search

puppylinux-woof-CE / woof-CE

woof - the Puppy builder
GNU General Public License v2.0
389 stars 278 forks source link

Seems to be a big dangerous bug in the sfs-load-on-the-fly program #3834

Open bigpup1 opened 1 year ago

bigpup1 commented 1 year ago

Here is a topic about a person that got confused on how to use an ISO. They opened the Puppy version ISO Clicked on the sfs files in the ISO They were able to get some kind of loading into the operating filesystem.

Full info given in the topic: https://forum.puppylinux.com/viewtopic.php?t=7801****

mavrothal commented 1 year ago

@bigpup1 this is what is written in the post you linked.

"When I explored the .iso, the dialogue box asked if I wanted to mount the sfs or install. I opted to run the distro once using SFS-on-the-fly. I took the .iso out of root and used the .iso image from the scratch drive. I placed +tmp+mozilla_root0+stretch-7.5-uefi-k.4.9.149.iso into sda1 per the on-the-fly instructions. I rebooted. ... ... The second try had an extra line in the loading menu. That line says: 'Loading extra SFS fixing menu'. I deleted +tmp+mozilla_root0+stretch-7.5-uefi-k.4.9.149.iso from sda1 and SFS-on-the-fly. The 'Loading extra SFS' message still appears."

I can not make any sense of it! Can you please described in your own words First what do you think the user actually did and what is the bug in to SFS-load-on-the-fly? i.e. what the program did wrong or should not do?

bigpup1 commented 1 year ago

The way I read the statement. The person opened the Puppy version ISO, that was different version of Puppy, from the one they where running. so they see all the different SFS files in it. All of the SFS's are not programs packaged as SFS. They are the different SFS's that make up the Puppy version.

They left clicked on one of the SFS files and the window pops up, giving options for what to do.

view contents cancel install SFS

They choose install SFS.

So, it tried to install the SFS

This not being a program sfs it messed up the operating system being used.

Example using a sfs from Bionicpup64 8.0.iso Running a completely different Puppy version to do this process. Screenshot(2)

To me the only options that should show for a Puppy versions individual sfs files. view contents cancel

mavrothal commented 1 year ago

So the idea is that SFS loader should allow to view but not install any other SFS named puppy_<distroname>.sfs * This is fairly simple assuming no one else wants to name their personal SFSs puppy_<something>.sfs or that the next puppy spinoff diverse from the proper naming scheme for the main distro sfs. Which boils down to the dilemma "protect from stupidity/ignorance or curb freedom of naming?" Given that this mistake is not detrimental to puppy (see pfix=ram), I would personally opt for freedom. However, is pretty simple to make a PR with the proposed change and see if other people here or elsewhere adopt it.

*I'm assuming you do not suggest to protect against {a,b,f,y,z}drv_<name>.sfs or that want to screen the name for each of the hundreds of puppies out there.