From mboxrd@z Thu Jan 1 00:00:00 1970 From: Bengt Richter Subject: bug#38422: .png files in /gnu/store with executable permissions (555) Date: Fri, 29 Nov 2019 07:03:29 -0800 Message-ID: <20191129150329.GA80736@PhantoNv4ArchGx.localdomain> References: <20191129075938.GA55971@PhantoNv4ArchGx.localdomain> <878sny6fgr.fsf@netris.org> Reply-To: Bengt Richter Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Return-path: Received: from eggs.gnu.org ([2001:470:142:3::10]:55292) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1iahoW-0006yG-1E for bug-guix@gnu.org; Fri, 29 Nov 2019 10:04:09 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1iahoT-0007F9-Db for bug-guix@gnu.org; Fri, 29 Nov 2019 10:04:06 -0500 Received: from debbugs.gnu.org ([209.51.188.43]:55673) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1iahoT-0007EJ-7r for bug-guix@gnu.org; Fri, 29 Nov 2019 10:04:05 -0500 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1iahoR-0002pK-4q for bug-guix@gnu.org; Fri, 29 Nov 2019 10:04:03 -0500 Sender: "Debbugs-submit" Resent-Message-ID: Content-Disposition: inline In-Reply-To: <878sny6fgr.fsf@netris.org> List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org Sender: "bug-Guix" To: Mark H Weaver Cc: 38422@debbugs.gnu.org Hi Mark. On +2019-11-29 07:20:41 -0500, Mark H Weaver wrote: > Hi Bengt, > > Bengt Richter wrote: > > I was wanting to check on some executable files in the store, > > and happened to see some executable .png files ;-/ > > > > I suspect they came in when I was playing with icecat > > and let it load a "theme", but I am not sure some didn't > > also happen trying to get firefox radio buttons to work ;-/ > > Certainly not. Unless you ran icecat as root, it would not have > sufficient permissions to modify /gnu/store. Installing a theme or > addon in IceCat, or changing its configuration, modifies files in your > ~/.mozilla, not /gnu/store. > Yes, d'oh ;-) I was writing the "PS." in my reply to Ricardo probably while you were writing this :) There I extracted some guix build -S tarball content and showed that that was the perm source. > > Anyway, does anyone else get 555 permissions on files like these? > > These are all *.png files with 555 permissons, but I trimmed back to see common prefixes. > > Obviously the moka-con-theme was most of it, but also faba and docbook look iffy. > > I looked at docbook-xsl-1.79.1, since I happen to have it installed on > my system. Some of the *.png files are incorrectly given executable > permissions within the upstream source tarball itself. I guess it's > probably the same issue with moka-icon-theme and faba-icon-theme, since > I don't see anything in our package code that would have done it. Yes, I found the bad perms in the tarball likewise. > > Most of the entries in your list that end with "png" but not ".png" are > actually programs whose name ends with "png", so they *should* be > executable. The files in /gnu/store/.links that end with "png" are just > random chance, because the file names themselves are hashes. Yeah, I realized. Could have done a cleaner job, but I was also curious how many legit executables ended in png. > > > Is this zero-day stuff with a nasty somewhere, waiting for referencing > > by another nasty, or am I being paranoid? > > I think you're being paranoid in this case. I don't see anything here > to be concerned about, just some minor sloppiness by 3 upstreams. > IIRC I did read of jpeg images being used to obfuscate call-home info in some tricky malware, so anomalies in the same kind of file triggered the question of whether it could be accidentally on purpose ;-/ > > What is the safe way to detoxify this mess? > > The proper solution is to send bug reports to the upstream developers of > docbook-xsl, faba-icon-theme, and moka-icon-theme, asking them to fix > the permissions of the *.png files in their source tarballs. > That I haven't done. Is there a standard way to do it? "guix show moka-icon-theme" tells me homepage, but it would be nice to have a guix show --verbose that would show bug reporting info :) > > I know I shouldn't directly chmod anything in store, right? > > Right, *never* modify files in /gnu/store directly. > > > The icecat discussion got moved to mozilla, > > Which discussion are you referring to? > Sorry, wrong zilla ;-p https://lists.gnu.org/archive/html/guix-devel/2019-10/msg00686.html > Thanks, > Mark -- Regards, Bengt Richter