Opened 14 years ago

Closed 14 years ago

#2487 closed defect (fixed)

Installed tcl/tkConfig.sh

Reported by: Randy McMurchy Owned by: Ag. Hatzimanikas
Priority: high Milestone: 6.3
Component: BOOK Version: SVN
Severity: major Keywords: tclConfig.sh tkConfig.sh
Cc:

Description

Ag pointed out in BLFS-Dev that the installed tcl/tkConfig.sh files contain references to the initial build directory. Alexander pointed out that it could lead to exploitation of the system.

The discussion on BLFS-Dev contains several "fixes" for the issue. This ticket is just a reminder that we need to implement it in the book once it is decided which "fix" to use.

Change History (4)

comment:1 by Ag. Hatzimanikas, 14 years ago

Owner: changed from blfs-book@… to Ag. Hatzimanikas
Status: newassigned

Preferred solution so far at:

http://linuxfromscratch.org/pipermail/blfs-dev/2008-March/018447.html

sed -i \
    -e "s@^\(TCL_SRC_DIR='\).*@\1/usr/include'@" \
    -e "/TC_B/s@='\(-L\)\?.*unix@='\1/usr/lib@" \
    -e "/SEARCH/s/=.*/=''/" \
    tclConfig.sh
sed -i \    
    -e "s@^\(TK_SRC_DIR='\).*@\1/usr/include'@" \
    -e "/TK_B/s@='\(-L\)\?.*unix@='\1/usr/lib@" \
    -e "/SEARCH/s/=.*/=''/" \
    tkConfig.sh

Those seds are going to be applied after make and before the installation. There are already comments in the xml pages with text explaining the issue, that are going to be used again.

comment:2 by Ag. Hatzimanikas, 14 years ago

Keywords: tclConfig.sh tkConfig.sh added
Resolution: fixed
Status: assignedclosed

Fixed in r7318.

Thanks to all who contributed input to fix this mess.

comment:3 by Randy McMurchy, 14 years ago

Resolution: fixed
Status: closedreopened

I don't think the sed is doing what Ag wants it to. I tested twice.

Reopening the ticket.

comment:4 by Ag. Hatzimanikas, 14 years ago

Resolution: fixed
Status: reopenedclosed

Yes It was a copy/paste from the original post to blfs-dev mailing list, where there was a typo at the first place, sorry.

Many thanks Randy for the testing. To be honest, I also wanted to say "I owe you a favor" but I thought it twice, so only the "thanks" for the moment. :)

Note: See TracTickets for help on using tickets.