Re: [9front] patch your shit

[Jacob Moody <moody@posixcafe.org>]

!WARNING!

As of the time of this writing (Sat Aug 24 22:17:26 GMT 2024) there is an issue
with this patch which causes hjfs to not permit none attaches. This is currently
being worked on and I suspect we'll have a solution within the next couple hours
but those running a hjfs CPU server may want to avoid updating immediately.
I will respond promptly to this thread once this bug has been patched, and I feel
it is safe to update these systems. I will provide a further write up once there is
a fix for the fix added.

- moody

On 8/24/24 14:08, hiro wrote:
> some people did something that increases security apparently. so patch
> your shit.
> 
> ref: 07aa9bfeef55ca987d411115adcfbbd4390ecf34
> parent: b05c74e7cb160f152e2f2cc2f6e0677763f8d57e
> author: Jacob Moody <moody@posixcafe.org>
> date: Sat Aug 24 12:58:31 EDT 2024
> 
> lib9p: verify uname against returned AuthInfo from factotum (thanks humm)
> 
> Before this it was possible to Tauth and Tattach with one
> user name and then authenticate with factotum using a different
> user name. To fix this we now ensure that the uname matches the returned
> cuid from AuthInfo.
> 
> This security bug is still pending a cute mascot and theme song.
> 
> 
> mein name ist hase. bye.