Package: ntfs-3g
Version: 1:2014.2.15AR.2-1+deb8u2cip2
Severity: normal
Tags: patch
Hello,
At the moment ntfs-3g ships with a setuid binary which is
unnecessary as FUSE already provides the setuid fusermount binary
and problematic if the code wasn't properly audited (which is
most likely the case). fusermount had CVEs in the past, i.e.
regarding missing environment sanitation, which could also be
present in ntfs-3g.
The attached patch removes unnecessary checks in the code which
abort when run as non-root, disables the blkdev mount option
which is not supported as non-root (and not required for ntfs-3g)
and removes the allow_other FUSE option which is problematic (as
it may hang processes of other users and has open CVEs) and also
not supported as non-root.
In addition the program must be compiled with
--with-fuse=external to use fusermount directly.
diff -Nru ntfs-3g-2014.2.15AR.2/debian/rules ntfs-3g-2014.2.15AR.2/debian/rules
--- ntfs-3g-2014.2.15AR.2/debian/rules 2015-05-26 20:03:00.000000000 +0200
+++ ntfs-3g-2014.2.15AR.2/debian/rules 2015-10-06 18:05:11.000000000 +0200
@@ -24,7 +24,7 @@
dh ${@} --parallel --with autoreconf
override_dh_auto_configure:
- dh_auto_configure -- --exec-prefix=/ --enable-crypto --enable-extras --enable-xattr-mappings --enable-quarantined --disable-ldconfig --with-fuse=internal $(CONFIGURE_FLAGS)
+ dh_auto_configure -- --exec-prefix=/ --enable-crypto --enable-extras --enable-xattr-mappings --enable-quarantined --disable-ldconfig --with-fuse=external $(CONFIGURE_FLAGS)
override_dh_auto_install:
dh_auto_install
And obviously the setuid flag must be removed.
Please consider applying this patch and if possible bringing it
upstream as it makes ntfs-3g securer on all systems.
Regards
Simon