It looks like this bug was introduced with the save_wd stuff in commit
b67faf329cebf0805b2b73cc775ccfc7a05390de. I don't have an easily
available version from then to test, though.
-- 8< --
* src/install.c (mkancesdirs_safe_wd): Save the current working
directory when using 'strip' on files.
* tests/install/strip-program.sh: Add two test cases.
* NEWS: Mention the bug fix.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-CBHGSM1T.
---
NEWS | 8 ++++++++
src/install.c | 9 +++++++--
tests/install/strip-program.sh | 32 +++++++++++++++++++++++++++++++-
3 files changed, 46 insertions(+), 3 deletions(-)
diff --git a/NEWS b/NEWS
index ae5c8e32a..14b1206dc 100644
--- a/NEWS
+++ b/NEWS
@@ -95,6 +95,14 @@ GNU coreutils NEWS -*-
outline -*-
before invoking 'strip' instead of using a umask of zero.
[This bug was present in "the beginning".]
+ 'install -D --strip' runs the strip program from the current working
directory
+ when the source and destination are absolute paths. Previously, it would run
+ the strip program from the parent directory of the destination file, which
+ could lead to executing the incorrect program if the PATH environment
variable
+ was set to an empty string or a relative file name was given to the
+ --strip-program option.
+ [bug introduced in coreutils-6.2]
+
'ls' no longer omits ACL indicators or capability coloring for subsequent
files on the same file system after an unsupported security context
lookup on a file without an ACL.
diff --git a/src/install.c b/src/install.c
index ffe2aee27..13621574c 100644
--- a/src/install.c
+++ b/src/install.c
@@ -762,9 +762,14 @@ static bool
mkancesdirs_safe_wd (char const *from, char *to, struct cp_options *x,
bool save_always)
{
+ /* Check whether we have to save the current working directory.
+ When using --strip, we must save the current working directory
+ since STRIP_PROGRAM may be relative or $PATH may be set to an
+ empty string, meaning STRIP_PROGRAM may be found and executed
+ in the current working directory. */
bool save_working_directory =
- save_always
- || ! (IS_ABSOLUTE_FILE_NAME (from) && IS_ABSOLUTE_FILE_NAME (to));
+ (save_always || strip_files
+ || ! (IS_ABSOLUTE_FILE_NAME (from) && IS_ABSOLUTE_FILE_NAME (to)));
struct savewd wd;
savewd_init (&wd);
diff --git a/tests/install/strip-program.sh b/tests/install/strip-program.sh
index e25c8399c..7eadeb134 100755
--- a/tests/install/strip-program.sh
+++ b/tests/install/strip-program.sh
@@ -23,7 +23,7 @@ working_umask_or_skip_
cat <<EOF > b || framework_failure_
#!$SHELL
-sed s/b/B/ \$1 > \$1.t && mv \$1.t \$1
+sed s/b/B/ "\$1" > "\$1".t && mv "\$1".t "\$1"
EOF
chmod a+x b || framework_failure_
@@ -32,6 +32,36 @@ echo aBc > exp || framework_failure_
ginstall src dest -s --strip-program=./b || fail=1
compare exp dest || fail=1
+# Test that a relative program name isn't executed from the incorrect
directory.
+mkdir -p d &&
+cwd="$(pwd)" || framework_failure_
+ginstall -D -s --strip-program=./b "$cwd"/src "$cwd"/d/dest >out 2>err \
+ || fail=1
+compare exp d/dest || fail=1
+compare /dev/null out || fail=1
+compare /dev/null err || fail=1
+
+# If the platform searches for programs in the current working directory when
+# $PATH is an empty string, make sure this is the case for --strip-program
+# as well.
+ginstall=$(cmd_exe ginstall) &&
+sed=$(cmd_exe sed) &&
+mv=$(cmd_exe mv) &&
+cat <<EOF >abs-b &&
+#!$SHELL
+"$sed" s/b/B/ "\$1" > "\$1".t && "$mv" "\$1".t "\$1"
+EOF
+chmod a+x abs-b &&
+cp src empty-path-test || framework_failure_
+if env PATH= abs-b empty-path-test && compare exp empty-path-test; then
+ env PATH= "$ginstall" -D -s --strip-program=abs-b "$cwd"/src "$cwd"/d/dest \
+ >out 2>err || fail=1
+ compare exp d/dest || fail=1
+ compare /dev/null out || fail=1
+ compare /dev/null err || fail=1
+fi
+rm -f empty-path-test || framework_failure_
+
cat <<EOF >getumask || framework_failure_
#!$SHELL
umask > \$1
--
2.56.0
