new snapshot available: coreutils-8.0.108-3aff3

View: New views
11 Messages — Rating Filter:   Alert me  

new snapshot available: coreutils-8.0.108-3aff3

by Jim Meyering :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

We're expecting to release coreutils-8.1 soon (like before the end
of the week), so here's a snapshot of the latest.  This includes
many improvements in gnulib, too.

For the latest NEWS (it's getting long), see this:

    http://git.sv.gnu.org/cgit/coreutils.git/plain/NEWS


coreutils snapshot:
  http://meyering.net/cu/coreutils-ss.tar.gz      9.9 MB
  http://meyering.net/cu/coreutils-ss.tar.xz      4.2 MB
  http://meyering.net/cu/coreutils-ss.tar.gz.sig
  http://meyering.net/cu/coreutils-ss.tar.xz.sig
aka
  http://meyering.net/cu/coreutils-8.0.108-3aff3.tar.gz
  http://meyering.net/cu/coreutils-8.0.108-3aff3.tar.xz

now, also available:
  http://people.redhat.com/meyering/cu/coreutils-ss.tar.xz
  http://people.redhat.com/meyering/cu/coreutils-ss.tar.gz
  http://people.redhat.com/meyering/cu/coreutils-8.0.108-3aff3.tar.xz
  http://people.redhat.com/meyering/cu/coreutils-8.0.108-3aff3.tar.gz

Changes in coreutils since 8.0.24-26e8e:

C de-Avillez (1):
      tail: add add missing backslash at the end of a line in usage

Eric Blake (38):
      tail: tweak usage for more clarity
      touch: add -h to change symlink timestamps, where supported
      tests: ensure touch honors trailing slash
      build: update gnulib submodule to latest, for utimens enhancements
      maint: turn on compiler warnings for gnulib tests
      build: update gnulib submodule to latest, for test cleanups
      build: prohibit improper use of stat and lstat
      tests: accommodate BSD getopt
      chroot, env, nice, su: use EXIT_CANCELED for internal failure
      nohup: use EXIT_CANCELED if not POSIXLY_CORRECT
      tests: enhance stdbuf and timeout tests
      maint: move chroot test
      tests: test recent status changes
      tests: avoid file name not portable to cygwin
      maint: let gnulib provide environ
      env: reject bogus -u arguments
      doc: document PATH interactions with env
      tests: clean up tests of env -- handling
      tests: fix PATH problems on cygwin
      tests: add printenv coverage
      env, printenv: add -0/--null option
      doc: turn env comments into documentation
      printenv: ignore bogus variable names
      nice, nohup, su: detect write failure to stderr
      maint: avoid exiting with magic number
      build: update gnulib submodule to latest, for fewer compiler warnings
      build: avoid some warnings
      mktemp: don't leave file behind on write failure
      doc: document mktemp
      tests: enhance mktemp test
      mktemp: rearrange --help output
      build: override gnulib tempname via diff
      build: reflect gnulib changes to tempname
      mktemp: add suffix handling
      mktemp: enhance test to catch just-fixed typo behavior
      mktemp: use more robust means to avoid double-close of stdout
      mktemp: fix bug with -q and closed stdout
      build: consistently use freopen-safer

Giuseppe Scrivano (3):
      tail -f: avoid a race condition
      tests: add a test for the `tail -f' race condition bug
      nproc: A new program to count the available processors

Jim Meyering (35):
      build: don't let environment settings perturb build
      build: update gnulib submodule to latest
      tests: abmon-align: avoid test failure
      maint: factor out duplication in currently unused rules
      build: use gnulib's isblank module
      build: prohibit direct use of readlink or readlinkat
      nice: execute program even when setpriority fails due to EACCES
      tests: nice: adjust new tests to work more portably
      tests: adjust new env test not to fail
      tests: rm/one-file-system: work around umount failure
      doc: avoid failing "make check"
      build: make doc checks more user-friendly
      doc: tell --enable-gcc-warnings users where to report problems
      build: allow whitespace violations in gl/lib/*.diff files
      build: update gnulib submodule to latest
      build (--enable-gcc-warnings): enable gcc's -Werror also in lib/
      remove stray closing comment delimiter, "*/", in previous change
      tests: don't let a fail=1 env. setting induce unwarranted test failure
      tests: remove the less-regular fail=0 assignments manually
      tests: factor 350 fail=0 initializations into test-lib.sh
      tests: prohibit fail=0 initialization
      admin: fix typo in release procedure
      admin: automate one more part of the release process
      tests: inotify-race: don't let malfunctioning gdb hang the test
      rm -f: ignore EROFS when it's really ENOENT
      tests: rm: add test for today's change in behavior
      maint: factor out cycle warning, now that du will use it, too
      du now diagnoses cycles, rather than ignoring them
      du: cleanup: remove dead-code vestige of already-removed option
      mktemp: don't use suff_len in place of #-of-`X's variable
      mktemp: don't try to close stdout twice
      build: move do-release-commit-and-tag to gnulib
      chcon, chgrp, chmod and chown now diagnose a directory cycle
      maint: make du's cycle-detection code consistent
      build: update gnulib submodule to latest for its FreeBSD fixes

Pádraig Brady (7):
      maint: issue warnings for more missing optional libraries
      md5sum, sha*sum, sum: line-buffer the printed checksums
      timeout: don't orphan monitored programs if they ignore specified signals
      maint: avoid "make syntax-check" failure
      echo, printf: interpret \e as the Escape character
      doc: improve the echo and printf help on escapes
      ls: fix capability coloring


Changes in gnulib since 8.0.24-26e8e:

* gnulib 959d9cb...26c5fd7 (94):
  > utimens: remove invalid futimesat call
  > fflush, freadseek: use fseeko, not fseek
  > autoupdate
  > modules/memchr (Depends-on): Drop getpagesize dependency.
  > build-aux/pmccabe2html: Drop #! header.  Doc fix.
  > build-aux/pmccabe2html: Disable execute bit. Improve example usage.
  > do-release-commit-and-tag: New module.
  > modules/select-tests (test_select_LDADD): Add $(INET_PTON_LIB).
  > getaddrinfo: Simplify Link: directive.
  > strtod: detect darwin bug
  > freopen-safer: new module
  > maint.mk: Prohibit inclusion of "close-stream.h" without use.
  > modules/pmccabe2html (configure.ac): Check for pmccabe tool.
  > getaddrinfo (Link): Add $(INET_NTOP_LIB).
  > Fix typo in last commit.
  > inet_ntop, inet_pton: Fix link error.
  > test-func.c: Also test value of __func__.
  > test-sys_socket: Fix compilation warning.
  > Fix link error.
  > Tests for module 'inet_pton'.
  > Tests for module 'inet_ntop'.
  > stdlib-safer: wrap all mkstemp variants
  > mkstemps, mkostemps: new modules
  > tempname: resync from glibc
  > utimens: fix use of futimens on older Linux
  > Make num_processors more flexible and consistent.
  > Document the new library dependencies of inet_ntop, inet_pton.
  > test-getaddrinfo: avoid compilation failure on FreeBSD 7.2
  > mktime, timegm: share common declaration
  > test-update-copyright: update test to match script changes
  > Fix link error on Solaris 8.
  > Avoid link error for inet_ntop on Solaris.
  > maint: avoid compiler warnings in m4 macros
  > pmccabe2html: Don't hard code awk path.
  > fseeko: fix m4 regression
  > inttostr: aesthetics and improved (compile-time) safety
  > build: avoid compiler warnings
  > stat: fix compilation on AIX
  > exclude: make more robust
  > perl scripts: remove #!/usr/bin/perl in favor of more portable...
  > filenamecat-lgpl: adjust clients
  > filenamecat: split into filenamecat-lgpl
  > argp: avoid memory leak
  > dirname-lgpl: adjust clients that don't need full dirname
  > dirname: split into dirname-lgpl
  > mkdir: make safe for libraries
  > tests: avoid some compiler warnings
  > sockets: avoid compiler warning
  > maint: detect usage(1) and other suspicious exits
  > timespec: long-to-int truncation could make timespec_cmp malfunction
  > fprintftime: wrap macro code argument in "do {...} while(0)"
  > fprintftime: remove stray semicolon from previous change
  > fprintftime: avoid a warning about ignored fwrite return value
  > exclude: avoid an unwarranted warning
  > fseek: avoid compilation failure when fflush is replaced
  > Avoid a nearly redundant gcc warning.
  > Avoid warning despite dropping the return value of fwrite.
  > areadlinkat: fix fallback path
  > digests, copy-file: increase the IO buffer size from 4KiB to 32KiB
  > tests: avoid several compiler warnings
  > areadlinkat: avoid failure on older glibc
  > Relicense stpncpy under LGPLv2+.
  > utimensat: work around Solaris 9 bug
  > fdutimensat: new module
  > doc: regenerate INSTALL
  > ChangeLog syntax: use TAB, not a sequence of leading spaces
  > acl: warn if ACL support is not detected
  > autoupdate
  > users.txt: add myserver
  > Add extern "C" block for C++.
  > Document the alternative APIs for character classification.
  > Tests for module 'isblank'.
  > New module 'isblank'.
  > New module 'ctype'.
  > m4: stylistic-only: hoist AC_SUBST to be adjacent to initialization
  > Don't let environment variables perturb build.
  > Avoid symlink attack in localcharset module.
  > Implement nproc for mingw.
  > Implement nproc for IRIX.
  > Implement nproc for HP-UX.
  > Implement nproc for NetBSD, OpenBSD.
  > Fix recognition of sys/sysctl.h on OpenBSD 4.0.
  > utimensat: new module
  > utimens: let lutimens work on non-symlinks
  > utimens: cache whether utimensat syscall works
  > test-stat-time, test-utimens: improve portability
  > sys_stat: sort replacement declarations
  > don't let environment settings perturb build
  > fchdir: avoid infinite recursion in mingw
  > test-stat-time: port to mingw
  > use AC_CHECK_FUNCS_ONCE, not AC_CHECK_FUNCS in modules/*
  > utimens-tests: port to NFS file systems
  > stat-time-tests: minor cleanups
  > sys_stat: guarantee struct timespec



