mig5/enroll
1
0
Fork 0
Code Issues Pull requests Projects Releases 4 Packages Activity Actions

Fix a TOCTOU in remote harvest zipapp
Some checks failed
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Waiting to run
Details
CI / test (debian, docker.io/library/debian:13, python3) (push) Waiting to run
Details
Lint / test (push) Waiting to run
Details
CI / test (push) Has been cancelled
Details

Browse source 
Promote uploaded zipapps into a private root-owned directory before
verification and execution. Copy and hash through the same pinned file
descriptor, reject unsafe file types and metadata, publish atomically,
and ensure sudo executes only the verified root-owned copy.
This commit is contained in:
Miguel Jacq 2026-08-03 15:29:17 +10:00
parent 82db7a7d72
commit 1e9806d2dc
Signed by: mig5
GPG key ID: 03906B4110AAD3B8
6 changed files with 831 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

6
debian/changelog vendored
View file

@ -1,3 +1,9 @@
enroll (0.8.1) unstable; urgency=medium
* Security: fix a TOCTOU in remote harvest.
-- Miguel Jacq <mig@mig5.net> Mon, 03 Aug 2026 15:20:00 +1000
enroll (0.8.0) unstable; urgency=medium
* Security: keep sudo-created remote harvest bundles root-owned while root packages and hashes them, expose only the archive to the authenticated SSH uid, and verify the root-computed digest after download. This removes the post-harvest tampering window created by recursively chowning the bundle before packaging without making the plaintext archive world-readable.