Lintian Reports

W maintainer-script-should-not-use-recursive-chown-or-chmod

All reports of maintainer-script-should-not-use-recursive-chown-or-chmod for the archive. The extended description of this tag is:

The maintainer script appears to call chmod or chown with a --recursive/-R argument, or uses find(1) in a similar manner.

This is vulnerable to hardlink attacks on mainline, non-Debian kernels that do not have fs.protected_hardlinks=1,

This arises through altering permissions or ownership within a directory that may be owned by a non-privileged user - such a user can link to files that they do not own such as /etc/shadow or files within /var/lib/dpkg/. The promiscuous chown or chmod would convert the ownership or permissions of these files so that they are manipulable by the non-privileged user.

Ways to avoid this problem include:

     - If your package uses a static uid, please perform the chown at
       package build time instead of installation time.
     - Use a non-recursive call instead, ensuring that you do not change
       ownership of files that are in user-controlled directories.
     - Use runuser(1) to perform any initialization work as the
       user you were previously chowning to.
    

Refer to https://bugs.debian.org/889060, https://bugs.debian.org/889488, and the runuser(1) manual page for details.

Severity: normal, Certainty: certain

Check: scripts, Type: binary

Evolution of the maintainer-script-should-not-use-recursive-chown-or-chmod Lintian tag over the past 366 days:

The beforementioned graph for the maintainer-script-should-not-use-recursive-chown-or-chmod tag

Emitted (non-overridden): 394, overridden: 21, total: 415

The package names link to the relevant maintainer page and the corresponding report for the source package. The links go to the full maintainer report page, which includes info and experimental tags and overridden tags, rather than the default page that shows only errors and warnings.

389-ds-base 1.4.0.19-2 (binary) (Debian FreeIPA Team <pkg-freeipa-devel@alioth-lists.debian.net>)

apt 1.8.0~alpha2 (binary) (APT Development Team <deity@lists.debian.org>)

armagetronad-dedicated 0.2.8.3.4-2 (binary) (Debian Games Team <pkg-games-devel@lists.alioth.debian.org>)

automysqlbackup 2.6+debian.4-2 (binary) (Thomas Goirand <zigo@debian.org>)

bareos-traymonitor 16.2.6-4 (binary) (Bareos Packaging Team <pkg-bareos-devel@lists.alioth.debian.org>)

bitlbee-common 3.5.1-1 (binary) (Wilmer van der Gaast <wilmer@gaast.net>)

boinc-app-eah-brp 0.20170426+dfsg-10+b3 (binary) (Debian BOINC Maintainers <pkg-boinc-devel@lists.alioth.debian.org>)

boinc-app-seti 8.00~svn3725-3 (binary) (Debian BOINC Maintainers <pkg-boinc-devel@lists.alioth.debian.org>)

boinc-app-seti-graphics 8.00~svn3725-3 (binary) (Debian BOINC Maintainers <pkg-boinc-devel@lists.alioth.debian.org>)

cacti 1.1.38+ds1-1 (binary) (Cacti Maintainer <pkg-cacti-maint@lists.alioth.debian.org>)

calendarserver 9.1+dfsg-1 (binary) (Rahul Amaram <amaramrahul@users.sourceforge.net>)

caml-crush-server 1.0.8-1+b1 (binary) (Thomas Calderon <calderon.thomas@gmail.com>)

canna 3.7p3-14 (binary) (Debian QA Group <packages@qa.debian.org>)

ceph-base 12.2.8+dfsg1-5 (binary) (Ceph Maintainers <ceph-maintainers@lists.ceph.com>)

ceph-common 12.2.8+dfsg1-5 (binary) (Ceph Maintainers <ceph-maintainers@lists.ceph.com>)

civicrm-common 5.8.0+dfsg-1 (binary) (Dmitry Smirnov <onlyjob@debian.org>)

cntlm 0.92.3-1+b1 (binary) (David Watson <dwatson@debian.org>)

