| 1 |
Hi, |
| 2 |
|
| 3 |
In case you don't know, opentmpfiles has an open CVE |
| 4 |
CVE-2017-18925: root privilege escalation by symlink attack |
| 5 |
https://github.com/OpenRC/opentmpfiles/issues/4 |
| 6 |
It has been an issue for quite a while, reported 3 years ago, |
| 7 |
and not much changed since. |
| 8 |
Also it lacks any sort of testing, and master branch is in a non-working |
| 9 |
state at time of writing, latest version is masked.[0] |
| 10 |
|
| 11 |
Due to nature of opentmpfiles (it's a POSIX sh script), |
| 12 |
it may be impossible to fix symlink handling and TOCTOU races. |
| 13 |
As a consequence I'll be switching default tmpfiles |
| 14 |
provider to sys-apps/systemd-tmpfiles by the end of the week by updating |
| 15 |
virtual/tmpfiles ebuild. |
| 16 |
|
| 17 |
pros of systemd-tmpfiles: |
| 18 |
0) Secure. |
| 19 |
1) Reference implementation. |
| 20 |
2) Supports all features, because ^. |
| 21 |
3) Has working tests. |
| 22 |
4) Has millions of users as part of systemd. |
| 23 |
5) upstream supports standalone usecase/build our ebuild uses. [1][2] |
| 24 |
6) drop-in replacement, just emerge and forget. |
| 25 |
|
| 26 |
systemd-tmpfiles does not depend on any systemd-isms, does not need dbus, |
| 27 |
and is just a drop-in replacement, the only step needed is to emerge the |
| 28 |
package. |
| 29 |
it's a simple single binary + manpage, binary links to libacl and couple other |
| 30 |
system libs. |
| 31 |
|
| 32 |
existing installations will not be affected, but openrc users are welcome to |
| 33 |
opt-in by running 'emerge --oneshot systemd-tmpfiles' |
| 34 |
|
| 35 |
[0] https://bugs.gentoo.org/751739 |
| 36 |
[1] https://github.com/systemd/systemd/pull/16061 |
| 37 |
[2] https://github.com/systemd/systemd/pull/16061/commits/db64ba81c62afa0e0d3e95c4a3e1ec3dd9a471a4 |
Archives