~ubuntu-branches/ubuntu/raring/ecryptfs-utils/raring : changes

~ubuntu-branches/ubuntu/raring/ecryptfs-utils/raring » Changes from revision 92

From Revision 76 to 57

Rev	Summary	Authors	Tags	Date
76	* src/utils/ecryptfs-verify, src/utils/Makefile.am: * src/utils/ecryptfs-verify, src/utils/Makefile.am: - add an ecryptfs-verify utility, LP: #845738 * src/testcases/write-read.sh: - added a write/read test utility * doc/manpage/ecryptfs-mount-private.1, doc/manpage/ecryptfs-setup- private.1, doc/manpage/mount.ecryptfs_private.1, doc/manpage/umount.ecryptfs_private.1: LP: #882267 - remove inaccurate documentation about being a member of the ecryptfs group * src/utils/ecryptfs-setup-private: LP: #882314 - fix preseeded encrypted home Ubuntu installations (thanks Timo!) * oneiric	Dustin Kirkland	93-0ubuntu1	12 years ago
75	* src/libecryptfs/key_management.c: LP: #725862 * src/libecryptfs/key_management.c: LP: #725862 - fix nasty bug affecting users who do not encrypt filenames; the first login works, but on logout, only one key gets cleaned out; subsequent logins do not insert the necessary key due to an early "goto out"; this fix needs to be SRU'd * debian/rules: LP: #586281 - fix perms on desktop mount file * src/pam_ecryptfs/pam_ecryptfs.c: LP: #838471 - rework syslogging to be less noisy and note pam_ecryptfs	Dustin Kirkland	92-0ubuntu1	12 years ago
74	[ Diego E. "Flameeyes" Pettenò ] [ Diego E. "Flameeyes" Pettenò ] * configure.ac: - fix reliance on nss-config, which hinders cross-compilation [ Marc Deslauriers ] * src/utils/mount.ecryptfs_private.c: * SECURITY UPDATE: wrong mtab ownership and permissions (LP: #830850) - debian/patches/CVE-2011-3145.patch: also set gid and umask before updating mtab in src/utils/mount.ecryptfs_private.c. - CVE-2011-3145	Dustin Kirkland	91-0ubuntu1	12 years ago
73	[ Marc Deslauriers ] [ Marc Deslauriers ] * SECURITY UPDATE: privilege escalation via mountpoint race conditions (LP: #732628) - debian/patches/CVE-2011-1831,1832,1834.patch: chdir into mountpoint before checking permissions in src/utils/mount.ecryptfs_private.c. - CVE-2011-1831 - CVE-2011-1832 * SECURITY UPDATE: race condition when checking source during mount (LP: #732628) - debian/patches/CVE-2011-1833.patch: use new ecryptfs_check_dev_ruid kernel option when mounting directory in src/utils/mount.ecryptfs_private.c. - CVE-2011-1833 * SECURITY UPDATE: mtab corruption via improper handling (LP: #732628) - debian/patches/CVE-2011-1831,1832,1834.patch: modify mtab via a temp file first and make sure it succeeds before replacing the real mtab in src/utils/mount.ecryptfs_private.c. - CVE-2011-1834 * SECURITY UPDATE: key poisoning via insecure temp directory handling (LP: #732628) - debian/patches/CVE-2011-1835.patch: make sure we don't copy into a user controlled directory in src/utils/ecryptfs-setup-private. - CVE-2011-1835 * SECURITY UPDATE: information disclosure via recovery mount in /tmp (LP: #732628) - debian/patches/CVE-2011-1836.patch: mount inside protected subdirectory in src/utils/ecryptfs-recover-private. - CVE-2011-1836 * SECURITY UPDATE: arbitrary file overwrite via lock counter race condition (LP: #732628) - debian/patches/CVE-2011-1837.patch: verify permissions with a file descriptor, and don't follow symlinks in src/utils/mount.ecryptfs_private.c. - CVE-2011-1837	Dustin Kirkland	90-0ubuntu1	12 years ago
72	* SECURITY UPDATE: privilege escalation via mountpoint race ... * SECURITY UPDATE: privilege escalation via mountpoint race conditions (LP: #732628) - debian/patches/CVE-2011-1831,1832,1834.patch: chdir into mountpoint before checking permissions in src/utils/mount.ecryptfs_private.c. - CVE-2011-1831 - CVE-2011-1832 * SECURITY UPDATE: race condition when checking source during mount (LP: #732628) - debian/patches/CVE-2011-1833.patch: use new ecryptfs_check_dev_ruid kernel option when mounting directory in src/utils/mount.ecryptfs_private.c. - CVE-2011-1833 * SECURITY UPDATE: mtab corruption via improper handling (LP: #732628) - debian/patches/CVE-2011-1831,1832,1834.patch: modify mtab via a temp file first and make sure it succeeds before replacing the real mtab in src/utils/mount.ecryptfs_private.c. - CVE-2011-1834 * SECURITY UPDATE: key poisoning via insecure temp directory handling (LP: #732628) - debian/patches/CVE-2011-1835.patch: make sure we don't copy into a user controlled directory in src/utils/ecryptfs-setup-private. - CVE-2011-1835 * SECURITY UPDATE: information disclosure via recovery mount in /tmp (LP: #732628) - debian/patches/CVE-2011-1836.patch: mount inside protected subdirectory in src/utils/ecryptfs-recover-private. - CVE-2011-1836 * SECURITY UPDATE: arbitrary file overwrite via lock counter race condition (LP: #732628) - debian/patches/CVE-2011-1837.patch: verify permissions with a file descriptor, and don't follow symlinks in src/utils/mount.ecryptfs_private.c. - CVE-2011-1837	Marc Deslauriers	89-0ubuntu2	12 years ago
