dpkg-source -x now tries to chown all files extracted from

tar files. The temporary directory is now created with mode
0700, too. Together this should make it safer to run
dpkg-source -x as root. Based on suggestions by Marcus
Brinkmann and Colin Watson. Closes: #144571, #238460

diff --git a/ChangeLog b/ChangeLog
index 9099da28d2dd4037a3565b71ccd0b255b7de80dd..8d38748c5a5314db0af90eb81116c396db72895d 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,7 +1,15 @@
+2005-10-03  Frank Lichtenheld  <djpig@debian.org>
+
+       * scripts/dpkg-source.pl: Try to chown files extracted from
+       a tar file to the uid and gid of the user. This should make
+       dpkg-source -x safer to use as root. Also create the temporary
+       directory mode 0700 to not allow anyone exploiting races
+       between the extraction and the chown.
+
 2005-08-27  Frank Lichtenheld  <djpig@debian.org>
 
-       * scripts/dpkg-gencontrol: Bail out with an error if parsedep
-       found an error while parsing a dependency field.
+       * scripts/dpkg-gencontrol: Bail out with an error if parsedep
+       found an error while parsing a dependency field.
 
 2005-08-17  Scott James Remnant  <scott@netsplit.com>
 

diff --git a/debian/changelog b/debian/changelog
index e42910e42d3b74d0844b3af77e10bd7ff223abcc..0606807d9b83e490ff27b4c90c09d3ed8963e469 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -3,6 +3,11 @@ dpkg (1.13.12~) unstable; urgency=low
   [Frank Lichtenheld]
   * Let dpkg-gencontrol bail out with an error if parsedep
     found an error while parsing a dependency field. Closes: #228125
+  * dpkg-source -x now tries to chown all files extracted from
+    tar files. The temporary directory is now created with mode
+    0700, too. Together this should make it safer to run
+    dpkg-source -x as root. Based on suggestions by Marcus
+    Brinkmann and Colin Watson. Closes: #144571, #238460
 
  --
 

diff --git a/scripts/dpkg-source.pl b/scripts/dpkg-source.pl
index 7548379fbbe684ad8b4544f681cbf59fd23f0697..6798b21554743d39a69187d747ee6ad817d2a07e 100755 (executable)
--- a/scripts/dpkg-source.pl
+++ b/scripts/dpkg-source.pl
@@ -642,10 +642,11 @@ if ($opmode eq 'build') {
        my $tmp = "$target.tmp-nest";
        (my $t = $target) =~ s!.*/!!;
 
-       mkdir($tmp,0755) || &syserr("unable to create `$tmp'");
+       mkdir($tmp,0700) || &syserr("unable to create `$tmp'");
        system "chmod", "g-s", $tmp;
        print("$progname: unpacking $tarfile\n");
        extracttar("$dscdir/$tarfile",$tmp,$t);
+       system "chown", '-R', '-f', join(':',@fowner), "$tmp/$t";
        rename("$tmp/$t",$target)
            || &syserr("unable to rename `$tmp/$t' to `$target'");
        rmdir($tmp)