X2Go Bug report logs - #293
Use initgroups() to initialize group access list

Full log

🔗 View this message in rfc822 format

MIME-Version: 1.0
X-Mailer: MIME-tools 5.502 (Entity 5.502)
X-Loop: owner@bugs.x2go.org
From: owner@bugs.x2go.org (X2Go Bug Tracking System)
Subject: Bug#293 closed by Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
 (X2Go issue (in src:nx-libs) has been marked as closed)
Message-ID: <handler.293.c.13778724244046.notifdone@bugs.x2go.org>
References: <20130830142009.424B95DB39@ymir>
X-X2go-PR-Keywords: pending patch
X-X2go-PR-Message: they-closed 293
X-X2go-PR-Package: nx-libs
Date: Fri, 30 Aug 2013 14:33:06 +0000
Content-Type: multipart/mixed; boundary="----------=_1377873186-16079-0"

[Message part 1 (text/plain, inline)]

This is an automatic notification regarding your Bug report
which was filed against the nx-libs package:

#293: Use initgroups() to initialize group access list

It has been closed by Mike Gabriel <mike.gabriel@das-netzwerkteam.de>.

Their explanation is attached below along with your original report.
If this explanation is unsatisfactory and you have not received a
better one in a separate message then please contact Mike Gabriel <mike.gabriel@das-netzwerkteam.de> by
replying to this email.


-- 
X2Go Bug Tracking System
Contact owner@bugs.x2go.org with problems

[Message part 2 (message/rfc822, inline)]

From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

To: 293-submitter@bugs.x2go.org

Cc: control@bugs.x2go.org, 293@bugs.x2go.org

Subject: X2Go issue (in src:nx-libs) has been marked as closed

Date: Fri, 30 Aug 2013 16:20:09 +0200 (CEST)

close #293
thanks

Hello,

we are very hopeful that X2Go issue #293 reported by you
has been resolved in the new release (2:3.5.0.21) of the
X2Go source project »src:nx-libs«.

You can view the complete changelog entry of src:nx-libs (2:3.5.0.21)
below, and you can use the following link to view all the code changes
between this and the last release of src:nx-libs.

    http://code.x2go.org/gitweb?p=nx-libs.git;a=commitdiff;h=422b1f554e5cb655b8a8702f9f3027760879ea02;hp=225445db3cb6c6fc05db264f537eb9ad6050fd1c

If you feel that the issue has not been resolved satisfyingly, feel
free to reopen this bug report or submit a follow-up report with
further observations described based on the new released version
of src:nx-libs.

Thanks a lot for contributing to X2Go!!!

light+love
X2Go Git Admin (on behalf of the sender of this mail)

---
X2Go Component: src:nx-libs
Version: 2:3.5.0.21
Status: RELEASE
Date: Fri, 30 Aug 2013 16:18:04 +0200
Fixes: 199 223 238 293
Changes: 
 nx-libs (2:3.5.0.21-0) RELEASED; urgency=low
 .
   [ Mike Gabriel ]
   * Provide a default keystrokes.cfg in /etc/nx (for nxagent) and /etc/x2go
     (for x2goagent). (Fixes: #199).
   * Use a keystrokes.cfg that reflects the normally hard-coded defaults of
     a vanilla nxagent. (Fixes: #223).
   * Set NXAGENT_KEYSTROKEFILE to /etc/x2go/keystrokes.cfg for wrapper x2goagent.
   * For vanilla nxagent move keystrokes.cfg from /etc/nx to /etc/nxagent.
   * Tarball roller script:
     + Only install keystrokes.cfg when in full mode.
     + Only install nxproxy wrapper when in lite mode.
   * /debian/control:
     + Add B-Ds: libfontconfig1-dev, libfontenc-dev.
   * /debian/nx-libs-dev.install:
     + Remove unrelated files from -dev package.
   * Fix keystrokes.cfg, use Ctrl+Alt+<key> instead of just Ctrl+<key>. (Adds to
     fixing #223).
 .
   [ Orion Poplawski ]
   * Change build options so that bundled libraries are not used anymore at
     build time. Remove bundled libraries from rolled tarballs, as well. (Fixes:
     #238).
   * Add patch: 602_nx-X11_initgroups.full.patch. Fix calling setuid and setgid
     without setgroups or initgroups. There is a high probability this means it
     didn't relinquish all groups, and this would be a potential security issue
     to be fixed. Seek POS36-C on the web for details about the problem. (Fixes:
     #293).

[Message part 3 (message/rfc822, inline)]

From: Orion Poplawski <orion@cora.nwra.com>

To: submit@bugs.x2go.org

Subject: Use initgroups() to initialize group access list

Date: Thu, 29 Aug 2013 11:12:14 -0600

[Message part 4 (text/plain, inline)]

Package: nx-libs
Tags: patch

The Fedora review of nx-libs caught the following rpmlint issue:

This executable is calling setuid and setgid without setgroups or initgroups.
There is a high probability this mean it didn't relinquish all groups, and this
would be a potential security issue to be fixed. Seek POS36-C on the web for
details about the problem.

Ref POS36-C:

https://www.securecoding.cert.org/confluence/display/seccode/POS36-C.+Observe+correct+revocation+order+while+relinquishing+privileges 


This patch adds initgroups() calls to code to initialize the supplemental 
group list.

I'm done some minimal testing (can connect to a session with client and server 
running this code), but I'm note sure how much that exercised it.

-- 
Orion Poplawski
Technical Manager                     303-415-9701 x222
NWRA, Boulder/CoRA Office             FAX: 303-415-9702
3380 Mitchell Lane                       orion@nwra.com
Boulder, CO 80301                   http://www.nwra.com

[nx-libs-initgroups.patch (text/x-patch, attachment)]

Send a report that this bug log contains spam.