From: Laurent Sansonetti <laurent.sansonetti@...>
Date: 2006-10-02T22:31:54+09:00
Subject: Insecure warnings on sticky-bit directories

------=_Part_60162_30336316.1159795911692
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Hi,

Currently, Ruby prints a warning when a directory that is part of
$PATH is world-writable, even if it has the sticky-bit set.

$ stat -Lx /tmp
  File: "/tmp"
  Size: 340          FileType: Directory
  Mode: (0777/drwxrwxrwt)         Uid: (    0/    root)  Gid: (    0/   wheel)
Device: 14,5   Inode: 24    Links: 5
Access: Mon Oct  2 14:14:43 2006
Modify: Mon Oct  2 15:10:13 2006
Change: Mon Oct  2 15:10:13 2006
$ PATH=$PATH:/tmp ruby -e "system('id')"
-e:1: warning: Insecure world writable dir /tmp, mode 041777
uid=501(lrz) gid=501(lrz) groups=501(lrz), 81(_appserveradm),
79(_appserverusr), 80(admin)

This is due to the fact that file.c:rb_path_check() always call
path_check_0() with the loadpath argument to Qtrue. A fix would be to
make sure the loadpath argument is only set when checking the load
path, and not otherwise.

Here is a quick tiny patch against 1.8.5 source tree, feel free to
check it out. It seems to solve the problem.

Laurent

------=_Part_60162_30336316.1159795911692
Content-Type: application/octet-stream; name="fix-stickybit-warn.diff"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="fix-stickybit-warn.diff"
X-Attachment-Id: f_essw0omm

LS0tIGZpbGUuYy5vbGQJMjAwNi0xMC0wMiAxNToxNTo0Ni4wMDAwMDAwMDAgKzAyMDAKKysrIGZp
bGUuYwkyMDA2LTEwLTAyIDE1OjE2OjI5LjAwMDAwMDAwMCArMDIwMApAQCAtNDE1MSw5ICs0MTUx
LDEwIEBACiAjZW5kaWYKIH0KIAotaW50Ci1yYl9wYXRoX2NoZWNrKHBhdGgpCitzdGF0aWMgaW50
CitfX3JiX3BhdGhfY2hlY2socGF0aCwgbG9hZHBhdGgpCiAgICAgY2hhciAqcGF0aDsKKyAgICBp
bnQgbG9hZHBhdGg7CiB7CiAjaWZuZGVmIERPU0lTSAogICAgIGNoYXIgKnAwLCAqcCwgKnBlbmQ7
CkBAIC00MTY3LDcgKzQxNjgsNyBAQAogICAgIGlmICghcCkgcCA9IHBlbmQ7CiAKICAgICBmb3Ig
KDs7KSB7Ci0JaWYgKCFwYXRoX2NoZWNrXzAocmJfc3RyX25ldyhwMCwgcCAtIHAwKSwgUXRydWUp
KSB7CisJaWYgKCFwYXRoX2NoZWNrXzAocmJfc3RyX25ldyhwMCwgcCAtIHAwKSwgbG9hZHBhdGgp
KSB7CiAJICAgIHJldHVybiAwOwkJLyogbm90IHNhZmUgKi8KIAl9CiAJcDAgPSBwICsgMTsKQEAg
LTQxNzksNiArNDE4MCwyMCBAQAogICAgIHJldHVybiAxOwogfQogCitpbnQKK3JiX3BhdGhfY2hl
Y2socGF0aCkKKyAgICBjaGFyICpwYXRoOworeworICAgIHJldHVybiBfX3JiX3BhdGhfY2hlY2so
cGF0aCwgUWZhbHNlKTsKK30KKworaW50CityYl9sb2FkcGF0aF9jaGVjayhwYXRoKQorICAgIGNo
YXIgKnBhdGg7Cit7CisgICAgcmV0dXJuIF9fcmJfcGF0aF9jaGVjayhwYXRoLCBRdHJ1ZSk7Cit9
CisKICNpZiBkZWZpbmVkKF9fTUFDT1NfXykgfHwgZGVmaW5lZChyaXNjb3MpCiBzdGF0aWMgaW50
CiBpc19tYWNvc19uYXRpdmVfcGF0aChwYXRoKQpAQCAtNDMxNSw3ICs0MzMwLDcgQEAKIAl9CiAJ
ZWxzZSB7CiAJICAgIGxwYXRoID0gUlNUUklORyh0bXApLT5wdHI7Ci0JICAgIGlmIChyYl9zYWZl
X2xldmVsKCkgPj0gMSAmJiAhcmJfcGF0aF9jaGVjayhscGF0aCkpIHsKKwkgICAgaWYgKHJiX3Nh
ZmVfbGV2ZWwoKSA+PSAxICYmICFyYl9sb2FkcGF0aF9jaGVjayhscGF0aCkpIHsKIAkJcmJfcmFp
c2UocmJfZVNlY3VyaXR5RXJyb3IsICJsb2FkaW5nIGZyb20gdW5zYWZlIHBhdGggJXMiLCBscGF0
aCk7CiAJICAgIH0KIAl9Cg==
------=_Part_60162_30336316.1159795911692--