colplot 5.2.0-1 (binary) (Troy Heber <troyh@debian.org>)

conserver-server 8.2.1-1+b1 (binary) (Jörgen Hägg <jh@debian.org>)

courier-base 0.78.0-2+b3 (binary) (Markus Wanner <markus@bluegap.ch>)

cpl-plugin-muse-calib 2.4.2+dfsg-1 (binary) (Debian Astronomy Team <debian-astro-maintainers@lists.alioth.debian.org>)

cpl-plugin-muse-calib 2.0.3+dfsg-1 (binary) (Debian Astronomy Team <debian-astro-maintainers@lists.alioth.debian.org>)

cpl-plugin-muse-calib 2.2+dfsg-1 (binary) (Debian Astronomy Team <debian-astro-maintainers@lists.alioth.debian.org>)

cpl-plugin-muse-calib 2.4.1+dfsg-1 (binary) (Debian Astronomy Team <debian-astro-maintainers@lists.alioth.debian.org>)

custodia 0.6.0-2 (binary) (Debian FreeIPA Team <pkg-freeipa-devel@alioth-lists.debian.net>)

dansguardian 2.10.1.1-5.1+b4 (binary) (Alexander Wirt <formorer@debian.org>)

darkstat 3.0.719-1+b1 (binary) (Rene Mayorga <rmayorga@debian.org>)

dcmtk 3.6.2-3+b2 (binary) (Debian Med Packaging Team <debian-med-packaging@lists.alioth.debian.org>)

dcmtk 3.6.3-1~exp1 (binary) (Debian Med Packaging Team <debian-med-packaging@lists.alioth.debian.org>)

dhcpy6d 0.4.3-1 (binary) (Axel Beckert <abe@debian.org>)

diamond 4.0.515-4 (binary) (Sandro Tosi <morph@debian.org>)

diaspora 0.6.0.1+debian-2 (binary) (Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@lists.alioth.debian.org>)

diaspora-common 0.7.6.1 (binary) (Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@lists.alioth.debian.org>)

diaspora-installer 0.7.6.1 (binary) (Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@lists.alioth.debian.org>)

didiwiki 0.5-13 (binary) (Ignace Mouzannar <mouzannar@gmail.com>)

dkim-milter-python 0.9-1 (binary) (Scott Kitterman <scott@kitterman.com>)

doodle 0.7.0-9+b2 (binary) (Prach Pongpanich <prachpub@gmail.com>)

dotlrn 2.5.0+dfsg2-1 (binary) (Hector Romojaro <hector.romojaro@gmail.com>)

dtc-stats-daemon 0.35.5-1 (binary) (Thomas Goirand <zigo@debian.org>)

elog 3.1.3-1-1 (binary) (Roger Kalt <roger.kalt@gmail.com>)

ferm 2.4-1 (binary) (Alexander Wirt <formorer@debian.org>)

fetchmail 6.4.0~beta4-1 (binary) (Laszlo Boszormenyi (GCS) <gcs@debian.org>)

fetchmail 6.3.26-3 (binary) (Laszlo Boszormenyi (GCS) <gcs@debian.org>)

fex 20160919-1 (binary) (Kilian Krause <kilian@debian.org>)

freeradius 3.0.16+dfsg-5 (binary) (Debian FreeRADIUS Packaging Team <pkg-freeradius-maintainers@lists.alioth.debian.org>)

freeradius-common 3.0.16+dfsg-5 (binary) (Debian FreeRADIUS Packaging Team <pkg-freeradius-maintainers@lists.alioth.debian.org>)

freewnn-cserver 1.1.1~a021+cvs20130302-7+b1 (binary) (Debian QA Group <packages@qa.debian.org>)

freewnn-jserver 1.1.1~a021+cvs20130302-7+b1 (binary) (Debian QA Group <packages@qa.debian.org>)

freewnn-kserver 1.1.1~a021+cvs20130302-7+b1 (binary) (Debian QA Group <packages@qa.debian.org>)

