Bug#1120931: creates temporary file in /

[Patrick Cernko]

Package: cxref
Version: 1.6e-9
Severity: minor




I suggest to fix the mktemp call in line 8 of the postinst to
CF=$(mktemp -p /tmp cxref.XXXXXXXX)
and continue relying on systemd-tempfiles for cleaning up on next boot.

-- System Information:
Debian Release: 13.2
  APT prefers stable-security
  APT policy: (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 6.16.12.1.amd64-smp (SMP w/4 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, 
TAINT_UNSIGNED_MODULE
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages cxref depends on:
ii  debconf [debconf-2.0]  1.5.91
ii  gcc                    4:14.2.0-1
ii  libc6                  2.41-12
ii  ucf                    3.0052

cxref recommends no packages.

Versions of packages cxref suggests:
pn  cxref-doc           <none>
ii  lynx [www-browser]  2.9.2-1
pn  texlive-binaries    <none>
ii  w3m [www-browser]   0.5.3+git20230121-2.1

-- debconf information:
* cxref/cxref-cpp-autoconf: true
--
Patrick Cernko <pcer...@mpi-klsb.mpg.de> +49 681 9325 5815
Joint Scientific IT and Technical Service
Max-Planck-Institute für Informatik & Softwaresysteme

During package installation, an empty file /cxref.XXXXXXXXXX is created by mktemp call in postinst. Later in the same postinst script, the basename of the file is used to create a temporary file in /tmp/. Neither of them are removed at the end of postinst, however the file in /tmp/ is removed on reboot by system-tmpfiles.

smime.p7s
Description: S/MIME Cryptographic Signature