bugfindutils - Bugs: bug #14386, updatedb relies on mktemp, which...

 
 

bug #14386: updatedb relies on mktemp, which is not portable

Submitted by:  Eric Blake <ericb>
Submitted on:  Sat 03 Sep 2005 02:27:57 PM UTC  
 
Category: updatedbSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: James Youngman <jay>
Originator Name: Eric BlakeOpen/Closed: Closed
Release: 4.2.25Fixed Release: 4.5.11

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Sat 14 May 2011 11:39:06 PM UTC, comment #6:

Fixed in current git.

James Youngman <jay>
Project AdministratorIn charge of this item.
Sun 11 Apr 2010 11:56:13 AM UTC, comment #5:

updatedb would probably be best rewritten. I'm going to mark the updatedb-related bus as "Postponed" in order to consider them all in a batch, when I get around to the rewrite.

(Leslie P. Polzer did start on a rewrite some time back as part of the Summer of Code but there are some updatedb-related issues his changes don't resolve yet, I think)

James Youngman <jay>
Project AdministratorIn charge of this item.
Fri 29 Jan 2010 05:46:14 PM UTC, comment #4:

Note that the recommended usage in the autoconf manual still tries mktemp first; it's just that it has a safe fallback that works even when mktemp is not present.

Anna
___________________
http://skylinemp3.com/

-Deleted Account- <annaanna1>
Wed 14 Jan 2009 06:21:05 AM UTC, comment #3:

http://oszone.info

Anonymous
 Spam posted by an anonymous
 Spam posted by an anonymous
Sat 17 Sep 2005 10:27:06 PM UTC, comment #2:

A minimal cygwin install is an example system. mktemp is available on cygwin, but only as an optional install on top of the bare minimum.

Note that the recommended usage in the autoconf manual still tries mktemp first; it's just that it has a safe fallback that works even when mktemp is not present.

Eric Blake <ericb>
Project Administrator
Sat 17 Sep 2005 10:11:16 PM UTC, comment #1:

On which systems is mktemp actually missing?

James Youngman <jay>
Project AdministratorIn charge of this item.
Sat 03 Sep 2005 02:27:57 PM UTC, original submission:

updatedb assumes that mktemp is on the user's PATH, which is not always the case. http://www.gnu.org/prep/standards/standards.html#Utilities-in-Makefiles does not include mktemp as a utility that portable programs can assume. CVS autoconf documents a more portable way to create secure temp files (actually, a secure temp directory, where you then store temp files inside):

@item @command{mktemp}
@c -------------------
@prindex @command{mktemp}
@cindex Creating temporary files
Shell scripts can use temporary files safely with @command{mktemp}, but
it does not exist on all systems. A portable way to create a safe
temporary file name is to create a temporary directory with mode 700 and
use a file inside this directory. Both methods prevent attackers from
gaining control, though @command{mktemp} is far less likely to fail
gratuitously under attack.

Here is sample code to create a new temporary directory safely:

@example
# Create a temporary directory $tmp in $TMPDIR (default /tmp).
# Use mktemp if possible; otherwise fall back on mkdir,
# with $RANDOM to make collisions less likely.
: $@{TMPDIR=/tmp@}
@{
tmp=`
(umask 077 && mktemp -d "$TMPDIR/fooXXXXXX") 2>/dev/null
` &&
test -n "$tmp" && test -d "$tmp"
@} || @{
tmp=$TMPDIR/foo$$-$RANDOM
(umask 077 && mkdir "$tmp")
@} || exit $?
@end example

Eric Blake <ericb>
Project Administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by jay (Posted a comment)
  • -unavailable- added by annaanna1 (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 9 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 02 Feb 2013 02:52:26 PM UTCjayFixed ReleaseNone=>4.5.11
      Open/ClosedOpen=>Closed
    Sat 14 May 2011 11:39:06 PM UTCjayStatusPostponed=>Fixed
    Sun 11 Apr 2010 11:56:13 AM UTCjayStatusNone=>Postponed
    Wed 09 Jul 2008 11:10:50 AM UTCjayAttached File#16040=>Removed
    Wed 09 Jul 2008 11:10:41 AM UTCjayAttached File#16041=>Removed
    Wed 09 Jul 2008 07:03:30 AM UTCNoneAttached File-=>Added powered_php_80x15.png, #16041
    Wed 09 Jul 2008 07:02:58 AM UTCNoneAttached File-=>Added get_php_80x15_2.png, #16040
    Sat 17 Sep 2005 10:11:16 PM UTCjayAssigned toNone=>jay

    Back to the top


    Powered by Savane 3.1-cleanup