Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 05 May 2015 21:37:31 +0200
From: Florian Weimer <>
Subject: Re: Problems in automatic crash analysis frameworks

On 05/05/2015 09:01 PM, Tavis Ormandy wrote:
> On Tue, May 5, 2015 at 5:17 AM, Florian Weimer <> wrote:
>> On 04/23/2015 09:10 PM, Florian Weimer wrote:
>>> On 04/17/2015 09:16 PM, Florian Weimer wrote:
>>>> A quick update on the abrt situation.
>>> Another update.  We now have a public tracking bug listing the issues:
>>>   <>
>> There is a public build (against EPEL7) of the consolidated fixes,
>> available as a Copr repository:
>>   <>
>> This also includes the consolidated fixes.
>> At this stage, we'd appreciate additional comments/reviews.
> Thanks Florian, this looks great. I'm just looking at the new ccpp, Is
> it intentional that os-release and so on are still copied from the
> process root?

Thanks for taking a look.  Have you downloaded the Copr builds?

In 0092-ccpp-do-not-read-data-from-root-directories.patch for abrt, the
root directory argument for dd_create_basic_files is changed to NULL,
which means that the copying inside dd_create_basic_files will not
happen (although the code is still around).  As far as I can tell, this
patch is also applied in the build.  Is there some other copying
operation I'm missing?

Florian Weimer / Red Hat Product Security

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.