Bug#923478: [Pkg-shadow-devel] Bug#923478: initscripts use unsafe `: >` shell command to create files

2019-04-28 Thread Chris Hofstaedtler
* Dmitry Bogatov [190429 01:14]: > [2019-04-26 13:17] Chris Hofstaedtler > > > According my experiments, it will. Even if I remove this code, something > > > (login/getty, maybe?) still creates /var/run/utmp, root:root. > > > > Which init was used in your experiments? > > sysvinit-core.

Bug#923478: [Pkg-shadow-devel] Bug#923478: initscripts use unsafe `: >` shell command to create files

2019-04-28 Thread Dmitry Bogatov
[2019-04-26 13:17] Chris Hofstaedtler > > According my experiments, it will. Even if I remove this code, something > > (login/getty, maybe?) still creates /var/run/utmp, root:root. > > Which init was used in your experiments? sysvinit-core. > If it was systemd or anything else honoring

Bug#923478: [Pkg-shadow-devel] Bug#923478: initscripts use unsafe `: >` shell command to create files

2019-04-26 Thread Chris Hofstaedtler
* Dmitry Bogatov [190425 16:13]: > [2019-04-22 09:18] "Serge E. Hallyn" > > > [ Dmitry Bogatov ] > > > Dear login maintainers, currently we have following core executed during > > > boot: > > > > > > # Create /var/run/utmp so we can login. > > > true > /var/run/utmp > > > if grep -q

Bug#923478: [Pkg-shadow-devel] Bug#923478: initscripts use unsafe `: >` shell command to create files

2019-04-25 Thread Dmitry Bogatov
[2019-04-22 09:18] "Serge E. Hallyn" > > [ Dmitry Bogatov ] > > Dear login maintainers, currently we have following core executed during > > boot: > > > > # Create /var/run/utmp so we can login. > > true > /var/run/utmp > > if grep -q ^utmp: /etc/group > > then > >

Bug#923478: [Pkg-shadow-devel] Bug#923478: initscripts use unsafe `: >` shell command to create files

2019-04-22 Thread Serge E. Hallyn
On Tue, Apr 16, 2019 at 10:44:21PM +, Dmitry Bogatov wrote: > > [2019-04-14 13:35] Cristian Ionescu-Idbohrn > > > On Sun, 14 Apr 2019, Dmitry Bogatov wrote: > > > > > > Definitely. But default one is from bin:util-linux. > > > > On my sid/unstable: > > > > # dpkg -S /bin/login > > login:

Bug#923478: initscripts use unsafe `: >` shell command to create files

2019-04-16 Thread Dmitry Bogatov
[2019-04-14 13:35] Cristian Ionescu-Idbohrn > On Sun, 14 Apr 2019, Dmitry Bogatov wrote: > > > > Definitely. But default one is from bin:util-linux. > > On my sid/unstable: > > # dpkg -S /bin/login > login: /bin/login You are right, it is from src:shadow. > > So I question, how much of this

Bug#923478: initscripts use unsafe `: >` shell command to create files

2019-04-14 Thread Cristian Ionescu-Idbohrn
On Sun, 14 Apr 2019, Dmitry Bogatov wrote: > > Definitely. But default one is from bin:util-linux. On my sid/unstable: # dpkg -S /bin/login login: /bin/login # dpkg -s login Package: login Essential: yes Status: install ok installed Priority: required Section: admin Installed-Size: 2695

Bug#923478: initscripts use unsafe `: >` shell command to create files

2019-04-14 Thread Dmitry Bogatov
[2019-04-11 14:45] Cristian Ionescu-Idbohrn > > part text/plain1537 > On Thu, 11 Apr 2019, Dmitry Bogatov wrote: > > > > Warning message and make do_start return 1, I guess. > > This is what I can come up with: Thank you. > + else > + echo "Error: failed

Bug#923478: initscripts use unsafe `: >` shell command to create files

2019-04-11 Thread Cristian Ionescu-Idbohrn
On Thu, 11 Apr 2019, Dmitry Bogatov wrote: > > Warning message and make do_start return 1, I guess. This is what I can come up with: >From 1ae8cb1cb6a306281ccddfa7aa67c13f6cb23ab5 Mon Sep 17 00:00:00 2001 From: Cristian Ionescu-Idbohrn Date: Thu, 11 Apr 2019 14:36:47 +0200 Subject: [PATCH]

