GNU bug report logs - #30228
owncloud-client files in ~/.config embed store file names

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 30228 in the body.
You can then email your comments to 30228 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Efraim Flashner <efraim <at> flashner.co.il>
To: bug-guix <at> gnu.org
Subject: desktop files embedding full path
Date: Tue, 23 Jan 2018 13:00:12 +0200

[Message part 1 (text/plain, inline)]

the owncloud-client package includes an option to add a .desktop entry
to $HOME/.configure/autostart/, which allows it to autostart when you
log in to your desktop environment. Because the full path of the binary
is in the .desktop file, it will always start THAT copy of
owncloud-client, even if it is garbage collected.

(ins)efraim <at> macbook41 ~/workspace/guix$ guix build --no-grafts owncloud-client
/gnu/store/61779fqfpwap9wwf2y5yidq4qciihq1i-owncloud-client-2.3.4
(ins)efraim <at> macbook41 ~/workspace/guix$ head -n8 /gnu/store/61779fqfpwap9wwf2y5yidq4qciihq1i-owncloud-client-2.3.4/share/applications/owncloud.desktop
[Desktop Entry]
Categories=Utility;X-SuSE-SyncUtility;
Type=Application
Exec=/gnu/store/61779fqfpwap9wwf2y5yidq4qciihq1i-owncloud-client-2.3.4/bin/owncloud
Name=ownCloud desktop sync client
Comment=ownCloud desktop synchronization client
GenericName=Folder Sync
Icon=owncloud

-- 
Efraim Flashner   <efraim <at> flashner.co.il>   אפרים פלשנר
GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted

[signature.asc (application/pgp-signature, inline)]

Message #8 received at 30228 <at> debbugs.gnu.org (full text, mbox):

From: ludo <at> gnu.org (Ludovic Courtès)
To: Efraim Flashner <efraim <at> flashner.co.il>
Cc: 30228 <at> debbugs.gnu.org
Subject: Re: bug#30228: desktop files embedding full path
Date: Wed, 24 Jan 2018 15:58:51 +0100

Hi,

Efraim Flashner <efraim <at> flashner.co.il> skribis:

> the owncloud-client package includes an option to add a .desktop entry
> to $HOME/.configure/autostart/, which allows it to autostart when you
> log in to your desktop environment. Because the full path of the binary
> is in the .desktop file, it will always start THAT copy of
> owncloud-client, even if it is garbage collected.

I think you shouldn’t copy manually the .desktop file to
~/.configure/autostart, precisely because of that.

Instead this should be done via in indirect GC root (as in “guix build
-r the-root owncloud-client”) or, ideally, by having it GuixSD-managed.

Thoughts?

Ludo’.

Message #11 received at 30228 <at> debbugs.gnu.org (full text, mbox):

From: Efraim Flashner <efraim <at> flashner.co.il>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: 30228 <at> debbugs.gnu.org
Subject: Re: bug#30228: desktop files embedding full path
Date: Mon, 29 Jan 2018 21:39:46 +0200

[Message part 1 (text/plain, inline)]

On Wed, Jan 24, 2018 at 03:58:51PM +0100, Ludovic Courtès wrote:
> Hi,
> 
> Efraim Flashner <efraim <at> flashner.co.il> skribis:
> 
> > the owncloud-client package includes an option to add a .desktop entry
> > to $HOME/.configure/autostart/, which allows it to autostart when you
> > log in to your desktop environment. Because the full path of the binary
> > is in the .desktop file, it will always start THAT copy of
> > owncloud-client, even if it is garbage collected.
> 
> I think you shouldn’t copy manually the .desktop file to
> ~/.configure/autostart, precisely because of that.
> 
> Instead this should be done via in indirect GC root (as in “guix build
> -r the-root owncloud-client”) or, ideally, by having it GuixSD-managed.
> 
> Thoughts?
> 
> Ludo’.

I agree it shouldn't copy a .desktop file into .config/autostart/. In
this case, the offending code is here¹, so there's not much that can be
done about it. In mine I've changed the Exec line to
/var/guix/profiles/per-user/... so it'll work as expected. In this case
the code generates a desktop file on the fly, so modifying the .desktop
file shipping with applications wouldn't even help here.


