X2Go Bug report logs - #293
Use initgroups() to initialize group access list

Toggle useless messages

Message #5 received at submit@bugs.x2go.org (full text, mbox, reply):

From: Orion Poplawski <orion@cora.nwra.com>

To: submit@bugs.x2go.org

Subject: Use initgroups() to initialize group access list

Date: Thu, 29 Aug 2013 11:12:14 -0600

[Message part 1 (text/plain, inline)]

Package: nx-libs
Tags: patch

The Fedora review of nx-libs caught the following rpmlint issue:

This executable is calling setuid and setgid without setgroups or initgroups.
There is a high probability this mean it didn't relinquish all groups, and this
would be a potential security issue to be fixed. Seek POS36-C on the web for
details about the problem.

Ref POS36-C:

https://www.securecoding.cert.org/confluence/display/seccode/POS36-C.+Observe+correct+revocation+order+while+relinquishing+privileges 


This patch adds initgroups() calls to code to initialize the supplemental 
group list.

I'm done some minimal testing (can connect to a session with client and server 
running this code), but I'm note sure how much that exercised it.

-- 
Orion Poplawski
Technical Manager                     303-415-9701 x222
NWRA, Boulder/CoRA Office             FAX: 303-415-9702
3380 Mitchell Lane                       orion@nwra.com
Boulder, CO 80301                   http://www.nwra.com

[nx-libs-initgroups.patch (text/x-patch, attachment)]

Message #10 received at 293@bugs.x2go.org (full text, mbox, reply):

From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

To: 293-submitter@bugs.x2go.org

Cc: control@bugs.x2go.org, 293@bugs.x2go.org

Subject: X2Go issue (in src:nx-libs) has been marked as pending for release

Date: Thu, 29 Aug 2013 22:24:33 +0200 (CEST)

tag #293 pending
fixed #293 2:3.5.0.21
thanks

Hello,

X2Go issue #293 (src:nx-libs) reported by you has been
fixed in X2Go Git. You can see the changelog below, and you can
check the diff of the fix at:

    http://code.x2go.org/gitweb?p=nx-libs.git;a=commitdiff;h=0946b43

The issue will most likely be fixed in src:nx-libs (2:3.5.0.21).

light+love
X2Go Git Admin (on behalf of the sender of this mail)

---
commit 0946b437570dea31365790d5cbf39c39f1b59c02
Author: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
Date:   Thu Aug 29 22:24:26 2013 +0200

    Add patch: 602_nx-X11_initgroups.full.patch. Fix calling setuid and setgid without setgroups or initgroups. There is a high probability this means it didn't relinquish all groups, and this would be a potential security issue to be fixed. Seek POS36-C on the web for details about the problem. (Fixes: #293).

diff --git a/debian/changelog b/debian/changelog
index 2242a75..b523ee1 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -19,6 +19,11 @@ nx-libs (2:3.5.0.21-0) UNRELEASED; urgency=low
   * Change build options so that bundled libraries are not used anymore at
     build time. Remove bundled libraries from rolled tarballs, as well. (Fixes:
     #238).
+  * Add patch: 602_nx-X11_initgroups.full.patch. Fix calling setuid and setgid
+    without setgroups or initgroups. There is a high probability this means it
+    didn't relinquish all groups, and this would be a potential security issue
+    to be fixed. Seek POS36-C on the web for details about the problem. (Fixes:
+    #293).
 
  -- Mike Gabriel <mike.gabriel@das-netzwerkteam.de>  Thu, 28 Mar 2013 21:07:42 +0100
 

Message #22 received at 293@bugs.x2go.org (full text, mbox, reply):

From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

To: 293-submitter@bugs.x2go.org

Cc: control@bugs.x2go.org, 293@bugs.x2go.org

Subject: X2Go issue (in src:nx-libs) has been marked as closed

Date: Fri, 30 Aug 2013 16:20:09 +0200 (CEST)

close #293
thanks

Hello,

we are very hopeful that X2Go issue #293 reported by you
has been resolved in the new release (2:3.5.0.21) of the
X2Go source project »src:nx-libs«.

You can view the complete changelog entry of src:nx-libs (2:3.5.0.21)
below, and you can use the following link to view all the code changes
between this and the last release of src:nx-libs.

    http://code.x2go.org/gitweb?p=nx-libs.git;a=commitdiff;h=422b1f554e5cb655b8a8702f9f3027760879ea02;hp=225445db3cb6c6fc05db264f537eb9ad6050fd1c

If you feel that the issue has not been resolved satisfyingly, feel
free to reopen this bug report or submit a follow-up report with
further observations described based on the new released version
of src:nx-libs.

