Ticket #167 (closed defect: fixed)

Opened 2 years ago

Last modified 1 year ago

Deal with dangerous Lua (extension) calls from scriptlets

Reported by: pmatilai Assigned to: RpmTickets
Priority: major Milestone: rpm-4.9.0
Component: rpm Version: RPM Development
Keywords: Cc:

Description

Currently it's far too easy to completely blow up the entire rpm process from -p <lua> scriptlets as they execute within rpm itself. At least the following can seriously mess up things: * posix.chroot() - should never be allowed from lua scripts * posix.fork() - somewhat questionable but potentially useful.. verify its "safe" * posix.exec() - unless posix.fork() is used first the executed program will replace rpm itself * os.exit() - unless posix.fork() was used, it'll terminate rpm itself

Figure a way to make them safe or disable when run from scriptlets.

Change History

11/15/10 07:49:55 changed by pmatilai

  • status changed from new to closed.
  • resolution set to fixed.
  • milestone set to rpm-4.9.0.