Your message dated Tue, 28 Apr 2015 23:48:54 +0000
with message-id <[email protected]>
and subject line Bug#689202: fixed in debsums 2.1
has caused the Debian Bug report #689202,
regarding debsums: --root option escapes the alternate root and looks in the
host system if paths in the alternate root contain absolute symlinks to
directories
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
689202: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=689202
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: debsums
Version: 2.0.52
Severity: important
Hi,
while analyzing two dubious piuparts errors involving debsums, I noticed
that debsums reports incorrectly some missing files. It works fine if I
install debsums in the chroot and run it from there - but it fails if I
run it from the outside with the --root option.
One package in question is drupal6-trans-ru which ships the file
/usr/share/drupal6/profiles/default/translations/ru.po, but the drupal
package (which was installed first) contains a
/usr/share/drupal6/profiles -> /etc/drupal/6/profiles symlink, so the
file actually ended up as
/etc/drupal/6/profiles/default/translations/ru.po
(This is a bad thing, but that's not the point in this bug report.)
debsums report nothing inside the chroot:
(pbuild7199)root@host:/# debsums -ac
but running debsums from the outside of the chroot:
$ sudo debsums -ac --root /tmp/pbuilder/build/7199/
debsums: missing file
/tmp/pbuilder/build/7199//usr/share/drupal6/profiles/default/translations/ru.po
(from drupal6-trans-ru package)
and if I create /etc/drupal/6/profiles/default/translations/ru.po on the
host system with some random content, I get a md5sum mismatch:
$ sudo debsums -ac --root /tmp/pbuilder/build/7199/
/tmp/pbuilder/build/7199//usr/share/drupal6/profiles/default/translations/ru.po
I don't know if one can manage to replace binaries in the chroot and
then create a symlink hierarchy so that debsums run from the outside
(probably with a secure, untamperable copy of the admindir given to
the --admindir option) would not notice this modification as it would
check a safe file from the host instead ...
If this is possible, severity should be raised as this is a possible
security issue.
I didn't try it, but you can probably escape via a long chain of
../../../../.. ..., too.
Andreas
--- End Message ---
--- Begin Message ---
Source: debsums
Source-Version: 2.1
We believe that the bug you reported is fixed in the latest version of
debsums, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Axel Beckert <[email protected]> (supplier of updated debsums package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Wed, 29 Apr 2015 00:04:17 +0200
Source: debsums
Binary: debsums
Architecture: source all
Version: 2.1
Distribution: unstable
Urgency: low
Maintainer: Debian Perl Group <[email protected]>
Changed-By: Axel Beckert <[email protected]>
Description:
debsums - tool for verification of installed package files against MD5 chec
Closes: 577197 689202 711560 737240 779626
Changes:
debsums (2.1) unstable; urgency=low
.
[ Axel Beckert ]
* Apply wrap-and-sort.
* Add a (yet incomplete) test suite
+ Add "Testsuite: autopkgtest-pkg-perl" header to debian/control.
+ Add build-dependency on libtest-command-simple-perl and
libfile-fnmatch-perl.
+ Add a debian/README.source briefly describing how the test suite is
being used.
* debian/control (non-test-suite-related changes):
+ Declare compliance with Debian Policy 3.9.6 (no further changes)
+ Add ${perl:Depends} to Depends. Fixes dpkg-gencontrol warning.
* debian/copyright + debian/lintian-overrides:
+ Update copyright years.
+ Add myself.
+ Convert to machine-readable DEP5 format.
+ Add lintian override for copyright-refers-to-symlink-license.
* debian/rules + Makefile:
+ Simplify by moving cp, rm and dh_installdocs parameters to
debian/{install,clean,docs}.
+ Remove now obsolete chmod call.
+ Drop variable usage for values only used once.
+ Move most overridden stuff from debian/rules to Makefile.
+ Drop option --rm-backups from po4a calls, it's a no-op since 0.41
- Add according version requirement to the po4a build-dependency
* debsums:
+ Warn if found md5sums file is empty but shouldn't. (Closes: #577197)
+ Broaden character set which is considered a valid version number.
(Closes: #779626)
+ Simplify parsing of dpkg-{parsechangelog,query} output by using more
specific options, allowing to drop the calls to grep and cut.
