[gentoo-commits] proj/linux-patches:5.10 commit in: /

["Mike Pagano" <mpagano@gentoo.org>]

commit:     b3f78be65acbb318d6af57a24685410c3a76d78e
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Feb 26 20:26:53 2022 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Feb 26 20:26:53 2022 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b3f78be6

Update default security restrictions

Bug: https://bugs.gentoo.org/834085

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 ...able-link-security-restrictions-by-default.patch | 21 +++++++++------------
 1 file changed, 9 insertions(+), 12 deletions(-)

diff --git a/1510_fs-enable-link-security-restrictions-by-default.patch b/1510_fs-enable-link-security-restrictions-by-default.patch
index f0ed144f..1b3e590d 100644
--- a/1510_fs-enable-link-security-restrictions-by-default.patch
+++ b/1510_fs-enable-link-security-restrictions-by-default.patch
@@ -1,20 +1,17 @@
-From: Ben Hutchings <ben@decadent.org.uk>
-Subject: fs: Enable link security restrictions by default
-Date: Fri, 02 Nov 2012 05:32:06 +0000
-Bug-Debian: https://bugs.debian.org/609455
-Forwarded: not-needed
-This reverts commit 561ec64ae67ef25cac8d72bb9c4bfc955edfd415
-('VFS: don't do protected {sym,hard}links by default').
---- a/fs/namei.c	2018-09-28 07:56:07.770005006 -0400
-+++ b/fs/namei.c	2018-09-28 07:56:43.370349204 -0400
-@@ -885,8 +885,8 @@ static inline void put_link(struct namei
+--- a/fs/namei.c	2022-01-09 17:55:34.000000000 -0500
++++ b/fs/namei.c	2022-02-26 11:32:31.832844465 -0500
+@@ -1020,10 +1020,10 @@ static inline void put_link(struct namei
  		path_put(&last->link);
  }
  
 -int sysctl_protected_symlinks __read_mostly = 0;
 -int sysctl_protected_hardlinks __read_mostly = 0;
+-int sysctl_protected_fifos __read_mostly;
+-int sysctl_protected_regular __read_mostly;
 +int sysctl_protected_symlinks __read_mostly = 1;
 +int sysctl_protected_hardlinks __read_mostly = 1;
- int sysctl_protected_fifos __read_mostly;
- int sysctl_protected_regular __read_mostly;
++int sysctl_protected_fifos __read_mostly = 1;
++int sysctl_protected_regular __read_mostly = 1;
  
+ /**
+  * may_follow_link - Check symlink following for unsafe situations