[18.03] Security backport for fuse (CVE-2018-10906) #48757
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
primeos
added
the
8.has: port to stable
|
No attempt on x86_64-darwin (full log) The following builds were skipped because they don't evaluate on x86_64-darwin: fuse, fuse3 Partial log (click to expand)
|
|
Success on aarch64-linux (full log) Attempted: fuse, fuse3 Partial log (click to expand)
|
|
Success on x86_64-linux (full log) Attempted: fuse, fuse3 Partial log (click to expand)
|
|
Hm, unfortunately this seems to break |
|
We could settle for setting: meta.knownVulnerabilities = [ "CVE-2018-10906: vulnerable to a restriction bypass when SELinux is active." ]; |
|
Hey @c0bw3b thanks for the suggestion, I wasn't aware of this attribute. However according to the nixpkgs manual Nix would refuse to install fuse:
That would be problematic because fuse will be installed by default on NixOS (IIRC). Unfortunately I don't have much time for this ATM (didn't thought it would break Xen), but I'll try something else and if that doesn't work I'll test if GrahamcOfBorg can build it (just to be sure). But luckily it's only a local exploit and SELinux needs to be active so the impact should be limited (but of course that doesn't mean we should completely ignore it). |
Stop using bin/mount.fuse from fuse3 for fuse2 (mount.fuse from fuse3 isn't guaranteed to remain backwards compatible). (cherry picked from commit c00b5bf)
(cherry picked from commit 085eab7)
(cherry picked from commit d3e3e13)
(cherry picked from commit fa6941f)
Upstream changelog: - SECURITY UPDATE: In previous versions of libfuse it was possible to for unprivileged users to specify the allow_other option even when this was forbidden in /etc/fuse.conf. The vulnerability is present only on systems where SELinux is active (including in permissive mode). - The fusermount binary has been hardened in several ways to reduce potential attack surface. Most importantly, mountpoints and mount options must now match a hard-coded whitelist. It is expected that this whitelist covers all regular use-cases. - Added a test of seekdir to test_syscalls. - Fixed readdir bug when non-zero offsets are given to filler and the filesystem client, after reading a whole directory, re-reads it from a non-zero offset e. g. by calling seekdir followed by readdir. (cherry picked from commit 46cd782)
Upstream changelog: - SECURITY UPDATE: In previous versions of libfuse it was possible to for unprivileged users to specify the allow_other option even when this was forbidden in /etc/fuse.conf. The vulnerability is present only on systems where SELinux is active (including in permissive mode). - libfuse no longer segfaults when fuse_interrupted() is called outside the event loop. - The fusermount binary has been hardened in several ways to reduce potential attack surface. Most importantly, mountpoints and mount options must now match a hard-coded whitelist. It is expected that this whitelist covers all regular use-cases. - Fixed rename deadlock on FreeBSD. (cherry picked from commit ec1082c)
primeos
force-pushed
the
security-backports-for-18.03
branch
from
3c5ebd7
to
228acdc
Compare
|
I've found the issue, it should work now. |
|
@GrahamcOfBorg build xen |
|
No attempt on aarch64-linux (full log) The following builds were skipped because they don't evaluate on aarch64-linux: xen Partial log (click to expand)
|
|
No attempt on x86_64-darwin (full log) The following builds were skipped because they don't evaluate on x86_64-darwin: xen Partial log (click to expand)
|
|
No attempt on x86_64-darwin (full log) The following builds were skipped because they don't evaluate on x86_64-darwin: fuse, fuse3 Partial log (click to expand)
|
|
Success on aarch64-linux (full log) Attempted: fuse, fuse3 Partial log (click to expand)
|
|
Success on x86_64-linux (full log) Attempted: fuse, fuse3 Partial log (click to expand)
|
|
Success on x86_64-linux (full log) Attempted: xen Partial log (click to expand)
|
|
SSHFS still works and the other rebuilds I've checked where all successful. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation for this change
Delayed security backport for CVE-2018-10906. SSHFS works, I'm currently testing some rebuilds.
Things done
sandboxinnix.confon non-NixOS)nix-shell -p nox --run "nox-review wip"./result/bin/)nix path-info -Sbefore and after)