[Rpm-maint] [rpm-software-management/rpm] First steps towards fixing the symlink CVEs (PR #1919)

[Panu Matilainen]

Details in commits, but basically fixes CVE-2021-35939 and lays down some necessary infrastructure for next steps in securing down our file operations.
You can view, comment on, or merge this pull request online at:

  https://github.com/rpm-software-management/rpm/pull/1919

-- Commit Summary --

  * Add optional callback on directory changes during rpmfi iteration
  * Validate intermediate symlinks during installation, CVE-2021-35939
  * Drop unsafe and now redundant unowned directories creation code

-- File Changes --

    M INSTALL (2)
    M configure.ac (3)
    M lib/fsm.c (371)
    M lib/rpmfi.c (24)
    M lib/rpmfi_internal.h (17)

-- Patch Links --

https://github.com/rpm-software-management/rpm/pull/1919.patch
https://github.com/rpm-software-management/rpm/pull/1919.diff

-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/1919
You are receiving this because you are subscribed to this thread.

Message ID: <rpm-software-management/rpm/pull/1919 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20220210/2c4331f0/attachment.html>