Package: base-files Severity: normal Tags: patch security X-Debbugs-Cc: Debian Security Team <[email protected]>
Dear Maintainer, I would like to submit three low-severity security hardening patches for the debian/postinst maintainer script. These are defense-in-depth improvements identified during a security code review. While none represent exploitable vulnerabilities in normal deployment scenarios, they improve robustness and satisfy security best practices. The patches are available on salsa.debian.org at: https://salsa.debian.org/superm1/base-files/-/tree/debian/SWSPLAT-23612 https://salsa.debian.org/superm1/base-files/-/tree/debian/SWSPLAT-23614 https://salsa.debian.org/superm1/base-files/-/tree/debian/SWSPLAT-23616 **Patch 1: Prevent symlink attacks in log file initialization** Branch: debian/SWSPLAT-23612 The ensure_file_owner_mode() function (lines 4-10) creates and sets ownership of system log files (wtmp, btmp, lastlog) but does not check whether the target path is a symlink before modifying it. While exploiting this requires write access to /var/log (normally root-only), it represents a theoretical TOCTOU vulnerability during package installation. Fix: Add explicit symlink check that refuses to operate on symlinks, and use chown -h to avoid dereferencing. **Patch 2: Quote DPKG_ROOT expansion in chmod** Branch: debian/SWSPLAT-23614 Line 100 invokes chmod with an unquoted $DPKG_ROOT expansion, unlike every other reference in the script. If DPKG_ROOT contains IFS whitespace or glob characters, the argument would word-split or glob-expand. Fix: Add quotes around the variable expansion to match the rest of the script. **Patch 3: Replace MD5 with SHA-256 for file integrity checks** Branch: debian/SWSPLAT-23616 The update_to_current_default() function uses MD5 to decide whether to overwrite /etc/profile and /root/.profile. MD5 is cryptographically broken for collision resistance. While the check is not used as a security control (it's a "did the admin customize this file?" heuristic), using SHA-256 improves crypto hygiene and silences security scanners. Fix: Replace md5sum with sha256sum and use grep -qxF for anchored fixed-string matching.
