Date: Sun, 21 Mar 2010 02:13:00 GMT From: Garrett Cooper <gcooper@FreeBSD.org> To: freebsd-gnats-submit@FreeBSD.org Subject: bin/144921: [patch] [pkg_install] Replace vsystem'ed call to mkdir(1) in add/futil.c with mkdir(1) Message-ID: <201003210213.o2L2D0xC089547@www.freebsd.org> Resent-Message-ID: <201003210220.o2L2K1Ge045245@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 144921
>Category: bin
>Synopsis: [patch] [pkg_install] Replace vsystem'ed call to mkdir(1) in add/futil.c with mkdir(1)
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Sun Mar 21 02:20:01 UTC 2010
>Closed-Date:
>Last-Modified:
>Originator: Garrett Cooper
>Release: 9-CURRENT
>Organization:
Cisco Systems, Inc.
>Environment:
>Description:
There's no reason why we should expose the end-user to potential security issues in creating a subshell, or incur the unnecessary overhead of using mkdir(1) via vsystem when we can use mkdir(2) instead.
>How-To-Repeat:
>Fix:
See patch.
Patch attached with submission follows:
==== //depot/projects/soc2007/gcooper-pkg_install-enhancements-simplified/usr.sbin/pkg_install/add/futil.c#1 - /scratch/freebsd/perforce/pkg_install-enhancements/usr.sbin/pkg_install/add/futil.c ====
@@ -50,7 +50,7 @@
}
}
else {
- if (vsystem("/bin/mkdir %s", dir)) {
+ if (mkdir(dir, 0700) < 0) {
if (cp2)
*cp2 = '/';
return FAIL;
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201003210213.o2L2D0xC089547>