borg mount / borgfs security fix (1.1-maint) #4331
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ThomasWaldmann
force-pushed
the
fuse-default-options
branch
from
3becd28 to
7eb1a36
Compare
Codecov Report
@@ Coverage Diff @@
## 1.1-maint #4331 +/- ##
============================================
+ Coverage 84.31% 84.4% +0.09%
============================================
Files 23 23
Lines 9421 9421
Branches 1607 1607
============================================
+ Hits 7943 7952 +9
+ Misses 1030 1023 -7
+ Partials 448 446 -2
Continue to review full report at Codecov.
|
ThomasWaldmann
force-pushed
the
fuse-default-options
branch
2 times, most recently
from
34d86ee to
3c4bcdb
Compare
ThomasWaldmann
changed the title
ThomasWaldmann
force-pushed
the
fuse-default-options
branch
from
3c4bcdb to
695707e
Compare
…ckup#3903 "default_permissions" is now enforced by borg by default to let the kernel check uid/gid/mode based permissions. "ignore_permissions" can be given to not enforce "default_permissions". note: man mount.fuse explicitly tells about the security issue: default_permissions By default FUSE doesn't check file access permissions, ... This option enables permission checking, restricting access based on file mode. This option is usually useful together with the allow_other mount option. We consider this a pitfall waiting for someone to fall into and this is why we chose to change the default behaviour for borg.
ThomasWaldmann
force-pushed
the
fuse-default-options
branch
from
695707e to
1b277cb
Compare
|
fix is in 1.1.9 release. result of platform testing was at first that same fakeroot-caused test failures as on macOS in the past are now also seen on linux (due to the on-by-default permissions check). fixed all platforms by ignoring permissions checking for this test. |
10 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
platform testing will be done as part of release process.