71	[ Dustin Kirkland ] [ Dustin Kirkland ] * debian/control: - add missing build dependency needed for release * doc/manpage/ecryptfs-wrap-passphrase.1: fix minor error in manpage * src/desktop/ecryptfs-find, src/desktop/Makefile.am: LP: #799157 - add a tool, /usr/share/ecryptfs-utils/ecryptfs-find that can help find cleartext/encrypted filenames by inode number * src/desktop/ecryptfs-find: - test file exists first; ditch the match; search all ecryptfs mounts that user can read/traverse * debian/ecryptfs-utils.links: - add a symlink for Ubuntu * scripts/release.sh: - improve release script [ Serge Hallyn ] * Fix from Christophe Dumez: mount.ecryptfs_private: Do not attempt to update mtab if it is a symbolic link. (LP: #789888)	Dustin Kirkland	89-0ubuntu1	12 years ago
70	* src/utils/mount.ecryptfs_private.c: * src/utils/mount.ecryptfs_private.c: - reduce the window size for the TOCTOU race; does not entirely solve LP: #732628, which is going to need to be fixed in the kernel with some heavy locking * debian/control: update urls * src/utils/ecryptfs-mount-private: LP: #725862 - fix ecryptfs-mount-private to insert only the fek, if filename encryption is disabled	Dustin Kirkland	88-0ubuntu1	13 years ago
69	[ Paolo Bonzini <pbonzini@redhat.com> ] [ Paolo Bonzini <pbonzini@redhat.com> ] * src/utils/ecryptfs-setup-private: update the Private.* selinux contexts [ Dustin Kirkland ] * src/utils/ecryptfs-setup-private: - add -p to mkdir, address noise for a non-error - must insert keys during testing phase, since we remove keys on unmount now, LP: #725862 * src/utils/ecryptfs_rewrap_passphrase.c: confirm passphrases in interactive mode, LP: #667331	Dustin Kirkland	87-0ubuntu1	13 years ago
68	[ Jakob Unterwurzacher ] [ Jakob Unterwurzacher ] * src/pam_ecryptfs/pam_ecryptfs.c: - check if this file exists and ask the user for the wrapping passphrase if it does - eliminate both ecryptfs_pam_wrapping_independent_set() and ecryptfs_pam_automount_set() and replace with a reusable file_exists_dotecryptfs() function [ Serge Hallyn and Dustin Kirkland ] * src/utils/mount.ecryptfs_private.c: - support multiple, user configurable private directories by way of a command line "alias" argument - this "alias" references a configuration file by the name of: $HOME/.ecryptfs/alias.conf, which is in an fstab(5) format, as well as $HOME/.ecryptfs/alias.sig, in the same format as Private.sig - if no argument specified, the utility operates in legacy mode, defaulting to "Private" - rename variables, s/dev/src/ and s/mnt/dest/ - add a read_config() function - add an alias char* to replace the #defined ECRYPTFS_PRIVATE_DIR - this is half of the fix to LP: #615657 * doc/manpage/mount.ecryptfs_private.1: document these changes * src/libecryptfs/main.c, src/utils/mount.ecryptfs_private.c: - allow umount.ecryptfs_private to succeed when the key is no longer in user keyring.	Dustin Kirkland	86-0ubuntu1	13 years ago
67	[ Dustin Kirkland ] [ Dustin Kirkland ] * src/utils/ecryptfs-recover-private: clean sigs of invalid characters * src/utils/mount.ecryptfs_private.c: - fix bug LP: #313812, clear used keys on unmount - add ecryptfs_unlink_sigs to the mount opts, so that unmounts from umount.ecryptfs behave similarly - use ecryptfs_remove_auth_tok_from_keyring() on the sig and sig_fnek [ presgas@gmail.com ] * src/utils/ecryptfs-migrate-home: - support user databases outside of /etc/passwd, LP: #627506	Dustin Kirkland	85-0ubuntu1	13 years ago
66	* src/desktop/ecryptfs-record-passphrase: fix typo, LP: #524... * src/desktop/ecryptfs-record-passphrase: fix typo, LP: #524139 * debian/rules, debian/control: - disable the gpg key module, as it's not yet functional - clean up unneeded build-deps - also, not using opencryptoki either * doc/manpage/ecryptfs.7: fix minor documentation bug, reported by email by Jon 'maddog' Hall * doc/manpage/ecryptfs-recover-private.1, doc/manpage/Makefile.am, po/POTFILES.in, src/utils/ecryptfs-recover-private, src/utils/Makefile.am: add a utility to simplify data recovery of an encrypted private directory from a Live ISO, LP: #689969	Dustin Kirkland	84-0ubuntu1	13 years ago
