Skip to Content.
Sympa Menu

sm-sorcery-bugs - [SM-Sorcery-Bugs] [Bug 14100] New: unsafe real_rm_source_dir

sm-sorcery-bugs AT lists.ibiblio.org

Subject: Bugs for Sorcery are reported here

List archive

Chronological Thread  
  • From: bugzilla-daemon AT bugs.sourcemage.org
  • To: sm-sorcery-bugs AT lists.ibiblio.org
  • Subject: [SM-Sorcery-Bugs] [Bug 14100] New: unsafe real_rm_source_dir
  • Date: 13 Nov 2007 01:49:09 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=14100

Summary: unsafe real_rm_source_dir
Product: Sorcery
Version: Untargetted future release
Platform: Other
OS/Version: other
Status: NEW
Severity: major
Priority: P2
Component: Sorcery
AssignedTo: sm-sorcery-bugs AT lists.ibiblio.org
ReportedBy: abouter AT sourcemage.org


Hi, I've been looking at libgrimoire.
Initially to see if real_mk_source_dir could use mkdir -p to ease
spellwriting.
After talking about it in #sourcemage I looked at real_rm_source_dir and got
scared by the rm -rf in there, so i wrote a test to see what happens.
See DETAILS in the attached "spell" for more info.

It turns out you can "rm -r" for almost every dir on a box by setting
SOURCE_DIRECTORY to something else than /usr/src, /usr and /
Think about /boot or /sbin.

It might be a very good idea to check SOURCE_DIRECTORY for ^/usr/src before
the
rm. It's quite possible to slip a spell into git which doesn't use
BUILD_DIRECTIRY/<something>. some spells like this are already in the
grimoire.
A list of spells is included in the tarball.

I do know that one can put a rm -rf / into a spell, but that's more likely to
get spotted than a dangerous SOURCE_DIRECTORY i guess.

Or is this just me being paranoid?

--
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.



  • [SM-Sorcery-Bugs] [Bug 14100] New: unsafe real_rm_source_dir, bugzilla-daemon, 11/12/2007

Archive powered by MHonArc 2.6.24.

Top of Page