Re: wordperfect 8 for linux security

From: Peter W (peterwat_private)
Date: Sat Dec 19 1998 - 17:11:40 PST

  • Next message: Ben Winslow: "Re: Ircii-epic: Irc: another funny stuff. In some irc clients dcc"

    Aleph: minor error in the first test of the script, should have quoted the env var in case it was not set. This should be correct, please use this if you have not already approved the previous note.
    
    Sorry, and thanks.
    
    -Peter
    
    Keith Owens wrote:
    
    > On Fri, 18 Dec 1998 11:47:45 -0500,
    > Edsel Adap <adapat_private> wrote:
    > >When wordperfect 8 is installed it creates a /tmp/wpc-<hostname>
    > >directory with permissions 777.  And all files inside of it are mode
    > >666.  And when these files are created, symlinks are followed.
    >
    > Worse that that.  Even if you delete the wpc-<hostname> file, the next
    > time you run wpc it creates it again.  So do not run wp8 under any
    > powerful userid.
    
    As noted before, WordPerfect respects TMPDIR, so start the app with something like:
    
    #!/bin/sh
    # Set $TMPDIR to ~/tmp if the user doesn't already have a TMPDIR variable
    if [ "${TMPDIR}" = "" ]; then
            TMPDIR=${HOME}/tmp
    fi
    if [ ! -d "${TMPDIR}" ]; then
       # Need to make a new directory
       TMPDIR_TEST="error"
       /bin/mkdir "${TMPDIR}" && TMPDIR_TEST="ok"
       if [ ${TMPDIR_TEST} != "ok" ]; then
            /bin/echo "Unable to create safe tmp directory ${TMPDIR}"
            exit 1
        fi
        /bin/chmod o= "${TMPDIR}"
    fi
    # Set $TMPDIR for the wpc-$HOSTNAME junk
    export TMPDIR
    # Clear LD_LIBRARY_PATH to prevent reported seg faults
    LD_LIBRARY_PATH="" export LD_LIBRARY_PATH
    # Set the PATH and exec the app, passing any command-line args
    PATH=${PATH}:/path/to/wordperfect/wpbin export PATH
    exec xwp "${@-}" &
    
    (thanks to Billy Ball, Bruce Israel, and David Niemi)
    
    -Peter
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:25:19 PDT