Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 18 Dec 2014 21:43:54 +0300
From: Alexander Cherepanov <cherepan@...me.ru>
To: oss-security@...ts.openwall.com
Subject: Re: Running Java across a privilege boundry

On 2014-12-18 20:50, Martin Carpenter wrote:
>> I requested a separate tag for relative RPATH a while ago:
>> https://bugs.debian.org/732682
>> Now we "only" need someone to write the code. :-)
>
> Great! Is that all we need? The tests reference the Debian policy manual
> (package debian-policy):
>
> https://www.debian.org/doc/debian-policy/ch-sharedlibs.html
>
> (for completeness: also sections 10.2, 10.3).
>
> This references neither RPATH nor RUNPATH. Perhaps we need to fix that
> first?

https://bugs.debian.org/555982

> Suggested addition:
>
> 8.7 RUNPATH and RPATH
> Libraries that define RPATH or RUNPATH should ensure that this does not
> contain relative paths. This is to prevent an executable from loading a
> library from an untrusted location. (This should include the corner
> cases whereby the path starts or ends with a colon, or includes two
> consecutive colons).
>
>
> Did I miss anything?

Relative paths is not the only problem. /tmp is even worse:

https://bugs.debian.org/759868

-- 
Alexander Cherepanov

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.