fs-uae-netplay-server 2.8.4+dfsg-2 (binary) (John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>)

ftp-cloudfs 0.25.2+20140217+git2a90c1a2eb-1 (binary) (PKG OpenStack <openstack-devel@lists.alioth.debian.org>)

fwanalog 0.6.9-8 (binary) (Debian QA Group <packages@qa.debian.org>)

ganglia-webfrontend 3.6.1-3 (binary) (Debian Monitoring Maintainers <pkg-monitoring-maintainers@lists.alioth.debian.org>)

gbrowse 2.56+dfsg-4 (binary) (Debian Med Packaging Team <debian-med-packaging@lists.alioth.debian.org>)

gbrowse-data 2.56+dfsg-4 (binary) (Debian Med Packaging Team <debian-med-packaging@lists.alioth.debian.org>)

gdm3 3.30.2-1 (binary) (Debian GNOME Maintainers <pkg-gnome-maintainers@lists.alioth.debian.org>)

gitolite3 3.6.9-1 (binary) (David Bremner <bremner@debian.org>)

glance-store-common 0.26.1-2 (binary) (Debian OpenStack <team+openstack@tracker.debian.org>)

glare-common 0.5.0-4 (binary) (PKG OpenStack <openstack-devel@lists.alioth.debian.org>)

gmetad 3.6.0-7+b2 (binary) (Debian Monitoring Maintainers <pkg-monitoring-maintainers@lists.alioth.debian.org>)

gnunet 0.11.0~pre666-1 (binary) (Bertrand Marc <bmarc@debian.org>)

gnunet 0.10.1-5.1 (binary) (Bertrand Marc <bmarc@debian.org>)

gosa 2.7.4+reloaded3-7 (binary) (Debian Edu Packaging Team <debian-edu-pkg-team@lists.alioth.debian.org>) overridden

greylistd 0.8.8.7 (binary) (Thorsten Alteholz <debian@alteholz.de>)

gsm-utils 1.10+20120414.gita5e5ae9a-0.3+b1 (binary) (Mark Purcell <msp@debian.org>)

gup 0.5.15+b1 (binary) (Marco d'Itri <md@linux.it>)

htcondor 8.6.8~dfsg.1-2+b1 (binary) (HTCondor Developers <condor-debian@cs.wisc.edu>)

i2p 0.9.37-2 (binary) (Masayuki Hatta <mhatta@debian.org>)

ifetch-tools 0.15.26d-1 (binary) (Richard Nelson <unixabg@gmail.com>)

ifmail 2.14tx8.10-23.1 (binary) (Marco d'Itri <md@linux.it>)

inspircd 2.0.24-1.1 (binary) (inspircd packagers <inspircd@packages.debian.org>)

iog 1.03-4 (binary) (Debian QA Group <packages@qa.debian.org>)

iptotal 0.3.3-13.1+b1 (binary) (Ignace Mouzannar <mouzannar@gmail.com>)

isdnvboxserver 1:3.25+dfsg1-9+b2 (binary) (Christoph Biedl <debian.axhn@manchmal.in-ulm.de>)

jwchat 1.0+dfsg-1.4 (binary) (Debian XMPP Maintainers <pkg-xmpp-devel@lists.alioth.debian.org>)

keysafe-server 0.20170811-1 (binary) (Sean Whitton <spwhitton@spwhitton.name>)

keystone 2:14.0.0-2 (binary) (Debian OpenStack <team+openstack@tracker.debian.org>)

ldap-account-manager 6.4-1 (binary) (Roland Gruber <post@rolandgruber.de>)

libapache2-mod-auth-openidc 2.3.7-1+b1 (binary) (Hans Zandbelt <hzandbelt@pingidentity.com>)

libapache2-mod-nss 1.0.14-1+b1 (binary) (Debian 389ds Team <pkg-fedora-ds-maintainers@lists.alioth.debian.org>)

libnss-ldap 265-5 (binary) (Debian QA Group <packages@qa.debian.org>)

logcheck 1.3.19 (binary) (Debian logcheck Team <logcheck@packages.debian.org>)

lpr 1:2008.05.17.2+b1 (binary) (Adam Majer <adamm@zombino.com>)

lurker 2.3-6 (binary) (Jonas Meurer <mejo@debian.org>)

manila-common 1:7.0.0-1 (binary) (Debian OpenStack <team+openstack@tracker.debian.org>)

mariadb-server-10.1 1:10.1.37-3 (binary) (Debian MySQL Maintainers <pkg-mysql-maint@lists.alioth.debian.org>)

mariadb-server-10.3 10.3.0-0+exp2 (binary) (Debian MySQL Maintainers <pkg-mysql-maint@lists.alioth.debian.org>)

mediawiki 1:1.31.1-4 (binary) (Kunal Mehta <legoktm@debian.org>)

mgetty-voice 1.2.1-1 (binary) (Andreas Barth <aba@ayous.org>)

milter-greylist 4.5.11-1.1+b5 (binary) (Paul Martin <pm@debian.org>)

minbif-common 1:1.0.5+git20150505-3 (binary) (Sebastien Delafond <seb@debian.org>)

mldonkey-server 3.1.6-1+b1 (binary) (Debian OCaml Maintainers <debian-ocaml-maint@lists.debian.org>)

mobyle 1.5.5+dfsg-6 (binary) (Debian Med Packaging Team <debian-med-packaging@lists.alioth.debian.org>)

mpdscribble 0.22-5 (binary) (mpd maintainers <pkg-mpd-maintainers@lists.alioth.debian.org>)

mysql-server-5.7 5.7.24-2 (binary) (Debian MySQL Maintainers <pkg-mysql-maint@lists.alioth.debian.org>)

netdata 1.10.0+dfsg-3 (binary) (Lennart Weller <lhw@ring0.de>)

netplan 1.10.1-5+b1 (binary) (Petter Reinholdtsen <pere@debian.org>)

nova-common 2:18.0.3-4 (binary) (Debian OpenStack <team+openstack@tracker.debian.org>)

ola 0.10.7.nojsmin-1+b1 (binary) (Wouter Verhelst <wouter@debian.org>)

onak 0.5.0-1 (binary) (Jonathan McDowell <noodles@earth.li>)

openacs 5.9.0+dfsg-1 (binary) (Hector Romojaro <hector.romojaro@gmail.com>)

openstack-dashboard 3:14.0.0-5 (binary) (Debian OpenStack <team+openstack@tracker.debian.org>)

openstack-dashboard-apache 3:14.0.0-5 (binary) (Debian OpenStack <team+openstack@tracker.debian.org>)

otrs2 6.0.14-1 (binary) (Patrick Matthäi <pmatthaei@debian.org>) overridden

phamm 0.6.5-1 (binary) (Phamm Team <team@phamm.org>)

phpldapadmin 1.2.2-6.1 (binary) (Fabio Tranchitella <kobold@debian.org>)

phpmyadmin 4:4.6.6-5 (binary) (Thijs Kinkhorst <thijs@debian.org>)

pinto 0.97+dfsg-4 (binary) (Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>)

plinth 0.44.0 (binary) (FreedomBox packaging team <freedombox-pkg-team@lists.alioth.debian.org>)

policyd-weight 0.1.15.2-12 (binary) (Werner Detter <werner@aloah-from-hell.de>)

polipo 1.1.1-10 (binary) (Debian QA Group <packages@qa.debian.org>)

postfwd 1.35-4 (binary) (Jan Wagner <waja@cyconet.org>)

prometheus-varnish-exporter 1.2-1+b3 (binary) (Debian Go Packaging Team <pkg-go-maintainers@lists.alioth.debian.org>)

pygopherd 2.0.18.5 (binary) (John Goerzen <jgoerzen@complete.org>)

