Hi On Mon, Dec 24, 2012 at 10:29:24PM +0100, Martin Quinson wrote: > attached is a possible patch for that issue. This is just a starting > point, as I was not able to test the patch myself. Also, I used 660 as > permissions to the file, I'm not sure of whether it's sensible or not. > > Please review and test before applying.
I had too a look at this vulnerability during looking open RC bugs for wheezy. I had a look at the upstream git repository and there are at least [1], [2] and [3]. [1]: http://git.fedorahosted.org/cgit/sanlock.git/commit/?id=3a2ba2d0fbe78f4eacd438b708ceff6e96903d37 [2]: http://git.fedorahosted.org/cgit/sanlock.git/commit/?id=1339694c3bad23055f896e90353c81fd65bd4a7e [3]: http://git.fedorahosted.org/cgit/sanlock.git/commit/?id=9b13cb12973fac422423eec1c6a91f21b5257c92 Attached is the debdiff contianing these three refreshed for the version in unstable and testing. But I'm not yet ready to propose a NMU. Testing of the resulting package is welcome! David, are you working too on it? Regards Salvatore
diff -Nru sanlock-2.2/debian/changelog sanlock-2.2/debian/changelog
--- sanlock-2.2/debian/changelog 2012-06-04 15:33:14.000000000 +0200
+++ sanlock-2.2/debian/changelog 2013-01-03 22:12:48.000000000 +0100
@@ -1,3 +1,14 @@
+sanlock (2.2-1.1) unstable; urgency=low
+
+ * Non-maintainer upload.
+ * Fix CVE-2012-5638 sanlock world writable /var/log/sanlock.log.
+ Add patches cherry-picked from git repository:
+ - 0001-sanlock-remove-umask-0.patch
+ - 0001-sanlock-use-lockfile-mode-644.patch
+ - 0001-wdmd-use-lockfile-mode-644.patch (Closes: #696424)
+
+ -- Salvatore Bonaccorso <car...@debian.org> Thu, 03 Jan 2013 22:12:33 +0100
+
sanlock (2.2-1) unstable; urgency=low
* Initial release. (Closes: #669102)
diff -Nru sanlock-2.2/debian/patches/0001-sanlock-remove-umask-0.patch
sanlock-2.2/debian/patches/0001-sanlock-remove-umask-0.patch
--- sanlock-2.2/debian/patches/0001-sanlock-remove-umask-0.patch
1970-01-01 01:00:00.000000000 +0100
+++ sanlock-2.2/debian/patches/0001-sanlock-remove-umask-0.patch
2013-01-03 22:12:48.000000000 +0100
@@ -0,0 +1,23 @@
+From 9b13cb12973fac422423eec1c6a91f21b5257c92 Mon Sep 17 00:00:00 2001
+From: David Teigland <teigl...@redhat.com>
+Date: Fri, 3 Aug 2012 14:24:07 -0500
+Subject: [PATCH] sanlock: remove umask 0
+
+Remove umask(0) which causes sanlock.log to have mode 666.
+It's 644 without the umask.
+
+Signed-off-by: David Teigland <teigl...@redhat.com>
+---
+ src/main.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/src/main.c
++++ b/src/main.c
+@@ -1198,7 +1198,6 @@
+ log_tool("cannot fork daemon\n");
+ exit(EXIT_FAILURE);
+ }
+- umask(0);
+ }
+
+ /* main task never does disk io, so we don't really need to set
diff -Nru sanlock-2.2/debian/patches/0001-sanlock-use-lockfile-mode-644.patch
sanlock-2.2/debian/patches/0001-sanlock-use-lockfile-mode-644.patch
--- sanlock-2.2/debian/patches/0001-sanlock-use-lockfile-mode-644.patch
1970-01-01 01:00:00.000000000 +0100
+++ sanlock-2.2/debian/patches/0001-sanlock-use-lockfile-mode-644.patch
2013-01-03 22:12:48.000000000 +0100
@@ -0,0 +1,21 @@
+From 1339694c3bad23055f896e90353c81fd65bd4a7e Mon Sep 17 00:00:00 2001
+From: David Teigland <teigl...@redhat.com>
+Date: Thu, 2 Aug 2012 11:27:54 -0500
+Subject: [PATCH] sanlock: use lockfile mode 644
+
+Signed-off-by: David Teigland <teigl...@redhat.com>
+---
+ src/lockfile.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/src/lockfile.c
++++ b/src/lockfile.c
+@@ -47,7 +47,7 @@
+
+ snprintf(path, PATH_MAX, "%s/%s", dir, name);
+
+- fd = open(path, O_CREAT|O_WRONLY|O_CLOEXEC, 0666);
++ fd = open(path, O_CREAT|O_WRONLY|O_CLOEXEC, 0644);
+ if (fd < 0) {
+ log_error("lockfile open error %s: %s",
+ path, strerror(errno));
diff -Nru sanlock-2.2/debian/patches/0001-wdmd-use-lockfile-mode-644.patch
sanlock-2.2/debian/patches/0001-wdmd-use-lockfile-mode-644.patch
--- sanlock-2.2/debian/patches/0001-wdmd-use-lockfile-mode-644.patch
1970-01-01 01:00:00.000000000 +0100
+++ sanlock-2.2/debian/patches/0001-wdmd-use-lockfile-mode-644.patch
2013-01-03 22:12:48.000000000 +0100
@@ -0,0 +1,21 @@
+From 3a2ba2d0fbe78f4eacd438b708ceff6e96903d37 Mon Sep 17 00:00:00 2001
+From: David Teigland <teigl...@redhat.com>
+Date: Wed, 1 Aug 2012 17:00:53 -0500
+Subject: [PATCH] wdmd: use lockfile mode 644
+
+Signed-off-by: David Teigland <teigl...@redhat.com>
+---
+ wdmd/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/wdmd/main.c
++++ b/wdmd/main.c
+@@ -819,7 +819,7 @@
+
+ sprintf(lockfile_path, "%s/wdmd.pid", WDMD_RUN_DIR);
+
+- fd = open(lockfile_path, O_CREAT|O_WRONLY|O_CLOEXEC, 0666);
++ fd = open(lockfile_path, O_CREAT|O_WRONLY|O_CLOEXEC, 0644);
+ if (fd < 0) {
+ log_error("lockfile open error %s: %s",
+ lockfile_path, strerror(errno));
diff -Nru sanlock-2.2/debian/patches/series sanlock-2.2/debian/patches/series
--- sanlock-2.2/debian/patches/series 2012-06-04 15:33:14.000000000 +0200
+++ sanlock-2.2/debian/patches/series 2013-01-03 22:12:48.000000000 +0100
@@ -1,4 +1,6 @@
sanlock-SCHED_RESET_ON_FORK-undefined.patch
libdir.patch
put_libs_into_dir.patch
-
+0001-sanlock-remove-umask-0.patch
+0001-sanlock-use-lockfile-mode-644.patch
+0001-wdmd-use-lockfile-mode-644.patch
signature.asc
Description: Digital signature
