https://bugzilla.novell.com/show_bug.cgi?id=864194 https://bugzilla.novell.com/show_bug.cgi?id=864194#c0 Summary: Percona Toolkit automatic version check transmits information to external entity Classification: openSUSE Product: openSUSE 13.1 Version: Final Platform: All OS/Version: openSUSE 13.1 Status: NEW Severity: Normal Priority: P5 - None Component: Other AssignedTo: bnc-team-screening@forge.provo.novell.com ReportedBy: Andreas.Stieger@gmx.de QAContact: qa-bugs@suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux i686; rv:27.0) Gecko/20100101 Firefox/27.0
From https://bugs.launchpad.net/percona-toolkit/+bug/1279502 There is a security / privacy concern, even though the automatic version check is mentioned on the change log.
It would make sense for a distribution maintained package to turn this off by default. Reproducible: Always Steps to Reproduce: user@host:~> PTDEBUG=1 pt-index-usage user#host:~> PTDEBUG=1 pt-index-usage 2>&1 | grep VersionCheck Actual Results: user#host:~> PTDEBUG=1 pt-index-usage [...] # OptionParser:974 9596 version-check default: yes # VersionCheck:5696 9596 Version check file percona-version-check in /tmp # VersionCheck:5810 9596 Version check file /tmp/percona-version-check contents: 0,1390762187 [...] user#host:~> PTDEBUG=1 pt-index-usage 2>&1 | grep VersionCheck # VersionCheck:5716 9621 FindBin::Bin: /usr/bin # VersionCheck:5875 9621 SELECT CONCAT(@@hostname, @@port) # VersionCheck:5896 9621 MySQL instance: d613005ef7763ae15e44be64c85ffe8b tux3306 $VAR1 = {}; # VersionCheck:5696 9621 Version check file percona-version-check in /tmp # VersionCheck:5810 9621 Version check file /tmp/percona-version-check contents: 0,1390762187 # VersionCheck:5818 9621 Intsance d613005ef7763ae15e44be64c85ffe8b last checked 1390762187 now 1392584082 diff 1821895 hours until next check -482.08 # VersionCheck:5825 9621 Time to check $VAR1 = { # VersionCheck:5818 9621 Intsance 0 last checked 1390762187 now 1392584082 diff 1821895 hours until next check -482.08 # VersionCheck:5825 9621 Time to check $VAR1 = { # VersionCheck:5739 9621 2 instances to check # VersionCheck:5748 9621 Using https # VersionCheck:5914 9621 Server response: $VAR1 = { # VersionCheck:6015 9621 Items: $VAR1 = { # VersionCheck:6160 9621 Perl version for $DBD::mysql::VERSION = 4.021 # VersionCheck:6160 9621 Perl version for $Percona::Toolkit::VERSION = 2.2.6 # VersionCheck:6149 9621 Perl version 5.18.1 # VersionCheck:6075 9621 platform: Linux # VersionCheck:6080 9621 lsb_release: /usr/bin/lsb_release # VersionCheck:6139 9621 OS version = openSUSE 13.1 (Bottle) (i586) # VersionCheck:6191 9621 SHOW VARIABLES # VersionCheck:6198 9621 MySQL version for MySQL = openSUSE package on tux3306 # VersionCheck:6198 9621 MySQL version for MySQL = 5.5.33-MariaDB on tux3306 # VersionCheck:5945 9621 Client response: $VAR1 = { # VersionCheck:5948 9621 Server suggestions: $VAR1 = { # VersionCheck:5696 9621 Version check file percona-version-check in /tmp # VersionCheck:5839 9621 Updating last check time: 1392584083 # VersionCheck:5782 9621 Error updating version check file: Cannot write to /tmp/percona-version-check: Permission denied at /usr/bin/pt-index-usage line 5858. Expected Results: 1. package owns /etc/percona-toolkit 2. package ghosts /etc/percona-toolkit/percona-toolkit.conf (pt-*.conf) 3. commands do not run version checks by default, unless specifically asked to do so -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.