Lintian Reports

W maintainer-script-should-not-use-recursive-chown-or-chmod

All reports of maintainer-script-should-not-use-recursive-chown-or-chmod for the archive. The extended description of this tag is:

The maintainer script appears to call chmod or chown with a --recursive/-R argument, or uses find(1) in a similar manner.

This is vulnerable to hardlink attacks on mainline, non-Debian kernels that do not have fs.protected_hardlinks=1,

This arises through altering permissions or ownership within a directory that may be owned by a non-privileged user - such a user can link to files that they do not own such as /etc/shadow or files within /var/lib/dpkg/. The promiscuous chown or chmod would convert the ownership or permissions of these files so that they are manipulable by the non-privileged user.

Ways to avoid this problem include:

     - If your package uses a static uid, please perform the chown at
       package build time instead of installation time.
     - Use a non-recursive call instead, ensuring that you do not change
       ownership of files that are in user-controlled directories.
     - Use runuser(1) to perform any initialization work as the
       user you were previously chowning to.
    

Refer to https://bugs.debian.org/889060, https://bugs.debian.org/889488, and the runuser(1) manual page for details.

Severity: normal, Certainty: certain

Check: scripts, Type: binary

Emitted (non-overridden): 160, overridden: 6, total: 166

The package names link to the relevant maintainer page and the corresponding report for the source package. The links go to the full maintainer report page, which includes info and experimental tags and overridden tags, rather than the default page that shows only errors and warnings.

apt 1.8.4 (binary) (APT Development Team <deity@lists.debian.org>)

automysqlbackup 2.6+debian.4-2 (binary) (Thomas Goirand <zigo@debian.org>)

boinc-app-eah-brp 0.20170426+dfsg-10+b3 (binary) (Debian BOINC Maintainers <pkg-boinc-devel@lists.alioth.debian.org>)

boinc-app-seti 8.00~svn4035-1 (binary) (Debian BOINC Maintainers <pkg-boinc-devel@lists.alioth.debian.org>)

boinc-app-seti-graphics 8.00~svn4035-1 (binary) (Debian BOINC Maintainers <pkg-boinc-devel@lists.alioth.debian.org>)

calendarserver 9.2+dfsg-1+b1 (binary) (Rahul Amaram <amaramrahul@users.sourceforge.net>)

calendarserver 9.2+dfsg-1 (binary) (Rahul Amaram <amaramrahul@users.sourceforge.net>)

canna 3.7p3-14 (binary) (Debian QA Group <packages@qa.debian.org>)

cntlm 0.92.3-1+b1 (binary) (David Watson <dwatson@debian.org>)

colplot 5.2.0-1 (binary) (Troy Heber <troyh@debian.org>)

conserver-server 8.2.4-2 (binary) (Conserver Maintainers <conserver@packages.debian.org>)

courier-base 1.0.6-1+b1 (binary) (Markus Wanner <markus@bluegap.ch>)

courier-base 1.0.6-1+b2 (binary) (Markus Wanner <markus@bluegap.ch>)

darkstat 3.0.719-1+b1 (binary) (Rene Mayorga <rmayorga@debian.org>)

dhcpy6d 0.4.3-1 (binary) (Axel Beckert <abe@debian.org>)

diaspora 0.7.9.0+dfsg-4 (binary) (Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@lists.alioth.debian.org>)

diaspora-common 0.7.6.1+debian1 (binary) (Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@lists.alioth.debian.org>)

diaspora-installer 0.7.6.1+debian1 (binary) (Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@lists.alioth.debian.org>)

didiwiki 0.5-13+b1 (binary) (Ignace Mouzannar <mouzannar@gmail.com>)

doodle 0.7.0-9+b2 (binary) (Prach Pongpanich <prachpub@gmail.com>)

dtc-stats-daemon 0.35.5-1 (binary) (Thomas Goirand <zigo@debian.org>)

elog 3.1.3-1-1 (binary) (Roger Kalt <roger.kalt@gmail.com>)

fetchmail 6.4.1-1 (binary) (Laszlo Boszormenyi (GCS) <gcs@debian.org>)

fex 20160919-1 (binary) (Kilian Krause <kilian@debian.org>)

freewnn-cserver 1.1.1~a021+cvs20130302-7+b1 (binary) (Debian QA Group <packages@qa.debian.org>)

freewnn-jserver 1.1.1~a021+cvs20130302-7+b1 (binary) (Debian QA Group <packages@qa.debian.org>)

freewnn-kserver 1.1.1~a021+cvs20130302-7+b1 (binary) (Debian QA Group <packages@qa.debian.org>)

