[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#661627: init script x11-common creates directories in insecure manners



On Wed, Feb 29, 2012 at 21:29:37 +0100, Julien Cristau wrote:

> On Tue, Feb 28, 2012 at 20:21:39 +0100, Julien Cristau wrote:
> 
> > On Tue, Feb 28, 2012 at 19:05:23 +0100, vladz wrote:
> > 
> > > On Tue, Feb 28, 2012 at 06:42:59PM +0100, Julien Cristau wrote:
> > > > > As a solution, I would suggest to take care of the "mkdir" return codes 
> > > > > (line 36 and 50).  To do not change permissions on failures.         
> > > > > 
> > > > This script is set -e AFAICT, which means it already does care about the
> > > > mkdir return code.
> > > 
> > > Yes but with the "-p" option, mkdir always return 0 (success):
> > > 
> > >   $ mkdir /tmp/dir
> > >   $ mkdir /tmp/dir
> > >   mkdir: cannot create directory `/tmp/dir': File exists
> > >   $ echo $?
> > >   1
> > >   $ mkdir -p /tmp/dir
> > >   $ echo $?
> > >   0
> > > 
> > Right, makes sense.  I can drop the -p, I guess.  Not sure what impact
> > that would have on things assuming they can use /tmp/.X11-unix (I
> > wouldn't really like to fix this just to have the same issue elsewhere).
> > Looking at trans_mkdir
> > (http://cgit.freedesktop.org/xorg/lib/libxtrans/tree/Xtransutil.c#n480)
> > it *looks* like it should be safe, though.
> > 
> Actually it's not going to work.  If /tmp/.X11-unix exists and is a
> directory (not a symlink), that's good enough for us, we don't want to
> fail in that case.
> 
And while I'm at it I'd also like to fix the $SOCKET_DIR.$$ thing
to use a random name instead (probably with mktemp).

Cheers,
Julien

Attachment: signature.asc
Description: Digital signature


Reply to: