<feed xmlns='http://www.w3.org/2005/Atom'>
<title>fscrypt.git, branch v0.2.4</title>
<subtitle>Go tool for managing Linux filesystem encryption
</subtitle>
<link rel='alternate' type='text/html' href='https://git.hodgden.net/cgit.cgi/fscrypt.git/'/>
<entry>
<title>Merge pull request #105 from google/release</title>
<updated>2018-08-23T18:10:06+00:00</updated>
<author>
<name>Joseph Richey</name>
<email>joerichey@google.com</email>
</author>
<published>2018-08-23T18:10:06+00:00</published>
<link rel='alternate' type='text/html' href='https://git.hodgden.net/cgit.cgi/fscrypt.git/commit/?id=1e1b67dae6c3ae3b5acb5ce377b01b286c3e676b'/>
<id>1e1b67dae6c3ae3b5acb5ce377b01b286c3e676b</id>
<content type='text'>
Release: v0.2.4</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Release: v0.2.4</pre>
</div>
</content>
</entry>
<entry>
<title>Release: v0.2.4</title>
<updated>2018-08-23T18:09:01+00:00</updated>
<author>
<name>Joe Richey joerichey@google.com</name>
<email>joerichey@google.com</email>
</author>
<published>2018-08-23T18:07:49+00:00</published>
<link rel='alternate' type='text/html' href='https://git.hodgden.net/cgit.cgi/fscrypt.git/commit/?id=a2ad53fd17e0dc43754982294c2a7e7d8a797a06'/>
<id>a2ad53fd17e0dc43754982294c2a7e7d8a797a06</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge pull request #103 from google/pam</title>
<updated>2018-08-23T18:05:39+00:00</updated>
<author>
<name>Joseph Richey</name>
<email>joerichey@google.com</email>
</author>
<published>2018-08-23T18:05:39+00:00</published>
<link rel='alternate' type='text/html' href='https://git.hodgden.net/cgit.cgi/fscrypt.git/commit/?id=6ba94e27031f2372073257222b6e551790b1b0c1'/>
<id>6ba94e27031f2372073257222b6e551790b1b0c1</id>
<content type='text'>
Cleanup privilege dropping/raising in pam_fscrypt</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Cleanup privilege dropping/raising in pam_fscrypt</pre>
</div>
</content>
</entry>
<entry>
<title>Improve debug and error output for pam_fscrypt</title>
<updated>2018-08-23T18:00:34+00:00</updated>
<author>
<name>Joe Richey joerichey@google.com</name>
<email>joerichey@google.com</email>
</author>
<published>2018-08-22T12:28:21+00:00</published>
<link rel='alternate' type='text/html' href='https://git.hodgden.net/cgit.cgi/fscrypt.git/commit/?id=11b09739cbcb25e6602267efe3d48eb063233f5a'/>
<id>11b09739cbcb25e6602267efe3d48eb063233f5a</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Ensure keyring privilege changes are reversible</title>
<updated>2018-08-23T18:00:34+00:00</updated>
<author>
<name>Joe Richey joerichey@google.com</name>
<email>joerichey@google.com</email>
</author>
<published>2018-08-22T12:23:00+00:00</published>
<link rel='alternate' type='text/html' href='https://git.hodgden.net/cgit.cgi/fscrypt.git/commit/?id=315f9b042237200174a1fb99427f74027e191d66'/>
<id>315f9b042237200174a1fb99427f74027e191d66</id>
<content type='text'>
This change makes sure that, when we set the ruid and euid in order to
get the user keyring linked into the current process keyring, we will
always be able to reverse these changes (using a suid of 0).

This fixes an issue where "su &lt;user&gt;" would result in a system error
when called by an unprivileged user. It also explains exactly how and
why we are making these privilege changes.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This change makes sure that, when we set the ruid and euid in order to
get the user keyring linked into the current process keyring, we will
always be able to reverse these changes (using a suid of 0).

