bugfindutils - Bugs: bug #14386, updatedb relies on mktemp, which...

 
 

bug #14386: updatedb relies on mktemp, which is not portable

Submitter:  Eric Blake <ericb>
Submitted:  Sat 03 Sep 2005 02:27:57 PM UTC
   
 
Category:  updatedb Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  jay
Originator Name:  Eric Blake Open/Closed:  Closed
Release:  4.2.25 Fixed Release:  4.5.11
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Sat 14 May 2011 11:39:06 PM UTC, comment #8: 

Fixed in current git.

James Youngman <jay>
Group administrator
Sun 11 Apr 2010 11:56:13 AM UTC, comment #7: 

updatedb would probably be best rewritten.   I'm going to mark the updatedb-related bus as "Postponed" in order to consider them all in a batch, when I get around to the rewrite.

(Leslie P. Polzer did start on a rewrite some time back as part of the Summer of Code but there are some updatedb-related issues his changes don't resolve yet, I think)

James Youngman <jay>
Group administrator
Fri 29 Jan 2010 05:46:14 PM UTC, comment #6: 

Note that the recommended usage in the autoconf manual still tries mktemp first; it's just that it has a safe fallback that works even when mktemp is not present.


Anna
___________________
http://skylinemp3.com/

-Deleted Account- <annaanna1>
Wed 14 Jan 2009 06:21:05 AM UTC, comment #5: 
Anonymous
  Spam posted by anonymous
  Spam posted by anonymous
Sat 17 Sep 2005 10:27:06 PM UTC, comment #2: 

A minimal cygwin install is an example system.  mktemp is available on cygwin, but only as an optional install on top of the bare minimum.

Note that the recommended usage in the autoconf manual still tries mktemp first; it's just that it has a safe fallback that works even when mktemp is not present.

Eric Blake <ericb>
Group administrator
Sat 17 Sep 2005 10:11:16 PM UTC, comment #1: 

On which systems is mktemp actually missing?

James Youngman <jay>
Group administrator
Sat 03 Sep 2005 02:27:57 PM UTC, original submission:  

updatedb assumes that mktemp is on the user's PATH, which is not always the case.  http://www.gnu.org/prep/standards/standards.html#Utilities-in-Makefiles does not include mktemp as a utility that portable programs can assume.  CVS autoconf documents a more portable way to create secure temp files (actually, a secure temp directory, where you then store temp files inside):

@item @command{mktemp}
@c -------------------
@prindex @command{mktemp}
@cindex Creating temporary files
Shell scripts can use temporary files safely with @command{mktemp}, but
it does not exist on all systems.  A portable way to create a safe
temporary file name is to create a temporary directory with mode 700 and
use a file inside this directory.  Both methods prevent attackers from
gaining control, though @command{mktemp} is far less likely to fail
gratuitously under attack.

Here is sample code to create a new temporary directory safely:

@example
# Create a temporary directory $tmp in $TMPDIR (default /tmp).
# Use mktemp if possible; otherwise fall back on mkdir,
# with $RANDOM to make collisions less likely.
: $@{TMPDIR=/tmp@}
@{
  tmp=`
    (umask 077 && mktemp -d "$TMPDIR/fooXXXXXX") 2>/dev/null
  ` &&
  test -n "$tmp" && test -d "$tmp"
@} || @{
  tmp=$TMPDIR/foo$$-$RANDOM
  (umask 077 && mkdir "$tmp")
@} || exit $?
@end example


Eric Blake <ericb>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by jay (Posted a comment)
  • -email is unavailable- added by annaanna1 (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 9 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2013-02-02 jay Fixed ReleaseNone 4.5.11
        Open/ClosedOpen Closed
    2011-05-14 jay StatusPostponed Fixed
    2010-04-11 jay StatusNone Postponed
    2008-07-09 jay Attached File#16040 Removed
    2008-07-09 jay Attached File#16041 Removed
    2008-07-09 None Attached File- Added powered_php_80x15.png, #16041
    2008-07-09 None Attached File- Added get_php_80x15_2.png, #16040
    2005-09-17 jay Assigned toNone jay

    Back to the top

    Powered by Savane 3.13-cf05.
    Corresponding source code