[Stable 7] CPIO breakage/

[Peter Jeremy]

On 2010-Jun-15 17:22:50 -0700, Xin LI <delphij at delphij.net> wrote:
>On 2010/06/15 17:05, Sean Bruno wrote:
>> A little more background.  It looks like symlinks are getting stripped
>> of their '/' which sucks.  Ideas?
...
>> e.g. /home/foo/bar -> /opt/baz/blob
>> 
>> becomes
>> 
>> home/foo/bar -> opt/baz/blob   
>> 
>> Yuck.
>
>This is a security measurement I think.

Can someone please explain how stripping a leading '/' off the
destination of a symlink enhances security?  The destination is
not being written to.

>--absolute-filenames disables this behavior.

This definitely reduces security and would seem to be far more
dangerous than being able to create symlinks to absolute pathnames.

-- 
Peter Jeremy
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 196 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-stable/attachments/20100617/cbf85ddb/attachment.pgp