mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-19 16:40:46 -09:00
f2da4a526f
Jann Horn, Project Zero (Google) discovered that ntfs-3g, a read-write
NTFS driver for FUSE does not not scrub the environment before
executing modprobe to load the fuse module. This influence the behavior
of modprobe (MODPROBE_OPTIONS environment variable, --config and
--dirname options) potentially allowing for local root privilege
escalation if ntfs-3g is installed setuid.
Notice that Buildroot does NOT install netfs-3g setuid root, but custom
permission tables might be used, causing it to vulnerable to the above.
ntfs-3g does not seem to have a publicly available version control system
and no new releases have been made, so instead grab the patch from Debian.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6f971f354c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
37 lines
1.1 KiB
Makefile
37 lines
1.1 KiB
Makefile
################################################################################
|
|
#
|
|
# ntfs-3g
|
|
#
|
|
################################################################################
|
|
|
|
NTFS_3G_VERSION = 2016.2.22
|
|
NTFS_3G_SOURCE = ntfs-3g_ntfsprogs-$(NTFS_3G_VERSION).tgz
|
|
NTFS_3G_SITE = http://tuxera.com/opensource
|
|
NTFS_3G_PATCH = https://sources.debian.net/data/main/n/ntfs-3g/1:2016.2.22AR.1-4/debian/patches/0003-CVE-2017-0358.patch
|
|
NTFS_3G_CONF_OPTS = --disable-ldconfig
|
|
NTFS_3G_INSTALL_STAGING = YES
|
|
NTFS_3G_DEPENDENCIES = host-pkgconf
|
|
NTFS_3G_LICENSE = GPLv2+, LGPLv2+
|
|
NTFS_3G_LICENSE_FILES = COPYING COPYING.LIB
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBFUSE),y)
|
|
NTFS_3G_CONF_OPTS += --with-fuse=external
|
|
NTFS_3G_DEPENDENCIES += libfuse
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_UTIL_LINUX_LIBUUID),y)
|
|
NTFS_3G_DEPENDENCIES += util-linux
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_NTFS_3G_ENCRYPTED),y)
|
|
NTFS_3G_CONF_ENV += LIBGCRYPT_CONFIG=$(STAGING_DIR)/usr/bin/libgcrypt-config
|
|
NTFS_3G_CONF_OPTS += --enable-crypto
|
|
NTFS_3G_DEPENDENCIES += gnutls libgcrypt
|
|
endif
|
|
|
|
ifneq ($(BR2_PACKAGE_NTFS_3G_NTFSPROGS),y)
|
|
NTFS_3G_CONF_OPTS += --disable-ntfsprogs
|
|
endif
|
|
|
|
$(eval $(autotools-package))
|