[Bug 233378] [patch] ports-mgmt/portmaster: place portmasterfail.txt in non world-writeable location

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=233378

            Bug ID: 233378
           Summary: [patch] ports-mgmt/portmaster: place
                    portmasterfail.txt in non world-writeable location
           Product: Ports & Packages
           Version: Latest
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: Individual Port(s)
          Assignee: se at FreeBSD.org
          Reporter: rs at bytecamp.net
             Flags: maintainer-feedback?(se at FreeBSD.org)
          Assignee: se at FreeBSD.org

Created attachment 199413
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=199413&action=edit
place portmasterfail.txt in ~

When building/upgrading ports via portmaster fails, it will place a list of
failed ports in /tmp/portmasterfail.txt.

Not only is this file created world-readable, any local user may create a
symlink attack with it.

I recommend placing portmasterfail.txt in $HOME.

with kind regards,
Robert Schulze

-- 
You are receiving this mail because:
You are the assignee for the bug.