From: Baurzhan Ismagulov <ibr@radix50.net>
To: isar-users@googlegroups.com
Subject: Re: [PATCH v5 0/5] Debootstrap integration
Date: Wed, 11 Apr 2018 08:28:33 +0200 [thread overview]
Message-ID: <20180411062833.GD4762@yssyq.radix50.net> (raw)
In-Reply-To: <e2030c2b-11d3-b63b-3be9-8575bb742ff5@siemens.com>
On Thu, Apr 05, 2018 at 11:16:43AM +0200, Jan Kiszka wrote:
> I would call this a "safety" concern - building images via Isar is not
> secure in any way as long as we require root permissions.
However we call it (directory traversal is commonly classified as a security
issue as opposed to safety as in health injury), it doesn't mean we should
easily add more of them just because the existing code already isn't perfect.
I've raised the issue to understand the implications, consider advantages and
disadvantages, and possibly determine TODOs if we end up with a trade-off.
For example, for this specific case, does upstream bitbake and / or OE check
whether cleandirs are within the build directory?
With kind regards,
Baurzhan.
next prev parent reply other threads:[~2018-04-11 6:28 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-04-03 10:07 claudius.heine.ext
2018-04-03 10:07 ` [PATCH v5 1/5] implement isar-bootstrap using debootstrap claudius.heine.ext
2018-04-03 10:07 ` [PATCH v5 2/5] meta/isar-bootstrap-helper.bbclass: handle rfs customization centrally claudius.heine.ext
2018-04-03 10:08 ` [PATCH v5 3/5] meta/buildchroot: switch to using isar-bootstrap claudius.heine.ext
2018-04-03 10:08 ` [PATCH v5 4/5] meta-isar/isar-image-base: " claudius.heine.ext
2018-04-03 10:08 ` [PATCH v5 5/5] meta-isar/multiconfig: remove multistrap references claudius.heine.ext
2018-04-04 20:34 ` [PATCH v5 0/5] Debootstrap integration Baurzhan Ismagulov
2018-04-05 8:03 ` Claudius Heine
2018-04-05 9:16 ` Jan Kiszka
2018-04-11 6:28 ` Baurzhan Ismagulov [this message]
2018-04-11 6:58 ` Jan Kiszka
2018-04-11 7:04 ` Claudius Heine
2018-04-09 10:50 ` Jan Kiszka
2018-04-09 12:48 ` Baurzhan Ismagulov
2018-04-09 14:47 ` Jan Kiszka
2018-04-10 11:38 ` Claudius Heine
2018-04-10 20:49 ` Baurzhan Ismagulov
2018-04-11 5:59 ` Baurzhan Ismagulov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180411062833.GD4762@yssyq.radix50.net \
--to=ibr@radix50.net \
--cc=isar-users@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox