On Sat, Dec 16, 2017 at 06:37:40PM +0000, Tobias Ulmer wrote:
> Hi Antoine,
>
> I noticed gstreamer1 core installs gst-ptp-helper setuid root.
>
> https://cgit.freedesktop.org/gstreamer/gstreamer/tree/libs/gst/helpers/gst-ptp-helper.c
>
> That's a rather large and scary program for a feature (Precision Time
> Protocol multicast multimedia shenanigans) with about zero users on
> OpenBSD.
>
> I doubt it does anything useful in its current state:
>
> gst-ptp-helper.c:305:2: warning: "Implement something to list all
> network interfaces" [-W#warnings]
> gst-ptp-helper.c:421:2: warning: "Implement something to get MAC
> addresses of network interfaces" [-W#warnings]
>
> You don't even want to see all the high quality libs it links against..
>
> Supposedly it's at least dropping privileges, but on a hunch compiling with
> -save-temps holds this:
> ...
> static void
> drop_privileges (void)
> {
> # 564 "gst-ptp-helper.c"
> }
> ...
>
> Not sure whether to laugh or cry.
>
> What I'm trying to say, can we nuke this crap from orbit, pretty please?
Thanks. I'll take care of it asap.
>
> Index: Makefile
> ===================================================================
> RCS file: /home/vcs/cvs/openbsd/ports/multimedia/gstreamer1/core/Makefile,v
> retrieving revision 1.43
> diff -u -p -r1.43 Makefile
> --- Makefile 8 Dec 2017 14:38:36 -0000 1.43
> +++ Makefile 16 Dec 2017 18:26:58 -0000
> @@ -4,6 +4,7 @@ COMMENT= framework for streaming media
>
> DISTNAME= gstreamer-${V}
> PKGNAME= ${GST_PKGNAME_PREFIX}-${V}
> +REVISION= 0
>
> SHARED_LIBS += gstreamer-1.0 3.3 # 1204.0
> SHARED_LIBS += gstbase-1.0 3.3 # 1204.0
> @@ -28,5 +29,8 @@ CONFIGURE_ENV += ac_cv_lib_gmp___gmpz_in
>
> # require (at least) gtk+
> CONFIGURE_ARGS += --disable-examples
> +
> +# make PTP helper 'suid' at your own peril
> +CONFIGURE_ARGS += --with-ptp-helper-permissions=none
>
> .include <bsd.port.mk>
> Index: pkg/PLIST
> ===================================================================
> RCS file: /home/vcs/cvs/openbsd/ports/multimedia/gstreamer1/core/pkg/PLIST,v
> retrieving revision 1.14
> diff -u -p -r1.14 PLIST
> --- pkg/PLIST 20 Jun 2017 11:48:53 -0000 1.14
> +++ pkg/PLIST 16 Dec 2017 18:26:58 -0000
> @@ -155,9 +155,7 @@ lib/pkgconfig/gstreamer-net-${API}.pc
> libexec/gstreamer-${API}/
> @bin libexec/gstreamer-${API}/gst-completion-helper
> @bin libexec/gstreamer-${API}/gst-plugin-scanner
> -@mode 4555
> @bin libexec/gstreamer-${API}/gst-ptp-helper
> -@mode
> @man man/man1/gst-inspect-${API}.1
> @man man/man1/gst-launch-${API}.1
> @man man/man1/gst-stats-${API}.1
--
Antoine
