Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 291242 - media-video/vlc overwrites /usr/share/vlc/http/.hosts on re-emerge
Summary: media-video/vlc overwrites /usr/share/vlc/http/.hosts on re-emerge
Status: RESOLVED OBSOLETE
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: High minor (vote)
Assignee: Paweł Stankowski
URL:
Whiteboard:
Keywords:
Depends on: CVE-2013-6934
Blocks:
  Show dependency tree
 
Reported: 2009-10-30 23:55 UTC by Viktor S
Modified: 2014-11-15 10:17 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
support ~/.config/vlc/http-hosts (vlc-2.0.6-http-hosts.patch,523 bytes, patch)
2013-05-07 02:51 UTC, SpanKY
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Viktor S 2009-10-30 23:55:08 UTC
When re-emerging vlc the file in the subject is overwritten. This is a problem because the file contains IP numbers of hosts who should be able to remote control VLC. In other words; if you do not have a backup, it will be overwritten and you'll have to rewrite the whole thing. Not a major bug, but rather annoying before you figure it out.


$ emerge --info
Portage 2.1.7.1 (default/linux/amd64/10.0, gcc-4.4.2, glibc-2.10.1-r0, 2.6.30-gentoo-r6-sgx64 x86_64)
=================================================================
System uname: Linux-2.6.30-gentoo-r6-sgx64-x86_64-Intel-R-_Core-TM-2_Duo_CPU_E6750_@_2.66GHz-with-gentoo-2.0.1
Timestamp of tree: Thu, 29 Oct 2009 00:15:01 +0000
distcc 3.1 x86_64-pc-linux-gnu [disabled]
ccache version 2.4 [enabled]
app-shells/bash:     4.0_p35
dev-java/java-config: 2.1.9-r1
dev-lang/python:     2.6.3, 3.1.1-r1
dev-util/ccache:     2.4-r8
dev-util/cmake:      2.6.4-r3
sys-apps/baselayout: 2.0.1
sys-apps/openrc:     0.5.2-r1
sys-apps/sandbox:    2.2
sys-devel/autoconf:  2.13, 2.63-r1
sys-devel/automake:  1.8.5-r3, 1.9.6-r2, 1.10.2, 1.11
sys-devel/binutils:  2.20
sys-devel/gcc-config: 1.4.1
sys-devel/libtool:   2.2.6a
virtual/os-headers:  2.6.30-r1
ACCEPT_KEYWORDS="amd64 ~amd64"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -march=core2 -pipe -ggdb"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/X11/xkb /usr/share/config"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c /etc/udev/rules.d"
CXXFLAGS="-O2 -march=core2 -pipe -ggdb"
DISTDIR="/usr/portage/distfiles"
FEATURES="assume-digests ccache confcache distlocks fixpackages news parallel-fetch protect-owned sandbox sfperms splitdebug strict unmerge-logs unmerge-orphans userfetch"
GENTOO_MIRRORS="http://ftp.snt.utwente.nl/pub/os/linux/gentoo ftp://ftp.snt.utwente.nl/pub/os/linux/gentoo "
LANG="en_US.UTF8"
LDFLAGS="-Wl,-O1"
MAKEOPTS="-j3"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage/layman/games /usr/local/portage/layman/kde-testing /usr/local/portage/layman/java-overlay /usr/local/portage"
SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage"
USE="X a52 aac acl alsa amd64 berkdb bzip2 cairo cddax cddb cdr cli cracklib crypt cups curl curlwrappers dbus dga directfb dri dts dvd dvdr dvdread encode exif fbcon ffmpeg firefox flac fortran freetype ftp gd gdbm gif gpm hal htmlhandbook iconv idn imagemagick imap ipod ipv6 isdnlog java jpeg jpeg2k kde kontact lame latex maildir matroska mbox mime mmx mng modules mono mp3 mpeg mplayer msn mudflap multilib musepack musicbrainz mysql nas ncurses network nls nptl nptlonly ogg openal opengl openmp pam pcre pdf perl plasma png pppd python qt3 qt3support qt4 quicktime rdesktop readline realcodecs reflection rss samba sasl session spl sqlite sse sse2 ssl subversion svg symlink sysfs tcl tcpd threads tiff truetype unicode usb vorbis wavpack webkit wmf x264 xcomposite xinerama xml xorg xvid zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" ELIBC="glibc" INPUT_DEVICES="evdev keyboard mouse" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" USERLAND="GNU" VIDEO_CARDS="nvidia nv" 
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, FFLAGS, INSTALL_MASK, LC_ALL, LINGUAS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
Comment 1 Sebastian Luther (few) 2009-10-31 06:57:45 UTC
Those files under /usr/share aren't supposed to be edited by the user. Sure it doesn't have an equivalent in /etc that allows you to override stuff from the file in /usr/share? 

If you really see  no other option, you can put the file in CONFIG_PROTECT in make.conf (see man make.conf).
Comment 2 Viktor S 2009-10-31 08:54:02 UTC
Documentation of this is very, VERY sparse at best. But I've found a solution:
Changelog for 0.9 [1] says that VLC now uses the XDG Base Directory Specification [2]. This means that it ALSO uses ~/.local/share/vlc/ for configuration. The solution to this problem is to create a http directory there and make a .hosts file in that directory. Why this isn't documented (and that's where the real problem is!) just about anywhere I have no idea, but this at least makes the file stay between versions.

[1] http://wiki.videolan.org/Next_changes
[2] http://standards.freedesktop.org/basedir-spec/basedir-spec-0.6.html
Comment 3 Viktor S 2009-10-31 13:34:20 UTC
Updated the VLC wiki's page for the HTTP interface [1] to reflect this. Linux only for now though.

[1] http://wiki.videolan.org/Documentation:Modules/http_intf
Comment 4 Viktor S 2009-11-02 16:46:38 UTC
I misread the XDG spec. ~/.config/vlc/http/.hosts is the correct path. This does not work though; opened a thread on the VLC forum asking why. It can be found here: [1]

[1] http://forum.videolan.org/viewtopic.php?f=13&t=67411
Comment 5 Viktor S 2009-11-03 14:59:48 UTC
The reply from the VLC people (in the link I posted) was to make a symlink between this file and /etc since that is how debian does it.

Proposal:
On install, create a symlink between /usr/share/vlc/http/.hosts and /etc/vlc/http/.hosts in order to protect it from being overwritten on reinstall/upgrade of VLC. The /etc path in this proposal were chosen on the basis of consistency.
Comment 6 cyberbat 2012-10-21 18:26:46 UTC
Path to .hosts is /usr/share/vlc/lua/http/.hosts in vlc-2.0. It's used only with USE=httpd. May be it's time to change the header?
Problem still exists. I have added CONFIG_PROTECT=/usr/share/vlc/lua/http/.hosts to protect .hosts but I will be glad to see some reaction from package maintainers.
Comment 7 Alon Bar-Lev (RETIRED) gentoo-dev 2013-03-18 14:52:46 UTC
Yes, I agree the /usr/share/vlc/lua/http/.hosts should be moved to /etc/vlc/lua/http/.hosts and create symlink.

Why hasn't this handled for such a long time?
Comment 8 SpanKY gentoo-dev 2013-05-07 02:51:16 UTC
Created attachment 347562 [details, diff]
support ~/.config/vlc/http-hosts

using /etc is incorrect.  that is a site wide (and usually owned by root) paths.  vlc runs as users and should be loading from ~/ like it does with vlcrc.

using CONFIG_PROTECT is a stop-gap measure, but it's better than using /etc.  you can do this locally with:
echo CONFIG_PROTECT=/usr/share/vlc/lua/http/.hosts > /etc/env.d/99vlc-hosts

but here's a patch to implement per-user settings.  i think upstream is dumb for the stance they've taken (since it's wrong).
Comment 9 Tom Wijsman (TomWij) (RETIRED) gentoo-dev 2014-02-22 13:08:34 UTC
From what is visible, the file does no longer exists and the code is no longer present when inspecting the patch context; therefore I mark this obsolete.

http://git.videolan.org/?p=vlc.git;a=blob;f=share/lua/intf/http.lua;hb=refs/heads/master
Comment 10 SpanKY gentoo-dev 2014-04-29 22:03:18 UTC
(In reply to Tom Wijsman (TomWij) from comment #9)

acl file support has been removed starting in the 2.1.x series:
http://git.videolan.org/?p=vlc.git;a=commitdiff;h=fe31e42032f3e14d55eb57c73ab7070e5aafcce6

it's in 2.0.x and older.
Comment 11 Paweł Stankowski 2014-11-15 10:17:45 UTC
Support for 2.0.x branch has ended because of security bug 499806.