Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

libirml.x86_64 calls mktemp. mkstemp is preferred #1264

Open
mysticrecords opened this issue Nov 17, 2023 · 4 comments
Open

libirml.x86_64 calls mktemp. mkstemp is preferred #1264

mysticrecords opened this issue Nov 17, 2023 · 4 comments

Comments

@mysticrecords
Copy link

when building packages 1 warning is reported

[   73s] RPMLINT report:
[   73s] ===============
[   73s] libirml1.x86_64: W: call-to-mktemp /usr/lib64/libirml.so.1
[   73s] This executable calls mktemp. As advised by the manpage (mktemp(3)), this
[   73s] function should be avoided. Some implementations are deeply insecure, and
[   73s] there is a race condition between the time of check and time of use (TOCTOU).
[   73s] See http://capec.mitre.org/data/definitions/29.html for details, and contact
[   73s] upstream to have this issue fixed.
[   73s] 
[   73s] 7 packages and 0 specfiles checked; 0 errors, 1 warnings.

mkstemp is preferred.

@pavelkumbrasev
Copy link
Contributor

Could you please clarify what version of TBB are you building? And in what environment?

@phprus
Copy link
Contributor

phprus commented Nov 17, 2023

@pavelkumbrasev

Current master:

// TODO: consider using mkstemp instead of mktemp.
char* sem_name = mktemp(templ);

@pavelkumbrasev
Copy link
Contributor

I know we still have RML code base for a Python distributions. I want to clarify when and how this problem appears.

@mysticrecords
Copy link
Author

Could you please clarify what version of TBB are you building? And in what environment?

Yea of course, it is version 2021.10 and building in opensuse Leap15.5 environment

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

4 participants