Re: Securing "make check" (CVE-2014-0067)

From: yamt(at)netbsd(dot)org (YAMAMOTO Takashi)
To: noah(at)leadboat(dot)com
Cc: bruce(at)momjian(dot)us, tgl(at)sss(dot)pgh(dot)pa(dot)us, pgsql-hackers(at)postgresql(dot)org
Subject: Re: Securing "make check" (CVE-2014-0067)
Date: 2014-04-04 02:36:05
Message-ID: 20140404023605.A37BA14A317@mail.netbsd.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

> Thanks. To avoid socket path length limitations, I lean toward placing the
> socket temporary directory under /tmp rather than placing under the CWD:
>
> http://www.postgresql.org/message-id/flat/20121129223632(dot)GA15016(at)tornado(dot)leadboat(dot)com

openvswitch has some tricks to overcome the socket path length
limitation using symlink. (or procfs where available)
iirc these were introduced for debian builds which use deep CWD.

http://git.openvswitch.org/cgi-bin/gitweb.cgi?p=openvswitch;a=blob;f=lib/socket-
util.c;h=aa0c7196da9926de38b7388b8e28ead12e12913e;hb=HEAD

look at shorten_name_via_symlink and shorten_name_via_proc.

YAMAMOTO Takashi

In response to

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Peter Geoghegan 2014-04-04 03:25:54 Re: B-Tree support function number 3 (strxfrm() optimization)
Previous Message Andres Freund 2014-04-03 23:40:28 Re: WAL format and API changes (9.5)