[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[bug#57365] [PATCH] gnu: guile-smc: Update to 0.5.0

From: Maxime Devos
Subject: [bug#57365] [PATCH] gnu: guile-smc: Update to 0.5.0
Date: Sat, 27 Aug 2022 09:54:47 +0200
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.12.0

On 26-08-2022 15:34, Mathieu Othacehe wrote:
+               (("\\(add-handler! %logger %syslog\\)")
+                (string-append
+                 "(add-handler! %logger\n"
+                 "              (make <port-log/us>\n"
+                 "                    #:port (open-file \"/tmp/smc.log\" 

When is this /tmp/smc.log used? When compiling guile-smc or when running guile-smc?

If the latter, an attacker on a multi-user system could use it to make you append to files the attacker ordinarily doesn't have access to -- consider guile-smc being in a process as root and the attacker creating /tmp/smc.log as a symlink to /etc/passwd first, depending on what was logged, there is now an additional entry in there or its corrupted, preventing booting.

Guile-SMC tries to log to the syslog by default but it seems that this
option is not working in Guix, so we need another way to log the
messages.  Or it may be that I just overlooked something.
I do think it works, at least there are plenty of mentions of 'syslog' in the Guix repository. However, possibly the build container forbids access (unverified), maybe for running tests you need a different logger.


Attachment: OpenPGP_0x49E3EE22191725EE.asc
Description: OpenPGP public key

Attachment: OpenPGP_signature
Description: OpenPGP digital signature

reply via email to

[Prev in Thread] Current Thread [Next in Thread]