bugfindutils - Bugs: bug #14386, updatedb relies on mktemp, which...

 
 
Show feedback again

bug #14386: updatedb relies on mktemp, which is not portable

Submitted by:  Eric Blake <ericb>
Submitted on:  Sat 03 Sep 2005 02:27:57 PM UTC  
 
Category: updatedbSeverity: 3 - Normal
Item Group: NoneStatus: None
Privacy: PublicAssigned to: James Youngman <jay>
Originator Name: Eric BlakeOpen/Closed: Open
Release: 4.2.25Fixed Release: None

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 14 Jan 2009 06:21:05 AM UTC, comment #3:

http://oszone.info

Anonymous
 Spam posted by an anonymous
 Spam posted by an anonymous
Sat 17 Sep 2005 10:27:06 PM UTC, comment #2:

A minimal cygwin install is an example system. mktemp is available on cygwin, but only as an optional install on top of the bare minimum.

Note that the recommended usage in the autoconf manual still tries mktemp first; it's just that it has a safe fallback that works even when mktemp is not present.

Eric Blake <ericb>
Project Administrator
Sat 17 Sep 2005 10:11:16 PM UTC, comment #1:

On which systems is mktemp actually missing?

James Youngman <jay>
Project AdministratorIn charge of this item.
Sat 03 Sep 2005 02:27:57 PM UTC, original submission:

updatedb assumes that mktemp is on the user's PATH, which is not always the case. http://www.gnu.org/prep/standards/standards.html#Utilities-in-Makefiles does not include mktemp as a utility that portable programs can assume. CVS autoconf documents a more portable way to create secure temp files (actually, a secure temp directory, where you then store temp files inside):

@item @command{mktemp}
@c -------------------
@prindex @command{mktemp}
@cindex Creating temporary files
Shell scripts can use temporary files safely with @command{mktemp}, but
it does not exist on all systems. A portable way to create a safe
temporary file name is to create a temporary directory with mode 700 and
use a file inside this directory. Both methods prevent attackers from
gaining control, though @command{mktemp} is far less likely to fail
gratuitously under attack.

Here is sample code to create a new temporary directory safely:

@example
# Create a temporary directory $tmp in $TMPDIR (default /tmp).
# Use mktemp if possible; otherwise fall back on mkdir,
# with $RANDOM to make collisions less likely.
: $@{TMPDIR=/tmp@}
@{
tmp=`
(umask 077 && mktemp -d "$TMPDIR/fooXXXXXX") 2>/dev/null
` &&
test -n "$tmp" && test -d "$tmp"
@} || @{
tmp=$TMPDIR/foo$$-$RANDOM
(umask 077 && mkdir "$tmp")
@} || exit $?
@end example

Eric Blake <ericb>
Project Administrator

 

(Note: upload size limit is set to 512 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter 421 here (basic anti-spam test):

 

 

Follow 5 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Wed 09 Jul 2008 11:10:50 AM UTCjayAttached File#16040=>Removed
Wed 09 Jul 2008 11:10:41 AM UTCjayAttached File#16041=>Removed
Wed 09 Jul 2008 07:03:30 AM UTCNoneAttached File-=>Added powered_php_80x15.png, #16041
Wed 09 Jul 2008 07:02:58 AM UTCNoneAttached File-=>Added get_php_80x15_2.png, #16040
Sat 17 Sep 2005 10:11:16 PM UTCjayAssigned toNone=>jay
Show feedback again

Back to the top


Powered by Savane 3.1-cleanup