Hello community,
here is the log from the commit of package kernel-source for openSUSE:Factory checked in at 2016-01-01 19:46:33
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/kernel-source (Old)
and /work/SRC/openSUSE:Factory/.kernel-source.new (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "kernel-source"
Changes:
--------
--- /work/SRC/openSUSE:Factory/kernel-source/kernel-debug.changes 2015-12-29 12:49:45.000000000 +0100
+++ /work/SRC/openSUSE:Factory/.kernel-source.new/kernel-debug.changes 2016-01-01 19:46:46.000000000 +0100
@@ -1,0 +2,7 @@
+Mon Dec 28 16:58:51 CET 2015 - jeffm(a)suse.com
+
+- ovl: fix permission checking for setattr (CVE-2015-8660
+ bsc#960281).
+- commit 77a3e32
+
+-------------------------------------------------------------------
kernel-default.changes: same change
kernel-docs.changes: same change
kernel-lpae.changes: same change
kernel-obs-build.changes: same change
kernel-obs-qa.changes: same change
kernel-pae.changes: same change
kernel-source.changes: same change
kernel-syms.changes: same change
kernel-vanilla.changes: same change
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ kernel-debug.spec ++++++
--- /var/tmp/diff_new_pack.JdRjGi/_old 2016-01-01 19:46:51.000000000 +0100
+++ /var/tmp/diff_new_pack.JdRjGi/_new 2016-01-01 19:46:51.000000000 +0100
@@ -59,7 +59,7 @@
Group: System/Kernel
Version: 4.3.3
%if 0%{?is_kotd}
-Release: <RELEASE>.g10b7cff
+Release: <RELEASE>.g77a3e32
%else
Release: 0
%endif
kernel-default.spec: same change
++++++ kernel-docs.spec ++++++
--- /var/tmp/diff_new_pack.JdRjGi/_old 2016-01-01 19:46:51.000000000 +0100
+++ /var/tmp/diff_new_pack.JdRjGi/_new 2016-01-01 19:46:51.000000000 +0100
@@ -29,7 +29,7 @@
Group: Documentation/Man
Version: 4.3.3
%if 0%{?is_kotd}
-Release: <RELEASE>.g10b7cff
+Release: <RELEASE>.g77a3e32
%else
Release: 0
%endif
++++++ kernel-lpae.spec ++++++
--- /var/tmp/diff_new_pack.JdRjGi/_old 2016-01-01 19:46:51.000000000 +0100
+++ /var/tmp/diff_new_pack.JdRjGi/_new 2016-01-01 19:46:51.000000000 +0100
@@ -59,7 +59,7 @@
Group: System/Kernel
Version: 4.3.3
%if 0%{?is_kotd}
-Release: <RELEASE>.g10b7cff
+Release: <RELEASE>.g77a3e32
%else
Release: 0
%endif
++++++ kernel-obs-build.spec ++++++
--- /var/tmp/diff_new_pack.JdRjGi/_old 2016-01-01 19:46:51.000000000 +0100
+++ /var/tmp/diff_new_pack.JdRjGi/_new 2016-01-01 19:46:51.000000000 +0100
@@ -44,7 +44,7 @@
Group: SLES
Version: 4.3.3
%if 0%{?is_kotd}
-Release: <RELEASE>.g10b7cff
+Release: <RELEASE>.g77a3e32
%else
Release: 0
%endif
kernel-obs-qa.spec: same change
++++++ kernel-pae.spec ++++++
--- /var/tmp/diff_new_pack.JdRjGi/_old 2016-01-01 19:46:52.000000000 +0100
+++ /var/tmp/diff_new_pack.JdRjGi/_new 2016-01-01 19:46:52.000000000 +0100
@@ -59,7 +59,7 @@
Group: System/Kernel
Version: 4.3.3
%if 0%{?is_kotd}
-Release: <RELEASE>.g10b7cff
+Release: <RELEASE>.g77a3e32
%else
Release: 0
%endif
++++++ kernel-source.spec ++++++
--- /var/tmp/diff_new_pack.JdRjGi/_old 2016-01-01 19:46:52.000000000 +0100
+++ /var/tmp/diff_new_pack.JdRjGi/_new 2016-01-01 19:46:52.000000000 +0100
@@ -32,7 +32,7 @@
Group: Development/Sources
Version: 4.3.3
%if 0%{?is_kotd}
-Release: <RELEASE>.g10b7cff
+Release: <RELEASE>.g77a3e32
%else
Release: 0
%endif
++++++ kernel-syms.spec ++++++
--- /var/tmp/diff_new_pack.JdRjGi/_old 2016-01-01 19:46:52.000000000 +0100
+++ /var/tmp/diff_new_pack.JdRjGi/_new 2016-01-01 19:46:52.000000000 +0100
@@ -27,7 +27,7 @@
