search

pelzlpj / orpie

Curses-based RPN calculator
GNU General Public License v3.0
70 stars 5 forks source link

missing-call-to-chdir-with-chroot in /usr/bin/orpie #7

Closed jared-wallace closed 7 years ago

jared-wallace commented 8 years ago

This executable appears to call chroot without using chdir to change the current directory. This is likely an error and permits an attacker to break out of the chroot by using fchdir. While that's not always a security issue, this has to be checked.

pelzlpj commented 8 years ago

Evidence please. I'm not aware of any use of chroot.

jared-wallace commented 8 years ago

I'm just going off what rpmlint is reporting when run against the binary rpms:

rpmlint x86_64/orpie-1.5.2-1.x86_64.rpm orpie.x86_64: E: missing-call-to-chdir-with-chroot /usr/bin/orpie orpie.x86_64: E: missing-call-to-chdir-with-chroot /usr/bin/orpie-curses-keys orpie.x86_64: E: incorrect-fsf-address /usr/share/doc/orpie/COPYING 1 packages and 0 specfiles checked; 3 errors, 0 warnings.

If you can confirm these are false positives, then this can be closed. I just need to have an explanation for the rpmlint errors when the package gets reviewed.