[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 31 Mar 2024 16:29:01 +0400
From: Loganaden Velvindron <loganaden@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Re: backdoor in upstream xz/liblzma leading to ssh
server compromise
Closer look at "Jia Tan" commits show that he/they disabled the Linux
landlock sandbox. Lasse Collin is doing
good work to audit the commits and I wish Github would reinstate his
github account.
commit f9cf4c05edd14dedfe63833f8ccbe41b55823b00 (HEAD -> master,
origin/master, origin/HEAD)
Author: Lasse Collin <lasse.collin@...aani.org>
Date: Sat Mar 30 14:36:28 2024 +0200
CMake: Fix sabotaged Landlock sandbox check.
It never enabled it.
After using git blame:
328c52da8 (Jia Tan 2024-02-26 23:02:06 +0800 1004) .
Pulling out git show:
commit 328c52da8a2bbb81307644efdb58db2c422d9ba7
Author: Jia Tan <jiat0218@...il.com>
Date: Mon Feb 26 23:02:06 2024 +0800
Build: Fix Linux Landlock feature test in Autotools and CMake builds.
The previous Linux Landlock feature test assumed that having the
linux/landlock.h header file was enough. The new feature tests also
requires that prctl() and the required Landlock system calls are
supported.
The code to weaken the sandbox was shipped in the 5.6.1 version.
On Sat, Mar 30, 2024, 19:42 Jeffrey Walton <noloader@...il.com> wrote:
>
> On Sat, Mar 30, 2024 at 9:38 AM Pierre-Elliott Bécue <peb@...ian.org> wrote:
> >
> > Bjoern Franke <bjo@...afweide.org> wrote on 30/03/2024 at 14:06:38+0100:
> >
> > > Am 30.03.24 um 04:50 schrieb Loganaden Velvindron:
> > >> Github has suspended the repo:
> > >> https://github.com/tukaani-project/xz
> > >> Im wondering what is the next step for the xz project as a whole ?
> > >
> > > https://git.tukaani.org/?p=xz.git;a=summary exists and Lasse said on
> > > IRC he thinks he would make a clean 5.6.2 release.
> > >
> > > Regards
> >
> > I honestly would like to extend my sympathy to Lasse.
> >
> > This situation must clearly be a hell for him.
>
> Lasse published a statement at <https://tukaani.org/xz-backdoor/>.
>
> > Someone asked what would become of xz as a project. I do hope in light
> > of this event, some people step in to help.
>
> Perhaps Lasse should turn over control of the project to an entity
> like the Linux Foundation. Xz is critical to Linux now, and it needs
> more oversight than Lasse can provide. (Not to impugn Lasse; he seems
> to be very busy. Extra [trusted] helping hands would probably be
> welcomed).
>
> Jeff
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
