Re: privilege escalation and potential data loss in logrotate

2010-12-10 Thread Florian Zumbiehl
Hi, > (copying the thread to debian-devel, where mass-bug-fills *has to* be > discussed, not d-qa) As such I would suggest completely moving this thread over to d-devel and dropping d-qa from subsequent mails. [...] > > If I don't see any solution emerging in a reasonable time frame, my next > >

Re: privilege escalation and potential data loss in logrotate

2010-12-10 Thread Olaf van der Spek
On Fri, Dec 10, 2010 at 11:00 AM, Paul Martin wrote: > On Fri, Dec 10, 2010 at 10:17:53AM +0100, Sandro Tosi wrote: > >> If you really care about this problem, which is nice, try to get >> logrotate fixed. > > As I have said before, I do welcome patches that don't break existing > functionality or

Re: privilege escalation and potential data loss in logrotate

2010-12-10 Thread Paul Martin
On Fri, Dec 10, 2010 at 10:17:53AM +0100, Sandro Tosi wrote: > If you really care about this problem, which is nice, try to get > logrotate fixed. As I have said before, I do welcome patches that don't break existing functionality or introduce new race conditions. None of my emails to Florian ar

Re: privilege escalation and potential data loss in logrotate

2010-12-10 Thread Sandro Tosi
(copying the thread to debian-devel, where mass-bug-fills *has to* be discussed, not d-qa) On Sat, Nov 20, 2010 at 08:23, Florian Zumbiehl wrote: > Hi, > > The short summary: > > 1. There is a privilege escalation vulnerability in stable's logrotate, >   verified to work for switching from the po