pysycache 3.1-3.2 (binary) (José L. Redrejo Rodríguez <jredrejo@debian.org>)

python3-designate-dashboard 7.0.0-1 (binary) (Debian OpenStack <team+openstack@tracker.debian.org>)

python3-heat-dashboard 1.4.0-1 (binary) (Debian OpenStack <team+openstack@tracker.debian.org>)

python3-ironic-ui 3.3.0-2 (binary) (Debian OpenStack <team+openstack@tracker.debian.org>)

python3-neutron-fwaas-dashboard 1.5.0-2 (binary) (Debian OpenStack <team+openstack@tracker.debian.org>)

python3-neutron-vpnaas-dashboard 1.4.0-1 (binary) (Debian OpenStack <team+openstack@tracker.debian.org>)

python3-octavia-dashboard 2.0.0-2.1 (binary) (Debian OpenStack <team+openstack@tracker.debian.org>)

qmail-run 2.0.2+nmu1 (binary) (Gerrit Pape <pape@smarden.org>)

qpsmtpd 0.94-3 (binary) (Debian QA Group <packages@qa.debian.org>)

rabbitmq-server 3.7.8-4 (binary) (Debian OpenStack <team+openstack@tracker.debian.org>)

remote-tty 4.0-13+b2 (binary) (Jonathan McDowell <noodles@earth.li>)

rocksndiamonds 4.1.1.0+dfsg-1 (binary) (Debian Games Team <pkg-games-devel@lists.alioth.debian.org>) overridden

rwhod 0.17-14 (binary) (Alberto Gonzalez Iniesta <agi@inittab.org>)

sa-compile 3.4.2-1 (binary) (Noah Meyerhans <noahm@debian.org>)

sddm 0.18.0-1 (binary) (Debian/Kubuntu Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>)

sendpage-server 1.0.3-1 (binary) (Kees Cook <kees@debian.org>)

sftpcloudfs 0.12.2-3 (binary) (PKG OpenStack <openstack-devel@lists.alioth.debian.org>)

siproxd 1:0.8.1-4.1+b2 (binary) (Debian VoIP Team <pkg-voip-maintainers@lists.alioth.debian.org>)

slapd 2.4.46+dfsg-5+b1 (binary) (Debian OpenLDAP Maintainers <pkg-openldap-devel@lists.alioth.debian.org>)

smtpprox-loopprevent 0.1-1 (binary) (Jesse Norell <jesse@kci.net>)

snmpd 5.7.3+dfsg-4+b1 (binary) (Net-SNMP Packaging Team <pkg-net-snmp-devel@lists.alioth.debian.org>) overridden

snort 2.9.7.0-5+b1 (binary) (Javier Fernández-Sanguino Peña <jfs@debian.org>)

snort 2.9.7.0-5 (binary) (Javier Fernández-Sanguino Peña <jfs@debian.org>)

socklog-run 2.1.0-8.1 (binary) (Gerrit Pape <pape@smarden.org>)

sogo 4.0.4-1 (binary) (Debian SOGo Maintainers <pkg-sogo-maintainers@lists.alioth.debian.org>)

solr-jetty 3.6.2+dfsg-16 (binary) (Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>)

solr-tomcat 3.6.2+dfsg-16 (binary) (Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>)

spellcast 1.0-22 (binary) (Javier Fernández-Sanguino Peña <jfs@debian.org>)

spf-milter-python 0.9-1 (binary) (Scott Kitterman <scott@kitterman.com>)

sphinxsearch 2.2.11-2 (binary) (Radu Spineanu <radu@debian.org>)

sympa 6.2.36~dfsg-2 (binary) (Debian Sympa team <sympa@packages.debian.org>)

tango-common 9.2.5a+dfsg1-2 (binary) (Debian Science Maintainers <debian-science-maintainers@lists.alioth.debian.org>)

taskd 1.1.0+dfsg-3 (binary) (Debian Tasktools Packaging Team <pkg-tasktools-discuss@lists.alioth.debian.org>)

