Re: Temporary files written to predetermined location during build

[ revisiting this thread since after all those unrelated replies it diesd. ]

Hi

On Wed, Aug 09, 2017 at 02:35:40PM +0200, Michael Stahl wrote:
> On 09.08.2017 14:27, Paul Menzel wrote:
> > > Building LibreOffice 5.4.0.3 with one user, and then building it with another
> > > user shows that it tries to write to the same paths in the temporary directory,
> > > which of course fails.
> > >
> > > ```
> > > […]
> > > ------------------------------------
> > > ... languages de_en-US ...
> > > ... analyzing files ...
> > > ... analyzing files with flag FILELIST ...
> > > filelist
> > > /dev/shm/bee-root/libreoffice/libreoffice-5.4.0.3-0/build/workdir/Package/xmlsec.filelist
> > > is empty
> > > ... analyzing files with flag SCPZIP_REPLACE ...
> > > ... analyzing all directories for this product ...
> > > ... analyzing links ...
> > > ... analyzing unix links ...
> > > ... creating profiles ...
> > > fatal: Not a git repository (or any parent up to mount point /dev)
> > > Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set).
> > > ERROR: Failure in installer.pm
> > > ERROR: ERROR: Cannot open file
> > > /tmp/LibreOffice//profiles/de_en-US/gid_Brand_Profile_Bootstrap_Ini/bootstraprc
> > > for writing at
> > > /dev/shm/bee-root/libreoffice/libreoffice-5.4.0.3-0/source/solenv/bin/modules/installer/files.pm
> > > line 85.
>
> that definitely looks like a bug, it should create that inside some
> random subdirectory...

Yes, especially as /tmp/<something predictable> is (also) a security-related bug
(possible symlink attack)..

See also http://bugs.debian.org/875415 which I just received...

Regards,

Rene