From 2c3420204e25c31b6768f8e30ade348db757b722 Mon Sep 17 00:00:00 2001 From: nl6720 Date: Sat, 26 Nov 2022 20:00:40 +0200 Subject: mkarchiso: open the ARCHISO_GNUPG_FD, ARCHISO_TLS_FD and ARCHISO_TLSCA_FD file descriptors only for reading Nothing should ever be written to these files, so let's make sure it cannot happen. --- CHANGELOG.rst | 2 ++ 1 file changed, 2 insertions(+) (limited to 'CHANGELOG.rst') diff --git a/CHANGELOG.rst b/CHANGELOG.rst index 982c722..4fa88db 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -13,6 +13,8 @@ Changed ------- - Check if the GPG public key file was successfully placed in the work directory before trying to use it. +- Open the file descriptors for code signing certificates and GPG public key as read only. Nothing from the within the + ``pacstrap`` invoked chroot should ever be allowed to write outside of it. Removed ------- -- cgit v1.2.3-54-g00ecf