Fix insecure tempfile usage http://bugs.gentoo.org/105000 --- flexbackup +++ flexbackup @@ -269,6 +269,7 @@ if (($::mode !~ m/^(list|extract|restore untie(%::index); } +system ('rm', '-rf', $cfg::tmpdir) if (defined($cfg::deltmpdir)); exit(0); ###################################################################### @@ -2725,6 +2726,13 @@ sub optioncheck { &checkvar(\$cfg::prefix,'prefix','exist',''); &checkvar(\$cfg::sprefix,'sprefix','exist',''); + # Create a subdirectory inside /tmp + if ($cfg::tmpdir eq '/tmp') { + $cfg::tmpdir = $cfg::tmpdir .'/'.$$; + mkdir ($cfg::tmpdir) || die "Can't create temporary directory, $!"; + $cfg::deltmpdir = 1; + } + if (@::errors) { print $::msg "Errors:\n"; while(@::errors) { @@ -5236,8 +5244,8 @@ sub test_bufferprog { # Create a script which tests the buffer program open(SCR,"> $tmp_script") || die; print SCR "#!/bin/sh\n"; - print SCR "tmp_data=/tmp/bufftest\$\$.txt\n"; - print SCR "tmp_err=/tmp/bufftest\$\$.err\n"; + print SCR "tmp_data=\`tempfile\`\n"; + print SCR "tmp_err=\`tempfile\`\n"; print SCR "echo testme > \$tmp_data\n"; print SCR "$buffer_cmd > /dev/null 2> \$tmp_err < \$tmp_data\n"; print SCR "res=\$?\n";