[lkml]   [2002]   [Mar]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: Bitkeeper licence issues

    > > > > Pavel, the problem here is your fundamental distrust.
    > > > By giving me binary-only installer you ask me to trust you. You ask me
    > > > to trust you without good reason [it only generates .tar.gz and
    > > > shellscript, why should it be binary? Was not shar designed to handle
    > > > that?], and that's pretty suspect.
    > >
    > > Bitmover doing anything remotely suspect in an executable installer
    > > would be commercial suicide, do you distrust realplayer too?
    > And all our installer does, and I will give you the code if you want it,
    > I'd be happy to even have Pavel audit it, is make two arrays,

    Okay, you wanted audit ;-).

    > main()
    > {
    > char installer_name[200];
    > char data_name[200];
    > char cmd[2048];
    > int fd;
    > fprintf(stderr, "Please wait while we unpack the installer...");
    > sprintf(installer_name, "/tmp/installer%d", getpid());
    > fd = creat(installer_name, 0777);

    If nasty user on same system creates symlink (ln -s /etc/passwd
    /tmp/installer123), he may overwrite any file on the system. You probably want

    fd = open(installer_name, O_WRONLY | O_TRUNC | O_CREAT | O_EXCL, 0755);

    Same goes for data.
    Casualities in World Trade Center: ~3k dead inside the building,
    cryptography in U.S.A. and free speech in Czech Republic.
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:25    [W:0.021 / U:0.120 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site