SHA256
1
0
forked from pool/permissions
Commit Graph

55 Commits

Author SHA256 Message Date
8d415c2c98 - Update to version 20200727:
* etc/permissions: remove static /var/spool/* dirs
  * etc/permissions: remove outdated entries
  * etc/permissions: remove unnecessary static dirs and devices
  * screen: remove now unused /var/run/uscreens

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=274
2020-07-27 12:19:56 +00:00
79548e974d - Update to version 20200710:
* Revert "etc/permissions: remove entries for bind-chrootenv". This
    currently conflicts with the way the CheckSUIDPermissions rpmlint-check is
    implemented.

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=271
2020-07-10 09:51:12 +00:00
af3b1d9d0a - Update to version 20200624:
* rework permissions.local text (boo#1173221)
  * dbus-1: adjust to new libexec dir location (bsc#1171164)
  * permission profiles: reinstate kdesud for kde5
  * etc/permissions: remove entries for bind-chrootenv
  * etc/permissions: remove traceroute entry
  * VirtualBox: remove outdated entry which is only a symlink any more
  * /bin/su: remove path refering to symlink
  * etc/permissions: remove legacy RPM directory entries
  * /etc/permissions: remove outdated sudo directories
  * singularity: remove outdated setuid-binary entries
  * chromium: remove now unneeded chrome_sandbox entry (bsc#1163588)
  * dbus-1: remove deprecated alternative paths
  * PolicyKit: remove outdated entries last used in SLE-11
  * pcp: remove no longer needed / conflicting entries
  * gnats: remove entries for package removed from Factory
  * kdelibs4: remove entries for package removed from Factory
  * v4l-base: remove entries for package removed from Factory
  * mailman: remove entries for package deleted from Factory
  * gnome-pty-helper: remove dead entry no longer part of the vte package
  * gnokii: remove entries for package no longer in Factory
  * xawtv (v4l-conf): correct group ownership in easy profile
  * systemd-journal: remove unnecessary profile entries
  * thttp: make makeweb entry usable in the secure profile (bsc#1171580)

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=268
2020-07-07 14:19:17 +00:00
2c673b8f18 - Update to version 20200526:
* profiles: add entries for enlightenment (bsc#1171686)

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=263
2020-05-26 13:04:28 +00:00
3cb7f26448 Accepting request 807566 from home:mgerstner:branches:Base:System
- Update to version 20200520:
  * permissions fixed profile: utempter: reinstate libexec compatibility entry

OBS-URL: https://build.opensuse.org/request/show/807566
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=262
2020-05-20 10:22:24 +00:00
Malte Kraus
b3c2250df9 Accepting request 807173 from home:mgerstner:branches:Base:System
- Update to version 20200519:
  * chkstat: fix sign conversion warnings on 32-bit architectures
  * chkstat: allow simultaneous use of `--set` and `--system`
  * regtest: adjust TestUnkownOwnership test to new warning output behaviour

OBS-URL: https://build.opensuse.org/request/show/807173
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=261
2020-05-19 09:32:14 +00:00
Malte Kraus
5ae3717c19 - Update to version 20200518:
* whitelist texlive public binary (bsc#1171686)

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=260
2020-05-18 12:07:18 +00:00
Malte Kraus
4445ad42e7 Accepting request 805788 from home:mgerstner:branches:Base:System
- Update to version 20200514:
  * fixed permissions: adjust to new libexec dir location (bsc#1171164)
    (affects utempter path)
- Update to version 20200513:
  * major rewrite of the chkstat tool
  * setuid bit for cockpit (bsc#1169614)

OBS-URL: https://build.opensuse.org/request/show/805788
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=259
2020-05-18 11:33:57 +00:00
Malte Kraus
5e5838f434 - Update to version 20200506:
* add whitelist for files in /usr/lib to be also allowed in
    /usr/libexec (bsc#1171164)

