On Sat, 27 Jul 2019 at 14:13:34 +0200, Salvatore Bonaccorso wrote:
> On Sat, Jul 27, 2019 at 11:37:48AM +0100, Simon McVittie wrote:
> > Security team: for stable, bearing those mitigations in mind, do you
> > want to do a DSA or is this point-release material?
>
> I think this can safely go via a point release then. Are you planning
> to do both the buster and stretch one? If as well the later, there
> seem some other CVEs which previously were marked no-dsa for stretch.
> If you think any of those might be sensible to include as well then
> please feel free to include those as well.
I don't have any local stretch machines any more except for test VMs,
so I can't do a whole lot of testing for stretch point releases. As a
result I'm only preparing a buster version at the moment.
If I do a stretch version later, then I'll look at whether the other
no-dsa CVEs are unintrusive enough to fix.
Simple reproducer for this one attached (requires python3-gi and
gsettings-desktop-schemas).
smcv
#!/usr/bin/python3
import os
import subprocess
import tempfile
import time
with tempfile.TemporaryDirectory() as tmp:
os.chmod(tmp, 0o755)
os.umask(0o002)
d = os.path.join(tmp, 'config')
f = os.path.join(d, 'test.cfg')
from gi.repository import Gio
backend = Gio.keyfile_settings_backend_new(f, '/', 'root')
settings = Gio.Settings.new_with_backend('org.gnome.desktop.background',
backend)
settings.set_int('picture-opacity', 42)
subprocess.call(['find', tmp, '-ls'])
assert os.path.exists(d)
assert (os.stat(d).st_mode & 0o7777) == 0o700, os.stat(d)
assert os.path.exists(f)
assert (os.stat(f).st_mode & 0o7777) == 0o600, os.stat(f)
