Johannes Segitz
7dcf78b266
Accepting request 787822 from home:jsegitz:branches:Base:System
...
- Update to version 20200324:
* whitelist s390-tools setgid bit on log directory (bsc#1167163)
* whitelist WMP (bsc#1161335)
* regtest: improve readability of path variables by using literals
* regtest: adjust test suite to new path locations in /usr/share/permissions
* regtest: only catch explicit FileNotFoundError
* regtest: provide valid home directory in /root
* regtest: mount permissions src repository in /usr/src/permissions
* regtest: move initialialization of TestBase paths into the prepare() function
* chkstat: suppport new --config-root command line option
* fix spelling of icingacmd group
OBS-URL: https://build.opensuse.org/request/show/787822
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=254
2020-03-24 14:13:59 +00:00
c1a2fada58
Accepting request 780264 from home:mkraus:branches:Base:System
...
- Update to version 20200228:
* chkstat: fix readline() on platforms with unsigned char
- Update to version 20200227:
* remove capability whitelisting for radosgw
* whitelist ceph log directory (bsc#1150366)
* adjust testsuite to post CVE-2020-8013 link handling
* testsuite: add option to not mount /proc
* do not follow symlinks that are the final path element: CVE-2020-8013
* add a test for symlinked directories
* fix relative symlink handling
* include cpp compat headers, not C headers
* Move permissions and permissions.* except .local to /usr/share/permissions
* regtest: fix the static PATH list which was missing /usr/bin
* regtest: also unshare the PID namespace to support /proc mounting
* regtest: bindMount(): explicitly reject read-only recursive mounts
* Makefile: force remove upon clean target to prevent bogus errors
* regtest: by default automatically (re)build chkstat before testing
* regtest: add test for symlink targets
* regtest: make capability setting tests optional
* regtest: fix capability assertion helper logic
* regtests: add another test case that catches set*id or caps in world-writable sub-trees
* regtest: add another test that catches when privilege bits are set for special files
* regtest: add test case for user owned symlinks
* regtest: employ subuid and subgid feature in user namespace
* regtest: add another test case that covers unknown user/group config
* regtest: add another test that checks rejection of insecure mixed-owner paths
* regtest: add test that checks for rejection of world-writable paths
* regtest: add test for detection of unexpected parent directory ownership
* regtest: add further helper functions, allow access to main instance
OBS-URL: https://build.opensuse.org/request/show/780264
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=252
2020-03-02 13:50:40 +00:00
Malte Kraus
a115569e05
- Update to version 20200213:
...
* remove obsolete/broken entries for rcp/rsh/rlogin
* chkstat: handle symlinks in final path elements correctly
* Revert "Revert "mariadb: settings for new auth_pam_tool (bsc#1160285)""
* Revert "mariadb: settings for new auth_pam_tool (bsc#1160285)"
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=250
2020-02-13 12:20:20 +00:00
d9ba7c2f04
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=248
2020-02-04 12:30:29 +00:00
a4023dfa6b
- Update to version 20200204:
...
* mariadb: settings for new auth_pam_tool (bsc#1160285)
* chkstat:
- add read-only fallback when /proc is not mounted (bsc#1160764)
- capability handling fixes (bsc#1161779)
- better error message when refusing to fix dir perms (#32 )
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=247
2020-02-04 12:22:39 +00:00
Malte Kraus
70de14a4ec
- Update to version 20200127:
...
* fix paths of ksysguard whitelisting
* fix zero-termination of error message for overly long paths
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=246
2020-01-27 12:02:43 +00:00
Malte Kraus
cba6c7245b
fix version
...
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=244
2019-12-05 14:37:17 +00:00
Malte Kraus
ac5efb502f
- Update to version 20191205:
...
* fix privilege escalation through untrusted symlinks (bsc#1150734,
CVE-2019-3690)
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=243
2019-12-05 14:34:56 +00:00
671dc94a75
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=242
2019-11-27 12:48:34 +00:00
5feb66e055
- Update to version 20191122:
...
* faxq-helper: correct "secure" permission for trusted group (bsc#1157498)
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=241
2019-11-27 12:48:04 +00:00
Malte Kraus
20fbab7702
- Update to version 20191118:
...
* whitelist ksysguard network helper (bsc#1151190)
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=239
2019-11-18 09:54:19 +00:00
Malte Kraus
bdb9837e95
- Update to version 20191112:
...
* fix syntax of paranoid profile
* fix squid permissions (bsc#1093414, CVE-2019-3688)
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=238
2019-11-12 12:51:22 +00:00
4e0657a187
Accepting request 734796 from home:scarabeus_iv:branches:Base:System
...
- Add || exit 0 on the scriptlet as it can actually fail in
rootless containers with podman. This makes sure the zypper
does not abort the container creation.
