[gentoo-user] setuid/setgid binaries, man-db security fix

[Ian Zimmerman]

This morning I was pointed at [1] (by reading [2]).

As far as I can see there has been no bug report about this in gentoo.
Should I file one now?  It doesn't look like the fix can be easily
backported so probably it will just end up being merged with the rest of
the new version.  But it may be worthwhile to mark it as a security
issue.

More generally, I'm wondering about set*id binaries in gentoo.  If I
don't want/need the particular feature thus provided, can I simply turn
off the set*id bit?  That's what [3] recommends, but what about
upgrades?  When a new version of the package is emerged, will the set*id
bit be turned back on?  Will I have to remember turning it off forever?
dpkg has a feature (dpkg-statoverride) where a local admin can force
permissions on files shipped in packages, and such overrides "stick"
even across upgrades.  Is there anything similar for gentoo?

[1]
https://lists.nongnu.org/archive/html/man-db-announce/2016-12/msg00000.html

[2]
http://www.chiark.greenend.org.uk/~cjwatson/blog/cve-2015-1336.html

[3]
https://wiki.gentoo.org/wiki/Security_Handbook/File_permissions

-- 
Please *no* private Cc: on mailing lists and newsgroups
Personal signed mail: please _encrypt_ and sign
Don't clear-text sign: http://cr.yp.to/smtp/8bitmime.html