fwanalog 0.6.9-8 (binary) (Debian QA Group <packages@qa.debian.org>)

ganglia-webfrontend 3.6.1-3 (binary) (Debian Monitoring Maintainers <pkg-monitoring-maintainers@lists.alioth.debian.org>)

gdm3 3.34.1-1 (binary) (Debian GNOME Maintainers <pkg-gnome-maintainers@lists.alioth.debian.org>)

gitolite3 3.6.11-2 (binary) (David Bremner <bremner@debian.org>)

glance-store-common 1.0.1-2 (binary) (Debian OpenStack <team+openstack@tracker.debian.org>)

glare-common 0.5.0-4 (binary) (Debian OpenStack <openstack-devel@lists.alioth.debian.org>)

gmetad 3.6.0-7+b2 (binary) (Debian Monitoring Maintainers <pkg-monitoring-maintainers@lists.alioth.debian.org>)

gnunet 0.10.1-5.1+b1 (binary) (Bertrand Marc <bmarc@debian.org>)

gnunet 0.11.0-1 (binary) (Bertrand Marc <bmarc@debian.org>)

gosa 2.7.4+reloaded3-10 (binary) (Debian Edu Packaging Team <debian-edu-pkg-team@lists.alioth.debian.org>) overridden

gsm-utils 1.10+20120414.gita5e5ae9a-0.3+b1 (binary) (Mark Purcell <msp@debian.org>)

gup 0.5.15+b1 (binary) (Marco d'Itri <md@linux.it>)

htcondor 8.6.8~dfsg.1-2+b1 (binary) (HTCondor Developers <condor-debian@cs.wisc.edu>)

inetsim 1.3.1+dfsg.1-1 (binary) (Debian Security Tools <team+pkg-security@tracker.debian.org>) overridden

iog 1.03-4 (binary) (Debian QA Group <packages@qa.debian.org>)

iptotal 0.3.3-13.1+b1 (binary) (Ignace Mouzannar <mouzannar@gmail.com>)

jwchat 1.0+dfsg-1.4 (binary) (Debian XMPP Maintainers <pkg-xmpp-devel@lists.alioth.debian.org>)

keysafe-server 0.20170811-1 (binary) (Sean Whitton <spwhitton@spwhitton.name>)

ldap-account-manager 6.7-1 (binary) (Roland Gruber <post@rolandgruber.de>)

libnss-ldap 265-5+b1 (binary) (Debian QA Group <packages@qa.debian.org>)

logcheck 1.3.20 (binary) (Debian logcheck Team <logcheck@packages.debian.org>)

lpr 1:2008.05.17.3 (binary) (Adam Majer <adamm@zombino.com>)

lurker 2.3-6+b1 (binary) (Jonas Meurer <mejo@debian.org>)

lurker 2.3-6 (binary) (Jonas Meurer <mejo@debian.org>)

manila-common 1:9.0.0-2 (binary) (Debian OpenStack <team+openstack@tracker.debian.org>)

mgetty-voice 1.2.1-1 (binary) (Andreas Barth <aba@ayous.org>)

milter-greylist 4.5.11-1.1+b5 (binary) (Paul Martin <pm@debian.org>)

minbif-common 1:1.0.5+git20150505-3 (binary) (Sebastien Delafond <seb@debian.org>)

mldonkey-server 3.1.6-1+b1 (binary) (Debian OCaml Maintainers <debian-ocaml-maint@lists.debian.org>)

mpdscribble 0.22-6 (binary) (mpd maintainers <pkg-mpd-maintainers@lists.alioth.debian.org>)

mysql-server-5.7 5.7.26-1 (binary) (Debian MySQL Maintainers <pkg-mysql-maint@lists.alioth.debian.org>)

netplan 1.10.1-6 (binary) (Debian QA Group <packages@qa.debian.org>)

ola 0.10.7.nojsmin-2 (binary) (Wouter Verhelst <wouter@debian.org>)

phamm 0.6.8-1 (binary) (Phamm Team <team@phamm.org>)

phpldapadmin 1.2.2-6.1 (binary) (Fabio Tranchitella <kobold@debian.org>)

policyd-weight 0.1.15.2-12 (binary) (Werner Detter <werner@aloah-from-hell.de>)

postfwd 1.35-5 (binary) (Jan Wagner <waja@cyconet.org>)

prometheus-varnish-exporter 1.5-1+b1 (binary) (Debian Go Packaging Team <pkg-go-maintainers@lists.alioth.debian.org>)

