search

veracrypt / VeraCrypt

Disk encryption with strong security based on TrueCrypt
https://www.veracrypt.fr
Other
6.91k stars 946 forks source link

Generic Linux installer overwrites /usr/sbin if it's a symlink #888

Closed jfsen closed 2 years ago

jfsen commented 2 years ago

In some Linux distros, like Archlinux and its offshoots, /usr/sbin is a symbolic link to /usr/bin. The generic Linux installer offered on the VeraCrypt website replaces this symlink with a directory during the installation.

Expected behavior

If the installer tries to copy files into a directory which is a symlink, the installer should copy the files into the linked directory instead.

Observed behavior

The symlink is removed and replaced with a directory. /usr/sbin directory is now empty, except for the file installed by the VeraCrypt installer. As a result programs which are called from /usr/sbin can no longer be started.

Steps to reproduce

  1. Tested on EndeavourOS
  2. Download the generic installers and execute e.g. veracrypt-1.25.4-setup-gui-x64

Additional comments

Archlinux and EndeavourOS provide their own albeit out-of-date version of VeraCrypt in the official repo, so this should only affect a small subset of users. But if the installer handles every symlink this way, then potentially other Linux distributions are affected as well.

idrassi commented 2 years ago

Thank you for reporting this issue. I have pushed a fix for it (https://github.com/veracrypt/VeraCrypt/commit/3cf936459202bc5985bc54548a5325efb1fbc453) and I'm preparing release of version 1.25.8 that will contain it.