9f5fb8034c
Today CVE-2020-7221 was publicly discussed on oss-sec [1]. MariaDB upstream had not mentioned this CVE in their last release notes. The CVE is related to auth-pam and the possibility of a local mariadb to root user exploit in the mysql_install_db script. Upstream has made amendments to the script, but according to the oss-sec posts the folder permissions were not updated as they should have been. In OpenWrt the script mysql_install_db is actually patched to never run the commands in question. This has been this way since MariaDB 10.4 was made available. Still, the directory permissions set by the postinstall script are too lax. To quote the discoverer of the issue, Matthias Gerstner from Suse, they exhibit "the dangerous situation of a setuid-root binary residing in a directory owned by an unprivileged user". This commit fixes this by changing the permissions to the following: root:mariadb 0750 /usr/lib/mariadb/plugin/auth_pam_tool_dir This way the setuid-root binary is only available to root and the mariadb user, while at the same time the mariadb user has no ownership of the directory. [1] https://seclists.org/oss-sec/2020/q1/55 Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net> |
||
|---|---|---|
| .. | ||
| conf | ||
| files | ||
| patches | ||
| Makefile | ||