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=256
2020-05-07 10:00:31 +00:00
Johannes Segitz
7dcf78b266 Accepting request 787822 from home:jsegitz:branches:Base:System
- Update to version 20200324:
  * whitelist s390-tools setgid bit on log directory (bsc#1167163)
  * whitelist WMP (bsc#1161335)
  * regtest: improve readability of path variables by using literals
  * regtest: adjust test suite to new path locations in /usr/share/permissions
  * regtest: only catch explicit FileNotFoundError
  * regtest: provide valid home directory in /root
  * regtest: mount permissions src repository in /usr/src/permissions
  * regtest: move initialialization of TestBase paths into the prepare() function
  * chkstat: suppport new --config-root command line option
  * fix spelling of icingacmd group

OBS-URL: https://build.opensuse.org/request/show/787822
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=254
2020-03-24 14:13:59 +00:00
c1a2fada58 Accepting request 780264 from home:mkraus:branches:Base:System
- Update to version 20200228:
  * chkstat: fix readline() on platforms with unsigned char

- Update to version 20200227:
  * remove capability whitelisting for radosgw
  * whitelist ceph log directory (bsc#1150366)
  * adjust testsuite to post CVE-2020-8013 link handling
  * testsuite: add option to not mount /proc
  * do not follow symlinks that are the final path element: CVE-2020-8013
  * add a test for symlinked directories
  * fix relative symlink handling
  * include cpp compat headers, not C headers
  * Move permissions and permissions.* except .local to /usr/share/permissions
  * regtest: fix the static PATH list which was missing /usr/bin
  * regtest: also unshare the PID namespace to support /proc mounting
  * regtest: bindMount(): explicitly reject read-only recursive mounts
  * Makefile: force remove upon clean target to prevent bogus errors
  * regtest: by default automatically (re)build chkstat before testing
  * regtest: add test for symlink targets
  * regtest: make capability setting tests optional
  * regtest: fix capability assertion helper logic
  * regtests: add another test case that catches set*id or caps in world-writable sub-trees
  * regtest: add another test that catches when privilege bits are set for special files
  * regtest: add test case for user owned symlinks
  * regtest: employ subuid and subgid feature in user namespace
  * regtest: add another test case that covers unknown user/group config
  * regtest: add another test that checks rejection of insecure mixed-owner paths
  * regtest: add test that checks for rejection of world-writable paths
  * regtest: add test for detection of unexpected parent directory ownership
  * regtest: add further helper functions, allow access to main instance

OBS-URL: https://build.opensuse.org/request/show/780264
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=252
2020-03-02 13:50:40 +00:00
Malte Kraus
a115569e05 - Update to version 20200213:
* remove obsolete/broken entries for rcp/rsh/rlogin
  * chkstat: handle symlinks in final path elements correctly
  * Revert "Revert "mariadb: settings for new auth_pam_tool (bsc#1160285)""
  * Revert "mariadb: settings for new auth_pam_tool (bsc#1160285)"

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=250
2020-02-13 12:20:20 +00:00
a4023dfa6b - Update to version 20200204:
* mariadb: settings for new auth_pam_tool (bsc#1160285)
  * chkstat:
    - add read-only fallback when /proc is not mounted (bsc#1160764)
    - capability handling fixes (bsc#1161779)
    - better error message when refusing to fix dir perms (#32)

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=247
2020-02-04 12:22:39 +00:00
Malte Kraus
70de14a4ec - Update to version 20200127:
* fix paths of ksysguard whitelisting
  * fix zero-termination of error message for overly long paths

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=246
2020-01-27 12:02:43 +00:00
Malte Kraus
ac5efb502f - Update to version 20191205:
* fix privilege escalation through untrusted symlinks (bsc#1150734,
    CVE-2019-3690)

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=243
2019-12-05 14:34:56 +00:00
5feb66e055 - Update to version 20191122:
* faxq-helper: correct "secure" permission for trusted group (bsc#1157498)

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=241
2019-11-27 12:48:04 +00:00
Malte Kraus
20fbab7702 - Update to version 20191118:
* whitelist ksysguard network helper (bsc#1151190)

