X2Go Bug report logs -
#293
Use initgroups() to initialize group access list
Reported by: Orion Poplawski <orion@cora.nwra.com>
Date: Thu, 29 Aug 2013 17:18:02 UTC
Severity: normal
Tags: patch, pending
Fixed in version 2:3.5.0.21
Done: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
Bug is archived. No further changes may be made.
Toggle useless messages
Report forwarded
to x2go-dev@lists.berlios.de, X2Go Developers <x2go-dev@lists.berlios.de>
:
Bug#293
; Package nx-libs
.
(Thu, 29 Aug 2013 17:18:02 GMT) (full text, mbox, link).
Acknowledgement sent
to Orion Poplawski <orion@cora.nwra.com>
:
New Bug report received and forwarded. Copy sent to X2Go Developers <x2go-dev@lists.berlios.de>
.
(Thu, 29 Aug 2013 17:18:02 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.x2go.org (full text, mbox, reply):
[Message part 1 (text/plain, inline)]
Package: nx-libs
Tags: patch
The Fedora review of nx-libs caught the following rpmlint issue:
This executable is calling setuid and setgid without setgroups or initgroups.
There is a high probability this mean it didn't relinquish all groups, and this
would be a potential security issue to be fixed. Seek POS36-C on the web for
details about the problem.
Ref POS36-C:
https://www.securecoding.cert.org/confluence/display/seccode/POS36-C.+Observe+correct+revocation+order+while+relinquishing+privileges
This patch adds initgroups() calls to code to initialize the supplemental
group list.
I'm done some minimal testing (can connect to a session with client and server
running this code), but I'm note sure how much that exercised it.
--
Orion Poplawski
Technical Manager 303-415-9701 x222
NWRA, Boulder/CoRA Office FAX: 303-415-9702
3380 Mitchell Lane orion@nwra.com
Boulder, CO 80301 http://www.nwra.com
[nx-libs-initgroups.patch (text/x-patch, attachment)]
Information forwarded
to x2go-dev@lists.berlios.de, X2Go Developers <x2go-dev@lists.berlios.de>
:
Bug#293
; Package nx-libs
.
(Thu, 29 Aug 2013 20:33:01 GMT) (full text, mbox, link).
Acknowledgement sent
to Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
:
Extra info received and forwarded to list. Copy sent to X2Go Developers <x2go-dev@lists.berlios.de>
.
(Thu, 29 Aug 2013 20:33:01 GMT) (full text, mbox, link).
Message #10 received at 293@bugs.x2go.org (full text, mbox, reply):
tag #293 pending
fixed #293 2:3.5.0.21
thanks
Hello,
X2Go issue #293 (src:nx-libs) reported by you has been
fixed in X2Go Git. You can see the changelog below, and you can
check the diff of the fix at:
http://code.x2go.org/gitweb?p=nx-libs.git;a=commitdiff;h=0946b43
The issue will most likely be fixed in src:nx-libs (2:3.5.0.21).
light+love
X2Go Git Admin (on behalf of the sender of this mail)
---
commit 0946b437570dea31365790d5cbf39c39f1b59c02
Author: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
Date: Thu Aug 29 22:24:26 2013 +0200
Add patch: 602_nx-X11_initgroups.full.patch. Fix calling setuid and setgid without setgroups or initgroups. There is a high probability this means it didn't relinquish all groups, and this would be a potential security issue to be fixed. Seek POS36-C on the web for details about the problem. (Fixes: #293).
diff --git a/debian/changelog b/debian/changelog
index 2242a75..b523ee1 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -19,6 +19,11 @@ nx-libs (2:3.5.0.21-0) UNRELEASED; urgency=low
* Change build options so that bundled libraries are not used anymore at
build time. Remove bundled libraries from rolled tarballs, as well. (Fixes:
#238).
+ * Add patch: 602_nx-X11_initgroups.full.patch. Fix calling setuid and setgid
+ without setgroups or initgroups. There is a high probability this means it
+ didn't relinquish all groups, and this would be a potential security issue
+ to be fixed. Seek POS36-C on the web for details about the problem. (Fixes:
+ #293).