tftpd-hpa 5.2+20150808-1+b1 (binary) (Ron Lee <ron@debian.org>)

tinyhoneypot 0.4.6-10 (binary) (Javier Fernandez-Sanguino Pen~a <jfs@computer.org>)

tinymce 3.4.8+dfsg0-2 (binary) (Debian QA Group <packages@qa.debian.org>)

tircd 0.30-4 (binary) (Debian QA Group <packages@qa.debian.org>)

tokyotyrant 1.1.40-4.2+b1 (binary) (Örjan Persson <orange@fobie.net>)

tome 2.4~0.git.2015.12.29-1.2+b2 (binary) (Manoj Srivastava <srivasta@debian.org>)

toxiproxy 2.0.0+dfsg1-6+b1 (binary) (Debian Go Packaging Team <pkg-go-maintainers@lists.alioth.debian.org>)

transmission-daemon 2.94-1+b2 (binary) (Sandro Tosi <morph@debian.org>)

trousers 0.3.14+fixed1-1 (binary) (Pierre Chifflier <pollux@debian.org>)

tumgreyspf 1.36-4.1 (binary) (Thomas Goirand <zigo@debian.org>)

typespeed 0.6.5-2.1+b3 (binary) (Dafydd Harries <daf@debian.org>)

upspinserver 0.0~git20170809.0.54a9e56a-1+b1 (binary) (Debian Go Packaging Team <pkg-go-maintainers@lists.alioth.debian.org>)

vdradmin-am 3.6.10-4 (binary) (Debian VDR Team <pkg-vdr-dvb-devel@lists.alioth.debian.org>)

vitrage-common 3.2.0-1 (binary) (Debian OpenStack <team+openstack@tracker.debian.org>)

wims 1:4.15d~dfsg1-3 (binary) (Georges Khaznadar <georgesk@debian.org>)

wims-java-applets 1:4.15d~dfsg1-3 (binary) (Georges Khaznadar <georgesk@debian.org>)

xletters 1.1.1-5+b1 (binary) (Debian Games Team <pkg-games-devel@lists.alioth.debian.org>)

xorp 1.8.6~wip.20160715-2+b2 (binary) (Jose M Calhariz <jose@calhariz.com>)

xpilot-ng-server 1:4.7.3-2.3 (binary) (Ben Armstrong <synrg@sanctuary.nslug.ns.ca>)

zabbix-agent 1:4.0.2+dfsg-1 (binary) (Dmitry Smirnov <onlyjob@debian.org>)

zabbix-java-gateway 1:4.0.2+dfsg-1 (binary) (Dmitry Smirnov <onlyjob@debian.org>)

zabbix-proxy-mysql 1:4.0.2+dfsg-1 (binary) (Dmitry Smirnov <onlyjob@debian.org>)

zabbix-proxy-pgsql 1:4.0.2+dfsg-1 (binary) (Dmitry Smirnov <onlyjob@debian.org>)

zabbix-proxy-sqlite3 1:4.0.2+dfsg-1 (binary) (Dmitry Smirnov <onlyjob@debian.org>)

zabbix-server-mysql 1:4.0.2+dfsg-1 (binary) (Dmitry Smirnov <onlyjob@debian.org>)

zabbix-server-pgsql 1:4.0.2+dfsg-1 (binary) (Dmitry Smirnov <onlyjob@debian.org>)

zoneminder 1.32.3-1 (binary) (Dmitry Smirnov <onlyjob@debian.org>)

zoneminder 1.30.4+dfsg1-5 (binary) (Dmitry Smirnov <onlyjob@debian.org>)

zope-common 0.5.54 (binary) (Debian/Ubuntu Zope Team <pkg-zope-developers@lists.alioth.debian.org>)

zorp 6.0.10-4 (binary) (SZALAY Attila <sasa@debian.org>)

zvmcloudconnector-common 1.2.3-1 (binary) (Debian OpenStack <team+openstack@tracker.debian.org>)