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=239
2019-11-18 09:54:19 +00:00
Malte Kraus
bdb9837e95 - Update to version 20191112:
* fix syntax of paranoid profile
  * fix squid permissions (bsc#1093414, CVE-2019-3688)

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=238
2019-11-12 12:51:22 +00:00
Johannes Segitz
13d46ae0a1 Accepting request 730731 from home:jsegitz:branches:Base:System
- Update to version 20190913:
  * setgid bit for nagios directory (bsc#1028975, bsc#1150345)
- This also restructures the sources for the permission package

OBS-URL: https://build.opensuse.org/request/show/730731
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=234
2019-09-13 13:17:47 +00:00
Malte Kraus
c9ec3a7362 - Update to version 20190830:
* dumpcap: remove 'other' executable bit because of capabilities (boo#1148788, CVE-2019-3687)

- Update to version 20190829:
  * add one more missing slash for icinga2
  * fix more missing slashes for directories

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=232
2019-08-30 14:26:48 +00:00
Malte Kraus
7bd46e85c9 - Update to version 20190820:
* cron directory permissions: add slashes

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=231
2019-08-20 09:47:17 +00:00
Johannes Segitz
617c5f2df9 Accepting request 714669 from home:mkraus:branches:Base:System
- Update to version 20190711:
  * iputils: Add capability permissions for clockdiff (bsc#1140994)

OBS-URL: https://build.opensuse.org/request/show/714669
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=228
2019-07-12 09:02:35 +00:00
6cbfeb58bb - Update to version 20190710:
* iputils/ping: Drop effective capability
  * iputils/ping6: Remove definitions

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=226
2019-07-10 12:30:03 +00:00
5b398c37ea - Update to version 20190521:
* singluarity: Add starter-suid for version 3.2.0
  * adjust settings for amanda to current binary layout

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=223
2019-06-13 08:58:09 +00:00
741577cc7c Accepting request 699578 from home:jsegitz:branches:Base:System
- Update to version 20190429:
  * removed entry for /var/cache/man. Conflicts with packaging and man:man is
    the better setting anyway (bsc#1133678)
  * fixed error in description of permissions.paranoid. Make it clear that this
    is not a usable profile, but intended as a base for own developments

OBS-URL: https://build.opensuse.org/request/show/699578
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=217
2019-05-01 06:26:24 +00:00
f25290dd69 Accepting request 674173 from home:jsegitz:branches:Base:System
- Update to version 20190212:
  * removed old entry for wodim
  * removed old entry for netatalk
  * removed old entry for suidperl
  * removed old entriy for utempter
  * removed old entriy for hostname
  * removed old directory entries
  * removed old entry for qemu-bridge-helper
  * removed old entries for pccardctl
  * removed old entries for isdnctrl
  * removed old entries for unix(2)_chkpwd
  * removed old entries for mount.nfs
  * removed old entries for (u)mount
  * removed old entry for fileshareset
  * removed old entries for KDE
  * removed old entry for heartbeat
  * removed old entry for gnome-control-center
  * removed old entry for pcp
  * removed old entry for lpdfilter
  * removed old entry for scotty
  * removed old entry for ia32el
  * removed old entry for squid
  * removed old qpopper whitelist
  * removed pt_chown entries. Not needed anymore and a bad idea anyway
  * removed old majordomo entry
  * removed stale entries for old ncpfs tools
  * removed old entry for rmtab
  * Fixed typo in icinga2 whitelist entry
  * New whitelisting for /usr/lib/virtualbox/VirtualBoxVM and removed stale
    entries for VirtualBox

OBS-URL: https://build.opensuse.org/request/show/674173
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=213
2019-02-13 16:59:34 +00:00
687b016f47 Accepting request 649628 from home:mgerstner:branches:Base:System
- Update to version 20181116:
  * zypper-plugin: new plugin to fix bsc#1114383

OBS-URL: https://build.opensuse.org/request/show/649628
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=211
2018-11-16 16:39:18 +00:00
2808ce4fdd - Update to version 20181112:
* singularity: remove -suid binaries that have been dropped since version
  2.4 (bsc#1028304)

