2024-05-10 23:18:36 -04:00
|
|
|
## Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
2020-12-01 04:28:15 -05:00
|
|
|
## See the file COPYING for copying conditions.
|
|
|
|
|
|
2024-01-02 07:34:29 -05:00
|
|
|
## Please use "/etc/permission-hardener.d/20_user.conf" or
|
|
|
|
|
## "/usr/local/etc/permission-hardener.d/20_user.conf" for your custom
|
2020-12-01 04:28:15 -05:00
|
|
|
## configuration. When security-misc is updated, this file may be overwritten.
|
|
|
|
|
|
|
|
|
|
## TODO: research
|
|
|
|
|
## https://github.com/QubesOS/qubes-core-agent-linux/blob/master/qubes-rpc/qfile-unpacker.c
|
2023-11-06 16:40:22 -05:00
|
|
|
##
|
|
|
|
|
## Qubes upstream security issue:
|
|
|
|
|
## qfile-unpacker allows unprivileged users in VMs to gain root privileges
|
2023-11-05 16:03:36 -05:00
|
|
|
## https://github.com/QubesOS/qubes-issues/issues/8633
|
2023-11-06 16:40:22 -05:00
|
|
|
##
|
2020-12-01 04:28:15 -05:00
|
|
|
## match both:
|
|
|
|
|
#/usr/lib/qubes/qfile-unpacker whitelist
|
|
|
|
|
#/lib/qubes/qfile-unpacker
|
2023-11-05 16:03:36 -05:00
|
|
|
qfile-unpacker matchwhitelist
|
