Package: kppp
Version: 4.8.4-1
Severity: important
Looking at the kdenetwork 4.8.4-1 source code I see the following code
snippets in kppp/connect.cpp starting at line 1419:
// Replace the DNS domain entry in the /etc/resolv.conf file and
// disable the nameserver entries if option is enabled
void add_domain(const QString &domain) {
// adds the DNS entries in the /etc/resolv.conf file
void adddns()
{
// remove the dns entries from the /etc/resolv.conf file
void removedns() {
The code inside the functions writes directly to /etc/resolv.conf. Nowhere
is there a check for the presence of /sbin/resolvconf.
When /sbin/resolvconf is present and executable it is not permitted to
write directly to /etc/resolv.conf. Programs that want to make changes to
resolv.conf must interface with /sbin/resolvconf which takes care of adding
material to and removing material from resolv.conf. Please see
/usr/share/doc/resolvconf/README.gz for more instructions.
It looks as if kppp writes to /etc/resolv.conf and does not mv
/etc/resolv.conf. So if /etc/resolv.conf is a symbolic link, as is normally
the case when resolvconf is installed, then kppp will write through the
link to /run/resolvconf/resolv.conf. Then the next time resolvconf updates
this file, kppp's changes will be obliterated.
I haven't tested kppp so I don't know whether the code in question is
actually executed.
