NXv3 (redistributed) https://openid.arctica-project.org/nx-libs/atom?h=3.6.x 2017-07-26T08:12:43+00:00 2017-07-26T08:12:43+00:00 Mike Gabriel mike.gabriel@das-netzwerkteam.de 2017-06-30T18:13:51+00:00 urn:sha1:f76c82403888bb498973ec974dbfd20e4edb02fe 2016-07-05T23:07:24+00:00 Mike Gabriel mike.gabriel@das-netzwerkteam.de 2016-07-05T14:22:51+00:00 urn:sha1:51c3d42f3d15b181d58a0df1e5abac8d298d4484 2016-04-27T10:46:00+00:00 Fernando Carvajal fcarvajal@qindel.com 2016-04-25T10:53:00+00:00 urn:sha1:a436cba04834da945d4a2be5335d1d7e95c6bf08 This commit removes several warnings in nxcomp related to unused but set variables. It also replaces tempnam function with the more secure one mkstemp and there has been removed another warning related to setgid and setuid returning values not being checked. So these were the compiler warnings in nxcomp that have been fixed: Loop.cpp: In function ‘int ParseRemoteOptions(char*)’: Loop.cpp:9423:7: warning: variable ‘hasLimit’ set but not used [-Wunused-but-set-variable] int hasLimit = 0; ^ Loop.cpp:9424:7: warning: variable ‘hasRender’ set but not used [-Wunused-but-set-variable] int hasRender = 0; ^ Loop.cpp:9425:7: warning: variable ‘hasTaint’ set but not used [-Wunused-but-set-variable] int hasTaint = 0; ^ Loop.cpp:9427:7: warning: variable ‘hasStrict’ set but not used [-Wunused-but-set-variable] int hasStrict = 0; ^ Loop.cpp:9428:7: warning: variable ‘hasShseg’ set but not used [-Wunused-but-set-variable] int hasShseg = 0; ^ ServerChannel.cpp: In member function ‘virtual int ServerChannel::handleWrite(const unsigned char*, unsigned int)’: ServerChannel.cpp:2132:9: warning: variable ‘hit’ set but not used [-Wunused-but-set-variable] int hit; ^ Proxy.o: In function `Proxy::handleSaveAllStores(char const*) const': Proxy.cpp:(.text+0x2cac): warning: the use of `tempnam' is dangerous, better use `mkstemp' Pipe.cpp: In function ‘FILE* Popen(char* const*, const char*)’: Pipe.cpp:240:23: warning: ignoring return value of ‘int setgid(__gid_t)’, declared with attribute warn_unused_result [-Wunused-result] setgid(getgid()); ^ Pipe.cpp:241:23: warning: ignoring return value of ‘int setuid(__uid_t)’, declared with attribute warn_unused_result [-Wunused-result] setuid(getuid()); ^ There was also a hidden problem in the way Proxy::handleSaveAllStores was checking for an error in the returning value from the call to the virtual method handleSaveAllStores of the specific proxy class really being used (ClientProxy or ServerProxy). Former code was considering the value 0 as the returning value in case of an error whereas both subclasses return the value -1 when there is an error in their handleSaveAllStores method. This bug has been fixed in this commit taking advantage of the modification that was already being made to this method in order to replace tempnam function with the more secure one mkstemp. Fixes: ArcticaProject/nx-libs#103 2015-02-13T12:32:17+00:00 Orion Poplawski orion@cora.nwra.com 2015-02-13T12:32:17+00:00 urn:sha1:415b20b6fbf562d4132fca90a00b6c32d94040ed The Fedora review of NX (redistributed) caught the following rpmlint issue: This executable is calling setuid and setgid without setgroups or initgroups. There is a high probability this mean it didn't relinquish all groups, and this would be a potential security issue to be fixed. Seek POS36-C on the web for details about the problem. Ref POS36-C: https://www.securecoding.cert.org/confluence/display/seccode/POS36-C.+Observe+correct+revocation+order+while+relinquishing+privileges This patch adds initgroups() calls to the code to initialize the supplemental group list. 2011-11-13T08:27:53+00:00 Reinhard Tartler siretart@tauware.de 2011-11-13T08:27:53+00:00 urn:sha1:477961678194817aaf1aaf3602f1c91d288a539d Summary: Imported nxcomp-3.4.0-6.tar.gz Keywords: Imported nxcomp-3.4.0-6.tar.gz into Git repository 2011-11-13T08:27:52+00:00 Reinhard Tartler siretart@tauware.de 2011-11-13T08:27:52+00:00 urn:sha1:799bf672a3588f205bd18ef39d9908069e0cd6d5 Summary: Imported nxcomp-3.4.0-1.tar.gz Keywords: Imported nxcomp-3.4.0-1.tar.gz into Git repository 2011-11-13T08:27:51+00:00 Reinhard Tartler siretart@tauware.de 2011-11-13T08:27:51+00:00 urn:sha1:3e924126b56c4d421e8263d25f6b14aa4ceed047 Summary: Imported nxcomp-3.1.0-4.tar.gz Keywords: Imported nxcomp-3.1.0-4.tar.gz into Git repository