Re: new snapshot available: coreutils-8.0.108-3aff3

by Pádraig Brady :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

                       Passed     Skipped     Failed
                  \---------------------------------
Fedora core 5 x86 |       363          47          0
Fedora 11 x86     |       363          47          0
Solaris 10 x86    |       342          68          0
FreeBSD 6 x86     |       336          72          2

FeeBSD 6 failures
  misc/env
    + env -u a=b true
    + fail=1
  touch/trailing-slash
    + touch dangling/
    + fail=1





Re: new snapshot available: coreutils-8.0.108-3aff3

by Jim Meyering :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Pádraig Brady wrote:

>                        Passed     Skipped     Failed
>                   \---------------------------------
> Fedora core 5 x86 |       363          47          0
> Fedora 11 x86     |       363          47          0
> Solaris 10 x86    |       342          68          0
> FreeBSD 6 x86     |       336          72          2
>
> FeeBSD 6 failures
>   misc/env
>     + env -u a=b true
>     + fail=1
>   touch/trailing-slash
>     + touch dangling/
>     + fail=1

Thanks!
Almost there...



Re: new snapshot available: coreutils-8.0.108-3aff3

by Eric Blake :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

According to Pádraig Brady on 11/9/2009 6:45 AM:

>                        Passed     Skipped     Failed
>                   \---------------------------------
> Fedora core 5 x86 |       363          47          0
> Fedora 11 x86     |       363          47          0
> Solaris 10 x86    |       342          68          0
> FreeBSD 6 x86     |       336          72          2
>
> FeeBSD 6 failures
>   misc/env
>     + env -u a=b true
>     + fail=1

Hmm, I'll take a look at that.  Sounds like we need rpl_unsetenv to reject
invalid arguments.

>   touch/trailing-slash
>     + touch dangling/
>     + fail=1

Expected.  My fix to stat this morning didn't go in until after Jim's
snapshot.  But should be fixed now with the latest gnulib.

- --
Don't work too hard, make some time for fun as well!

Eric Blake             ebb9@...
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (Cygwin)
Comment: Public key at home.comcast.net/~ericblake/eblake.gpg
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkr4H3IACgkQ84KuGfSFAYBCbQCgm+akODTBNYxu0ZrwdpB509tY
DwkAoJ16rdeBvrh6C1QWtpvl7ExaSlLc
=aix3
-----END PGP SIGNATURE-----



Re: new snapshot available: coreutils-8.0.108-3aff3

by Gilles Espinasse :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message


----- Original Message -----
From: "Jim Meyering" <jim@...>
To: <bug-coreutils@...>
Sent: Monday, November 09, 2009 12:04 PM
Subject: new snapshot available: coreutils-8.0.108-3aff3


