bugGNU nano - Bugs: bug #58439, using 'allow_insecure_backup' in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #58439: using 'allow_insecure_backup' in unwritable directory mangles existing backup

Submitter:  Benno Schulenberg <bens>
Submitted:  Sun 24 May 2020 05:23:43 PM UTC
   
 
Severity:  3 - Normal Status:  Fixed
Assigned to:  bens Open/Closed:  Closed

Mon 25 May 2020 10:33:34 AM UTC, comment #2: 

Fixed in git, commit b3052246, by using O_TRUNC instead of O_APPEND.

Benno Schulenberg <bens>
Group administrator
Mon 25 May 2020 08:00:58 AM UTC, comment #1: 

Of course, it's not necessary to use ACLs to obtain the same effect.  Simply having a writable file plus backup file in an unwritable directory is enough to reproduce the bug:

mkdir tub
touch tub/bar~ tub/bar
sudo chown root:root tub
sudo chmod go-w tub
echo aaa >tub/bar~
echo bbb >tub/bar

Now run 'src/nano -B tub/bar', and type: ccc ^S ^X
Then do 'cat tub/bar~' and see that it does not contain just "bbb", as it should, but two lines: "aaa" and "bbb".

Benno Schulenberg <bens>
Group administrator
Sun 24 May 2020 05:23:43 PM UTC, original submission:  

To reproduce, put 'set allow_insecure_backup' in your ~/.nanorc file, and run (replacing 'yourusername' with your actual user name):

sudo mkdir box
sudo touch box/foo~ box/foo
sudo setfacl -m u:yourusername:rw  box/foo~ box/foo
echo 000 >box/foo~
echo 111 >box/foo
cat box/foo~
cat box/foo

Verify that 'foo~' and 'foo' indeed contain "000" and "111".

Now run 'src/nano -B box/foo', and type: 222 ^S ^X.

Again do 'cat box/foo~', and see that the backup file now consists of two lines, the first with "000" and the second with "111".  Wrong!  When unlinking the existing foo~ file failed (because the box directory is owned by root and not writable by a normal user), the existing file was opened in append mode (because of O_APPEND).  This is silly -- we never want to append to a backup file, we want to overwrite it.

Benno Schulenberg <bens>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-07-30 bens Open/ClosedOpen Closed
    2020-05-25 bens StatusNone Fixed
    2020-05-25 bens Summaryusing 'allow_insecure_backup' in unwritable directory can create bad backups using 'allow_insecure_backup' in unwritable directory mangles existing backup
    2020-05-25 bens Summaryusing 'allow_insecure_backup' on files with ACLs can create bad backups using 'allow_insecure_backup' in unwritable directory can create bad backups
    2020-05-24 bens Summaryusing 'allow_insecure_backups' on files with ACLs can create bad backups using 'allow_insecure_backup' on files with ACLs can create bad backups

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code