mirror of
https://github.com/flatpak/flatpak.git
synced 2026-04-09 17:39:39 -04:00
libostree attempts to strip the setuid and setgid bits from file permissions in user-mode checkouts, which, if successful, would make Flatpak's check for setuid ineffective and unnecessary. In versions older than 2017.7 this was not consistently applied, making commits2c8e241and02a299fnecessary to defeat CVE-2017-9780 (see #845). libostree 2017.7 removes setuid and setgid bits more thoroughly as a result of fixing https://github.com/ostreedev/ostree/issues/633 in PR https://github.com/ostreedev/ostree/pull/903, which means that this test fails when linking flatpak 0.8.x to libostree 2017.7. Signed-off-by: Simon McVittie <smcv@debian.org>