+ Use "use warnings;" instead of "perl -w".
+ Remove superfluous parentheses in foreach loop.
+ Remove obsolete CVS keywords.
+ Quote HERE document delimiters to ease syntax highlighting and
please perlcritic.
+ Whitespace cleanup, wrapping long lines.
+ Improve code readability by using consistent spacing and indentation.
* man/debsums.1 + man/po/*.po:
+ Remove mentioning of /etc/apt/apt.conf.d/90debsums (Closes: #737240)
+ Remove obsolete CVS keywords.
+ Replace "the file's md5sum" with "the file's MD5 sum".
* man/po/de.po: Don't translate fixed terms from debsums' API.
* man/po/debsums.pot: Replace dummy boilerplate text.
* rdebsums:
+ Whitespace cleanup.
+ Exit with highest exit code of any of its child debsums processes
exited. (Closes: #711560)
* messages.po: Was generated, removed from Git and source package.
* Fix typo in URL in previous changelog entry.
.
[ Andreas Beckmann ]
* Fix accessing files in the host root filesystem (/) while checking an
alternate --root and following absolute symlinks. (Closes: #689202)
Manually resolve symlinks without escaping the --root directory and open
the resolved path instead of the original one.
Checksums-Sha1:
6db5bceb5b6c4ee18b072f4817b01e8ebcd72567 1752 debsums_2.1.dsc
de0875999be5a5ae7b14d91cac8bc36e5a7d138e 48524 debsums_2.1.tar.xz
7338b3e9afc2b5f25d7270a4ee7c405d412a0d8f 48374 debsums_2.1_all.deb
Checksums-Sha256:
1dc7cd0b1fb0e7c5d583445c2b2b212d44ef0709e2c4e17e7e0d929eef651f51 1752
debsums_2.1.dsc
c34ff5fd61703c383e5c3a70002c741fd47e5b49154d0164f09e18c11a5148c2 48524
debsums_2.1.tar.xz
1003ea4a49a42d93659d49a2b29cdec6ec30dd3103113dc79d9ec047bb7e9250 48374
debsums_2.1_all.deb
Files:
3b0cbe704cadc46b5c5a6ea606a8915d 1752 admin optional debsums_2.1.dsc
1f20aabe355cd341d199810d7565235a 48524 admin optional debsums_2.1.tar.xz
7293c9f0ec6a480d955a58bfcc1b987a 48374 admin optional debsums_2.1_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJVQAVqAAoJEGvmY8daNcl1KMwP/1+ti4rXorxDjAHMB6NaHbGi
nWs8cQL9y6VBr0meWPNCkevxIjtcEtzhyCYHcDYbcOcDfiYWOZCp5rHe3Yy89b26
ngRGYIXl8mRr2lHKt+P1jNkCvxoUdJTdikljnowCMioYUnlmfHa81ssQpk88xTpw
0PNnlgVNgJfH/M/Wk/HCX5ij2GtRUnjBkBGGAVtGoYn526rbUMVWsejsdGIGi7HW
MgPH6Vk1gu9jogwMLSqAXnmambhOn6O0+KtG3cRXFtdr/f8t4gEhK93aqL1PcOJH
+Cncah+EyN4lbkt8U4zyVeCE5TW832ebJTgLnVwwiEh7q5TrU+Pkl6zA4/MZmlSx
1YayObGhCboPWHQbZ7BA0xK4J9PdfaV8bIeiVsbowhKK1GkJk7NOMGHasc0sTeJ2
3vXgao7P7iy04R0laNyZvVfkiM+z3PeOSFerU6kG2j67UinjCbx88S7sRFnhR4Wi
9Hjz5f2zL7+XyF8rfGEr0p3JTvn2Xk2qiybK2pkQPn1F3QZnOkWxk/n/I30Tv9Qv
jiI2tefd/3VhPvo2Pl02yf2u4iRhmFx5Kh1pvqJz2BU4rgFicF8Y94ZPZjEiD9wP
9d6uuAPKhr8o7fKvx0upuabaiS4KfKUKo4+HJGmsl2PpQWEJ6EheSOw7ikLegTPa
gnN7mBEiel8jH/dBij1R
=/wMD
-----END PGP SIGNATURE-----
--- End Message ---
