 -0400 Subject: [PATCH 33/67] policycoreutils: sandbox:
FIXME rewrite /tmp handling

seunshare now creates a runtime temporary directory owned by root and with the sticky bit set properly. Files from the user-specified directory are copied to the runtime directory and the changes synced back (using rsync) at the end of the seunshare run.

review needed to changelog correctness/completeness

Quoted 9 lines
Quoted 6 lines
Signed-off-by Eric Paris <[email protected]> Acked-by: Dan Walsh

<[email protected]> --- policycoreutils/sandbox/sandbox |
8 +- policycoreutils/sandbox/seunshare.8 | 2 +-
policycoreutils/sandbox/seunshare.c | 488 +++++++++++++++++++++++++++-------- 3 files changed, 386 insertions(+), 112 deletions(-)

Is the above perhaps meant to fix CVE-2011-1011 ?

Yes
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk5zXOMACgkQrlYvE4MpobM7EQCgkBGDChQayys3AGe0U85PYF9R A6cAni11KI5MPSwxEc2zHfarZ4HkRorZ
=6c1p
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.