bugfindutils - Bugs: bug #20951, Very bad/unclear/confusing...

 
 

bug #20951: Very bad/unclear/confusing documentation for a security note of find's -execdir option

Submitter:  None
Submitted:  Sat 01 Sep 2007 11:55:14 AM UTC
   
 
Category:  documentation Severity:  2 - Minor
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  jay
Originator Name:  Hamidreza Mz Originator Email:  -email is unavailable-
Open/Closed:  Closed Release:  4.2.27
Fixed Release:  4.3.9
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 10 Nov 2007 04:12:48 PM UTC, comment #3: 

To learn how to apply a patch, read the manual page for "patch".  Briefly, asve the patch in a file with any name, change working directory to the top of the findutils source tree, and then run "patch < your-file-name".

James Youngman <jay>
Group administrator
Thu 25 Oct 2007 01:48:26 PM UTC, comment #2: 

Thanks a lot for patch. Excellent rich explanations! very good job is done.
But can you tell me how to patch? Please mention the command line.
I tried, but get some errors and document didnt get patched.

Hamidreza Mz <fs_lover>
Sat 01 Sep 2007 03:17:38 PM UTC, comment #1: 

I had written "current directory" because having an empty element or a leading/trailing colon in $PATH has the same effect as ".".  This being the case, I hadn't wanted to write "."

I now realise that the effect is less clear than I had hoped.  I will think about how to make this clearer.

James Youngman <jay>
Group administrator
Sat 01 Sep 2007 11:55:14 AM UTC, original submission:  

from `find' info manual:
If you use``-execdir', you must ensure that the current directory is not on $PATH, because otherwise an attacker could make `find' run commands of their choice simply by leaving a suitably-named file in the right directory. GNU find will refuse to run if you use `-execdir' and the current directory is in $PATH.


man:
If you use this option, you must ensure that your $PATH environment variable does not reference the current directory; otherwise, an attacker can run any commands they like by leaving an appropriately-named file in a directory in which you will run -execdir.

Finally I searched the web to understand the meaning of these sentences.

I found this:
http://www.gnu.org/software/findutils/manual/html_node/find_html/Race-Conditions-with-_002dexec.html#Race-Conditions-with-_002dexec
that says:
The -execdir action refuses to do anything if the current directory is included in the $PATH environment variable. This is necessary because -execdir runs programs in the same directory in which it finds files – in general, such a directory might be writable by untrusted users. For similar reasons, -execdir does not allow {} to appear in the name of the command to be run.

but I couldnt understand their meaning! becuase I couldnt even find an answering test case for it to ensure of the situation  that caused that behavior and its mechanism... I tested it many times in many fashions and by several presumptions...

an instance of my tests:
[root@localhost ~]# echo $PATH
/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin:/root/bin
[root@localhost ~]# cd /bin
[root@localhost bin]# find . -name cp -execdir pwd ';'
/bin
[root@localhost bin]#


eventually I started a topic for it in a GNU/Linux (with a BSD section too) dedicated forum and requested help .
I am Persian and that forum too; but codes inserted are in english!!
You can see that almost short discussion here if you want: http://www.technotux.org/html/index.php?name=PNphpBB2&file=viewtopic&p=96442#96442


thanks to my friends finally we recognize that what problem was what that confuses we.
We recognize also that it is obviously a fault in documentations that would probably confuse most of the people that read it.
problem was that documents didnt indicate clearly what was their meaning of the current directory (read this: you must ensure that the current directory is not on $PATH). there are several probable assumptions for this: directory that find is revoked from there; cwd for commands executed by -execdir that is the directory that `find' finds target file(s) there; and finally  much far assumption (I think for many people) as my friends said/named the `dynamic current directory' (dot! - .) that is reasonably weird to see in $PATH (at least for persons like we that have not seen such a manner to this time).
when you say cwd, persons think of that we thought at first. this is the most/vary expected assumption. does you understand? oh I am a little verbose!! (at least my rivals say that ;D)

you could and now should address this fault in your documentations as soon as possible. please!! :D
I think that`s very easy to fulfil!
even by adding three characters `(.)' somewhere appropriate; although more explanation seems to be proper.

anyway the letter is ending :(
thanks for you all lovely free software mans (and women!).
we knows you! we thank you for all things you bring to our community and humanity.
we utilize all of your produced tools and knowledge everyday.


Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by fs_lover (Posted a comment)
  • -email is unavailable- added by jay (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2007-11-11 jay Open/ClosedOpen Closed
        Fixed ReleaseNone 4.3.9
    2007-11-10 jay StatusNone Fixed
    2007-09-08 jay SummaryVery bad/unclear/confusing documentationing for a security note of find\'s -execdir option Very bad/unclear/confusing documentation for a security note of find's -execdir option
    2007-09-08 jay Assigned toNone jay
    2007-09-08 jay Attached File- Added 0001-Bug-20951-better-explanation-of-indecure-PATH.patch, #13896
    2007-09-01 jay Severity3 - Normal 2 - Minor

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code