prometheus-varnish-exporter 1.5-1 (binary) (Debian Go Packaging Team <pkg-go-maintainers@lists.alioth.debian.org>)

pysycache 3.1-3.3 (binary) (José L. Redrejo Rodríguez <jredrejo@debian.org>)

qmail-run 2.0.2+nmu1 (binary) (Gerrit Pape <pape@smarden.org>)

qpsmtpd 0.94-4 (binary) (Debian QA Group <packages@qa.debian.org>)

rabbitmq-server 3.7.18-1 (binary) (Debian OpenStack <team+openstack@tracker.debian.org>)

remote-tty 4.0-13+b2 (binary) (Jonathan McDowell <noodles@earth.li>)

rwhod 0.17-14+b1 (binary) (Alberto Gonzalez Iniesta <agi@inittab.org>)

rwhod 0.17-14 (binary) (Alberto Gonzalez Iniesta <agi@inittab.org>)

sendpage-server 1.0.3-1 (binary) (Kees Cook <kees@debian.org>)

siproxd 1:0.8.1-4.1+b2 (binary) (Debian VoIP Team <pkg-voip-maintainers@lists.alioth.debian.org>)

smtpprox-loopprevent 0.1-1 (binary) (Jesse Norell <jesse@kci.net>)

snmpd 5.8+dfsg-2 (binary) (Net-SNMP Packaging Team <pkg-net-snmp-devel@lists.alioth.debian.org>) overridden

snort 2.9.7.0-5 (binary) (Javier Fernandez-Sanguino Peña <jfs@debian.org>)

snort 2.9.7.0-5+b1 (binary) (Javier Fernandez-Sanguino Peña <jfs@debian.org>)

socklog-run 2.1.0-8.1 (binary) (Gerrit Pape <pape@smarden.org>)

solr-jetty 3.6.2+dfsg-22 (binary) (Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>)

solr-tomcat 3.6.2+dfsg-22 (binary) (Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>)

spellcast 1.0-22 (binary) (Javier Fernandez-Sanguino Peña <jfs@debian.org>)

sphinxsearch 2.2.11-2+b1 (binary) (Radu Spineanu <radu@debian.org>)

sympa 6.2.40~dfsg-3 (binary) (Debian Sympa team <sympa@packages.debian.org>)

tango-common 9.2.5a+dfsg1-2 (binary) (Debian Science Team <debian-science-maintainers@lists.alioth.debian.org>)

taskd 1.1.0+dfsg-3+b1 (binary) (Debian Tasktools Packaging Team <pkg-tasktools-discuss@lists.alioth.debian.org>)

tftpd-hpa 5.2+20150808-1+b1 (binary) (Ron Lee <ron@debian.org>)

tinyhoneypot 0.4.6-10 (binary) (Javier Fernandez-Sanguino Pen~a <jfs@computer.org>)

tinymce 3.4.8+dfsg0-2 (binary) (Debian QA Group <packages@qa.debian.org>)

tircd 0.30-4 (binary) (Debian QA Group <packages@qa.debian.org>)

tokyotyrant 1.1.40-4.2+b1 (binary) (Örjan Persson <orange@fobie.net>)

tome 2.4~0.git.2015.12.29-1.2+b2 (binary) (Manoj Srivastava <srivasta@debian.org>)

trousers 0.3.14+fixed1-1+b1 (binary) (Pierre Chifflier <pollux@debian.org>)

tumgreyspf 1.36-4.1 (binary) (Thomas Goirand <zigo@debian.org>)

typespeed 0.6.5-2.1+b3 (binary) (Dafydd Harries <daf@debian.org>)

vdradmin-am 3.6.10-4 (binary) (Debian VDR Team <pkg-vdr-dvb-devel@lists.alioth.debian.org>)

vitrage-common 5.0.0-2 (binary) (Debian OpenStack <team+openstack@tracker.debian.org>)

wims 1:4.15d~dfsg1-3+b1 (binary) (Georges Khaznadar <georgesk@debian.org>)

wims 1:4.15d~dfsg1-3 (binary) (Georges Khaznadar <georgesk@debian.org>)

wims-java-applets 1:4.15d~dfsg1-3 (binary) (Georges Khaznadar <georgesk@debian.org>)

xletters 1.1.1-5+b1 (binary) (Debian Games Team <pkg-games-devel@lists.alioth.debian.org>)

xorp 1.8.6~wip.20160715-2+b2 (binary) (Jose M Calhariz <jose@calhariz.com>)

zoneminder 1.32.3-2 (binary) (Dmitry Smirnov <onlyjob@debian.org>)