> We're expecting to release coreutils-8.1 soon (like before the end
> of the week), so here's a snapshot of the latest.  This includes
> many improvements in gnulib, too.
>
Maybe a bit late.
Just tested that snapshot and have some failures
grep FAIL test_i486/20091114*/coreutils-8.0.108-3aff3-02.log
FAIL: rm/fail-eperm
FAIL: misc/pwd-long
FAIL: rm/fail-eperm (exit: 255)
FAIL: misc/pwd-long (exit: 255)

Set with
 cd $(DIR_APP) && ./configure --prefix=/usr \
     --enable-install-program=hostname \
     --enable-no-install-program=kill,uptime

Both tests fail for the same reason
FAIL: rm/fail-eperm (exit: 255)
===============================

fail-eperm: considering /tmp/cceXxKh6.c
Insecure directory in $ENV{PATH} while running with -T switch at
./rm/fail-eperm line 88.

FAIL: misc/pwd-long (exit: 255)
===============================

Insecure directory in $ENV{PATH} while running with -T switch at - line 73.

perl is v5.10.1

    Gilles




Re: new snapshot available: coreutils-8.0.108-3aff3

by Jim Meyering :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Gilles Espinasse wrote:

> ----- Original Message -----
> From: "Jim Meyering" <jim@...>
> To: <bug-coreutils@...>
> Sent: Monday, November 09, 2009 12:04 PM
> Subject: new snapshot available: coreutils-8.0.108-3aff3
>
>
>> We're expecting to release coreutils-8.1 soon (like before the end
>> of the week), so here's a snapshot of the latest.  This includes
>> many improvements in gnulib, too.
>>
> Maybe a bit late.

Thanks for testing.

> Just tested that snapshot and have some failures
> grep FAIL test_i486/20091114*/coreutils-8.0.108-3aff3-02.log
> FAIL: rm/fail-eperm
> FAIL: misc/pwd-long
> FAIL: rm/fail-eperm (exit: 255)
> FAIL: misc/pwd-long (exit: 255)
>
> Set with
>  cd $(DIR_APP) && ./configure --prefix=/usr \
>      --enable-install-program=hostname \
>      --enable-no-install-program=kill,uptime
>
> Both tests fail for the same reason
> FAIL: rm/fail-eperm (exit: 255)
> ===============================
>
> fail-eperm: considering /tmp/cceXxKh6.c
> Insecure directory in $ENV{PATH} while running with -T switch at
> ./rm/fail-eperm line 88.
>
> FAIL: misc/pwd-long (exit: 255)
> ===============================
>
> Insecure directory in $ENV{PATH} while running with -T switch at - line 73.

Is some directory in your $PATH group- or world-writable?



Re: new snapshot available: coreutils-8.0.108-3aff3

by Gilles Espinasse :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message


----- Original Message -----
From: "Jim Meyering" <jim@...>
To: "Gilles Espinasse" <g.esp@...>
Cc: <bug-coreutils@...>
Sent: Saturday, November 14, 2009 3:51 PM
Subject: Re: new snapshot available: coreutils-8.0.108-3aff3


> Gilles Espinasse wrote:
> > ----- Original Message -----
> > From: "Jim Meyering" <jim@...>
> > To: <bug-coreutils@...>
> > Sent: Monday, November 09, 2009 12:04 PM
> > Subject: new snapshot available: coreutils-8.0.108-3aff3
> >
> >
> >> We're expecting to release coreutils-8.1 soon (like before the end
> >> of the week), so here's a snapshot of the latest.  This includes
> >> many improvements in gnulib, too.
> >>
> > Maybe a bit late.
>
> Thanks for testing.
>
> > Just tested that snapshot and have some failures
> > grep FAIL test_i486/20091114*/coreutils-8.0.108-3aff3-02.log
> > FAIL: rm/fail-eperm
> > FAIL: misc/pwd-long
> > FAIL: rm/fail-eperm (exit: 255)
> > FAIL: misc/pwd-long (exit: 255)
> >
> > Set with
> >  cd $(DIR_APP) && ./configure --prefix=/usr \
> >      --enable-install-program=hostname \
> >      --enable-no-install-program=kill,uptime
> >
> > Both tests fail for the same reason
> > FAIL: rm/fail-eperm (exit: 255)
> > ===============================
> >
> > fail-eperm: considering /tmp/cceXxKh6.c
> > Insecure directory in $ENV{PATH} while running with -T switch at
> > ./rm/fail-eperm line 88.
> >
> > FAIL: misc/pwd-long (exit: 255)
> > ===============================
> >
> > Insecure directory in $ENV{PATH} while running with -T switch at - line
73.
>
> Is some directory in your $PATH group- or world-writable?

should not
find `echo "$PATH" | sed 's/:/ /g'` -maxdepth 0 -ls
1331275    4 drwxr-xr-x   2 root     root         4096 Oct 21 23:07
/tools_i486/usr/bin
1672609    4 drwxr-xr-x   2 root     root         4096 Nov 14 17:56 /bin
1672645    4 drwxr-xr-x   2 root     root         4096 Nov 14 17:57 /usr/bin
1672640    4 drwxr-xr-x   2 root     root         4096 Nov 14 17:57 /sbin
1672648    4 drwxr-xr-x   2 root     root         4096 Nov 14 17:57
/usr/sbin
1672299   12 drwxr-xr-x   2 root     root        12288 Nov 14 17:42
/tools_i486/bin

I have tried to understand exactly where the script fail.
Modified the script like in the attached patch to reproduce the first part
of the perl part as I was unsure of the meaning of line 73 in pwd-long
failure message

The added part run, so the problem is later :
[chroot-i486] root:/usr/src/coreutils-8.0.108-3aff3$ make check -C tests
TESTS=misc/pwd-long VERBOSE=yes                      make: Entering
directory `/usr/src/coreutils-8.0.108-3aff3/tests'
make  check-TESTS
make[1]: Entering directory `/usr/src/coreutils-8.0.108-3aff3/tests'
make[2]: Entering directory `/usr/src/coreutils-8.0.108-3aff3/tests'
FAIL: misc/pwd-long
=======================================================
   GNU coreutils 8.0.108-3aff3: tests/test-suite.log
=======================================================

1 of 1 test failed.

.. contents:: :depth: 2


FAIL: misc/pwd-long (exit: 255)
===============================

end of added lines
Insecure directory in $ENV{PATH} while running with -T switch at - line 73.
======================================
1 of 1 test failed
See tests/test-suite.log
Please report to bug-coreutils@...
======================================
make[2]: *** [test-suite.log] Error 1

Gilles


pwd-long-hack.patch (1K) Download Attachment

Re: new snapshot available: coreutils-8.0.108-3aff3

by Jim Meyering :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Gilles Espinasse wrote:
...

>> > Insecure directory in $ENV{PATH} while running with -T switch at - line
> 73.
>>
>> Is some directory in your $PATH group- or world-writable?
>
> should not
> find `echo "$PATH" | sed 's/:/ /g'` -maxdepth 0 -ls
> 1331275    4 drwxr-xr-x   2 root     root         4096 Oct 21 23:07
> /tools_i486/usr/bin
> 1672609    4 drwxr-xr-x   2 root     root         4096 Nov 14 17:56 /bin
> 1672645    4 drwxr-xr-x   2 root     root         4096 Nov 14 17:57 /usr/bin
> 1672640    4 drwxr-xr-x   2 root     root         4096 Nov 14 17:57 /sbin
> 1672648    4 drwxr-xr-x   2 root     root         4096 Nov 14 17:57
> /usr/sbin
> 1672299   12 drwxr-xr-x   2 root     root        12288 Nov 14 17:42
> /tools_i486/bin

That doesn't show the actual value of your $PATH envvar.
I'll bet it starts with ":".  *THAT* is definitely insecure.



Re: new snapshot available: coreutils-8.0.108-3aff3

by Gilles Espinasse :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message


----- Original Message -----
From: "Jim Meyering" <jim@...>
To: "Gilles Espinasse" <g.esp@...>
Cc: <bug-coreutils@...>
Sent: Sunday, November 15, 2009 9:37 AM
Subject: Re: new snapshot available: coreutils-8.0.108-3aff3


> Gilles Espinasse wrote:
> ...
> >> > Insecure directory in $ENV{PATH} while running with -T switch at -
line

