net-misc/peervpn: 0.044-r2 revbump for bug 602550

Remove the chown call from the openrc init script start_post function,
in order to prevent privilege escalation attacks. It is unsafe to call
chown in a directory that is not owned by root, since the target file
could be a hardlink to a root-owned file.

X-Gentoo-bug: 602550
X-Gentoo-bug-url: https://bugs.gentoo.org/show_bug.cgi?id=602550

Package-Manager: portage-2.3.3

diff --git a/net-misc/peervpn/files/peervpn.initd b/net-misc/peervpn/files/peervpn.initd
index b607ec3de3f4c99f46dd6949ebd01975a96baeb8..d90043f0de97cc1073d31d125632fd8b8e018652 100644 (file)
--- a/net-misc/peervpn/files/peervpn.initd
+++ b/net-misc/peervpn/files/peervpn.initd
@@ -25,8 +25,3 @@ depend() {
 start_pre() {
        checkpath -d -m 0755 -o "${user}":"${group}" "${pidfile%/*}"
 }
-
-start_post() {
-       # Use -h to prevent privilege escalation attacks. Fixes bug #602550.
-       chown -h "${user}":"${group}" "${logfile}"
-}

diff --git a/net-misc/peervpn/files/peervpn.logrotated b/net-misc/peervpn/files/peervpn.logrotated
index 5de0a2487847363c8aaba76f1e2f8d126d5fb70c..e99669c913588547d9cf36ea8115fb5442a549d1 100644 (file)
--- a/net-misc/peervpn/files/peervpn.logrotated
+++ b/net-misc/peervpn/files/peervpn.logrotated
@@ -1,5 +1,4 @@
 /var/log/peervpn/peervpn.log {
-       su peervpn peervpn
        missingok
        size 5M
        rotate 3

diff --git a/net-misc/peervpn/peervpn-0.044-r1.ebuild b/net-misc/peervpn/peervpn-0.044-r2.ebuild
similarity index 96%
rename from net-misc/peervpn/peervpn-0.044-r1.ebuild
rename to net-misc/peervpn/peervpn-0.044-r2.ebuild
index 52e1451c5f78db474a8bd0e7cc2d4009d6ad6a3c..be4523194e9e9b5a494b73481a7ed8ae29569f08 100644 (file)
--- a/net-misc/peervpn/peervpn-0.044-r1.ebuild
+++ b/net-misc/peervpn/peervpn-0.044-r2.ebuild
@@ -46,7 +46,6 @@ src_install() {
        systemd_dounit "${FILESDIR}/${PN}.service"
 
        keepdir /var/log/${PN}
-       fowners ${PN}:${PN} /var/log/${PN}
        insinto /etc/logrotate.d
        newins "${FILESDIR}/${PN}.logrotated" "${PN}"
 }