[Bug build/13888] /tmp usage during testing

["cvs-commit at gcc dot gnu.org" <sourceware-bugzilla at sourceware dot org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=13888

--- Comment #5 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, master has been updated
       via  27f10a09630cac9bc0816e2a46cd9912379aaea8 (commit)
      from  05598a0907cad1350962e89b781215209a785d92 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=27f10a09630cac9bc0816e2a46cd9912379aaea8

commit 27f10a09630cac9bc0816e2a46cd9912379aaea8
Author: Joseph Myers <joseph@codesourcery.com>
Date:   Tue Jun 26 21:48:48 2018 +0000

    Fix hardcoded /tmp paths in testing (bug 13888).

    As noted in bug 13888, and as I noted previously in
    <https://sourceware.org/ml/libc-alpha/2000-10/msg00111.html>, various
    tests used hardcoded paths in /tmp, so posing issues for simultaneous
    test runs from different build directories.

    This patch fixes such uses of hardcoded file names to put them in the
    build directory instead (in the case of stdio-common/bug5 the file
    names are changed as well, to avoid a conflict with the name bug5.out
    also used for the automatic test output redirection).  It also fixes
    test-installation.pl likewise (that was using filenames with $$ in
    them rather than strictly hardcoded names, but that's still not good
    practice for temporary file naming).

    Note that my list of files changed is not identical to that in bug
    13888.  I added tst-spawn3.c and test-installation.pl, and removed
    some tests that seem to me (now) to create temporary files securely
    (simply using /tmp is not itself a problem if the temporary files are
    handled properly with mkstemp; I haven't checked whether those tests
    used to do things insecurely).  conformtest is not changed because the
    makefiles always pass a --tmpdir option so the /tmp default is
    irrelevant, and for the same reason there is no actual problem with
    nptl/tst-umask1.c because again the makefiles always override the
    default.

    nptl/sockperf.c is ignored because there is no code to run it;
    probably that file should actually be removed.

    Some tests use the mktemp function, but I think they all use it in a
    way that *is* secure (for generating names for directories / sockets /
    fifos / symlinks, where the operation using the name will not follow
    symlinks and so there is no potential for a symlink attack on the
    account running the testsuite).

    Some tests use the tmpnam function to generate temporary file names.
    This is in principle insecure, but not addressed by this patch (I
    consider it a separate issue from the fully hardcoded paths).

    Tested for x86_64.

        [BZ #13888]
        * posix/Makefile (CFLAGS-tst-spawn3.c): New variable.
        * posix/tst-spawn3.c (do_test): Put tst-spwan3.pid in OBJPFX, not
        /tmp.
        * scripts/test-installation.pl: Put temporary files in build
        directory, not /tmp.
        * stdio-common/Makefile (CFLAGS-bug3.c): New variable.
        (CFLAGS-bug4.c): Likewise.
        (CFLAGS-bug5.c): Likewise.
        (CFLAGS-test-fseek.c): Likewise.
        (CFLAGS-test-popen.c): Likewise.
        (CFLAGS-test_rdwr.c): Likewise.
        * stdio-common/bug3.c (main): Put temporary file in OBJPFX, not
        /tmp.
        * stdio-common/bug4.c (main): Likewise.
        * stdio-common/bug5.c (main): Likewise.
        * stdio-common/test-fseek.c (TESTFILE): Likewise.
        * stdio-common/test-popen.c (do_test): Likewise.
        * stdio-common/test_rdwr.c (main): Likewise.

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog                    |   22 ++++++++++++++++++++++
 posix/Makefile               |    1 +
 posix/tst-spawn3.c           |    4 ++--
 scripts/test-installation.pl |   14 ++++++++------
 stdio-common/Makefile        |    7 +++++++
 stdio-common/bug3.c          |    2 +-
 stdio-common/bug4.c          |    2 +-
 stdio-common/bug5.c          |    4 ++--
 stdio-common/test-fseek.c    |    2 +-
 stdio-common/test-popen.c    |    8 ++++----
 stdio-common/test_rdwr.c     |    2 +-
 11 files changed, 50 insertions(+), 18 deletions(-)

-- 
You are receiving this mail because:
You are on the CC list for the bug.