On Tue, 6 Mar 2012 22:05:31 +0100 Gian Piero Carrubba wrote: > Package: apt-listbugs > Version: 0.1.6 > Severity: normal > Tags: patch
Hi Gian Piero,
thanks for your bug report! :-)
>
> Running aptitude (and consequently apt-listbug) via sudo, I'm not able
> to display the bugs list in a browser:
>
> ====
> Are you sure you want to install/upgrade the above packages? [Y/n/?/...] w
> bash: /dev/tty: No such device or address
> W: Failed to invoke browser.
> su gpiero -c "/usr/bin/sensible-browser /tmp/apt-listbugs27667.0.html <
> /dev/tty"
> ====
>
> Not sure when this bug has been introduced: it could be a while it
> doesn't work for me, but this hunk of code seems to be here since ages
> ago and I'm pretty sure I used it in the last years. I can only guess
> su's behaviour has changed in the meantime.
I am in a hurry now and I still have to try and reproduce the issue
(something that I hope to do soon), but, from a first casual glance, it
seems that this may be due to the fix for the security bug #628843.
Message #20 seems to say that the fix removes from the
child process the ability to open "/dev/tty".
And the vulnerability (which seems to be CVE-2005-4890, if I understand
correctly) seems to have been fixed in unstable by version 1:4.1.5-1 of
binary package login on 12 Feb 2012.
Mmmh, I think I should read the whole #628843 bug log...
>
> Please consider applying the following patch or a similar one in order
> to not include the shell redirection inside the command launched via su.
>
> ====
> --- old-apt-listbugs-0.1.6/lib/apt-listbugs/logic.rb 2012-03-06
> 21:56:13.735125556 +0100
> +++ new-apt-listbugs-0.1.6/lib/apt-listbugs/logic.rb 2012-03-06
> 21:56:14.099128219 +0100
> @@ -620,10 +620,9 @@
> tmp.close
>
> puts "Invoking browser for #{tmp.path}" if $DEBUG
> - browsercommandline = ""
> - browsercommandline << "su #{ENV["SUDO_USER"]} -c \"" if
> ENV["SUDO_USER"]
> - browsercommandline << "#{@config.browser} #{tmp.path} < /dev/tty"
> - browsercommandline << "\"" if ENV["SUDO_USER"]
> + browsercommandline = "#{@config.browser} #{tmp.path}"
> + browsercommandline = "su #{ENV["SUDO_USER"]} -c \"" +
> browsercommandline + "\"" if ENV["SUDO_USER"]
> + browsercommandline << " < /dev/tty"
> if system(browsercommandline)
> puts "successfully invoked browser" if $DEBUG
> else
> ====
Thanks for providing a patch: if I understand correctly, you are
proposing to move the "< /dev/tty" out of the -c argument, so that it
applies to su, rather than to the browser command-line.
I am not sure why you reformatted the browsercommandline building steps
so much, but anyway...
I'll try to reproduce the issue and test whether your proposed solution
works properly.
Please stay tuned, I hope to get back to you soon.
Bye and thanks.
--
http://www.inventati.org/frx/frx-gpg-key-transition-2010.txt
New GnuPG key, see the transition document!
..................................................... Francesco Poli .
GnuPG key fpr == CA01 1147 9CD2 EFDF FB82 3925 3E1C 27E1 1F69 BFFE
pgp5ZrQZkvIDv.pgp
Description: PGP signature