* the actual error looks like:
/dev/zero: chown: Operation not permitted
OBS-URL: https://build.opensuse.org/request/show/734796
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=236
2019-10-03 13:03:49 +00:00
Johannes Segitz
13d46ae0a1
Accepting request 730731 from home:jsegitz:branches:Base:System
...
- Update to version 20190913:
* setgid bit for nagios directory (bsc#1028975, bsc#1150345)
- This also restructures the sources for the permission package
OBS-URL: https://build.opensuse.org/request/show/730731
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=234
2019-09-13 13:17:47 +00:00
Malte Kraus
c9ec3a7362
- Update to version 20190830:
...
* dumpcap: remove 'other' executable bit because of capabilities (boo#1148788, CVE-2019-3687)
- Update to version 20190829:
* add one more missing slash for icinga2
* fix more missing slashes for directories
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=232
2019-08-30 14:26:48 +00:00
Johannes Segitz
617c5f2df9
Accepting request 714669 from home:mkraus:branches:Base:System
...
- Update to version 20190711:
* iputils: Add capability permissions for clockdiff (bsc#1140994)
OBS-URL: https://build.opensuse.org/request/show/714669
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=228
2019-07-12 09:02:35 +00:00
a83a90964a
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=227
2019-07-10 12:30:49 +00:00
f1694e5736
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=224
2019-06-13 10:04:14 +00:00
5b398c37ea
- Update to version 20190521:
...
* singluarity: Add starter-suid for version 3.2.0
* adjust settings for amanda to current binary layout
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=223
2019-06-13 08:58:09 +00:00
6d800560d0
Accepting request 707829 from home:jsegitz:branches:Base:System
...
- Move BuildRequires: back to main package
OBS-URL: https://build.opensuse.org/request/show/707829
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=222
2019-06-05 12:35:17 +00:00
c817154009
Accepting request 707806 from home:jsegitz:branches:Base:System
...
- Moved requires to subpackages (bsc#1137257)
OBS-URL: https://build.opensuse.org/request/show/707806
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=221
2019-06-05 11:28:29 +00:00
7ef24ac09f
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=219
2019-05-02 13:38:50 +00:00
9bbb7deff7
Accepting request 700150 from home:jsegitz:branches:Base:System
...
- Fixed versions. Removed set_version from _service file, doesn't
work with the new packaging. Call fix_version.sh to set current
date as version instead
- Fixed requires for -config and -zypp-plugin
OBS-URL: https://build.opensuse.org/request/show/700150
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=218
2019-05-02 13:24:27 +00:00
741577cc7c
Accepting request 699578 from home:jsegitz:branches:Base:System
...
- Update to version 20190429:
* removed entry for /var/cache/man. Conflicts with packaging and man:man is
the better setting anyway (bsc#1133678)
* fixed error in description of permissions.paranoid. Make it clear that this
is not a usable profile, but intended as a base for own developments
OBS-URL: https://build.opensuse.org/request/show/699578
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=217
2019-05-01 06:26:24 +00:00
edfc5837d1
Accepting request 693920 from home:jengelh:branches:Base:System
...
- Fix RPM group, fix hard requirement on documentation.
Update description typography.
OBS-URL: https://build.opensuse.org/request/show/693920
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=216
2019-04-15 18:37:33 +00:00
e7563d435d
Accepting request 693721 from home:jsegitz:branches:Base:System
...
- Created new subpackages -config, -doc and standalone package chkstat
where we can start a better versioning scheme and require it from the
original package
OBS-URL: https://build.opensuse.org/request/show/693721
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=215
2019-04-12 13:08:09 +00:00
f25290dd69
Accepting request 674173 from home:jsegitz:branches:Base:System
...
- Update to version 20190212:
* removed old entry for wodim
* removed old entry for netatalk
* removed old entry for suidperl
* removed old entriy for utempter
* removed old entriy for hostname
* removed old directory entries
* removed old entry for qemu-bridge-helper
* removed old entries for pccardctl
* removed old entries for isdnctrl
* removed old entries for unix(2)_chkpwd
* removed old entries for mount.nfs
* removed old entries for (u)mount
* removed old entry for fileshareset
* removed old entries for KDE
* removed old entry for heartbeat
* removed old entry for gnome-control-center
* removed old entry for pcp
* removed old entry for lpdfilter
* removed old entry for scotty
* removed old entry for ia32el
* removed old entry for squid
* removed old qpopper whitelist
* removed pt_chown entries. Not needed anymore and a bad idea anyway
* removed old majordomo entry
* removed stale entries for old ncpfs tools
* removed old entry for rmtab
* Fixed typo in icinga2 whitelist entry
* New whitelisting for /usr/lib/virtualbox/VirtualBoxVM and removed stale
entries for VirtualBox
OBS-URL: https://build.opensuse.org/request/show/674173
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=213
2019-02-13 16:59:34 +00:00
687b016f47
Accepting request 649628 from home:mgerstner:branches:Base:System
...
