GNU bug report logs - #66245
[PATCH] ; Silence macOS 14 warning

Previous Next

Full log

Message #29 received at 66245 <at> debbugs.gnu.org (full text, mbox):

From: Stefan Kangas <stefankangas <at> gmail.com>
To: Alan Third <alan <at> idiocy.org>
Cc: 66245 <at> debbugs.gnu.org, eliz <at> gnu.org, Eshel Yaron <me <at> eshelyaron.com>
Subject: Re: bug#66245: [PATCH] ; Silence macOS 14 warning
Date: Fri, 29 Sep 2023 02:34:52 -0700

Alan Third <alan <at> idiocy.org> writes:

> I'm not sure that Emacs has any particularly noteworthy privileges,
> though. The example they give is an application that has installer
> type privileges, which I doubt Emacs would ever have or need.

One thing we do commonly have, I think, is access to the Documents
directory.

OTOH, on GNU/Linux we typically don't really have any special protection
for user files.

>> The full exploit chain there is not very easy to understand, but it
>> seems like several techniques are used for some of the more nasty stuff,
>> and some of the steps have been fixed already.  There can be other ways
>> to do the same thing of course.  So I'm not sure what to say about the
>> urgency of fixing this; it could be urgent, or it could wait until 29.2.
>> What is your view?
>
> I'm not sure either. Is there a rough timeline for the release of
> 29.2? I feel like this is perhaps not very urgent, but if we're
> talking, say, three or four months or more we maybe don't want to wait
> that long.

I don't think we have a rough timeline for 29.2 as of now.  I'm leaning
towards just including this in the next release as usual, since the bug
only affects the macOS port, and anyways, and IIUC, depends on other
things being vulnerable to be exploited.

But I'm very open to being convinced otherwise, if anyone sees any
problems with that.

Eli, do you have any comments here?

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.