[PATCH] Make startkde work with not-default KDETMP and KDEVARTMP

[David Faure]

On Tuesday 15 January 2008, Andras Mantia wrote:
> On Tuesday 15 January 2008, Dirk Mueller wrote:
> > On Wednesday 09 January 2008, Andras Mantia wrote:
> > > Comments are welcome.
> >
> > The patch opens a security vulnerability if $KDETMP is within a world
> > writeable directory. I see it was not committed (which is good), just
> > mentioning it in case somebody reconsiders and commits the patch.
> >
> > Greetings,
> > Dirk
> 
> I assume the same issue is with the lnusertemp patch David posted, 
> right?
> 
> Or the below check is enough there?
> 
> if (stat_buf.st_uid != getuid())
>   {
>      fprintf(stderr, "Error: \"%s\" is owned by uid %d instead of uid 
> %d.\n", tmp_dir, stat_buf.st_uid, getuid());
>      return 1;
>   }

Actually this check is what -breaks- my patch: you didn't test it with the standard setup (KDETMP not set).
In that setup, and with my patch, the above test is called for /tmp, and this breaks kde startup since lnusertemp says:
Error: "/tmp" is owned by uid 0 instead of uid 1000.
Here's an updated patch that accepts that the base tmp dir (KDETMP or /tmp) is not owned by the user.

Dirk, can you explain your comment? By default KDETMP *is* a world-writeable directory like /tmp...
But inside it lnusertemp creates a subdir anyway...

-- 
David Faure, faure at kde.org, sponsored by Trolltech to work on KDE,
Konqueror (http://www.konqueror.org), and KOffice (http://www.koffice.org).
-------------- next part --------------
A non-text attachment was scrubbed...
Name: lnusertemp.c.diff
Type: text/x-diff
Size: 2357 bytes
Desc: not available
URL: <http://mail.kde.org/pipermail/kde-core-devel/attachments/20080118/4b16adf2/attachment.diff>