diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2025-01-28 14:23:06 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2025-01-29 17:13:21 +0000 |
| commit | b8945a926a2f10ebac7458b44e81acdc84413a91 (patch) | |
| tree | c23cff71e490cc9391021c9a3d0a9468c1fa6010 | |
| parent | 88d5d81087113112fcafff109b14ae21d7e3a687 (diff) | |
etcupdate: Restrict access to the conflicts directory
In the window during conflict resolution, copies of installed files with
conflicts are added here with the default mode. Restrict access.
Approved by: so
Security: FreeBSD-SA-25:03.etcupdate
PR: 277470
Reviewed by: philip, jhb, emaste
Differential Revision: https://reviews.freebsd.org/D48576
(cherry picked from commit c43ae7ab4bf89c2b274c1cbefe663c456e9211d1)
(cherry picked from commit 93836ff92be84a1d4e7611577ffe116a0e30d008)
| -rwxr-xr-x | usr.sbin/etcupdate/etcupdate.sh | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/usr.sbin/etcupdate/etcupdate.sh b/usr.sbin/etcupdate/etcupdate.sh index 39d1f9e56a54..7bddd6593b56 100755 --- a/usr.sbin/etcupdate/etcupdate.sh +++ b/usr.sbin/etcupdate/etcupdate.sh @@ -1611,6 +1611,9 @@ EOF # Initialize conflicts and warnings handling. rm -f $WARNINGS mkdir -p $CONFLICTS + if ! chmod 0700 ${CONFLICTS}; then + panic "Unable to set permissions on conflicts directory" + fi # Ignore removed files for the pre-world case. A pre-world # update uses a stripped-down tree. |