From 7a807c8ea1d27a8d462726586bd385dd8ab750a7914671a4ff2d8fa8853cc94a Mon Sep 17 00:00:00 2001 From: "Dr. Werner Fink" Date: Wed, 11 Mar 2020 16:11:02 +0000 Subject: [PATCH] . OBS-URL: https://build.opensuse.org/package/show/Publishing:TeXLive/texlive-filesystem?expand=0&rev=132 --- texlive-filesystem.changes | 13 ++++++++---- texlive-filesystem.spec | 43 +++++++++----------------------------- texlive.cron | 1 + update.texlive | 2 +- 4 files changed, 21 insertions(+), 38 deletions(-) diff --git a/texlive-filesystem.changes b/texlive-filesystem.changes index 1709139..c5b985a 100644 --- a/texlive-filesystem.changes +++ b/texlive-filesystem.changes @@ -1,8 +1,13 @@ +------------------------------------------------------------------- +Wed Mar 11 16:03:20 UTC 2020 - Dr. Werner Fink + +- Use CVE numbers + ------------------------------------------------------------------- Thu Feb 20 11:01:15 UTC 2020 - Dr. Werner Fink - Use setpriv to create ls-R files, below /var/cache/texmf/fonts - use uid mktex for this (boo#1159740) + use uid mktex for this (boo#1159740, CVE-2020-8016) ------------------------------------------------------------------- Wed Feb 5 06:56:24 UTC 2020 - Dr. Werner Fink @@ -13,7 +18,7 @@ Wed Feb 5 06:56:24 UTC 2020 - Dr. Werner Fink Tue Feb 4 12:20:03 UTC 2020 - Dr. Werner Fink - Again use setpriv but now switch to every single owner for clearing - the files of this owner (boo#1159740) + the files of this owner (boo#1159740, CVE-2020-8016) ------------------------------------------------------------------- Fri Jan 31 12:32:25 UTC 2020 - Dr. Werner Fink @@ -35,9 +40,9 @@ Thu Jan 16 12:02:43 UTC 2020 - Dr. Werner Fink Fri Jan 10 12:35:50 UTC 2020 - Dr. Werner Fink - Set default user for ls-R files and font cache directories - to user nobody (bsc#1159740) + to user nobody (bsc#1159740, CVE-2020-8016) - Use setpriv to switch to nobody:mktex before clearing - font cache directories (bsc#1158910) + font cache directories (bsc#1158910, CVE-2020-8017) ------------------------------------------------------------------- Thu Dec 19 08:04:39 UTC 2019 - Dr. Werner Fink diff --git a/texlive-filesystem.spec b/texlive-filesystem.spec index 9e39245..55f0a8c 100644 --- a/texlive-filesystem.spec +++ b/texlive-filesystem.spec @@ -15388,55 +15388,32 @@ popd %{_bindir}/getent group %{texgrp} > /dev/null 2>&1 || %{_sbindir}/groupadd -r %{?texgid:-g %texgid} %{texgrp} %{_bindir}/getent passwd %{texusr} > /dev/null 2>&1 || %{_sbindir}/useradd -r %{?texuid:-u %texuid} -g %{texgrp} -d %{_fontcache} -s /bin/false %{texusr} # the ls-R file on update -error=0 for dir in %{_texmfconfdir} \ + %{_fontcache} \ %{_texmfvardir} \ %{_texmfvardir}/dist \ %{_texmfvardir}/main do - test ! -h ${dir}/ls-R || rm -vf ${dir}/ls-R - test -e ${dir}/ls-R || continue - test "$(stat --format '%U:%G' ${dir}/ls-R)" != root:%{texgrp} || continue - chown root:%{texgrp} ${dir}/ls-R || error=1 + rm -f ${dir}/ls-R done -for dir in %{_fontcache} -do - test ! -h ${dir}/ls-R || rm -vf ${dir}/ls-R - test -e ${dir}/ls-R || continue - test "$(stat --format '%U:%G' ${dir}/ls-R)" != %{texusr}:%{texgrp} || continue - chown %{texusr}:%{texgrp} ${dir}/ls-R || error=1 -done -test $error = 0 || exit 1 %post %fillup_only -n texlive # the ls-R file (empty at package time) error=0 +user= for dir in %{_texmfconfdir} \ + %{_fontcache} \ %{_texmfvardir} \ %{_texmfvardir}/dist \ %{_texmfvardir}/main do - test ! -e ${dir}/ls-R -o -h ${dir}/ls-R || continue - tmp=$(setpriv --reuid root --regid mktex --init-groups mktemp ${dir}/ls-R.XXXXXX) || error=1 - test $error = 0 || continue - setpriv --reuid root --regid mktex --init-groups mv ${tmp} ${dir}/ls-R || error=1 - test $error = 0 || continue - chmod 0664 ${dir}/ls-R || error=1 - test $error = 0 || continue - echo '%% ls-R -- filename database for kpathsea; do not change this line.' > \ - ${dir}/ls-R -done -for dir in %{_fontcache} -do - test ! -e ${dir}/ls-R -o -h ${dir}/ls-R || continue - tmp=$(setpriv --reuid mktex --regid mktex --init-groups mktemp ${dir}/ls-R.XXXXXX) || error=1 - test $error = 0 || continue - setpriv --reuid mktex --regid mktex --init-groups mv ${tmp} ${dir}/ls-R || error=1 - test $error = 0 || continue - chmod 0664 ${dir}/ls-R || error=1 - echo '%% ls-R -- filename database for kpathsea; do not change this line.' > \ - ${dir}/ls-R + test "$dir" = %{_fontcache} && user=%{texusr} || user=root + setpriv --reuid $user --regid mktex --init-groups /bin/sh -ec " + tmp=\$(mktemp ${dir}/ls-R.XXXXXX) + chmod 0664 \${tmp} + echo '%% ls-R -- filename database for kpathsea; do not change this line.' > \${tmp} + mv \${tmp} ${dir}/ls-R" || error=1 done %if %{defined set_permissions} %set_permissions %{_texmfconfdir}/ls-R diff --git a/texlive.cron b/texlive.cron index b7a2e07..452d6c9 100644 --- a/texlive.cron +++ b/texlive.cron @@ -54,6 +54,7 @@ fi # # Update the ls-R's +# Note that this is done as user mktex # mktexlsr > /dev/null diff --git a/update.texlive b/update.texlive index 7ec4173..a3f13c4 100644 --- a/update.texlive +++ b/update.texlive @@ -56,7 +56,7 @@ export LANG MKTEXLSR UPDMAPSYNC # # Sanity check # -size=$(find /etc/texmf/ls-R -follow -printf '%s') +size=$(find /etc/texmf/ls-R -follow -printf '%s' || echo 0) test $size -lt 80 && > /var/run/texlive/run-mktexlsr rotator ()