From perl-diddler@tlinx.org

Created by perl-diddler@tlinx.org

The perl test suite doesn't accurately test copying of permission
bits in it's copy routines (in lib/File/Copy):

lib/File/Copy ................................................. # Failed test 'Permission bits set correctly'
# at ../lib/File/Copy.t line 363.
# got: 'rw-rw-r--'
# expected: 'rw-rw-rw-'
# Failed test 'Permission bits set correctly'
# at ../lib/File/Copy.t line 364.
# got: 'rw-rw-r--'
# expected: 'rw-rw-rw-'
# Failed test 'Permission bits set correctly'
...
# Failed test 'Permission bits set correctly'
# at ../lib/File/Copy.t line 364.
# got: 'rw-rw-r--'
# expected: '---------'
# Looks like you failed 112 tests of 466.
FAILED at test 73

It seems to think that 'other' should have write permission
in the 1st tests, but in the last test shown,
it thinks the file should have no access permissions, but
it does (should that be flagged as a security bug?).

If the test suite is running on a file system with ACL's,
(not uncommon these days), and perl was built in a directory
(like "/home") that has a default-file acl with a default
for "other" limited to r-x, as in this acl:

Ishtar:perl/perl-5.24/lib/File> lsacl .
[u::rwx,g::rwx,o::r-x/u::rwx,g::rwx,o::r-x] .

(the 1st ACL, from the '[' to the '/' is the acl on the directory,
the 2nd ACL from '/' to ']' is the default acl for things created in
the directory. New files & dirs get the default acl:

Ishtar:perl/perl-5.24/lib/File> ll file
-rw-rw-r-- 1 0 Apr 3 00:56 file
Ishtar:perl/perl-5.24/lib/File> umask 0
Ishtar:perl/perl-5.24/lib/File> touch file2
Ishtar:perl/perl-5.24/lib/File> ll file2
-rw-rw-r-- 1 0 Apr 3 00:56 file2
Ishtar:perl/perl-5.24/lib/File> mkdir test
Ishtar:perl/perl-5.24/lib/File> ll -d test
drwxrwxr-x 2 6 Apr 3 00:56 test/
Ishtar:perl/perl-5.24/lib/File> lsacl .
[u::rwx,g::rwx,o::r-x/u::rwx,g::rwx,o::r-x] .

Changing both acls on dir 'test':
chacl -b u::rwx,g::rwx,o::rwx u::rwx,g::rwx,o::rwx test

Now touch creates file w/expected permissions:
Ishtar:perl/perl-5.24/lib/File> touch test/file2
Ishtar:perl/perl-5.24/lib/File> ll test/file2
-rw-rw-rw- 1 0 Apr 3 01:01 test/file2

--------------

Note, linux 'cp' shows the same behavior (write bit turned off
on file created in dir defaulting to no-write for other):

Ishtar:perl/perl-5.24/lib/File> /usr/bin/cp file2 file3
Ishtar:perl/perl-5.24/lib/File> ll file?
-rw-rw-rw- 1 0 Apr 3 00:56 file2
-rw-rw-r-- 1 0 Apr 3 01:04 file3

But in dir w/all bits defaulted to on for 'other', (in dir test):

Ishtar:perl/perl-5.24/lib/File> /usr/bin/cp file2 test/file3
Ishtar:perl/perl-5.24/lib/File> ll test/file3
-rw-rw-rw- 1 0 Apr 3 01:05 test/file3

Now it works.

Hopefully perl not setting perms-bits to '000' isn't
a security problem somewhere, as it isn't working.

FWIW, 'lsacl' is a bash script to show file acl's in the
same form as used by 'chacl'. "chacl -l" should perform
a similar function.

Perl Info


Flags:
    category=core
    severity=high

Site configuration information for perl 5.16.3:

Configured by law at Wed Jan 22 12:58:58 PST 2014.

Summary of my perl5 (revision 5 version 16 subversion 3) configuration:
   
  Platform:
    osname=linux, osvers=3.12.0-isht-van, archname=x86_64-linux-thread-multi-ld
    uname='linux ishtar 3.12.0-isht-van #1 smp preempt wed nov 13 16:50:51 pst 2013 x86_64 x86_64 x86_64 gnulinux '
    config_args=''
    hint=previous, useposix=true, d_sigaction=define
    useithreads=define, usemultiplicity=define
    useperlio=define, d_sfio=undef, uselargefiles=define, usesocks=undef
    use64bitint=define, use64bitall=define, uselongdouble=define
    usemymalloc=n, bincompat5005=undef
  Compiler:
    cc='gcc', ccflags ='-D_REENTRANT -D_GNU_SOURCE -fno-strict-aliasing -pipe -fstack-protector -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64',
    optimize='-g -O2',
    cppflags='-D_REENTRANT -D_GNU_SOURCE -fno-strict-aliasing -pipe -fstack-protector -D_REENTRANT -D_GNU_SOURCE -fno-strict-aliasing -pipe -fstack-protector -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -D_REENTRANT -D_GNU_SOURCE -fno-strict-aliasing -pipe -fstack-protector -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64'
    ccversion='', gccversion='4.8.1 20130909 [gcc-4_8-branch revision 202388]', gccosandvers=''
    intsize=4, longsize=8, ptrsize=8, doublesize=8, byteorder=12345678
    d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=16
    ivtype='long', ivsize=8, nvtype='long double', nvsize=16, Off_t='off_t', lseeksize=8
    alignbytes=16, prototype=define
  Linker and Libraries:
    ld='gcc', ldflags ='-g -fstack-protector -fPIC'
    libpth=/usr/lib64 /lib64
    libs=-lnsl -lndbm -lgdbm -ldb -ldl -lm -lcrypt -lutil -lpthread -lc -lgdbm_compat
    perllibs=-lnsl -ldl -lm -lcrypt -lutil -lpthread -lc
    libc=/lib/libc-2.18.so, so=so, useshrplib=true, libperl=libperl-5.16.3.so
    gnulibc_version='2.18'
  Dynamic Linking:
    dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-Wl,-E -Wl,-rpath,/home/perl/perl-5.16.3/lib/x86_64-linux-thread-multi-ld/CORE'
    cccdlflags='-fPIC', lddlflags='-shared -g -O2 -fstack-protector -fPIC'

Locally applied patches:
    


@INC for perl 5.16.3:
    /home/perl/perl-5.16.3/lib/site/x86_64-linux-thread-multi-ld
    /home/perl/perl-5.16.3/lib/site
    /home/perl/perl-5.16.3/lib/x86_64-linux-thread-multi-ld
    /home/perl/perl-5.16.3/lib
    .


Environment for perl 5.16.3:
    HOME=/home/law
    LANG (unset)
    LANGUAGE (unset)
    LC_COLLATE=C
    LC_CTYPE=en_US.UTF-8
    LC_MESSAGES=C
    LC_MONETARY=C
    LC_NUMERIC=C
    LC_TIME=C
    LD_LIBRARY_PATH (unset)
    LOGDIR (unset)
    PATH=/home/perl/perl-5.24:/sbin:.::/home/law/bin:/usr/local/bin:/usr/bin:/bin:/usr/games:/opt/kde3/bin:/usr/lib/mit/bin:/usr/lib/mit/sbin:/usr/sbin:/etc/local/func_lib:/home/law/lib:/home/law/bin/lib
    PERL_BADLANG (unset)
    SHELL=/bin/bash

perl test suite bug #15939

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions