[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1418925051.5935.33.camel@juliet.mcarpenter.org>
Date: Thu, 18 Dec 2014 18:50:51 +0100
From: Martin Carpenter <mcarpenter@...e.fr>
To: oss-security@...ts.openwall.com
Subject: Re: Running Java across a privilege boundry
On Thu, 2014-12-18 at 15:46 +0100, Jakub Wilk wrote:
> Absolutely. Lintian has a check for RPATH (but not for RUNPATH, AFAICT);
> alas, it doesn't distinguish between security and non-security problems:
> https://lintian.debian.org/tags/binary-or-shlib-defines-rpath.html
Aha, thanks. Security vs. non-security is perhaps not a disaster:
"serious, certain" would already be an improvement over not flagging
this at all.
> I requested a separate tag for relative RPATH a while ago:
> https://bugs.debian.org/732682
> Now we "only" need someone to write the code. :-)
Great! Is that all we need? The tests reference the Debian policy manual
(package debian-policy):
https://www.debian.org/doc/debian-policy/ch-sharedlibs.html
(for completeness: also sections 10.2, 10.3).
This references neither RPATH nor RUNPATH. Perhaps we need to fix that
first?
Suggested addition:
8.7 RUNPATH and RPATH
Libraries that define RPATH or RUNPATH should ensure that this does not
contain relative paths. This is to prevent an executable from loading a
library from an untrusted location. (This should include the corner
cases whereby the path starts or ends with a colon, or includes two
consecutive colons).
Did I miss anything?
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
