[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-stable] [PATCH stable-1.1] qga: set umask 0077 when daemonizin
From: |
Laszlo Ersek |
Subject: |
Re: [Qemu-stable] [PATCH stable-1.1] qga: set umask 0077 when daemonizing (CVE-2013-2007) |
Date: |
Mon, 27 May 2013 02:28:47 +0200 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130513 Thunderbird/17.0.6 |
On 05/27/13 02:19, Andreas Färber wrote:
> Am 27.05.2013 02:11, schrieb Laszlo Ersek:
>> Do you plan to backport
>>
>> 8fe6bbc qga: distinguish binary modes in "guest_file_open_modes" map
>> 2b72001 qga: unlink just created guest-file if fchmod() or fdopen()
>> fails on it
>>
>> too? These are considered polish for the CVE fix.
>
> I did backport both to openSUSE 12.2 - they apply without conflicts. :)
> I mainly posted this one to check if there are better QERRs to use.
I think your choices were apt.
>> Also, a side-note: existing world-writable log files etc. are not
>> recreated nor have their modes changed, so maybe a release note or some
>> such would be useful for admins ("delete your previous logfile &
>> optional unix domain socket, or change their modes manually").
>
> Feel free to add a note to the 1.5 Release Notes - it can then be copied
> to the previous releases we backport this fix to.
Do you mean in the wiki? I'll need an account first :)
Thanks,
Laszlo