On Wed, Jan 23, 2013 at 02:41:50PM +0100, Jakub Hrozek wrote:
On Wed, Jan 23, 2013 at 12:41:32PM +0100, Pavel Březina wrote:
> On 01/23/2013 12:37 PM, Jakub Hrozek wrote:
> >[PATCH 1/2] TOOLS: Use openat/unlinkat when removing the homedir
> >
> >The removal of a home directory is sensitive to concurrent modification
> >of the directory tree being removed and can unlink files outside the
> >directory tree.
> >
> >[PATCH 2/2] TOOLS: Use file descriptor to avoid races when creating a
> >home directory
> >
> >When creating a home directory, the destination tree can be modified in
> >various ways while it is being constructed because directory permissions
> >are set before populating the directory. This can lead to file creation
> >and permission changes outside the target directory tree, using hard links.
> >
> >https://fedorahosted.org/sssd/ticket/1782
> >
> >This security problem was assigned CVE-2013-0219
>
> Already reviewed during the embargo. Ack.
Pushed to master and sssd-1-9
Backported and pushed to sssd-1-8