Bug#412242: tetex-bin: mktexpk places some fonts in the current directory

[Frank Küster <frank@kuesterei.ch>]

Sergei Ivanov <svivanov@pdmi.ras.ru> wrote:

> On Tuesday 27 February 2007 12:01, Frank Küster wrote:
>> retitle 412242 fonts generated upon format creation are placed in 
>> TEXMFSYSVAR 
> [...]
>> >> /var/lib/texmf/fonts is and never was supposed to contain pk fonts, if I
>> >> remember correctly.
>
> I still think that the issue is about maketexpk. If /var/lib/texmf is not for 
> fonts, then it should not be in the search path. 

The search paths and the creation paths are tied together, although not
the same.  /var/lib/texmf/fonts must be in the search path, because it
contains the subdirectory map/ with the generated system-wide map
files.  On the other hand, the rule to put generated fonts in the same
tree as their sources generally makes sense.  

One change we could consider is to try the users' font directory before
the current directory.  But that would only hide the problem that these
fonts should never be created in /var/lib/texmf, in an ideal world.

> If it is, then maketexpk 
> should not be confused by the fact that the directory is not writable.

Well, it isn't confused.  The question is only what it should do instead.

>> Now fmtutil-sys should not create the fonts in ~root/.texmf-var,
>> naturally, and the question is: If fmtutil would put the fonts in the
>> fallback, /tmp/texfonts, where they are erased upon reboot, would that
>> cause any problems?
>
> I can think of security problems. What if /tmp/texfonts/something is a symlink 
> pointing to a sensitive place?

This is a problem, even if not a severe one (the symlink cannot exist in
advance, it would have to be created between mktexpk's check and the
metafont run, and it's hard to get arbitrary output there).  That's the
reasons why the fonts are in per-user directories now by default.  

Only for the font generation when the format is created, /tmp/texfonts
makes sense, because this will be automatically erased sooner or later,
whereas /root/.texmf-var/ will not.

Regards, Frank
-- 
Dr. Frank Küster
Single Molecule Spectroscopy, Protein Folding @ Inst. f. Biochemie, Univ. Zürich
Debian Developer (teTeX/TeXLive)