Bugs for Sorcery are reported here

[bugzilla-daemon AT bugs.sourcemage.org]

http://bugs.sourcemage.org/show_bug.cgi?id=14100

           Summary: unsafe real_rm_source_dir
           Product: Sorcery
           Version: Untargetted future release
          Platform: Other
        OS/Version: other
            Status: NEW
          Severity: major
          Priority: P2
         Component: Sorcery
        AssignedTo: sm-sorcery-bugs AT lists.ibiblio.org
        ReportedBy: abouter AT sourcemage.org


Hi, I've been looking at libgrimoire.
Initially to see if real_mk_source_dir could use mkdir -p to ease 
spellwriting.
After talking about it in #sourcemage I looked at real_rm_source_dir and got
scared by the rm -rf in there, so i wrote a test to see what happens.
See DETAILS in the attached "spell" for more info.

It turns out you can "rm -r" for almost every dir on a box by setting
SOURCE_DIRECTORY to something else than /usr/src, /usr and /
Think about /boot or /sbin.

It might be a very good idea to check SOURCE_DIRECTORY for ^/usr/src before 
the
rm. It's quite possible to slip a spell into git which doesn't use
BUILD_DIRECTIRY/<something>. some spells like this are already in the 
grimoire.
A list of spells is included in the tarball.

I do know that one can put a rm -rf / into a spell, but that's more likely to
get spotted than a dangerous SOURCE_DIRECTORY i guess.

Or is this just me being paranoid?

-- 
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.