Bdale Garbee <[EMAIL PROTECTED]> wrote: > Hello. > > As per the attached, tar's default behavior regarding setuid/setgid bits > has been identified as a security issue and submitted to the Debian bug > tracking system, among other places. > > My initial reaction was to be concerned that changing the default would > violate user expectations, but I understand the motivation for this > class of behavioral change request. > > I would prefer to not deviate the Debian tar default behavior from > "stock". What's your take on this? > > Please preserve the CC in replies so that our bug tracking system can > keep a record of the conversation.
The claim in http://marc.theaimsgroup.com/?l=bugtraq&m=112327628230258&w=2 is wrong! Neither the deafault behavior of "tar" is mentioned correcty nor does this mean that the standard is quoted correctly. Here is the standard: x Extract the named file or files from the archive. If a named file matches a directory whose contents had been written onto the archive, this directory is (recursively) extracted. If a named file in the archive does not exist on the system, the file is created with the same mode as the one in the archive, except that the set-user-ID and set-group-ID modes are not set unless the user has appropriate privileges. If the files exist, their modes are not changed except as described above. The owner, group, and modification time are restored (if possible). If no file operand is given, the entire content of the archive is extracted. Note that if several files with the same name are in the archive, the last one overwrites all earlier ones. Jörg -- EMail:[EMAIL PROTECTED] (home) Jörg Schilling D-13353 Berlin [EMAIL PROTECTED] (uni) [EMAIL PROTECTED] (work) Blog: http://schily.blogspot.com/ URL: http://cdrecord.berlios.de/old/private/ ftp://ftp.berlios.de/pub/schily _______________________________________________ Bug-tar mailing list [email protected] http://lists.gnu.org/mailman/listinfo/bug-tar
