Mirror of https://https.git.savannah.gnu.org/git/coreutils.git/ https://git.shady.money/coreutils/atom?h=v9.0 2021-06-27T01:40:26Z 2021-06-27T01:40:26Z Paul Eggert eggert@cs.ucla.edu 2021-06-27T01:23:52Z urn:sha1:53bb0235d5fdcf6b5e0243b53b1713eb2f5474bc 2021-01-01T16:36:09Z Pádraig Brady P@draigBrady.com 2021-01-01T16:36:09Z urn:sha1:32ff1d1313ff566685b9092ac929251a4c22e7c4 Run "make update-copyright" and then... * gnulib: Update to latest with copyright year adjusted. * tests/init.sh: Sync with gnulib to pick up copyright year. * bootstrap: Likewise. * tests/sample-test: Adjust to use the single most recent year. 2020-10-27T19:23:46Z Pádraig Brady P@draigBrady.com 2020-10-27T14:10:14Z urn:sha1:51cfaef6557a4ff72a8900014185d9299979f7ea * src/basenc.c (usage): Remove extraneous blank line, to be consistent with other utilities that have options. * src/realpath.c: Likewise. * src/runcon.c: Likewise. Addresses https://bugs.gnu.org/44248 2020-01-01T14:16:56Z Pádraig Brady P@draigBrady.com 2020-01-01T14:16:56Z urn:sha1:aaba82431ceca97441d56152d8c7ec2d84fa1d12 Run "make update-copyright" and then... * gnulib: Update to latest with copyright year adjusted. * tests/init.sh: Sync with gnulib to pick up copyright year. * bootstrap: Likewise. * tests/sample-test: Adjust to use the single most recent year. 2019-01-01T23:51:48Z Assaf Gordon assafgordon@gmail.com 2019-01-01T23:50:20Z urn:sha1:8dfcf38af1280c34d7c02b1bbed151368f6de211 Run "make update-copyright" and then... * gnulib: Update to latest with copyright year adjusted. * tests/init.sh: Sync with gnulib to pick up copyright year. * bootstrap: Likewise. * tests/sample-test: Adjust to use the single most recent year. 2018-01-01T15:57:22Z Pádraig Brady P@draigBrady.com 2018-01-01T15:57:22Z urn:sha1:ece7157933fea925da10b5c3e7ace1f0fb2d9f50 Run "make update-copyright" and then... * gnulib: Update to latest with copyright year adjusted. * tests/init.sh: Sync with gnulib to pick up copyright year. * bootstrap: Likewise. * tests/sample-test: Adjust to use the single most recent year. 2017-09-19T08:22:54Z Paul Eggert eggert@cs.ucla.edu 2017-09-19T08:13:23Z urn:sha1:be87d61299f52e366bcb65fd176ccf325b0f77e0 2017-08-30T07:28:20Z Pádraig Brady P@draigBrady.com 2017-08-30T07:27:41Z urn:sha1:f5d7c0842ef7adc2be6e85f9ef66b35ebbbd6a61 This reverts commit v8.27-97-g8cb06d4 because the setsid() fallback was not implemented correctly and disabling the ioctl was not a complete solution to the security issue of the child being passed the tty of the parent. Given runcon is not really a sandbox command, the advice is to use `runcon ... setsid ...` to avoid this particular issue. 2017-08-29T07:38:19Z Pádraig Brady P@draigBrady.com 2017-08-28T08:57:54Z urn:sha1:8cb06d4b44a67f89f24b25e2394365533f6e5968 Similar to the issue with SELinux sandbox (CVE-2016-7545), children of runcon can inject arbitrary input to the terminal that would be run at the originating terminal privileges. The new libseccomp dependency is widely available and used on modern SELinux systems, but is not available by default on older systems like RHEL6 etc. * m4/jm-macros.m4: Check for libseccomp and warn if unavailable on selinux supporting systems. * src/local.mk: Link runcon with -lseccomp. * src/runcon.c (disable_tty_inject): A new function to disable use of the TIOCSTI using libseccomp, or with setsid() where libseccomp is unavailable. * tests/misc/runcon-no-inject.sh: A new test that uses python to make the TIOCSTI call, and ensure that doesn't succeed. * tests/local.mk: Reference the new test * NEWS: Mention the fix. Addresses http://bugs.gnu.org/24541 2017-01-01T22:38:02Z Pádraig Brady P@draigBrady.com 2017-01-01T22:38:02Z urn:sha1:e7a2580b96370da03c4d3553ccdf4ee66a14c6a4 Run "make update-copyright" and then... * gnulib: Update to latest with copyright year adjusted. * tests/init.sh: Sync with gnulib to pick up copyright year. * bootstrap: Likewise. * tests/sample-test: Adjust to use the single most recent year.