From: Max Nikulin <manikulin@gmail.com>
To: Cletip Cletip <clement020302@gmail.com>
Cc: Org Mode List <emacs-orgmode@gnu.org>
Subject: Re: [BUG] Tangle with symbolic links don't work
Date: Tue, 7 Nov 2023 17:55:49 +0700 [thread overview]
Message-ID: <e443418b-7c66-413d-86ee-cdaa0bf3042c@gmail.com> (raw)
In-Reply-To: <87wmuu3lh7.fsf@localhost>
On 06/11/2023 23:17, Ihor Radchenko wrote:
> Cletip Cletip writes:
>
>> I have an Org file, test.org, from which I tangle code blocks into test.py.
>> The complication arises because test.py is a symbolic link.
I suggest to change your workflow to not depend on particular means to
write tangled files. Perhaps you may set tangle directory. Unfortunately
the description is too concise to figure out if it would be convenient
enough.
> Max, do you see any pitfalls using `file-truename'?
Sorry, I am not familiar with related code path. That is why I can not
reason what way to deal with file name is safer.
If there is a world-writable directory in the file path (usually
$TMPDIR) then `file-truename' is less safe, see
https://www.kernel.org/doc/html/latest/admin-guide/sysctl/fs.html#protected-symlinks
echo content >/home/ubuntu/tmp/file.txt
ls -l /home/ubuntu/tmp/file.txt
-rw-r--r-- 1 ubuntu ubuntu 8 Nov 7 17:29 /home/ubuntu/tmp/file.txt
ls -l /tmp/ln
lrwxrwxrwx 1 test test 25 Nov 7 17:10 /tmp/ln -> /home/ubuntu/tmp/file.txt
Notice different owner of the symlink.
echo overwrite >/tmp/ln
bash: /tmp/ln: Permission denied
cat /home/ubuntu/tmp/file.txt
content
`file-truename':
echo overwrite>"$(readlink -f /tmp/ln)"
cat /home/ubuntu/tmp/file.txt
overwrite
/usr/sbin/sysctl fs.protected_symlinks
fs.protected_symlinks = 1
In general, I am never sure that Org code follows best practices in
respect to security in general and in respect to /tmp in particular. The
following citation is unrelated to /tmp, but the same proposed patch has
an issue with predictable name in /tmp:
Visuwesh… Re: [BUG] [PATCH] Add yank-media and DND handler. Wed, 27 Sep
2023 13:59:49 +0530. https://list.orgmode.org/878r8sj9xe.fsf@gmail.com
> That would be quite annoying IMO. I say we let the user shoot
> themselves in the foot.
Even when /tmp or similar directories are not involved, a proper
strategy to replace file content should be carefully chosen. E.g. cp(1)
preserves inode number while install(1) replaces target file atomically
(create a temporary one and rename). The latter way is more suitable for
shared libraries since it allows running application to continue call
function from the deleted file.
I know, it is not an answer you expected from me, but giving a better
one require to much efforts to read the code and to debug it.
next prev parent reply other threads:[~2023-11-07 10:56 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-11-06 16:08 [BUG] Tangle with symbolic links don't work Cletip Cletip
2023-11-06 16:17 ` Ihor Radchenko
2023-11-07 10:55 ` Max Nikulin [this message]
2023-11-07 11:30 ` Ihor Radchenko
2023-11-20 9:55 ` Cletip Cletip
2023-12-04 12:58 ` Ihor Radchenko
2023-12-15 11:26 ` Ihor Radchenko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://www.orgmode.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=e443418b-7c66-413d-86ee-cdaa0bf3042c@gmail.com \
--to=manikulin@gmail.com \
--cc=clement020302@gmail.com \
--cc=emacs-orgmode@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).