[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#514016: cdebootstrap - packages with symlinks to dirs (libc6) can lead to writes outside the new root



severity 514015 important
severity 514016 important
thanks

While there are many good arguments made here about why (c)debootstrap
should handle these symlinks safely, fundamentally, if you can install two
packages at the same time that disagree about whether a given path is a
symlink or a directory, there's a bug in those packages.  All co-installable
packages need to agree on symlinks and directories, otherwise installing a
package that uses a symlink, followed by installing a package that uses a
directory, then removing the package that shipped the symlink will leave
orphaned files on the filesystem that dpkg won't be able to find anymore. 
And using relative symlinks instead of absolute symlinks won't fix this,
either.

So *that* bug should be treated as RC, wherever it occurs, but I don't think
we should treat this bug in *debootstrap as RC.

-- 
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
Ubuntu Developer                                    http://www.debian.org/
slangasek@ubuntu.com                                     vorlon@debian.org

Attachment: signature.asc
Description: Digital signature


Reply to: