From owner-freebsd-ports-bugs@FreeBSD.ORG Thu Aug 24 09:30:18 2006 Return-Path: X-Original-To: freebsd-ports-bugs@hub.freebsd.org Delivered-To: freebsd-ports-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2B79D16A4DE for ; Thu, 24 Aug 2006 09:30:18 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 588E543D5F for ; Thu, 24 Aug 2006 09:30:16 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.4/8.13.4) with ESMTP id k7O9UFrP039006 for ; Thu, 24 Aug 2006 09:30:15 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.4/8.13.4/Submit) id k7O9UFvx038999; Thu, 24 Aug 2006 09:30:15 GMT (envelope-from gnats) Resent-Date: Thu, 24 Aug 2006 09:30:15 GMT Resent-Message-Id: <200608240930.k7O9UFvx038999@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Henrik Brix Andersen Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E25F716A4DE; Thu, 24 Aug 2006 09:26:16 +0000 (UTC) (envelope-from brix@fangorn.brixandersen.dk) Received: from ns2.pil.dk (ns2.pil.dk [195.41.47.38]) by mx1.FreeBSD.org (Postfix) with ESMTP id 53D2E43D68; Thu, 24 Aug 2006 09:26:15 +0000 (GMT) (envelope-from brix@fangorn.brixandersen.dk) Received: from fangorn.brixandersen.dk (fw2.pil.dk [83.90.227.58]) by ns2.pil.dk (Postfix) with ESMTP id ABF4D7BAB32; Thu, 24 Aug 2006 11:26:14 +0200 (CEST) Received: by fangorn.brixandersen.dk (Postfix, from userid 1001) id AA0DE2E022; Thu, 24 Aug 2006 11:25:59 +0200 (CEST) Message-Id: <20060824092559.AA0DE2E022@fangorn.brixandersen.dk> Date: Thu, 24 Aug 2006 11:25:59 +0200 (CEST) From: Henrik Brix Andersen To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: drift@pil.dk, secteam@FreeBSD.org Subject: ports/102473: [patch] portaudit fails to overwrite auditfile.tbz when run as non-root X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Henrik Brix Andersen List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Aug 2006 09:30:18 -0000 >Number: 102473 >Category: ports >Synopsis: [patch] portaudit fails to overwrite auditfile.tbz when run as non-root >Confidential: no >Severity: non-critical >Priority: medium >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Thu Aug 24 09:30:15 GMT 2006 >Closed-Date: >Last-Modified: >Originator: Henrik Brix Andersen >Release: FreeBSD 6.1-STABLE i386 >Organization: pil.dk >Environment: System: FreeBSD fangorn.brixandersen.dk 6.1-STABLE FreeBSD 6.1-STABLE #8: Sat Aug 19 12:14:49 CEST 2006 root@fangorn.brixandersen.dk:/usr/obj/usr/src/sys/GENERIC i386 >Description: security/portaudit fails to overwrite the auditfile.tbz file when run as a non-root user since it sets a=r on the file once downloaded. The patch below solves this by mv'ing the file before attempting a new download instead of cp'ing it. >How-To-Repeat: Set $portaudit_dir in /usr/local/etc/portaudit.conf to a location writable by a non-root user and run 'portaudit -F' as that user. Notice that on the second run of 'portaudit -F' it fails to overwrite the auditfile.tbz. >Fix: Proposed patch: --- portaudit-cmd.sh.patch begins here --- --- portaudit-cmd.sh.orig Thu Aug 24 10:19:31 2006 +++ portaudit-cmd.sh Thu Aug 24 10:19:39 2006 @@ -300,7 +300,7 @@ fi cd "$portaudit_dir" if [ -r "$portaudit_filename" ]; then - cp -f "$portaudit_filename" "$portaudit_filename.old" + mv -f "$portaudit_filename" "$portaudit_filename.old" fi $opt_verbose && echo "Attempting to fetch from $portaudit_sites." --- portaudit-cmd.sh.patch ends here --- >Release-Note: >Audit-Trail: >Unformatted: