Subject: Re: bug#851: openrc: Incorrect handling of 'no_new_privs' in openrc-run

From: Mark Hindley <[email-masked]>
Date: Mon, 15 Jul 2024 17:33:45 +0100

Control: tags -1 upstream
Control: fixed -1 0.52.1-1

On Wed, Jul 03, 2024 at 01:12:57AM +1100, murzik wrote:
>    Subject: openrc: Incorrect handling of 'no_new_privs' in openrc-run
>    Package: openrc
>    X-Debbugs-Cc: [email-masked]
>    Version: 0.45.2-2+deb12u1
>    Severity: grave
>    Justification: renders package unusable
>    Tags: patch
>    Dear Maintainer,
>    Supervise-daemon handler
>    supervise_daemon.sh(/lib/rc/sh/supervise-daemon.sh) for openrc-run
>    has problems with handling the no_new_privs parameter!
>    at line 41 we have the following code:
>       ${no_new_privs:+--no_new_privs} \
>    And there is no '--no_new_privs' option in supervise-daemon, only
>    '--no-new-privs'.
>    So, line 41 should be replaced with
>       ${no_new_privs:+--no-new-privs} \

Thanks. This was fixed upstream in version 0.52.1.

Mark