-- Mike Gabriel <mike.gabriel@das-netzwerkteam.de> Thu, 28 Mar 2013 21:07:42 +0100
Added tag(s) pending.
Request was from Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
to control@bugs.x2go.org
.
(Thu, 29 Aug 2013 20:33:02 GMT) (full text, mbox, link).
Marked as fixed in versions 2:3.5.0.21.
Request was from Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
to control@bugs.x2go.org
.
(Thu, 29 Aug 2013 20:33:02 GMT) (full text, mbox, link).
Message sent on
to Orion Poplawski <orion@cora.nwra.com>
:
Bug#293.
(Thu, 29 Aug 2013 20:33:02 GMT) (full text, mbox, link).
Information forwarded
to x2go-dev@lists.berlios.de, X2Go Developers <x2go-dev@lists.berlios.de>
:
Bug#293
; Package nx-libs
.
(Fri, 30 Aug 2013 14:33:04 GMT) (full text, mbox, link).
Acknowledgement sent
to Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
:
Extra info received and forwarded to list. Copy sent to X2Go Developers <x2go-dev@lists.berlios.de>
.
(Fri, 30 Aug 2013 14:33:04 GMT) (full text, mbox, link).
Message #22 received at 293@bugs.x2go.org (full text, mbox, reply):
close #293
thanks
Hello,
we are very hopeful that X2Go issue #293 reported by you
has been resolved in the new release (2:3.5.0.21) of the
X2Go source project »src:nx-libs«.
You can view the complete changelog entry of src:nx-libs (2:3.5.0.21)
below, and you can use the following link to view all the code changes
between this and the last release of src:nx-libs.
http://code.x2go.org/gitweb?p=nx-libs.git;a=commitdiff;h=422b1f554e5cb655b8a8702f9f3027760879ea02;hp=225445db3cb6c6fc05db264f537eb9ad6050fd1c
If you feel that the issue has not been resolved satisfyingly, feel
free to reopen this bug report or submit a follow-up report with
further observations described based on the new released version
of src:nx-libs.
Thanks a lot for contributing to X2Go!!!
light+love
X2Go Git Admin (on behalf of the sender of this mail)
---
X2Go Component: src:nx-libs
Version: 2:3.5.0.21
Status: RELEASE
Date: Fri, 30 Aug 2013 16:18:04 +0200
Fixes: 199 223 238 293
Changes:
nx-libs (2:3.5.0.21-0) RELEASED; urgency=low
.
[ Mike Gabriel ]
* Provide a default keystrokes.cfg in /etc/nx (for nxagent) and /etc/x2go
(for x2goagent). (Fixes: #199).
* Use a keystrokes.cfg that reflects the normally hard-coded defaults of
a vanilla nxagent. (Fixes: #223).
* Set NXAGENT_KEYSTROKEFILE to /etc/x2go/keystrokes.cfg for wrapper x2goagent.
* For vanilla nxagent move keystrokes.cfg from /etc/nx to /etc/nxagent.
* Tarball roller script:
+ Only install keystrokes.cfg when in full mode.
+ Only install nxproxy wrapper when in lite mode.
* /debian/control:
+ Add B-Ds: libfontconfig1-dev, libfontenc-dev.
* /debian/nx-libs-dev.install:
+ Remove unrelated files from -dev package.
* Fix keystrokes.cfg, use Ctrl+Alt+<key> instead of just Ctrl+<key>. (Adds to
fixing #223).
.
[ Orion Poplawski ]
* Change build options so that bundled libraries are not used anymore at
build time. Remove bundled libraries from rolled tarballs, as well. (Fixes:
#238).
* Add patch: 602_nx-X11_initgroups.full.patch. Fix calling setuid and setgid
without setgroups or initgroups. There is a high probability this means it
didn't relinquish all groups, and this would be a potential security issue
to be fixed. Seek POS36-C on the web for details about the problem. (Fixes:
#293).
Information forwarded
to x2go-dev@lists.berlios.de, X2Go Developers <x2go-dev@lists.berlios.de>
:
Bug#293
; Package nx-libs
.
(Fri, 30 Aug 2013 14:33:04 GMT) (full text, mbox, link).
