diff options
| author | Colin Watson <cjwatson@debian.org> | 2017-12-03 12:24:51 +0000 |
|---|---|---|
| committer | Colin Watson <cjwatson@debian.org> | 2017-12-03 12:24:51 +0000 |
| commit | f3749790f6efb2a1927558827569de7bd66df472 (patch) | |
| tree | 3e6f1abda8824b8a4b2de5bd15aaf1b02cc2b1a9 /manual | |
| parent | 2851246deff8f83224fc40c6d0231c6834c24177 (diff) | |
Confine most untrusted data handling using seccomp
Fixes Debian bug #877199.
* configure.ac: Require libpipeline >= 1.5.0. Call MAN_LIBSECCOMP.
* docs/INSTALL.quick: Bump minimum libpipeline version to 1.5.0. List
libseccomp as recommended.
* lib/Makefile.am (libman_la_CPPFLAGS): Add $(libseccomp_CFLAGS).
(libman_la_SOURCES): Add sandbox.c and sandbox.h.
(libman_la_LDFLAGS): Add $(libseccomp_LIBS).
* lib/sandbox.c: New file.
* lib/sandbox.h: New file.
* m4/man-libseccomp.m4: New file.
* src/man.c (set_term): Check that process ID matches original before
calling tcsetattr.
(get_term): Record original process ID to work around an arguable bug in
pipecmd_exec.
* src/lexgrog_test.c (main), src/man.c (main), src/manconv_main.c
(main), src/mandb.c (main), src/zsoelim_main.c (main): Initialise
sandbox.
* lib/decompress.c (decompress_open, decompress_fdopen): Attach sandbox
to decompression commands.
* src/lexgrog.l (find_name): Attach sandbox to 'col'.
* src/man.c (add_col): Attach sandbox to 'col'.
(make_roff_command): Attach sandbox to 'zsoelim' and to groff-related
programs.
(add_output_iconv): Attach sandbox to 'iconv'.
(make_display_command): Attach sandbox to 'tr'.
(open_cat_stream, display_catman): Attach sandbox to compression
commands.
* src/manconv_client.c (add_manconv): Attach sandbox to manconv_stdin.
* src/straycats.c (check_for_stray): Attach sandbox to 'col'.
* src/whatis.c (use_grep): Attach sandbox to 'grep'.
* src/accessdb.c, src/catman.c, src/globbing_test.c, src/manpath.c:
Define stub sandbox variable.
* docs/NEWS: Document this.
Diffstat (limited to 'manual')
| -rw-r--r-- | manual/Makefile.in | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/manual/Makefile.in b/manual/Makefile.in index c8258301..63361385 100644 --- a/manual/Makefile.in +++ b/manual/Makefile.in @@ -106,6 +106,7 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/man-arg-automatic-create.m4 \ $(top_srcdir)/m4/man-compress-lib.m4 \ $(top_srcdir)/m4/man-gnu-nroff.m4 \ $(top_srcdir)/m4/man-heirloom-nroff.m4 \ + $(top_srcdir)/m4/man-libseccomp.m4 \ $(top_srcdir)/m4/man-linguas.m4 $(top_srcdir)/m4/man-po4a.m4 \ $(top_srcdir)/m4/man-trans-subst.m4 \ $(top_srcdir)/gnulib/m4/00gnulib.m4 \ @@ -1279,6 +1280,8 @@ libdir = @libdir@ libexecdir = @libexecdir@ libpipeline_CFLAGS = @libpipeline_CFLAGS@ libpipeline_LIBS = @libpipeline_LIBS@ +libseccomp_CFLAGS = @libseccomp_CFLAGS@ +libseccomp_LIBS = @libseccomp_LIBS@ lispdir = @lispdir@ localedir = @localedir@ localstatedir = @localstatedir@ |