Re: [gentoo-user] setuid/setgid binaries, man-db security fix

[John Covici]

On Mon, 12 Dec 2016 17:46:31 -0500,
Ian Zimmerman wrote:
>
> This morning I was pointed at [1] (by reading [2]).
>
> As far as I can see there has been no bug report about this in gentoo.
> Should I file one now?  It doesn't look like the fix can be easily
> backported so probably it will just end up being merged with the rest of
> the new version.  But it may be worthwhile to mark it as a security
> issue.
>
> More generally, I'm wondering about set*id binaries in gentoo.  If I
> don't want/need the particular feature thus provided, can I simply turn
> off the set*id bit?  That's what [3] recommends, but what about
> upgrades?  When a new version of the package is emerged, will the set*id
> bit be turned back on?  Will I have to remember turning it off forever?
> dpkg has a feature (dpkg-statoverride) where a local admin can force
> permissions on files shipped in packages, and such overrides "stick"
> even across upgrades.  Is there anything similar for gentoo?
>
> [1]
> https://lists.nongnu.org/archive/html/man-db-announce/2016-12/msg00000.html
>
> [2]
> http://www.chiark.greenend.org.uk/~cjwatson/blog/cve-2015-1336.html
>
> [3]
> https://wiki.gentoo.org/wiki/Security_Handbook/File_permissions
>

I suppose you could automatically run a shell script in the post
installation phase to fix the permissions.  I need to do the opposite
for one of the sendmail binaries.

-- 
Your life is like a penny.  You're going to lose it.  The question is:
How do
you spend it?

         John Covici
         covici@××××××××××.com