pkgsrc-Bugs archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

pkg/39449: lang/pear uses /tmp (probably unsafely) during build

>Number:         39449
>Category:       pkg
>Synopsis:       lang/pear uses /tmp (probably unsafely) during build
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Sep 02 02:45:00 +0000 2008
>Originator:     David Sainty
Linux 2.6.24-19-generic #1 SMP Fri Jul 11 23:41:49 UTC 2008 i686 GNU/Linux

Building lang/pear leads to the creation of /tmp/test, /tmp/pear and 

If the package is built with unprivileged users and old files of the same names 
are present, then the package build doesn't progress correctly.

Unfortunately the package installation still completes, but most of the files 
in PLIST aren't there.

An installation with "ln -s myfile /tmp/test" in place suggests that this is a 
security hole at package installation time - it does create or overwrite 
"/tmp/myfile".  I haven't tested overwriting arbitrary files with a root 
installation of pear, but I suspect I already know what it will do :)


Get it to use a directory under "work" instead of "/tmp".

Home | Main Index | Thread Index | Old Index