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=210
2018-11-12 12:15:37 +00:00
a73387d528 - Update to version 20181030:
* capability whitelisting: allow cap_net_bind_service for ns-slapd from 389-ds

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=208
2018-10-30 12:14:17 +00:00
7054263663 - Update to version 20181029:
* setuid whitelisting: add fusermount3 (bsc#1111230)

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=207
2018-10-29 16:59:42 +00:00
6f2a944fac - Update to version 20181025:
* setuid whitelisting: add authbind binary (bsc#1111251)

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=206
2018-10-25 16:15:13 +00:00
f4d7d3598d - Update to version 20180827:
* setuid whitelisting: add firejail binary (bsc#1059013)

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=203
2018-08-27 09:16:16 +00:00
d7a67f7831 - Update to version 20180810:
* setuid whitelisting: add lxc-user-nic (bsc#988348)

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=202
2018-08-10 09:23:22 +00:00
11a9977c9e - Update to version 20180802:
* whitelisting: added smc-tools LD_PRELOAD library (bsc#1102956)

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=200
2018-08-02 16:24:20 +00:00
255dbfc84f Accepting request 624972 from home:mgerstner:branches:Base:System
- Update to version 20180724:
  * Fix wrong file path in help string
  * whitelisting: add spice-gtk usb helper setuid binary (bnc#1101420)

OBS-URL: https://build.opensuse.org/request/show/624972
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=198
2018-07-24 11:46:06 +00:00
9ebc9d2aa6 - Update to version 20180508:
* Capabilities for usage of Wireshark for non-root (bsc#957624)

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=195
2018-05-08 06:12:16 +00:00
6cb0226aaa * the eror should be reported for permfiles[i], not argv[i], as these are not the same files. (bsc#1047247)
OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=193
2018-01-25 13:17:25 +00:00
ee933ba6a8 - Update to version 20180125:
* make btmp root:utmp (bsc#1050467)

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=192
2018-01-25 12:54:05 +00:00
ac7a7aecfc - Update to version 20180115:
* - polkit-default-privs: usbauth (bsc#1066877)

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=191
2018-01-15 09:57:27 +00:00
f434538bbd - Update to version 20171129:
* permissions: adding gvfs (bsc#1065864)
  * Allow setgid incingacmd on directory /run/icinga2/cmd bsc#1069410
  * Allow fping cap_net_raw (bsc#1047921)

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=187
2017-11-29 17:02:48 +00:00
a7962163fe - Update to version 20171121:
* - permissions: adding kwayland (bsc#1062182)

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=182
2017-11-21 14:07:42 +00:00
b680cbc36d - Update to version 20171106:
* Allow setuid root for singularity (group only) bsc#1028304

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=180
2017-11-06 15:58:58 +00:00
fb770d791f - Update to version 20171025:
* Stricter permissions on cron directories (paranoid) and stricter permissions on sshd_config (secure/paranoid)

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=177
2017-10-25 15:51:58 +00:00
8b1949dd93 - Update to version 20170928:
* Fix invalid syntax bsc#1048645 bsc#1060738

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=174
2017-09-28 10:48:52 +00:00
ae2fcfcc83 - Update to version 20170927:
* fix typos in manpages

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=173
2017-09-27 14:50:43 +00:00
88add7774f - Update to version 20170922:
* Allow setuid root for singularity (group only) bsc#1028304

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=171
2017-09-22 14:01:01 +00:00
79244e6f3c - Update to version 20170913:
* Allow setuid for shadow newuidmap, newgidmap bsc#979282, bsc#1048645)

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=168
2017-09-13 16:53:54 +00:00
f811efeca2 - Update to version 20170906:
*

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=165
2017-09-06 09:44:09 +00:00
88cf747ec1 OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=162 2017-09-06 09:42:16 +00:00
80e970fabb OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=155 2017-06-02 10:54:25 +00:00