Thanks a lot for contributing to X2Go!!!

light+love
X2Go Git Admin (on behalf of the sender of this mail)

---
X2Go Component: src:nx-libs
Version: 2:3.5.0.21
Status: RELEASE
Date: Fri, 30 Aug 2013 16:18:04 +0200
Fixes: 199 223 238 293
Changes: 
 nx-libs (2:3.5.0.21-0) RELEASED; urgency=low
 .
   [ Mike Gabriel ]
   * Provide a default keystrokes.cfg in /etc/nx (for nxagent) and /etc/x2go
     (for x2goagent). (Fixes: #199).
   * Use a keystrokes.cfg that reflects the normally hard-coded defaults of
     a vanilla nxagent. (Fixes: #223).
   * Set NXAGENT_KEYSTROKEFILE to /etc/x2go/keystrokes.cfg for wrapper x2goagent.
   * For vanilla nxagent move keystrokes.cfg from /etc/nx to /etc/nxagent.
   * Tarball roller script:
     + Only install keystrokes.cfg when in full mode.
     + Only install nxproxy wrapper when in lite mode.
   * /debian/control:
     + Add B-Ds: libfontconfig1-dev, libfontenc-dev.
   * /debian/nx-libs-dev.install:
     + Remove unrelated files from -dev package.
   * Fix keystrokes.cfg, use Ctrl+Alt+<key> instead of just Ctrl+<key>. (Adds to
     fixing #223).
 .
   [ Orion Poplawski ]
   * Change build options so that bundled libraries are not used anymore at
     build time. Remove bundled libraries from rolled tarballs, as well. (Fixes:
     #238).
   * Add patch: 602_nx-X11_initgroups.full.patch. Fix calling setuid and setgid
     without setgroups or initgroups. There is a high probability this means it
     didn't relinquish all groups, and this would be a potential security issue
     to be fixed. Seek POS36-C on the web for details about the problem. (Fixes:
     #293).

Message #27 received at 293@bugs.x2go.org (full text, mbox, reply):

From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

To: 293-submitter@bugs.x2go.org

Cc: control@bugs.x2go.org, 293@bugs.x2go.org

Subject: X2Go issue (in src:nx-libs) has been marked as closed

Date: Fri, 30 Aug 2013 16:20:08 +0200 (CEST)

close #293
thanks

Hello,

we are very hopeful that X2Go issue #293 reported by you
has been resolved in the new release (2:3.5.0.21) of the
X2Go source project »src:nx-libs«.

You can view the complete changelog entry of src:nx-libs (2:3.5.0.21)
below, and you can use the following link to view all the code changes
between this and the last release of src:nx-libs.

    http://code.x2go.org/gitweb?p=nx-libs.git;a=commitdiff;h=1102c6c766cfca9136b7fb04dfb6bcbf3c8ab25d;hp=225445db3cb6c6fc05db264f537eb9ad6050fd1c

If you feel that the issue has not been resolved satisfyingly, feel
free to reopen this bug report or submit a follow-up report with
further observations described based on the new released version
of src:nx-libs.

Thanks a lot for contributing to X2Go!!!

light+love
X2Go Git Admin (on behalf of the sender of this mail)

---
X2Go Component: src:nx-libs
Version: 2:3.5.0.21
Status: RELEASE
Date: Fri, 30 Aug 2013 16:18:04 +0200
Fixes: 199 223 238 293
Changes: 
 nx-libs (2:3.5.0.21-0) RELEASED; urgency=low
 .
   [ Mike Gabriel ]
   * Provide a default keystrokes.cfg in /etc/nx (for nxagent) and /etc/x2go
     (for x2goagent). (Fixes: #199).
   * Use a keystrokes.cfg that reflects the normally hard-coded defaults of
     a vanilla nxagent. (Fixes: #223).
   * Set NXAGENT_KEYSTROKEFILE to /etc/x2go/keystrokes.cfg for wrapper x2goagent.
   * For vanilla nxagent move keystrokes.cfg from /etc/nx to /etc/nxagent.
   * Tarball roller script:
     + Only install keystrokes.cfg when in full mode.
     + Only install nxproxy wrapper when in lite mode.
   * /debian/control:
     + Add B-Ds: libfontconfig1-dev, libfontenc-dev.
   * /debian/nx-libs-dev.install:
     + Remove unrelated files from -dev package.
   * Fix keystrokes.cfg, use Ctrl+Alt+<key> instead of just Ctrl+<key>. (Adds to
     fixing #223).
 .
   [ Orion Poplawski ]
   * Change build options so that bundled libraries are not used anymore at
     build time. Remove bundled libraries from rolled tarballs, as well. (Fixes:
     #238).
   * Add patch: 602_nx-X11_initgroups.full.patch. Fix calling setuid and setgid
     without setgroups or initgroups. There is a high probability this means it
     didn't relinquish all groups, and this would be a potential security issue
     to be fixed. Seek POS36-C on the web for details about the problem. (Fixes:
     #293).

Send a report that this bug log contains spam.