Temporary files written to predetermined location during build

[Rene Engelhard]

[ revisiting this thread since after all those unrelated replies it diesd. ]

Hi

On Wed, Aug 09, 2017 at 02:35:40PM +0200, Michael Stahl wrote:
> On 09.08.2017 14:27, Paul Menzel wrote:
> >> Building LibreOffice 5.4.0.3 with one user, and then building it with another
> >> user shows that it tries to write to the same paths in the temporary directory,
> >> which of course fails.
> >>
> >> ```
> >> […]
> >> ------------------------------------
> >> ... languages de_en-US ...
> >> ... analyzing files ...
> >> ... analyzing files with flag FILELIST ...
> >> filelist
> >> /dev/shm/bee-root/libreoffice/libreoffice-5.4.0.3-0/build/workdir/Package/xmlsec.filelist
> >> is empty
> >> ... analyzing files with flag SCPZIP_REPLACE ...
> >> ... analyzing all directories for this product ...
> >> ... analyzing links ...
> >> ... analyzing unix links ...
> >> ... creating profiles ...
> >> fatal: Not a git repository (or any parent up to mount point /dev)
> >> Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set).
> >> ERROR: Failure in installer.pm
> >> ERROR: ERROR: Cannot open file
> >> /tmp/LibreOffice//profiles/de_en-US/gid_Brand_Profile_Bootstrap_Ini/bootstraprc
> >> for writing at
> >> /dev/shm/bee-root/libreoffice/libreoffice-5.4.0.3-0/source/solenv/bin/modules/installer/files.pm
> >> line 85.
> 
> that definitely looks like a bug, it should create that inside some
> random subdirectory...

Yes, especially as /tmp/<something predictable> is (also) a security-related bug
(possible symlink attack)..

See also http://bugs.debian.org/875415 which I just received...

Regards,

Rene