> > 73.
> >>
> >> Is some directory in your $PATH group- or world-writable?
> >
> > should not
> > find `echo "$PATH" | sed 's/:/ /g'` -maxdepth 0 -ls
> > 1331275    4 drwxr-xr-x   2 root     root         4096 Oct 21 23:07
> > /tools_i486/usr/bin
> > 1672609    4 drwxr-xr-x   2 root     root         4096 Nov 14 17:56 /bin
> > 1672645    4 drwxr-xr-x   2 root     root         4096 Nov 14 17:57
/usr/bin
> > 1672640    4 drwxr-xr-x   2 root     root         4096 Nov 14 17:57
/sbin
> > 1672648    4 drwxr-xr-x   2 root     root         4096 Nov 14 17:57
> > /usr/sbin
> > 1672299   12 drwxr-xr-x   2 root     root        12288 Nov 14 17:42
> > /tools_i486/bin
>
> That doesn't show the actual value of your $PATH envvar.
> I'll bet it starts with ":".  *THAT* is definitely insecure.
No
First, I could do in the chroot
perl -e 'print "$ENV{PATH}\n";'
/tools_i486/usr/bin:/bin:/usr/bin:/sbin:/usr/sbin:/tools_i486/bin

Secondly, in the modified pwd-long test, I was able to run what is strictly
the first part of the test before the 'do ... until (++$i == $n);' so PATH
should be sane to this point.

If I add the 'do ... until (++$i == $n);' part in my changes like in the
patch send, test status is changed to skip
[chroot-i486] root:/usr/src/coreutils-8.0.108-3aff3$ make check -C tests
TESTS=misc/pwd-long VERBOSE=yes
make: Entering directory `/usr/src/coreutils-8.0.108-3aff3/tests'
make  check-TESTS
make[1]: Entering directory `/usr/src/coreutils-8.0.108-3aff3/tests'
make[2]: Entering directory `/usr/src/coreutils-8.0.108-3aff3/tests'
SKIP: misc/pwd-long
====================
All 0 tests passed
(1 test was not run)
====================
make[2]: Leaving directory `/usr/src/coreutils-8.0.108-3aff3/tests'
make[1]: Leaving directory `/usr/src/coreutils-8.0.108-3aff3/tests'
make: Leaving directory `/usr/src/coreutils-8.0.108-3aff3/tests'

So I have not yet found where it fail and why.

Gilles




Re: new snapshot available: coreutils-8.0.108-3aff3

by Jim Meyering :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Gilles Espinasse wrote:
>> ...
>> >> > Insecure directory in $ENV{PATH} while running with -T switch at -
...
>> >> Is some directory in your $PATH group- or world-writable?

It is insecure also if a parent of one of those directories is
group- or world-writable.

>> > should not
>> > find `echo "$PATH" | sed 's/:/ /g'` -maxdepth 0 -ls
>> > 1331275    4 drwxr-xr-x   2 root     root         4096 Oct 21 23:07
>> > /tools_i486/usr/bin
>> > 1672609    4 drwxr-xr-x   2 root     root         4096 Nov 14 17:56 /bin
>> > 1672645    4 drwxr-xr-x   2 root     root         4096 Nov 14 17:57
> /usr/bin
>> > 1672640    4 drwxr-xr-x   2 root     root         4096 Nov 14 17:57
> /sbin
>> > 1672648    4 drwxr-xr-x   2 root     root         4096 Nov 14 17:57
>> > /usr/sbin
>> > 1672299   12 drwxr-xr-x   2 root     root        12288 Nov 14 17:42
>> > /tools_i486/bin
>>
>> That doesn't show the actual value of your $PATH envvar.
>> I'll bet it starts with ":".  *THAT* is definitely insecure.
> No
> First, I could do in the chroot
> perl -e 'print "$ENV{PATH}\n";'
> /tools_i486/usr/bin:/bin:/usr/bin:/sbin:/usr/sbin:/tools_i486/bin

Try ls -ld /tools_i486 /tools_i486/usr



Re: new snapshot available: coreutils-8.0.108-3aff3

by Eric Blake :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

According to Eric Blake on 11/9/2009 6:56 AM:
>> FeeBSD 6 failures
>>   misc/env
>>     + env -u a=b true
>>     + fail=1
>
> Hmm, I'll take a look at that.  Sounds like we need rpl_unsetenv to reject
> invalid arguments.

gnulib should work around this now.

- --
Don't work too hard, make some time for fun as well!

Eric Blake             ebb9@...
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (Cygwin)
Comment: Public key at home.comcast.net/~ericblake/eblake.gpg
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAksCKGgACgkQ84KuGfSFAYC2aACfeh/xnQXvNZgaKL3A1rlaXSJI
4UsAnjPNuAg3NY7eZXNoyzbpIbsnJAYv
=SWQO
-----END PGP SIGNATURE-----