[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#754041: "apt-get build-dep <pkgname>" no longer secure when cwd=/tmp



On Sun, Jul 06, 2014 at 11:49:26PM +0200, Jakub Wilk wrote:
>  # apt-get build-dep nyancat

Even if we ignore security for a moment I am not a fan of this syntax as
it is too suprising for me. I think I would be happier if this would
always require a relative/absolute path rather than just a directory
name ala: apt-get build-dep ./nyancat

(aka: at least one / in the pkgname before a file lookup is attempt. And
a message like those for regex/glob if it matched anything)

This also 'solves' the security problem by letting the user decide how
secure she wants to be.

(I haven't looked at the code though, yet)


Best regards

David Kalnischkies

Attachment: signature.asc
Description: Digital signature


Reply to: