Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 308803

Summary: sys-admin/perl-cleaner-2_pre091219 unsafe under prefix!
Product: Gentoo/Alt Reporter: Stuart Shelton <srcshelton>
Component: Prefix SupportAssignee: Gentoo Prefix <prefix>
Status: RESOLVED INVALID    
Severity: critical    
Priority: High    
Version: unspecified   
Hardware: All   
OS: All   
Whiteboard:
Package list:
Runtime testing required: ---

Description Stuart Shelton 2010-03-10 10:33:29 UTC
$ which perl
/opt/gentoo/usr/bin/perl
$ perl -we 'foreach $component ( @INC ) { print "$component\n" }'
/opt/gentoo/usr/lib32/perl5/site_perl/5.10.1/mips-irix-thread-multi
/opt/gentoo/usr/lib32/perl5/site_perl/5.10.1
/opt/gentoo/usr/lib32/perl5/site_perl
/opt/gentoo/usr/lib32/perl5/vendor_perl/5.10.1/mips-irix-thread-multi
/opt/gentoo/usr/lib32/perl5/vendor_perl/5.10.1
/opt/gentoo/usr/lib32/perl5/vendor_perl
/opt/gentoo/usr/lib32/perl5/5.10.1/mips-irix-thread-multi
/opt/gentoo/usr/lib32/perl5/5.10.1
.
$ perl-cleaner -v -v -v --reallyall

 * Beginning a clean up of .ph files
 * Excluding files for 0.0.0 and 0.0.0/mipseb-irix-thread-multi from cleaning

 * Locating ph files for removal
 *   ...in /usr/bsd/lib/perl5/site_perl/5.10.0/mipseb-irix-thread-multi
/usr/bsd/lib/perl5/site_perl/5.10.0
/usr/bsd/lib/perl5/vendor_perl/5.10.0/mipseb-irix-thread-multi
/usr/bsd/lib/perl5/vendor_perl/5.10.0
/usr/bsd/lib/perl5/vendor_perl
/usr/bsd/lib/perl5/5.10.0/mipseb-irix-thread-multi
/usr/bsd/lib/perl5/5.10.0
 *       Check: /usr/bsd/lib/perl5/vendor_perl/5.10.0/mips-irix/ABIinfo.ph
 *         Found different version
 *   Removing: /usr/bsd/lib/perl5/vendor_perl/5.10.0/mips-irix/ABIinfo.ph
rm: remove write-protected regular file `/usr/bsd/lib/perl5/vendor_perl/5.10.0/mips-irix/ABIinfo.ph'? 


perl-cleaner should not be trying to touch any part of the filesystem outside of $EPREFIX, even if '--reallyall' is specified.

(This could be a question of semantics - but I'd still insist that perl-cleaner run from within a prefix should never attempt to erase files outside, no matter what the command-line options.  At the very least, this process will almost certainly fail due to permissions errors)
Comment 1 Jeremy Olexa (darkside) (RETIRED) archtester gentoo-dev Security 2010-07-29 12:51:53 UTC
If it happens with new versions, please re-open. thx