On Mon, Aug 10, 2015 at 01:32:54AM +0200, Jakub Wilk wrote: > * Jakub Wilk <jw...@debian.org>, 2015-06-20, 17:04: > >pbuilder builds the package in $BUILDPLACE/tmp/buildd. But $BUILDPLACE/tmp > >is normally world-writable, and pbuilder doesn't fail if the buildd > >direcory already exists: > > > > mkdir -p "$BUILDPLACE/tmp/buildd" > > > >There's a race window between unpacking base.tgz and the mkdir call when > >malicious local user could create their own $BUILDPLACE/tmp/buildd. > > As Mattia correctly noted in another mail, tmp/builddr is stored in the > tarball, so (assuming that tar unpacks it securely...) there's no race > window when you build a package.
*can* be stored in the tarball. If a user wants to use it's own tarball creation system the directory will be created at build time. -- regards, Mattia Rizzolo GPG Key: 66AE 2B4A FCCF 3F52 DA18 4D18 4B04 3FCD B944 4540 .''`. more about me: http://mapreri.org : :' : Launchpad user: https://launchpad.net/~mapreri `. `'` Debian QA page: https://qa.debian.org/developer.php?login=mattia `-
signature.asc
Description: Digital signature