diff options
| author | David Wragg <david@rabbitmq.com> | 2010-07-13 01:49:28 +0100 |
|---|---|---|
| committer | David Wragg <david@rabbitmq.com> | 2010-07-13 01:49:28 +0100 |
| commit | 354c3731cfa8fc71d523cfc0753bf9dccbc6fe42 (patch) | |
| tree | bc727123514e0bd1324a072d0b0548c4fa3d5eb9 /packaging | |
| parent | d33f188d9423144fc0c743d06cb1992fc277c2ce (diff) | |
| download | rabbitmq-server-git-354c3731cfa8fc71d523cfc0753bf9dccbc6fe42.tar.gz | |
Remove IFS setting on the su command
The script has lots of IFS vulnerabilities before it reaches the su
command. If we really want to guard against IFS, we should set it at
the top. But how many shell scripts have you ever seen that do that?
If the user sets IFS, and breaks things, it seem reasonable to regard
that as their problem. There is no security issue here because you
should already be root or the rabbitmq user to run the script.
Diffstat (limited to 'packaging')
| -rw-r--r-- | packaging/macports/Makefile | 18 |
1 files changed, 8 insertions, 10 deletions
diff --git a/packaging/macports/Makefile b/packaging/macports/Makefile index f67970a545..3a22eef08a 100644 --- a/packaging/macports/Makefile +++ b/packaging/macports/Makefile @@ -31,20 +31,18 @@ $(DEST)/Portfile: Portfile.in -f checksums.sed <$^ >$@ rm checksums.sed +# The purpose of the intricate substitution below is to set up similar +# environment vars to the ones that su will on Linux. On OS X, we +# have to use the -m option to su in order to be able to set the shell +# (which for the rabbitmq user would otherwise be /dev/null). But the +# -m option means that *all* environment vars get preserved. Erlang +# needs vars such as HOME to be set. So we have to set them +# explicitly. macports: dirs $(DEST)/Portfile for f in rabbitmq-asroot-script-wrapper rabbitmq-script-wrapper ; do \ cp $(COMMON_DIR)/$$f $(DEST)/files ; \ done - # The purpose of this intricate substitution is to set up the - # same environment vars that su will on Linux. On OS X, we - # have to use the -m option to su in order to be able to set - # the shell (which for the rabbitmq user would otherwise be - # /dev/null). But the -m option means that *all* environment - # vars get preserved. Erlang needs vars such as HOME to be - # set. So we have to set them explicitly. Note that the IFS - # value is "<space><tab><newline>" - sed -i -e 's|@SU_RABBITMQ_SH_C@|SHELL=/bin/sh HOME=/var/lib/rabbitmq IFS=" \ -" USER=rabbitmq LOGNAME=rabbitmq PATH="$$(eval `PATH=MACPORTS_PREFIX/bin /usr/libexec/path_helper -s`; echo $$PATH)" su -m rabbitmq -c|' \ + sed -i -e 's|@SU_RABBITMQ_SH_C@|SHELL=/bin/sh HOME=/var/lib/rabbitmq USER=rabbitmq LOGNAME=rabbitmq PATH="$$(eval `PATH=MACPORTS_PREFIX/bin /usr/libexec/path_helper -s`; echo $$PATH)" su -m rabbitmq -c|' \ $(DEST)/files/rabbitmq-script-wrapper cp patch-org.macports.rabbitmq-server.plist.diff $(DEST)/files if [ -n "$(MACPORTS_USERHOST)" ] ; then \ |