Skip to content

levain 0.9.1

Choose a tag to compare

View all tags
@phillipclapham phillipclapham released this 12 Oct 12:47
· 3972 commits to main since this release
v0.9.1
308ab9e

A security fix. Upgrade if you use gpg on a machine where Levain runs bash.

Security

  • Bash can no longer write gnupg's configuration files. Bash runs as you, so it could write gpg-agent.conf and gnupg's other configuration files. Your gpg-agent runs outside Levain's floor and starts programs those files name, so a bash session could get a program of its choosing run outside the floor, with your network and your files. gpg-agent.conf, scdaemon.conf, gpg.conf, dirmngr.conf and common.conf are now read-only to bash in ~/.gnupg, and in $GNUPGHOME when Levain's own environment sets it to an absolute path. gpg signing and decryption through your agent keep working. Found in Levain's own review and reproduced on Linux; the fix was verified there against the same reproduction.
  • Known open issue: bash can still reach your gpg-agent. This release closes the configuration-file path that was reproduced. It does not keep a bash session from reaching gpg-agent by other means. Levain 2.0 changes how bash reaches local services, so that gpg-agent is out of its reach unless you allow it.
Assets 5
Loading