Fedora 29 Update: FEDORA-2018-2f9521c82e Moderate: Setuid File Risk

flatpak is a system for building, distributing and running sandboxed desktop

applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for

more information.

flatpak 1.0.6 release. This release fixes an issue that lets system-wide

installed applications create setuid root files inside their app dir (somewhere

in /var/lib/flatpak/app). Setuid support is disabled inside flatpaks, so such

files are only a risk if the user runs them manually outside flatpak.

Installing a flatpak system-wide is needs root access, so this isn't a privilege

elevation for non-root users, and allowing root to install setuid files is

something all traditional packaging systems allow. However flatpak tries to be

better than that, in order to make it easier to trust third party repositories.

Changes in this version: * The permissions of the files created by the

apply_extra script is canonicalized and the script itself is run without any

capabilities. * Better matching of existing remotes when the local and remote

configuration differs wrt collection ids. * New flatpakrepo

DeployCollectionID replaces CollectionID, doing the same thing. It is

recommended to use this instead because older versions of flatpak has bugs in

the support of collection ids, and this key will only be respected in

versions where it works. * The X11 socket is now mounted read-only.

* Fri Nov 16 2018 Kalev Lember - 1.0.6-1

- Update to 1.0.6

* Mon Nov 12 2018 Kalev Lember - 1.0.5-2

- Recommend p11-kit-server instead of just p11-kit (#1649049)

* Mon Nov 12 2018 Kalev Lember - 1.0.5-1

- Update to 1.0.5

* Fri Oct 12 2018 Kalev Lember - 1.0.4-1

- Update to 1.0.4

su -c 'dnf upgrade --advisory FEDORA-2018-2f9521c82e' at the command

line. For more information, refer to the dnf documentation available at

https://dnf.readthedocs.io/en/latest/command_ref.html

All packages are signed with the Fedora Project GPG key. More details on the

GPG keys used by the Fedora Project can be found at

https://fedoraproject.org/security/

package-announce mailing list -- package-announce@lists.fedoraproject.org

To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org

Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/

List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines

List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/