tmpfiles.d/systemd.conf in systemd before 214 uses weak permissions for journal files under (1) /run/log/journal/%m and (2) /var/log/journal/%m, which allows local users to obtain sensitive information by reading these files.

This update for SystemD provides fixes and enhancements.

The following security issue has been fixed :

  - Don't allow read access to journal files to users.
    (bsc#972612, CVE-2014-9770, CVE-2015-8842)

The following non-security issues have been fixed :

  - Restore initrd-udevadm-cleanup-db.service. (bsc#978275,     bsc#976766)

  - Incorrect permissions set after boot on journal files.
    (bsc#973848)

  - Exclude device-mapper from block device ownership event     locking. (bsc#972727)

  - Explicitly set mode for /run/log.

  - Don't apply sgid and executable bit to journal files,     only the directories they are contained in.

  - Add ability to mask access mode by pre-existing access     mode on files/directories.

  - No need to pass --all if inactive is explicitly     requested in list-units. (bsc#967122)

  - Fix automount option and don't start associated mount     unit at boot. (bsc#970423)

  - Support more than just power-gpio-key. (fate#318444,     bsc#970860)

  - Add standard gpio power button support. (fate#318444,     bsc#970860)

  - Downgrade warnings about wanted unit which are not     found. (bsc#960158)

  - Shorten hostname before checking for trailing dot.
    (bsc#965897)

  - Remove WorkingDirectory parameter from emergency, rescue     and console-shell.service. (bsc#959886)

  - Don't ship boot.udev and systemd-journald.init anymore.

  - Revert 'log: honour the kernel's quiet cmdline     argument'. (bsc#963230)

This update was imported from the SUSE:SLE-12-SP1:Update update project.

This update for SystemD provides fixes and enhancements.

The following security issue has been fixed :

  - Don't allow read access to journal files to users.
    (bsc#972612, CVE-2014-9770, CVE-2015-8842)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for systemd fixes several issues :

e5e362a udev: exclude MD from block device ownership event locking 8839413 udev: really exclude device-mapper from block device ownership event locking 66782e6 udev: exclude device-mapper from block device ownership event locking (bsc#972727) 1386f57 tmpfiles: explicitly set mode for /run/log faadb74 tmpfiles: don't allow read access to journal files to users not in systemd-journal 9b1ef37 tmpfiles: don't apply sgid and executable bit to journal files, only the directories they are contained in 011c39f tmpfiles: add ability to mask access mode by pre-existing access mode on files/directories 07e2d60 tmpfiles: get rid of 'm' lines d504e28 tmpfiles: various modernizations f97250d systemctl: no need to pass --all if inactive is explicitly requested in list-units (bsc#967122) 2686573 fstab-generator: fix automount option and don't start associated mount unit at boot (bsc#970423) 5c1637d login: support more than just power-gpio-key (fate#318444) (bsc#970860) 2c95ecd logind: add standard gpio power button support (fate#318444) (bsc#970860) af3eb93 Revert 'log-target-null-instead-kmsg' 555dad4 shorten hostname before checking for trailing dot (bsc#965897) 522194c Revert 'log: honour the kernel's quiet cmdline argument' (bsc#963230) cc94e47 transaction:
downgrade warnings about wanted unit which are not found (bsc#960158) eb3cfb3 Revert 'vhangup-on-all-consoles' 0c28752 remove WorkingDirectory parameter from emergency, rescue and console-shell.service (bsc#959886)

  - Don't allow read access to journal files to users     (boo#972612 CVE-2014-9770 CVE-2015-8842) Remove the     world read bit from the permissions of (persistent)     archived journals. This was incorrectly set due to     backported commit 18afa5c2a7a6c215. For the same reasons     we also have to fix the permissions of     /run/log/journal/<machine-id> directory to make sure     that regular user won't access to its content.

  - spec: remove libudev1 runtime dependencies on udev

This update for systemd fixes several issues.

These security issues were fixed :

  - CVE-2014-9770, CVE-2015-8842: Don't allow read access to     journal files to users (boo#972612)

These non-security issues were fixed :

  - Import commit 523777609a04fe9e590420e89f94ef07e3719baa:
    e5e362a udev: exclude MD from block device ownership     event locking 8839413 udev: really exclude device-mapper     from block device ownership event locking 66782e6 udev:
    exclude device-mapper from block device ownership event     locking (boo#972727) 1386f57 tmpfiles: explicitly set     mode for /run/log faadb74 tmpfiles: don't allow read     access to journal files to users not in systemd-journal     9b1ef37 tmpfiles: don't apply sgid and executable bit to     journal files, only the directories they are contained     in 011c39f tmpfiles: add ability to mask access mode by     pre-existing access mode on files/directories 07e2d60     tmpfiles: get rid of 'm' lines d504e28 tmpfiles: various     modernizations f97250d systemctl: no need to pass --all     if inactive is explicitly requested in list-units     (boo#967122) 2686573 fstab-generator: fix automount     option and don't start associated mount unit at boot     (boo#970423) 5c1637d login: support more than just     power-gpio-key (fate#318444) (boo#970860) 2c95ecd     logind: add standard gpio power button support     (fate#318444) (boo#970860) af3eb93 Revert     'log-target-null-instead-kmsg' 555dad4 shorten hostname     before checking for trailing dot (boo#965897) 522194c     Revert 'log: honour the kernel's quiet cmdline argument'     (boo#963230) cc94e47 transaction: downgrade warnings     about wanted unit which are not found (boo#960158)     eb3cfb3 Revert 'vhangup-on-all-consoles' 0c28752 remove     WorkingDirectory parameter from emergency, rescue and     console-shell.service (boo#959886) 1d6d840 Fix wrong     substitution variable name in     systemd-udev-root-symlink.service.in (boo#964355)

  - Don't ship boot.udev and systemd-journald.init anymore.
    It was used during the systemd transition when both     sysvinit and systemd could be used on the same system

ID	Name	Product	Family	Severity
91402	openSUSE Security Update : systemd (openSUSE-2016-648)	Nessus	SuSE Local Security Checks	low
91254	SUSE SLED12 / SLES12 Security Update : systemd (SUSE-SU-2016:1351-1)	Nessus	SuSE Local Security Checks	low
91253	SUSE SLED12 / SLES12 Security Update : systemd (SUSE-SU-2016:1346-1)	Nessus	SuSE Local Security Checks	low
90594	openSUSE Security Update : systemd (openSUSE-2016-488)	Nessus	SuSE Local Security Checks	low
90593	openSUSE Security Update : systemd (openSUSE-2016-487)	Nessus	SuSE Local Security Checks	low

Detections

Analytics

CVE-2014-9770

low

Tenable Plugins

low

low

low

low

low