[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <20240411152016.1185109-1-ben.hutchings@mind.be>
Date: Thu, 11 Apr 2024 17:20:16 +0200
From: Ben Hutchings <ben.hutchings@...d.be>
To: buildroot@...ldroot.org
Cc: Ben Hutchings <ben.hutchings@...d.be>,
oss-security@...ts.openwall.com
Subject: [PATCH] package/skeleton-init-sysv: Set sticky bit on /dev/shm
/dev/shm is a world-writable directory, like /tmp, and should also
have the sticky bit set. Without this, any user can delete and
replace another user's files in /dev/shm.
This bug has been present since /dev/shm was added to the skeleton
/etc/fstab, but appears to have been fixed for systems using systemd
by commit 76fc9275f14e "system: separate sysv and systemd parts of the
skeleton" which went into Buildroot 2017.08.
Signed-off-by: Ben Hutchings <ben.hutchings@...d.be>
Fixes: 22fde22e35f98f7830c2f8955465532328348cd1
---
package/skeleton-init-sysv/skeleton/etc/fstab | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/package/skeleton-init-sysv/skeleton/etc/fstab b/package/skeleton-init-sysv/skeleton/etc/fstab
index 169054b74f..06c20fe9d5 100644
--- a/package/skeleton-init-sysv/skeleton/etc/fstab
+++ b/package/skeleton-init-sysv/skeleton/etc/fstab
@@ -2,7 +2,7 @@
/dev/root / ext2 rw,noauto 0 1
proc /proc proc defaults 0 0
devpts /dev/pts devpts defaults,gid=5,mode=620,ptmxmode=0666 0 0
-tmpfs /dev/shm tmpfs mode=0777 0 0
+tmpfs /dev/shm tmpfs mode=1777 0 0
tmpfs /tmp tmpfs mode=1777 0 0
tmpfs /run tmpfs mode=0755,nosuid,nodev 0 0
sysfs /sys sysfs defaults 0 0
--
2.39.2
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
