bugfindutils - Bugs: bug #14386, updatedb relies on mktemp, which...

 
 

bug #14386: updatedb relies on mktemp, which is not portable

Submitted by:  Eric Blake <ericb>
Submitted on:  Sat Sep 3 14:27:57 2005  
 
Category: updatedbSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: James Youngman <jay>
Originator Name: Eric BlakeOpen/Closed: Closed
Release: 4.2.25Fixed Release: 4.5.11

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Sat May 14 23:39:06 2011, comment #6:

Fixed in current git.

James Youngman <jay>
Project AdministratorIn charge of this item.
Sun Apr 11 11:56:13 2010, comment #5:

updatedb would probably be best rewritten. I'm going to mark the updatedb-related bus as "Postponed" in order to consider them all in a batch, when I get around to the rewrite.

(Leslie P. Polzer did start on a rewrite some time back as part of the Summer of Code but there are some updatedb-related issues his changes don't resolve yet, I think)

James Youngman <jay>
Project AdministratorIn charge of this item.
Fri Jan 29 17:46:14 2010, comment #4:

Note that the recommended usage in the autoconf manual still tries mktemp first; it's just that it has a safe fallback that works even when mktemp is not present.

Anna
___________________
http://skylinemp3.com/

-Deleted Account- <annaanna1>
Wed Jan 14 06:21:05 2009, comment #3:

http://oszone.info

Anonymous
 Spam posted by an anonymous
 Spam posted by an anonymous
Sat Sep 17 22:27:06 2005, comment #2:

A minimal cygwin install is an example system. mktemp is available on cygwin, but only as an optional install on top of the bare minimum.

Note that the recommended usage in the autoconf manual still tries mktemp first; it's just that it has a safe fallback that works even when mktemp is not present.

Eric Blake <ericb>
Project Administrator
Sat Sep 17 22:11:16 2005, comment #1:

On which systems is mktemp actually missing?

James Youngman <jay>
Project AdministratorIn charge of this item.
Sat Sep 3 14:27:57 2005, original submission:

updatedb assumes that mktemp is on the user's PATH, which is not always the case. http://www.gnu.org/prep/standards/standards.html#Utilities-in-Makefiles does not include mktemp as a utility that portable programs can assume. CVS autoconf documents a more portable way to create secure temp files (actually, a secure temp directory, where you then store temp files inside):

@item @command{mktemp}
@c -------------------
@prindex @command{mktemp}
@cindex Creating temporary files
Shell scripts can use temporary files safely with @command{mktemp}, but
it does not exist on all systems. A portable way to create a safe
temporary file name is to create a temporary directory with mode 700 and
use a file inside this directory. Both methods prevent attackers from
gaining control, though @command{mktemp} is far less likely to fail
gratuitously under attack.

Here is sample code to create a new temporary directory safely:

@example
# Create a temporary directory $tmp in $TMPDIR (default /tmp).
# Use mktemp if possible; otherwise fall back on mkdir,
# with $RANDOM to make collisions less likely.
: $@{TMPDIR=/tmp@}
@{
tmp=`
(umask 077 && mktemp -d "$TMPDIR/fooXXXXXX") 2>/dev/null
` &&
test -n "$tmp" && test -d "$tmp"
@} || @{
tmp=$TMPDIR/foo$$-$RANDOM
(umask 077 && mkdir "$tmp")
@} || exit $?
@end example

Eric Blake <ericb>
Project Administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by jay (Posted a comment)
  • -unavailable- added by annaanna1 (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 9 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat Feb 2 14:52:26 2013jayFixed ReleaseNone=>4.5.11
      Open/ClosedOpen=>Closed
    Sat May 14 23:39:06 2011jayStatusPostponed=>Fixed
    Sun Apr 11 11:56:13 2010jayStatusNone=>Postponed
    Wed Jul 9 11:10:50 2008jayAttached File#16040=>Removed
    Wed Jul 9 11:10:41 2008jayAttached File#16041=>Removed
    Wed Jul 9 07:03:30 2008NoneAttached File-=>Added powered_php_80x15.png, #16041
    Wed Jul 9 07:02:58 2008NoneAttached File-=>Added get_php_80x15_2.png, #16040
    Sat Sep 17 22:11:16 2005jayAssigned toNone=>jay

    Back to the top


    Powered by Savane 3.1-cleanup