[PATCH] Make startkde work with not-default KDETMP and KDEVARTMP
faure at kde.org
Fri Jan 18 18:34:23 GMT 2008
On Tuesday 15 January 2008, Andras Mantia wrote:
> On Tuesday 15 January 2008, Dirk Mueller wrote:
> > On Wednesday 09 January 2008, Andras Mantia wrote:
> > > Comments are welcome.
> > The patch opens a security vulnerability if $KDETMP is within a world
> > writeable directory. I see it was not committed (which is good), just
> > mentioning it in case somebody reconsiders and commits the patch.
> > Greetings,
> > Dirk
> I assume the same issue is with the lnusertemp patch David posted,
> Or the below check is enough there?
> if (stat_buf.st_uid != getuid())
> fprintf(stderr, "Error: \"%s\" is owned by uid %d instead of uid
> %d.\n", tmp_dir, stat_buf.st_uid, getuid());
> return 1;
Actually this check is what -breaks- my patch: you didn't test it with the standard setup (KDETMP not set).
In that setup, and with my patch, the above test is called for /tmp, and this breaks kde startup since lnusertemp says:
Error: "/tmp" is owned by uid 0 instead of uid 1000.
Here's an updated patch that accepts that the base tmp dir (KDETMP or /tmp) is not owned by the user.
Dirk, can you explain your comment? By default KDETMP *is* a world-writeable directory like /tmp...
But inside it lnusertemp creates a subdir anyway...
David Faure, faure at kde.org, sponsored by Trolltech to work on KDE,
Konqueror (http://www.konqueror.org), and KOffice (http://www.koffice.org).
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 2357 bytes
Desc: not available
More information about the kde-core-devel