This fixes an issue where "su &lt;user&gt;" would result in a system error
when called by an unprivileged user. It also explains exactly how and
why we are making these privilege changes.
</pre>
</div>
</content>
</entry>
<entry>
<title>Ensure setting user privileges is reversible</title>
<updated>2018-08-23T18:00:34+00:00</updated>
<author>
<name>Joe Richey joerichey@google.com</name>
<email>joerichey@google.com</email>
</author>
<published>2018-08-22T12:17:32+00:00</published>
<link rel='alternate' type='text/html' href='https://git.hodgden.net/cgit.cgi/fscrypt.git/commit/?id=3022c1603d968c22f147b4a2c49c4637dd1be91b'/>
<id>3022c1603d968c22f147b4a2c49c4637dd1be91b</id>
<content type='text'>
This change makes sure after dropping then elevating privileges for a
process, the euid, guid, and groups are all the same as they were
originally. This significantly simplifies the privilege logic.

This fixes CVE-2018-6558, which allowed an unprivleged user to gain
membership in the root group (gid 0) due to the groups not being
properly reset in the process.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This change makes sure after dropping then elevating privileges for a
process, the euid, guid, and groups are all the same as they were
originally. This significantly simplifies the privilege logic.

This fixes CVE-2018-6558, which allowed an unprivleged user to gain
membership in the root group (gid 0) due to the groups not being
properly reset in the process.
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge pull request #104 from google/travis</title>
<updated>2018-08-23T17:59:35+00:00</updated>
<author>
<name>Joseph Richey</name>
<email>joerichey@google.com</email>
</author>
<published>2018-08-23T17:59:35+00:00</published>
<link rel='alternate' type='text/html' href='https://git.hodgden.net/cgit.cgi/fscrypt.git/commit/?id=d4d88e16b54eaa9ba2a8dcb07ba545b60f4d4208'/>
<id>d4d88e16b54eaa9ba2a8dcb07ba545b60f4d4208</id>
<content type='text'>
Fix Travis to only use Go 1.10</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Fix Travis to only use Go 1.10</pre>
</div>
</content>
</entry>
<entry>
<title>Update docs to indicate v1.10 is required</title>
<updated>2018-08-23T17:53:58+00:00</updated>
<author>
<name>Joe Richey joerichey@google.com</name>
<email>joerichey@google.com</email>
</author>
<published>2018-08-23T17:53:58+00:00</published>
<link rel='alternate' type='text/html' href='https://git.hodgden.net/cgit.cgi/fscrypt.git/commit/?id=7fb7ad1dc46b9bfc9b80c41dc22658bffaa8351c'/>
<id>7fb7ad1dc46b9bfc9b80c41dc22658bffaa8351c</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Fix Travis to only use Go 1.10</title>
<updated>2018-08-23T17:50:17+00:00</updated>
<author>
<name>Joe Richey joerichey@google.com</name>
<email>joerichey@google.com</email>
</author>
<published>2018-08-23T17:50:17+00:00</published>
<link rel='alternate' type='text/html' href='https://git.hodgden.net/cgit.cgi/fscrypt.git/commit/?id=c3599745ebabda35c43fbb569acf468f98489f5c'/>
<id>c3599745ebabda35c43fbb569acf468f98489f5c</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge pull request #102 from google/mips</title>
<updated>2018-08-22T12:45:42+00:00</updated>
<author>
<name>Joseph Richey</name>
<email>joerichey@google.com</email>
</author>
<published>2018-08-22T12:45:42+00:00</published>
<link rel='alternate' type='text/html' href='https://git.hodgden.net/cgit.cgi/fscrypt.git/commit/?id=75a59da2c5724ca4faf148e50e3c772310287bf3'/>
<id>75a59da2c5724ca4faf148e50e3c772310287bf3</id>
<content type='text'>
Use proper sizes when casting to Go slice</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Use proper sizes when casting to Go slice</pre>
</div>
</content>
</entry>
</feed>