Bug#923478: initscripts use unsafe `: >` shell command to create files

2019-04-11 Thread Dmitry Bogatov
[2019-04-08 20:20] Cristian Ionescu-Idbohrn > On Mon, 8 Apr 2019, Dmitry Bogatov wrote: > > [2019-04-07 10:52] Cristian Ionescu-Idbohrn > > > > > On Sat, 6 Apr 2019, Dmitry Bogatov wrote: > > > > > > The redirection in /etc/init.d/bootmisc.sh on line 29 is _not_ error > > > handled. Writing

Bug#923478: initscripts use unsafe `: >` shell command to create files

2019-04-08 Thread Cristian Ionescu-Idbohrn
On Mon, 8 Apr 2019, Dmitry Bogatov wrote: > [2019-04-07 10:52] Cristian Ionescu-Idbohrn > > > On Sat, 6 Apr 2019, Dmitry Bogatov wrote: > > > > The redirection in /etc/init.d/bootmisc.sh on line 29 is _not_ error > > handled. Writing to a file can fail (for various reasons). > > > > OTOH, the

Bug#923478: initscripts use unsafe `: >` shell command to create files

2019-04-08 Thread Dmitry Bogatov
[2019-04-07 10:52] Cristian Ionescu-Idbohrn > On Sat, 6 Apr 2019, Dmitry Bogatov wrote: > > [2019-04-05 11:11] Cristian Ionescu-Idbohrn > > > > > Thing is neither the `:' nor the `true' commands are needed. To > > > truncate a file it's sufficient to redirect _nothing_ to that file. > > > >

Bug#923478: initscripts use unsafe `: >` shell command to create files

2019-04-07 Thread Cristian Ionescu-Idbohrn
On Sat, 6 Apr 2019, Dmitry Bogatov wrote: > [2019-04-05 11:11] Cristian Ionescu-Idbohrn > > > Thing is neither the `:' nor the `true' commands are needed. To > > truncate a file it's sufficient to redirect _nothing_ to that file. > > > > $ dash -c '>/tmp/dir/; echo $?; echo hello world;'

Bug#923478: initscripts use unsafe `: >` shell command to create files

2019-04-06 Thread Dmitry Bogatov
[2019-04-05 11:11] Cristian Ionescu-Idbohrn > Thing is neither the `:' nor the `true' commands are needed. To > truncate a file it's sufficient to redirect _nothing_ to that file. > >$ dash -c '>/tmp/dir/; echo $?; echo hello world;' > dash: 1: cannot create /tmp/dir/:

Bug#923478: initscripts use unsafe `: >` shell command to create files

2019-04-05 Thread Cristian Ionescu-Idbohrn
On Thu, 28 Feb 2019, Thorsten Glaser wrote: > > I’d say that aborting might be preferrable, but I checked your patch. > > In the first case, it’s indeed preferrable to continue the init script > (and have the two additional error messages from chmod and chgrp, but > it continue on), and in the

Bug#923478: initscripts use unsafe `: >` shell command to create files

2019-02-28 Thread Thorsten Glaser
Hi Pierre, I’d say that aborting might be preferrable, but I checked your patch. In the first case, it’s indeed preferrable to continue the init script (and have the two additional error messages from chmod and chgrp, but it continue on), and in the second case… >Init scripts try to use this

Bug#923478: initscripts use unsafe `: >` shell command to create files

2019-02-28 Thread Pierre Ynard
Patch in attachment -- Pierre Ynard From 33ee6752b8752cedd4cdc3bb936485e3aec14e03 Mon Sep 17 00:00:00 2001 From: Pierre Ynard Date: Thu, 28 Feb 2019 19:16:48 +0100 Subject: [PATCH] Do not use unsafe `: >` shell command to create files (Closes: #923478) As per POSIX standard and dash

Bug#923478: initscripts use unsafe `: >` shell command to create files

2019-02-28 Thread Pierre Ynard
Package: initscripts Version: 2.93-8 Severity: normal Tags: patch As per the POSIX standard: http://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#tag_18_14 http://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#tag_18_08_01 The `:` is a "special built-in"