Re: Bug report in test suite

[Bernhard Voelker]

On 11/19/21 01:03, Lahfa Samy wrote:
> FAIL: tests/find/execdir-fd-leak.sh

The error message in the logfile is quite clear:

  FAIL: tests/find/execdir-fd-leak
  ================================

  find: The current directory is included in the PATH environment variable, 
which is insecure in combination \
  with the -execdir action of find.  Please remove the current directory from your $PATH 
(that is, remove ".", \
  doubled colons, or leading or trailing colons)
  Option -execdir of find leaks file descriptors
  oldfind: The current directory is included in the PATH environment variable, 
which is insecure in combination \
  with the -execdir action of find.  Please remove the current directory from your $PATH 
(that is, remove ".", \
  doubled colons, or leading or trailing colons)
  Option -execdir of oldfind leaks file descriptors
  FAIL tests/find/execdir-fd-leak.sh (exit status: 1)

I'm getting exactly the same when the PATH variable contains the current directory 
".".
This is a security problem, and I've not seen this on any system in the last 15 
years.

Still, the test suite should cater for and run in a sane environment.
This could be done in the test setup script 'tests/init.sh' which comes from 
gnulib,
as I think this is a useful thing for probably all projects.
Alternatively, the findutils test setup could do it.

Finally, I'm wondering about 2 other topics in the output you provided:

a) When I run `./configure && make && make check` with such a vulnerable 
PATH="$PATH:."
setting, then the check already fails earlier in 'find/testsuite/...' tests:

  FAIL: sv-bug-27563-execdir.old-O0, /home/berny/tmp/findutils-4.8.0/find/testsuite/../oldfind: The current directory is included in the PATH environment variable, which is insecure in combination 
with   the -execdir action of find.  Please remove the current directory from your $PATH (that is, remove ".", doubled colons, or leading or trailing colons)
  FAIL: sv-bug-27563-execdir.old-O0, standard output differs from the expected 
result:
  --- find.out  2021-11-19 19:13:09.265117146 +0000
  +++ cmp.out   2021-11-19 19:13:09.265117146 +0000
  @@ -0,0 +1 @@
  +./yyyy
  child process exited abnormally

b) There are several lines like the following:

> make[1]: env: Permission denied

I can't imagine what would trigger this other than e.g. a strange 
cross-compilation environment.
Is there something special about your build?

Have a nice day,
Berny