Re: [devel] bad paths in rpm packages

[Alexey Tourbin <at@altlinux.ru>]

[-- Attachment #1: Type: text/plain, Size: 2684 bytes --]

On Tue, Mar 25, 2008 at 05:50:03AM +0300, Alexey Tourbin wrote:
> Но тут всплыла другая проблема: путь может быть каноничен,
> но не кошерен.  rpm позволяет запаковать некошерный путь:
> 
> %install
> install -pD /dev/null %buildroot/etc/rc.d/init.d/functions
> ln -s rc.d/init.d %buildroot/etc/init.d
> %files
> /etc/init.d/functions
> 
> $ rpm -bb test.spec 
> ...
> warning: Installed (but unpackaged) file(s) found:
>     /etc/init.d
>     /etc/rc.d/init.d/functions
> Wrote: /home/at/RPM/RPMS/athlon/test-1.0-alt1.athlon.rpm
> $ rpm -qlvp /home/at/RPM/RPMS/athlon/test-1.0-alt1.athlon.rpm
> -rwxr-xr-x    1 root    root                0 Mar 20 18:50 /etc/init.d/functions
> $

Вроде сделал проверку, чтобы нельзя было запаковать файл в пути
которого встречается симлинк.


commit 5c12a6d19d7a03752eb0a2f57f7b21bdfaf91589
Author: Alexey Tourbin <at@altlinux>
Date:   Wed Mar 26 01:14:32 2008 +0300

    files.c (addFile): check that each intermediate path component is directory (not symlink)
    
    %install
    install -pD /dev/null %buildroot/etc/rc.d/init.d/functions
    ln -s rc.d/init.d %buildroot/etc/init.d
    %files
    /etc/init.d/functions
    /etc/init.d
    
    Old behaviour:
    lrwxrwxrwx    1 root    root               11 Mar 26 01:15 /etc/init.d -> rc.d/init.d
    -rwxr-xr-x    1 root    root                0 Mar 20 18:50 /etc/init.d/functions
    
    New behaviour:
    error: File path component must be directory (/tmp/.private/at/test-buildroot/etc/init.d): /tmp/.private/at/test-buildroot/etc/init.d/functions

diff --git a/build/files.c b/build/files.c
index 35d34be..0a1451f 100644
--- a/build/files.c
+++ b/build/files.c
@@ -1661,6 +1661,31 @@ static int addFile(FileList fl, const char * diskURL,
 	}
     }
 
+    /* intermediate path component must be directories, not symlinks */
+    {
+	struct stat st;
+	size_t du_len = strlen(diskURL);
+	char *du = alloca(du_len + 1);
+	char *p = du + du_len - strlen(fileURL);
+	strcpy(du, diskURL);
+	while ((p = strchr(p + 1, '/'))) {
+	    *p = '\0';
+	    if (Lstat(du, &st)) {
+		rpmError(RPMERR_BADSPEC, _("File not found: %s\n"), diskURL);
+		fl->processingFailed = 1;
+		return RPMERR_BADSPEC;
+	    }
+	    if (!S_ISDIR(st.st_mode)) {
+		rpmError(RPMERR_BADSPEC,
+			_("File path component must be directory (%s): %s\n"),
+			du, diskURL);
+		fl->processingFailed = 1;
+		return RPMERR_BADSPEC;
+	    }
+	    *p = '/';
+	}
+    }
+
     if ((! fl->isDir) && S_ISDIR(statp->st_mode)) {
 	/* We use our own ftw() call, because ftw() uses stat()    */
 	/* instead of lstat(), which causes it to follow symlinks! */

[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]