summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rwxr-xr-xbin/etc-update33
1 files changed, 22 insertions, 11 deletions
diff --git a/bin/etc-update b/bin/etc-update
index 0a6a79e9c..268185676 100755
--- a/bin/etc-update
+++ b/bin/etc-update
@@ -367,18 +367,26 @@ Please select from the menu above (-1 to ignore this update): "
}
function do_merge() {
+ # make sure we keep the merged file in the secure tempdir
+ # so we dont leak any information contained in said file
+ # (think of case where the file has 0600 perms; during the
+ # merging process, the temp file gets umask perms!)
local file="${1}"
local ofile="${2}"
- local mfile="${2}.merged"
+ local mfile="${TMP}/${2}.merged"
local -i my_input=0
echo "${file} ${ofile} ${mfile}"
- if [ -e ${mfile} ] ; then
+ if [[ -e ${mfile} ]] ; then
echo "A previous version of the merged file exists, cleaning..."
- rm ${rm_opts} ${mfile}
+ rm ${rm_opts} "${mfile}"
fi
+ # since mfile will be like $TMP/path/to/original-file.merged, we
+ # need to make sure the full /path/to/ exists ahead of time
+ mkdir -p "${mfile%/*}"
+
until (( ${my_input} == -1 )); do
echo "Merging ${file} and ${ofile}"
$(echo "${merge_command}" |
@@ -402,8 +410,8 @@ Please select from the menu above (-1 to exit, losing this merge): "
chown "$(stat -f %Su:%Sg "${ofile}")" "${mfile}"
chmod $(stat -f %Mp%Lp "${ofile}") "${mfile}"
fi
- mv ${mv_opts} ${mfile} ${ofile}
- rm ${rm_opts} ${file}
+ mv ${mv_opts} "${mfile}" "${ofile}"
+ rm ${rm_opts} "${file}"
return 255
;;
2) ( echo "Showing differences between ${ofile} and ${mfile}"
@@ -417,7 +425,7 @@ Please select from the menu above (-1 to exit, losing this merge): "
4) ${EDITOR:-nano -w} "${mfile}"
continue
;;
- 5) rm ${rm_opts} ${mfile}
+ 5) rm ${rm_opts} "${mfile}"
return 0
;;
*) continue
@@ -425,7 +433,7 @@ Please select from the menu above (-1 to exit, losing this merge): "
esac
done
done
- rm ${rm_opts} ${mfile}
+ rm ${rm_opts} "${mfile}"
return 255
}
@@ -439,7 +447,7 @@ function die() {
[ ${count} -gt 0 ] && echo "NOTE: ${count} updates remaining"
fi
- rm -rf ${TMP}
+ rm -rf "${TMP}"
exit ${2}
}
@@ -461,9 +469,12 @@ export PORTAGE_TMPDIR
#echo $CONFIG_PROTECT_MASK
#export PORTAGE_TMPDIR=$(/usr/lib/portage/bin/portageq envvar PORTAGE_TMPDIR)
-TMP="${PORTAGE_TMPDIR}/$$"
-rm -rf ${TMP} 2> /dev/null
-mkdir ${TMP} || die "failed mkdir command!" 1
+TMP="${PORTAGE_TMPDIR}/etc-update-$$"
+rm -rf "${TMP}" 2> /dev/null
+mkdir "${TMP}" || die "failed to create temp dir" 1
+# make sure we have a secure directory to work in
+chmod 0700 "${TMP}" || die "failed to set perms on temp dir" 1
+chown ${UID:-0}:${GID:-0} "${TMP}" || die "failed to set ownership on temp dir" 1
# I need the CONFIG_PROTECT value
#CONFIG_PROTECT=$(/usr/lib/portage/bin/portageq envvar CONFIG_PROTECT)