[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 05 May 2015 21:37:31 +0200
From: Florian Weimer <fweimer@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: Problems in automatic crash analysis frameworks
On 05/05/2015 09:01 PM, Tavis Ormandy wrote:
> On Tue, May 5, 2015 at 5:17 AM, Florian Weimer <fweimer@...hat.com> wrote:
>> On 04/23/2015 09:10 PM, Florian Weimer wrote:
>>> On 04/17/2015 09:16 PM, Florian Weimer wrote:
>>>> A quick update on the abrt situation.
>>>
>>> Another update. We now have a public tracking bug listing the issues:
>>>
>>> <https://bugzilla.redhat.com/show_bug.cgi?id=1214172>
>>
>>
>> There is a public build (against EPEL7) of the consolidated fixes,
>> available as a Copr repository:
>>
>> <http://copr.fedoraproject.org/coprs/jfilak/abrt-hardened/>
>>
>> This also includes the consolidated fixes.
>>
>> At this stage, we'd appreciate additional comments/reviews.
>
> Thanks Florian, this looks great. I'm just looking at the new ccpp, Is
> it intentional that os-release and so on are still copied from the
> process root?
Thanks for taking a look. Have you downloaded the Copr builds?
In 0092-ccpp-do-not-read-data-from-root-directories.patch for abrt, the
root directory argument for dd_create_basic_files is changed to NULL,
which means that the copying inside dd_create_basic_files will not
happen (although the code is still around). As far as I can tell, this
patch is also applied in the build. Is there some other copying
operation I'm missing?
--
Florian Weimer / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
