From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 3EDE3138334 for ; Fri, 3 Jan 2020 14:37:17 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 56F37E0BD0; Fri, 3 Jan 2020 14:37:13 +0000 (UTC) Received: from smtp.gentoo.org (woodpecker.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id AA404E08FB for ; Fri, 3 Jan 2020 14:37:12 +0000 (UTC) Received: from [192.168.1.100] (c-98-218-46-55.hsd1.md.comcast.net [98.218.46.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: mjo) by smtp.gentoo.org (Postfix) with ESMTPSA id B75D934DEC5 for ; Fri, 3 Jan 2020 14:37:11 +0000 (UTC) Subject: Re: [gentoo-dev] Vanilla sources To: gentoo-dev@lists.gentoo.org References: <3197490.ugo6OjCCXa@daneel.sf-tec.de> <1794534.0xJHuh4lKC@crazyhorse> <19015309.XG3PSQ8cOu@daneel.sf-tec.de> From: Michael Orlitzky Message-ID: <5537134e-0412-862d-e105-94c678229b46@gentoo.org> Date: Fri, 3 Jan 2020 09:37:05 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.3.1 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-dev@lists.gentoo.org Reply-to: gentoo-dev@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply MIME-Version: 1.0 In-Reply-To: <19015309.XG3PSQ8cOu@daneel.sf-tec.de> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Archives-Salt: b0e15190-0e39-4d96-bbad-86744c5306fd X-Archives-Hash: f658f565d53812883c5d612c5024c9ed On 1/2/20 6:35 PM, Rolf Eike Beer wrote: > > I only run vanilla-sources since there are still lot of cache corruption > problems in hppa kernels, or whatever makes them flaky. The vanilla-sources are unsafe to use on Gentoo. Many services have stupid-easy root exploits, since we install tmpfiles entries by default and OpenRC runs them insecurely: * https://github.com/OpenRC/opentmpfiles/issues/3 * https://github.com/OpenRC/opentmpfiles/issues/4 I've fixed similar exploits when I've found them in /etc/init.d and pkg_postinst[0][1], but they continue to be added to the tree. And there is no fix for opentmpfiles. The gentoo-sources aren't 100% safe either, but the exploitable scenario is less common thanks to fs.protected_{hardlinks,symlinks}=1. [0] http://michael.orlitzky.com/articles/end_root_chowning_now_%28make_etc-init.d_great_again%29.xhtml [1] http://michael.orlitzky.com/articles/end_root_chowning_now_%28make_pkg_postinst_great_again%29.xhtml