¹ https://github.com/owncloud/client/blob/f326bf371d690f1929f7c5c06aebf53c7255daa6/src/common/utility_unix.cpp#L73

-- 
Efraim Flashner   <efraim <at> flashner.co.il>   אפרים פלשנר
GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted

[signature.asc (application/pgp-signature, inline)]

Message #14 received at 30228 <at> debbugs.gnu.org (full text, mbox):

From: ludo <at> gnu.org (Ludovic Courtès)
To: Efraim Flashner <efraim <at> flashner.co.il>
Cc: 30228 <at> debbugs.gnu.org
Subject: Re: bug#30228: desktop files embedding full path
Date: Tue, 30 Jan 2018 12:00:02 +0100

Hello,

Efraim Flashner <efraim <at> flashner.co.il> skribis:

> On Wed, Jan 24, 2018 at 03:58:51PM +0100, Ludovic Courtès wrote:
>> Hi,
>> 
>> Efraim Flashner <efraim <at> flashner.co.il> skribis:
>> 
>> > the owncloud-client package includes an option to add a .desktop entry
>> > to $HOME/.configure/autostart/, which allows it to autostart when you
>> > log in to your desktop environment. Because the full path of the binary
>> > is in the .desktop file, it will always start THAT copy of
>> > owncloud-client, even if it is garbage collected.
>> 
>> I think you shouldn’t copy manually the .desktop file to
>> ~/.configure/autostart, precisely because of that.
>> 
>> Instead this should be done via in indirect GC root (as in “guix build
>> -r the-root owncloud-client”) or, ideally, by having it GuixSD-managed.
>> 
>> Thoughts?
>> 
>> Ludo’.
>
> I agree it shouldn't copy a .desktop file into .config/autostart/. In
> this case, the offending code is here¹, so there's not much that can be
> done about it. In mine I've changed the Exec line to
> /var/guix/profiles/per-user/... so it'll work as expected. In this case
> the code generates a desktop file on the fly, so modifying the .desktop
> file shipping with applications wouldn't even help here.
>
>
> ¹ https://github.com/owncloud/client/blob/f326bf371d690f1929f7c5c06aebf53c7255daa6/src/common/utility_unix.cpp#L73

What do you think should be done on the Guix side?  We could patch the
code above to not install the .desktop file in ~/.config, for instance.

Thanks,
Ludo’.

Message #17 received at 30228 <at> debbugs.gnu.org (full text, mbox):

From: Efraim Flashner <efraim <at> flashner.co.il>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: 30228 <at> debbugs.gnu.org
Subject: Re: bug#30228: desktop files embedding full path
Date: Sun, 18 Feb 2018 21:03:38 +0200

[Message part 1 (text/plain, inline)]

On Tue, Jan 30, 2018 at 12:00:02PM +0100, Ludovic Courtès wrote:
> Hello,
> 
> Efraim Flashner <efraim <at> flashner.co.il> skribis:
> 
> > On Wed, Jan 24, 2018 at 03:58:51PM +0100, Ludovic Courtès wrote:
> >> Hi,
> >> 
> >> Efraim Flashner <efraim <at> flashner.co.il> skribis:
> >> 
> >> > the owncloud-client package includes an option to add a .desktop entry
> >> > to $HOME/.configure/autostart/, which allows it to autostart when you
> >> > log in to your desktop environment. Because the full path of the binary
> >> > is in the .desktop file, it will always start THAT copy of
> >> > owncloud-client, even if it is garbage collected.
> >> 
> >> I think you shouldn’t copy manually the .desktop file to
> >> ~/.configure/autostart, precisely because of that.
> >> 
> >> Instead this should be done via in indirect GC root (as in “guix build
> >> -r the-root owncloud-client”) or, ideally, by having it GuixSD-managed.
> >> 
> >> Thoughts?
> >> 
> >> Ludo’.
> >
> > I agree it shouldn't copy a .desktop file into .config/autostart/. In
> > this case, the offending code is here¹, so there's not much that can be
> > done about it. In mine I've changed the Exec line to
> > /var/guix/profiles/per-user/... so it'll work as expected. In this case
> > the code generates a desktop file on the fly, so modifying the .desktop
> > file shipping with applications wouldn't even help here.
> >
> >
> > ¹ https://github.com/owncloud/client/blob/f326bf371d690f1929f7c5c06aebf53c7255daa6/src/common/utility_unix.cpp#L73
> 
> What do you think should be done on the Guix side?  We could patch the
> code above to not install the .desktop file in ~/.config, for instance.
> 
> Thanks,
> Ludo’.