Version: 4.3.3
%if %using_buildservice
%if 0%{?is_kotd}
-Release: <RELEASE>.g10b7cff
+Release: <RELEASE>.g77a3e32
%else
Release: 0
%endif
++++++ kernel-vanilla.spec ++++++
--- /var/tmp/diff_new_pack.JdRjGi/_old 2016-01-01 19:46:52.000000000 +0100
+++ /var/tmp/diff_new_pack.JdRjGi/_new 2016-01-01 19:46:52.000000000 +0100
@@ -59,7 +59,7 @@
Group: System/Kernel
Version: 4.3.3
%if 0%{?is_kotd}
-Release: <RELEASE>.g10b7cff
+Release: <RELEASE>.g77a3e32
%else
Release: 0
%endif
++++++ patches.fixes.tar.bz2 ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/patches.fixes/ovl-fix-permission-checking-for-setattr new/patches.fixes/ovl-fix-permission-checking-for-setattr
--- old/patches.fixes/ovl-fix-permission-checking-for-setattr 1970-01-01 01:00:00.000000000 +0100
+++ new/patches.fixes/ovl-fix-permission-checking-for-setattr 2015-12-28 16:58:51.000000000 +0100
@@ -0,0 +1,47 @@
+From: Miklos Szeredi <miklos(a)szeredi.hu>
+Date: Fri, 4 Dec 2015 19:18:48 +0100
+Subject: ovl: fix permission checking for setattr
+Git-commit: acff81ec2c79492b180fade3c2894425cd35a545
+Patch-mainline: v4.4-rc4
+References: CVE-2015-8660 bsc#960281
+
+[Al Viro] The bug is in being too enthusiastic about optimizing ->setattr()
+away - instead of "copy verbatim with metadata" + "chmod/chown/utimes"
+(with the former being always safe and the latter failing in case of
+insufficient permissions) it tries to combine these two. Note that copyup
+itself will have to do ->setattr() anyway; _that_ is where the elevated
+capabilities are right. Having these two ->setattr() (one to set verbatim
+copy of metadata, another to do what overlayfs ->setattr() had been asked
+to do in the first place) combined is where it breaks.
+
+Signed-off-by: Miklos Szeredi <miklos(a)szeredi.hu>
+Cc: <stable(a)vger.kernel.org>
+Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk>
+Acked-by: Jeff Mahoney <jeffm(a)suse.com>
+---
+ fs/overlayfs/inode.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
+index ec0c2a0..9612849 100644
+--- a/fs/overlayfs/inode.c
++++ b/fs/overlayfs/inode.c
+@@ -49,13 +49,13 @@ int ovl_setattr(struct dentry *dentry, struct iattr *attr)
+ if (err)
+ goto out;
+
+- upperdentry = ovl_dentry_upper(dentry);
+- if (upperdentry) {
++ err = ovl_copy_up(dentry);
++ if (!err) {
++ upperdentry = ovl_dentry_upper(dentry);
++
+ mutex_lock(&upperdentry->d_inode->i_mutex);
+ err = notify_change(upperdentry, attr, NULL);
+ mutex_unlock(&upperdentry->d_inode->i_mutex);
+- } else {
+- err = ovl_copy_up_last(dentry, attr, false);
+ }
+ ovl_drop_write(dentry);
+ out:
+
++++++ series.conf ++++++
--- /var/tmp/diff_new_pack.JdRjGi/_old 2016-01-01 19:46:52.000000000 +0100
+++ /var/tmp/diff_new_pack.JdRjGi/_new 2016-01-01 19:46:52.000000000 +0100
@@ -292,6 +292,7 @@
########################################################
# Overlayfs
########################################################
+ patches.fixes/ovl-fix-permission-checking-for-setattr
########################################################
# Swap-over-NFS
++++++ source-timestamp ++++++
--- /var/tmp/diff_new_pack.JdRjGi/_old 2016-01-01 19:46:52.000000000 +0100
+++ /var/tmp/diff_new_pack.JdRjGi/_new 2016-01-01 19:46:52.000000000 +0100
@@ -1,3 +1,3 @@
-2015-12-22 12:19:48 +0100
-GIT Revision: 10b7cffdfab2ff23f20a3b540351232646c1105d
+2015-12-28 16:58:51 +0100
+GIT Revision: 77a3e32efb4979780b41ec71dde40026a3045fbc
GIT Branch: stable
