freebsd security - May 2017 - [Bug 219527] Flawed umask handling in /etc/rc.d/random

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=219527

            Bug ID: 219527
           Summary: Flawed umask handling in /etc/rc.d/random
           Product: Base System
           Version: 11.0-STABLE
          Hardware: Any
                OS: Any
            Status: New
          Keywords: regression
          Severity: Affects Many People
          Priority: ---
         Component: misc
          Assignee: freebsd-bugs at FreeBSD.org
          Reporter: fk at fabiankeil.de
                CC: freebsd-security at FreeBSD.org

Lu Tung-Pin reported on freebsd-current@ a couple of months ago:

| A 2014 change broke the umask handling in /etc/rc.d/random,
| leaving /entropy with ug+r permissions. Quick fix attached,
| mirroring random_stop() behavior.
https://lists.freebsd.org/pipermail/freebsd-current/2017-January/064602.html

A couple of patch improvements were suggested but none
of them were committed.

It would be great if one of the proposed fixes would make it into 11.1.

I've been using the original version of the patch since January and can
confirm that it works as advertised.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=219527

Xin LI <delphij at FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |delphij at FreeBSD.org,
                   |                            |markm at FreeBSD.org,
                   |                            |security-officer at FreeBSD.or
                   |                            |g
           Assignee|freebsd-bugs at FreeBSD.org    |des at FreeBSD.org

--- Comment #1 from Xin LI <delphij at FreeBSD.org> ---
Hi, Dag-Erling / Mark,

Could you please take a look at this?  The proposed change looks reasonable to
me.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=219527

--- Comment #2 from Mark Murray <markm at FreeBSD.org> ---
Agreed. The proposed change looks good. I say get it out there ASAP.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=219527

Ed Maste <emaste at freebsd.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |emaste at freebsd.org

--- Comment #3 from Ed Maste <emaste at freebsd.org> ---
Jilles' version of the patch looks good to me - the one in
https://lists.freebsd.org/pipermail/freebsd-current/2017-January/064607.html

-- 
You are receiving this mail because:
You are on the CC list for the bug.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=219527

Xin LI <delphij at FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|des at FreeBSD.org             |delphij at FreeBSD.org

-- 
You are receiving this mail because:
You are on the CC list for the bug.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=219527

Xin LI <delphij at FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|New                         |In Progress

--- Comment #4 from Xin LI <delphij at FreeBSD.org> ---
MFC scheduled.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=219527

--- Comment #5 from commit-hook at freebsd.org ---
A commit references this bug:

Author: delphij
Date: Sat May 27 06:24:06 UTC 2017
New revision: 318975
URL: https://svnweb.freebsd.org/changeset/base/318975

Log:
  Tighten /entropy permissions.

  PR:           219527
  Reported by:  Lu Tung-Pin <lutungpin at openmailbox.org>
  Submitted by: jilles
  MFC after:    3 days

Changes:
  head/etc/rc.d/random

-- 
You are receiving this mail because:
You are on the CC list for the bug.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=219527

Kubilay Kocak <koobs at FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |mfc-stable10?,
                   |                            |mfc-stable11?
           Keywords|                            |security

-- 
You are receiving this mail because:
You are on the CC list for the bug.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=219527

--- Comment #6 from commit-hook at freebsd.org ---
A commit references this bug:

Author: delphij
Date: Wed May 31 05:00:02 UTC 2017
New revision: 319275
URL: https://svnweb.freebsd.org/changeset/base/319275

Log:
  MFC r318975:

  Tighten /entropy permissions.

  PR:           219527
  Reported by:  Lu Tung-Pin <lutungpin at openmailbox.org>
  Submitted by: jilles

Changes:
_U  stable/11/
  stable/11/etc/rc.d/random

-- 
You are receiving this mail because:
You are on the CC list for the bug.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=219527

Xin LI <delphij at FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|mfc-stable10?,              |mfc-stable10+,
                   |mfc-stable11?               |mfc-stable11+
         Resolution|---                         |FIXED
             Status|In Progress                 |Closed

-- 
You are receiving this mail because:
You are on the CC list for the bug.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=219527

Xin LI <delphij at FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|mfc-stable10+               |mfc-stable10-

-- 
You are receiving this mail because:
You are on the CC list for the bug.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=219527

Kubilay Kocak <koobs at FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                URL|                            |https://lists.freebsd.org/p
                   |                            |ipermail/freebsd-current/20
                   |                            |17-January/064607.html

-- 
You are receiving this mail because:
You are on the CC list for the bug.