[src/netbsd-6]: src/doc ticket 1309

[bouyer <bouyer%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/c1798b830664
branches:  netbsd-6
changeset: 776981:c1798b830664
user:      bouyer <bouyer%NetBSD.org@localhost>
date:      Wed Jul 01 07:24:22 2015 +0000

description:
ticket 1309

diffstat:

 doc/CHANGES-6.2 |  16 +++++++++++++++-
 1 files changed, 15 insertions(+), 1 deletions(-)

diffs (27 lines):

diff -r 72f2ccc9c1fb -r c1798b830664 doc/CHANGES-6.2
--- a/doc/CHANGES-6.2   Wed Jul 01 07:22:37 2015 +0000
+++ b/doc/CHANGES-6.2   Wed Jul 01 07:24:22 2015 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: CHANGES-6.2,v 1.1.2.220 2015/06/19 17:51:18 snj Exp $
+# $NetBSD: CHANGES-6.2,v 1.1.2.221 2015/07/01 07:24:22 bouyer Exp $
 
 A complete list of changes from the 6.1 release until the 6.2 release:
 
@@ -11532,3 +11532,17 @@
        Fix dot-lookup when readdir does not provide inodes
        [manu, ticket #1306]
 
+usr.bin/calendar/calendar.c                    1.51
+
+       Correct privilege handling problems in calendar -a (which runs as root
+       from /etc/daily); do not exec other programs while the real uid is
+       still 0.
+
+       Also, clear the supplementary groups list up front and call initgroups
+       when becoming another user, to avoid leaking any extra group
+       privileges that we might have.
+
+       And finally, don't silently ignore errors changing uid and gid; those
+       are serious if they happen.
+       [dholland, ticket #1309]
+