Hello community, here is the log from the commit of package aaa_base for openSUSE:Factory checked in at Thu Feb 3 01:47:51 CET 2011. -------- --- aaa_base/aaa_base.changes 2011-02-01 13:21:59.000000000 +0100 +++ /mounts/work_src_done/STABLE/aaa_base/aaa_base.changes 2011-02-02 10:18:29.000000000 +0100 @@ -1,0 +2,6 @@ +Tue Feb 1 15:23:17 CET 2011 - werner@suse.de + +- For plain bourne shells use `command -v' instead of `type -p' +- Avoid world writable temporary reverse mtab (bnc#665479, CVE-2011-0461) + +------------------------------------------------------------------- calling whatdependson for head-i586 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ aaa_base.spec ++++++ --- /var/tmp/diff_new_pack.j4blZ9/_old 2011-02-03 01:47:21.000000000 +0100 +++ /var/tmp/diff_new_pack.j4blZ9/_new 2011-02-03 01:47:21.000000000 +0100 @@ -20,7 +20,7 @@ Name: aaa_base Version: 11.4 -Release: 24 +Release: 25 License: GPLv2+ Group: System/Fhs Provides: bin bootutls etc skeleng skelger ++++++ aaa_base.tar.bz2 ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aaa_base/etc/init.d/boot.localfs new/aaa_base/etc/init.d/boot.localfs --- old/aaa_base/etc/init.d/boot.localfs 2011-01-25 11:07:26.000000000 +0100 +++ new/aaa_base/etc/init.d/boot.localfs 2011-02-01 15:19:58.000000000 +0100 @@ -55,10 +55,10 @@ # that /proc and /sys files are not seekable, therefore # we use a TMPDIR on the tmpfs /dev/shm. # -if type -p tac > /dev/null 2>&1 ; then +if command -v tac > /dev/null 2>&1 ; then reverse () { - TMPDIR=/dev/shm tac + tac } else reverse () @@ -293,7 +293,15 @@ stop) mounts=/etc/fstab test -r /proc/mounts && mounts=/proc/mounts - reverse < $mounts > /dev/shm/mtab + if TMPDIR=$(/bin/mktemp -d /dev/shm/.XXXXXX 2>/dev/null) ; then + export TMPDIR + reverse < $mounts > ${TMPDIR}/mtab + rvtab=${TMPDIR}/mtab + else + TMPDIR=/dev/shm + export TMPDIR + rvtab=$mounts + fi mtab= test "$2" = "nomtab" && mtab=-n @@ -302,13 +310,13 @@ # move to intermezzo package ? # First umount intermezzo filesystems - if type -p umountizo > /dev/null 1>&2 ; then + if command -v umountizo > /dev/null 1>&2 ; then while read line ; do case "$line" in *[Ii][Nn][Tt][Ee][Rr][Mm][Ee][Zz][Zz][Oo]*) umountizo >/dev/null 2>&1 esac - done < /dev/shm/mtab + done < ${rvtab} fi ulist= @@ -335,7 +343,7 @@ /dev*) continue ;; /proc*) continue ;; /sys*) continue ;; - /cgroup*) continue ;; + /cgroup*) continue ;; /var/lib/nfs/rpc_pipefs) continue ;; esac @@ -350,7 +358,7 @@ case ",$mntfs," in *,$type,*) umount $mtab -t $type $fs ;; esac - done < /dev/shm/mtab + done < ${rvtab} grep "loop" /proc/partitions | while read major minor blocks name ; do case "$name" in @@ -385,8 +393,6 @@ if test "$UMOUNT_FAILED" = true -a -z "$mtab" ; then echo "${warn}Oops${done}: umount failed :-( -- trying to remount readonly..." ulist=,${ulist// /,}, - mounts=/etc/fstab - test -r /proc/mounts && mounts=/proc/mounts # Use cat and a pipe because umount changes # /proc/mounts during direct read call cat $mounts | \ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aaa_base/etc/profile.d/profile.sh new/aaa_base/etc/profile.d/profile.sh --- old/aaa_base/etc/profile.d/profile.sh 2011-02-01 13:15:38.000000000 +0100 +++ new/aaa_base/etc/profile.d/profile.sh 2011-02-01 15:20:34.000000000 +0100 @@ -113,13 +113,13 @@ if test -s "$desktop" ; then while read -r line; do case ${line} in - Exec=*) WINDOWMANAGER="$(type -p ${line#Exec=})" + Exec=*) WINDOWMANAGER="$(command -v ${line#Exec=})" break esac done < $desktop fi if test -n "$DEFAULT_WM" -a -z "$WINDOWMANAGER" ; then - WINDOWMANAGER="$(type -p ${DEFAULT_WM##*/})" + WINDOWMANAGER="$(command -v ${DEFAULT_WM##*/})" fi PATH=$SAVEPATH unset SAVEPATH desktop diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aaa_base/etc/profile.d/sh.utf8 new/aaa_base/etc/profile.d/sh.utf8 --- old/aaa_base/etc/profile.d/sh.utf8 2004-04-08 16:44:44.000000000 +0200 +++ new/aaa_base/etc/profile.d/sh.utf8 2011-02-01 15:22:22.000000000 +0100 @@ -1,7 +1,7 @@ # # Try to autodetect UTF-8 capable terminal line # -if type -p testutf8 > /dev/null 2>&1 ; then +if command -v testutf8 > /dev/null 2>&1 ; then testutf8 ret="$?" if test -n "$LANG" ; then ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Remember to have fun... -- To unsubscribe, e-mail: opensuse-commit+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-commit+help@opensuse.org