Date: Friday, February 10, 2017 @ 11:39:20 Author: anthraxx Revision: 288540
upgpkg: nginx 1.10.3-2 (logrotate regression fix) To correctly be safe for CVE-2016-1247, we need all nginx log dirs to be owned by both user and group root. Also, since nginx childs runs as http user, the directories permissions must be 0755, so the http user can descent into it. Since the logrotate will create the log files as http:log, the nginx childs will be able to write to the logs, but will not be able to create files inside those dirs, fully preventing CVE-2016-1247. Modified: nginx/trunk/PKGBUILD nginx/trunk/nginx.install ---------------+ PKGBUILD | 4 ++-- nginx.install | 7 +++++++ 2 files changed, 9 insertions(+), 2 deletions(-) Modified: PKGBUILD =================================================================== --- PKGBUILD 2017-02-10 05:00:14 UTC (rev 288539) +++ PKGBUILD 2017-02-10 11:39:20 UTC (rev 288540) @@ -7,7 +7,7 @@ pkgname=nginx pkgver=1.10.3 -pkgrel=1 +pkgrel=2 pkgdesc='Lightweight HTTP server and IMAP/POP3 proxy server' arch=('i686' 'x86_64') url='https://nginx.org' @@ -102,7 +102,7 @@ install -d "$pkgdir"/var/lib/nginx install -dm700 "$pkgdir"/var/lib/nginx/proxy - chmod 750 "$pkgdir"/var/log/nginx + chmod 755 "$pkgdir"/var/log/nginx chown root:root "$pkgdir"/var/log/nginx install -d "$pkgdir"/usr/share/nginx Modified: nginx.install =================================================================== --- nginx.install 2017-02-10 05:00:14 UTC (rev 288539) +++ nginx.install 2017-02-10 11:39:20 UTC (rev 288540) @@ -17,4 +17,11 @@ if (( $(vercmp $2 1.10.2-3) < 0)); then chown root:root var/log/nginx fi + + if (( $(vercmp $2 1.10.3-2) < 0 )); then + chmod 755 var/log/nginx + echo ':: Security notice:' + echo ' - When additional log directories are used in /var/log/nginx make sure they' + echo ' are owned by root:root and have 755 set as permission to mitigate CVE-2016-1247' + fi }