Acknowledgement sent
to Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
:
Extra info received and forwarded to list. Copy sent to X2Go Developers <x2go-dev@lists.berlios.de>
.
(Fri, 30 Aug 2013 14:33:04 GMT) (full text, mbox, link).
Message #27 received at 293@bugs.x2go.org (full text, mbox, reply):
close #293
thanks
Hello,
we are very hopeful that X2Go issue #293 reported by you
has been resolved in the new release (2:3.5.0.21) of the
X2Go source project »src:nx-libs«.
You can view the complete changelog entry of src:nx-libs (2:3.5.0.21)
below, and you can use the following link to view all the code changes
between this and the last release of src:nx-libs.
http://code.x2go.org/gitweb?p=nx-libs.git;a=commitdiff;h=1102c6c766cfca9136b7fb04dfb6bcbf3c8ab25d;hp=225445db3cb6c6fc05db264f537eb9ad6050fd1c
If you feel that the issue has not been resolved satisfyingly, feel
free to reopen this bug report or submit a follow-up report with
further observations described based on the new released version
of src:nx-libs.
Thanks a lot for contributing to X2Go!!!
light+love
X2Go Git Admin (on behalf of the sender of this mail)
---
X2Go Component: src:nx-libs
Version: 2:3.5.0.21
Status: RELEASE
Date: Fri, 30 Aug 2013 16:18:04 +0200
Fixes: 199 223 238 293
Changes:
nx-libs (2:3.5.0.21-0) RELEASED; urgency=low
.
[ Mike Gabriel ]
* Provide a default keystrokes.cfg in /etc/nx (for nxagent) and /etc/x2go
(for x2goagent). (Fixes: #199).
* Use a keystrokes.cfg that reflects the normally hard-coded defaults of
a vanilla nxagent. (Fixes: #223).
* Set NXAGENT_KEYSTROKEFILE to /etc/x2go/keystrokes.cfg for wrapper x2goagent.
* For vanilla nxagent move keystrokes.cfg from /etc/nx to /etc/nxagent.
* Tarball roller script:
+ Only install keystrokes.cfg when in full mode.
+ Only install nxproxy wrapper when in lite mode.
* /debian/control:
+ Add B-Ds: libfontconfig1-dev, libfontenc-dev.
* /debian/nx-libs-dev.install:
+ Remove unrelated files from -dev package.
* Fix keystrokes.cfg, use Ctrl+Alt+<key> instead of just Ctrl+<key>. (Adds to
fixing #223).
.
[ Orion Poplawski ]
* Change build options so that bundled libraries are not used anymore at
build time. Remove bundled libraries from rolled tarballs, as well. (Fixes:
#238).
* Add patch: 602_nx-X11_initgroups.full.patch. Fix calling setuid and setgid
without setgroups or initgroups. There is a high probability this means it
didn't relinquish all groups, and this would be a potential security issue
to be fixed. Seek POS36-C on the web for details about the problem. (Fixes:
#293).
Marked Bug as done
Request was from Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
to control@bugs.x2go.org
.
(Fri, 30 Aug 2013 14:33:06 GMT) (full text, mbox, link).
Notification sent
to Orion Poplawski <orion@cora.nwra.com>
:
Bug acknowledged by developer.
(Fri, 30 Aug 2013 14:33:06 GMT) (full text, mbox, link).
Message sent on
to Orion Poplawski <orion@cora.nwra.com>
:
Bug#293.
(Fri, 30 Aug 2013 14:33:11 GMT) (full text, mbox, link).
Message sent on
to Orion Poplawski <orion@cora.nwra.com>
:
Bug#293.
(Fri, 30 Aug 2013 14:33:11 GMT) (full text, mbox, link).
Bug archived.
Request was from Debbugs Internal Request <owner@bugs.x2go.org>
to internal_control@bugs.x2go.org
.
(Sat, 28 Sep 2013 05:24:02 GMT) (full text, mbox, link).
Send a report that this bug log contains spam.
X2Go Developers <owner@bugs.x2go.org>.
Last modified:
Wed Dec 4 22:38:56 2024;
Machine Name:
ymir.das-netzwerkteam.de
X2Go Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.