65	src/desktop/ecryptfs-record-passphrase: fix typo, LP: #52413... src/desktop/ecryptfs-record-passphrase: fix typo, LP: #524139	Dustin Kirkland	83-0ubuntu3	14 years ago
64	debian/rules, debian/control: disable the gpg key module, debian/rules, debian/control: disable the gpg key module, as it's not yet functional; does more harm than good to build it; should not be in 10.04 LTS; clean up build-deps; also, not using opencryptoki either; unbreak the build for 32-bit Lucid	Dustin Kirkland	83-0ubuntu2	14 years ago
63	[ David Planella ] [ David Planella ] * Makefile.am, configure.ac, debian/control, debian/po/POTFILES.sh, debian/po/ecryptfs-utils.pot, debian/po/fr.po, debian/rules, po/POTFILES.in, src/desktop/Makefile.am, src/desktop/ecryptfs-mount-private.desktop, src/desktop/ecryptfs-mount-private.desktop.in, src/desktop/ecryptfs-record-passphrase, src/desktop/ecryptfs-setup-private.desktop, src/desktop/ecryptfs-setup-private.desktop.in: - internationalization work for LP: #358283 * po/LINGUAS, po/ca.po: Catalan translation [ Yan Li <yan.i.li@intel.com> ] * src/pam_ecryptfs/pam_ecryptfs.c, src/utils/Makefile.am, src/utils/ecryptfs-migrate-home: add a script and pam hooks to support automatic migration to encrypted home directory [ Dustin Kirkland ] * src/utils/ecryptfs-migrate-home: clean up for merge - use $() rather than `` - drop set -u - use = and !=, and quote vars, rather than testing with -ne, -eq, for better shell portability - improve usage statement and error text - check if already encrypted - handle migration of multiple users on boot - fix all whitespace, use tabs for indents - use quotes around variables, rather than ${} (stylistic preference) - major simplification for immediate release + remove boot and user modes; only support administrator mode for security reasons and to avoid race conditions + other modes can be re-added, if necessary, and if security concerns can be addressed - ensure running as root - drop VERBOSE option, always print useful info messages - call the user $USER_NAME rather than $USER_ID since id implies number, and here we're deailing with names - no decimals on awk calculation - mktemp on the target user, not root - check that there is enough disk space available to do the migration - ensure the user's homedir group is correct - add critical instructions, user must login after the migration and before the reboot, as their wrapped passphrase will be cleared on reboot (possible we should use an init script to move these to /var/tmp on reboot) - ensure permissions are set correctly - improve text at the end of the migration, organize into notes * ecryptfs-utils.ecryptfs-utils-restore.upstart, ecryptfs-utils.ecryptfs-utils-save.upstart, rules: - try to protect migrating users who don't login before the next reboot * debian/ecryptfs-utils.install: install the locale messages * src/desktop/ecryptfs-record-passphrase: improve dialog text * src/desktop/ecryptfs-record-passphrase: revert the _ bit, as it's not quite working yet, will need to talk to David to fix * Mark LP: #471725 as fixed	Dustin Kirkland	83-0ubuntu1	14 years ago
62	debian/rules: fix FTBFS, CFLAGS needed for libgcrypt11-dev l... debian/rules: fix FTBFS, CFLAGS needed for libgcrypt11-dev linking	Dustin Kirkland	82-0ubuntu2	14 years ago
61	Merging upstream release Merging upstream release	Dustin Kirkland	82-0ubuntu1	14 years ago
60	* src/utils/ecryptfs-setup-private, debian/control: LP: #456... * src/utils/ecryptfs-setup-private, debian/control: LP: #456565 - fix typo, s/getext/gettext - depend on gettext-base	Dustin Kirkland	81-0ubuntu3	14 years ago
59	src/utils/ecryptfs-setup-private: fix bug where setup-privat... src/utils/ecryptfs-setup-private: fix bug where setup-private incorrectly assumed that the home/private dir ownerships should be owned by USER:USER; instead, default to USER:GROUP, where GROUP is the USER's primary group by default, cherry-pick upstream r463, LP: #445301	Dustin Kirkland	81-0ubuntu2	14 years ago
58	[ Michael Terry ] [ Michael Terry ] * src/utils/ecryptfs-setup=swap: clean up some error message reporting, LP: #430891, #430890 [ Dustin Kirkland ] * doc/manpage/ecryptfs.7: note the 64-char passphrase limit, LP: #386504 * src/utils/ecryptfs-setup-private: minor documentation change	Dustin Kirkland	81-0ubuntu1	14 years ago
57	Merge from upstream Merge from upstream	Dustin Kirkland	80-0ubuntu1	14 years ago

Older »