From ab377ea535b36239c6857beec333dee1b3c1ff85 Mon Sep 17 00:00:00 2001 From: José Bollo Date: Thu, 30 Jan 2020 18:13:40 +0100 Subject: security-manager: Restrict socket accesses MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ensure that only members of the group and the owner can access the security manager. Bug-AGL: SPEC-3146 Change-Id: Ia529be6b4ef425d03be31f0d2e2d623fa6ac091e Signed-off-by: José Bollo --- .../0015-Restrict-socket-accesses.patch | 34 ++++++++++++++++++++++ .../security-manager/security-manager_git.bb | 1 + 2 files changed, 35 insertions(+) create mode 100644 meta-security/recipes-security/security-manager/security-manager/0015-Restrict-socket-accesses.patch (limited to 'meta-security/recipes-security/security-manager') diff --git a/meta-security/recipes-security/security-manager/security-manager/0015-Restrict-socket-accesses.patch b/meta-security/recipes-security/security-manager/security-manager/0015-Restrict-socket-accesses.patch new file mode 100644 index 000000000..d9949193b --- /dev/null +++ b/meta-security/recipes-security/security-manager/security-manager/0015-Restrict-socket-accesses.patch @@ -0,0 +1,34 @@ +From 7cffcd61378a9d7c0e7db5691b2da3a37448c969 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jos=C3=A9=20Bollo?= +Date: Thu, 30 Jan 2020 09:19:25 +0100 +Subject: [PATCH 15/15] Restrict socket accesses +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Ensure that only members of the group and the owner can access +the security manager. + +Bug-AGL: SPEC-3146 + +Change-Id: I68ce6523db4bfd4707c3680555c3cb0cf8858ef2 +Signed-off-by: José Bollo +--- + systemd/security-manager.socket | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/systemd/security-manager.socket b/systemd/security-manager.socket +index af1c1da..b401f77 100644 +--- a/systemd/security-manager.socket ++++ b/systemd/security-manager.socket +@@ -1,6 +1,6 @@ + [Socket] + ListenStream=/run/security-manager.socket +-SocketMode=0777 ++SocketMode=0660 + SmackLabelIPIn=* + SmackLabelIPOut=@ + +-- +2.21.1 + diff --git a/meta-security/recipes-security/security-manager/security-manager_git.bb b/meta-security/recipes-security/security-manager/security-manager_git.bb index f438ea505..b34973519 100644 --- a/meta-security/recipes-security/security-manager/security-manager_git.bb +++ b/meta-security/recipes-security/security-manager/security-manager_git.bb @@ -20,6 +20,7 @@ SRC_URI += " \ file://0012-Avoid-casting-from-const-T-to-void.patch \ file://0013-Removing-tizen-platform-config.patch \ file://0014-Ensure-post-install-initialization-of-database.patch \ + file://0015-Restrict-socket-accesses.patch \ " # Use make with cmake and not ninja -- cgit 1.2.3-korg