I've been thinking about it and it would also just be possible to patch
the exec line there to only have the binary name. As an unintended
consquence, if you did add the desktop entry to .config/autostart/ and
the exec was only 'owncloud-client' then we would match the other
distros' behaviors of not running uninstalled programs, if you were to
later uninstall owncloud-client from your profile.

I bet the reason it is coded this way is to allow for
/usr/bin/owncloud-client or /usr/local/bin/owncloud-client, but just
'owncloud-client' will pick up the executable if it is in the runpath.

I think that's the best option, to change the 'exec' line to just
'owncloud-client'.

-- 
Efraim Flashner   <efraim <at> flashner.co.il>   אפרים פלשנר
GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted

[signature.asc (application/pgp-signature, inline)]

Message #20 received at 30228 <at> debbugs.gnu.org (full text, mbox):

From: Ricardo Wurmus <rekado <at> elephly.net>
To: Efraim Flashner <efraim <at> flashner.co.il>
Cc: Ludovic Courtès <ludo <at> gnu.org>, 30228 <at> debbugs.gnu.org
Subject: Re: bug#30228: desktop files embedding full path
Date: Sun, 18 Feb 2018 21:06:11 +0100

Efraim Flashner <efraim <at> flashner.co.il> writes:

> On Tue, Jan 30, 2018 at 12:00:02PM +0100, Ludovic Courtès wrote:
>> Hello,
>> 
>> Efraim Flashner <efraim <at> flashner.co.il> skribis:
>> 
>> > On Wed, Jan 24, 2018 at 03:58:51PM +0100, Ludovic Courtès wrote:
>> >> Hi,
>> >> 
>> >> Efraim Flashner <efraim <at> flashner.co.il> skribis:
>> >> 
>> >> > the owncloud-client package includes an option to add a .desktop entry
>> >> > to $HOME/.configure/autostart/, which allows it to autostart when you
>> >> > log in to your desktop environment. Because the full path of the binary
>> >> > is in the .desktop file, it will always start THAT copy of
>> >> > owncloud-client, even if it is garbage collected.
>> >> 
>> >> I think you shouldn’t copy manually the .desktop file to
>> >> ~/.configure/autostart, precisely because of that.
>> >> 
>> >> Instead this should be done via in indirect GC root (as in “guix build
>> >> -r the-root owncloud-client”) or, ideally, by having it GuixSD-managed.
>> >> 
>> >> Thoughts?
>> >> 
>> >> Ludo’.
>> >
>> > I agree it shouldn't copy a .desktop file into .config/autostart/. In
>> > this case, the offending code is here¹, so there's not much that can be
>> > done about it. In mine I've changed the Exec line to
>> > /var/guix/profiles/per-user/... so it'll work as expected. In this case
>> > the code generates a desktop file on the fly, so modifying the .desktop
>> > file shipping with applications wouldn't even help here.
>> >
>> >
>> > ¹ https://github.com/owncloud/client/blob/f326bf371d690f1929f7c5c06aebf53c7255daa6/src/common/utility_unix.cpp#L73
>> 
>> What do you think should be done on the Guix side?  We could patch the
>> code above to not install the .desktop file in ~/.config, for instance.
>> 
>> Thanks,
>> Ludo’.
>
> I've been thinking about it and it would also just be possible to patch
> the exec line there to only have the binary name. As an unintended
> consquence, if you did add the desktop entry to .config/autostart/ and
> the exec was only 'owncloud-client' then we would match the other
> distros' behaviors of not running uninstalled programs, if you were to
> later uninstall owncloud-client from your profile.
>
> I bet the reason it is coded this way is to allow for
> /usr/bin/owncloud-client or /usr/local/bin/owncloud-client, but just
> 'owncloud-client' will pick up the executable if it is in the runpath.
>
> I think that's the best option, to change the 'exec' line to just
> 'owncloud-client'.

Would that pick up owncloud-client if there is an executable of that
name somewhere in PATH?  Could this be a security problem?

-- 
Ricardo

GPG: BCA6 89B6 3655 3801 C3C6  2150 197A 5888 235F ACAC
https://elephly.net

Message #23 received at 30228 <at> debbugs.gnu.org (full text, mbox):

From: Efraim Flashner <efraim <at> flashner.co.il>
To: Ricardo Wurmus <rekado <at> elephly.net>
Cc: Ludovic Courtès <ludo <at> gnu.org>, 30228 <at> debbugs.gnu.org
Subject: Re: bug#30228: desktop files embedding full path
Date: Sun, 18 Feb 2018 22:29:48 +0200

[Message part 1 (text/plain, inline)]

On Sun, Feb 18, 2018 at 09:06:11PM +0100, Ricardo Wurmus wrote:
> 
> Efraim Flashner <efraim <at> flashner.co.il> writes:
> 
> > On Tue, Jan 30, 2018 at 12:00:02PM +0100, Ludovic Courtès wrote:
> >> Hello,
> >> 
> >> Efraim Flashner <efraim <at> flashner.co.il> skribis:
> >> 
> >> > On Wed, Jan 24, 2018 at 03:58:51PM +0100, Ludovic Courtès wrote:
> >> >> Hi,
> >> >> 
> >> >> Efraim Flashner <efraim <at> flashner.co.il> skribis:
> >> >> 
> >> >> > the owncloud-client package includes an option to add a .desktop entry
> >> >> > to $HOME/.configure/autostart/, which allows it to autostart when you
> >> >> > log in to your desktop environment. Because the full path of the binary
> >> >> > is in the .desktop file, it will always start THAT copy of
> >> >> > owncloud-client, even if it is garbage collected.
> >> >> 
> >> >> I think you shouldn’t copy manually the .desktop file to
> >> >> ~/.configure/autostart, precisely because of that.
> >> >> 
> >> >> Instead this should be done via in indirect GC root (as in “guix build
> >> >> -r the-root owncloud-client”) or, ideally, by having it GuixSD-managed.
> >> >> 
> >> >> Thoughts?
> >> >> 
> >> >> Ludo’.
> >> >
> >> > I agree it shouldn't copy a .desktop file into .config/autostart/. In
> >> > this case, the offending code is here¹, so there's not much that can be
> >> > done about it. In mine I've changed the Exec line to
> >> > /var/guix/profiles/per-user/... so it'll work as expected. In this case
> >> > the code generates a desktop file on the fly, so modifying the .desktop
> >> > file shipping with applications wouldn't even help here.
> >> >
> >> >
> >> > ¹ https://github.com/owncloud/client/blob/f326bf371d690f1929f7c5c06aebf53c7255daa6/src/common/utility_unix.cpp#L73
> >> 
> >> What do you think should be done on the Guix side?  We could patch the
> >> code above to not install the .desktop file in ~/.config, for instance.
> >> 
> >> Thanks,
> >> Ludo’.
> >
> > I've been thinking about it and it would also just be possible to patch
> > the exec line there to only have the binary name. As an unintended
> > consquence, if you did add the desktop entry to .config/autostart/ and
> > the exec was only 'owncloud-client' then we would match the other
> > distros' behaviors of not running uninstalled programs, if you were to
> > later uninstall owncloud-client from your profile.
> >
> > I bet the reason it is coded this way is to allow for
> > /usr/bin/owncloud-client or /usr/local/bin/owncloud-client, but just
> > 'owncloud-client' will pick up the executable if it is in the runpath.
> >
> > I think that's the best option, to change the 'exec' line to just
> > 'owncloud-client'.
> 
> Would that pick up owncloud-client if there is an executable of that
> name somewhere in PATH?  Could this be a security problem?
> 

efraim <at> macbook41 ~$ echo $PATH
/home/efraim/.guix-profile/bin:/home/efraim/.guix-profile/sbin:/run/setuid-programs:/run/current-system/profile/bin:/run/current-system/profile/sbin

probably, but I assume you'd have to modify your default path to add
~/bin or something. It seems less worse than starting an older version
of owncloud-client or trying to start one that's been garbage collected.

-- 
Efraim Flashner   <efraim <at> flashner.co.il>   אפרים פלשנר
GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted

[signature.asc (application/pgp-signature, inline)]

Message #30 received at 30228-done <at> debbugs.gnu.org (full text, mbox):

From: Efraim Flashner <efraim <at> flashner.co.il>
To: 30228-done <at> debbugs.gnu.org
Subject: Re: bug#30228: desktop files embedding full path
Date: Wed, 20 Feb 2019 09:08:41 +0200

[Message part 1 (text/plain, inline)]

Fixed in commit 2b371f4dd5ddafa0786240b40408ef5c30d7a526

-- 
Efraim Flashner   <efraim <at> flashner.co.il>   אפרים פלשנר
GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted

[signature.asc (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.