Bug 563301

Summary:	--rpm-requires does not imply -n
Product:	[Fedora] Fedora	Reporter:	Ville Skyttä <ville.skytta>
Component:	bash	Assignee:	Roman Rakus <rrakus>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	medium
Version:	12	CC:	rrakus, tsmetana, twaugh
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	bash-4.0.35-3.fc12	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-04-09 01:28:50 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Ville Skyttä 2010-02-09 18:59:29 UTC

The --rpm-requires argument is documented to imply -n (i.e. don't execute any commands), but that does not hold true; commands in scripts are actually executed, making this a potentially dangerous problem.  Tested on F-12, appears to affect Rawhide as well, FWIW CentOS 5.4's bash-3.2-24.el5 is not affected, don't know about other versions.

$ rpm -q bash
bash-4.0.35-2.fc12.x86_64

$ echo 'echo "hello from script" ; ls /root' > t.sh
$ bash --rpm-requires t.sh
executable(ls)
hello from script
ls: cannot open directory /root: Permission denied

Comment 1 Roman Rakus 2010-03-30 08:50:13 UTC

Thanks for the report. I have done a mistake when reformatting patch. Affected bashes are all since F-11. I will do all necessary updates.

Comment 2 Fedora Update System 2010-03-30 12:47:11 UTC

bash-4.0-10.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/bash-4.0-10.fc11

Comment 3 Fedora Update System 2010-03-30 14:11:13 UTC

bash-4.0.35-3.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/bash-4.0.35-3.fc12

Comment 4 Fedora Update System 2010-03-31 12:25:24 UTC

bash-4.1.2-4.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/bash-4.1.2-4.fc13

Comment 5 Fedora Update System 2010-04-01 01:56:55 UTC

bash-4.0.35-3.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update bash'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/bash-4.0.35-3.fc12

Comment 6 Fedora Update System 2010-04-09 01:28:46 UTC

bash-4.0.35-3.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2010-04-09 04:24:47 UTC

bash-4.1.2-4.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.