- Update to version 20181116:
* zypper-plugin: new plugin to fix bsc#1114383
OBS-URL: https://build.opensuse.org/request/show/649628
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=211
2018-11-16 16:39:18 +00:00
2808ce4fdd
- Update to version 20181112:
...
* singularity: remove -suid binaries that have been dropped since version
2.4 (bsc#1028304)
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=210
2018-11-12 12:15:37 +00:00
a73387d528
- Update to version 20181030:
...
* capability whitelisting: allow cap_net_bind_service for ns-slapd from 389-ds
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=208
2018-10-30 12:14:17 +00:00
7054263663
- Update to version 20181029:
...
* setuid whitelisting: add fusermount3 (bsc#1111230)
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=207
2018-10-29 16:59:42 +00:00
6f2a944fac
- Update to version 20181025:
...
* setuid whitelisting: add authbind binary (bsc#1111251)
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=206
2018-10-25 16:15:13 +00:00
f4d7d3598d
- Update to version 20180827:
...
* setuid whitelisting: add firejail binary (bsc#1059013)
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=203
2018-08-27 09:16:16 +00:00
d7a67f7831
- Update to version 20180810:
...
* setuid whitelisting: add lxc-user-nic (bsc#988348)
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=202
2018-08-10 09:23:22 +00:00
11a9977c9e
- Update to version 20180802:
...
* whitelisting: added smc-tools LD_PRELOAD library (bsc#1102956)
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=200
2018-08-02 16:24:20 +00:00
255dbfc84f
Accepting request 624972 from home:mgerstner:branches:Base:System
...
- Update to version 20180724:
* Fix wrong file path in help string
* whitelisting: add spice-gtk usb helper setuid binary (bnc#1101420)
OBS-URL: https://build.opensuse.org/request/show/624972
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=198
2018-07-24 11:46:06 +00:00
9ebc9d2aa6
- Update to version 20180508:
...
* Capabilities for usage of Wireshark for non-root (bsc#957624)
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=195
2018-05-08 06:12:16 +00:00
ee933ba6a8
- Update to version 20180125:
...
* make btmp root:utmp (bsc#1050467)
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=192
2018-01-25 12:54:05 +00:00
ac7a7aecfc
- Update to version 20180115:
...
* - polkit-default-privs: usbauth (bsc#1066877)
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=191
2018-01-15 09:57:27 +00:00
0433ec9d56
Accepting request 548215 from home:kukuk:branches:Base:System
...
- fillup is required for post, not pre installation
OBS-URL: https://build.opensuse.org/request/show/548215
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=189
2017-12-05 07:10:12 +00:00
d85ec2cc61
Accepting request 546606 from home:pluskalm:branches:Base:System
...
- Cleanup spec file with spec-cleaner
- Drop conditions/definitions related to old distros
OBS-URL: https://build.opensuse.org/request/show/546606
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=188
2017-11-30 10:35:19 +00:00
f434538bbd
- Update to version 20171129:
...
* permissions: adding gvfs (bsc#1065864)
* Allow setgid incingacmd on directory /run/icinga2/cmd bsc#1069410
* Allow fping cap_net_raw (bsc#1047921)
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=187
2017-11-29 17:02:48 +00:00
24ce7041d6
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=186
2017-11-24 16:26:13 +00:00
2688fa191a
Accepting request 544692 from home:RBrownSUSE:branches:Base:System
...
Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)
OBS-URL: https://build.opensuse.org/request/show/544692
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=185
2017-11-23 14:58:07 +00:00
a7962163fe
- Update to version 20171121:
...
* - permissions: adding kwayland (bsc#1062182)
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=182
2017-11-21 14:07:42 +00:00
b680cbc36d
- Update to version 20171106:
...
* Allow setuid root for singularity (group only) bsc#1028304
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=180
2017-11-06 15:58:58 +00:00
fb770d791f
- Update to version 20171025:
...
* Stricter permissions on cron directories (paranoid) and stricter permissions on sshd_config (secure/paranoid)
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=177
2017-10-25 15:51:58 +00:00
8b1949dd93
- Update to version 20170928:
...
* Fix invalid syntax bsc#1048645 bsc#1060738
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=174
2017-09-28 10:48:52 +00:00
ae2fcfcc83
- Update to version 20170927:
...
* fix typos in manpages
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=173
2017-09-27 14:50:43 +00:00
88add7774f
- Update to version 20170922:
...
* Allow setuid root for singularity (group only) bsc#1028304
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=171
2017-09-22 14:01:01 +00:00