Bug#327389: java-package: traversal permissions leading to libjavaplugin_oji.so are too restrictive - fix details included

[Scott Edwards]

Package: java-package
Version: 0.25
Severity: important

factiods gleaned from the dpkg bot on freenode regarding this topic:
http://supaplex.aros.net/freenode-dpkg-2005-09-09.txt
The system wide approach didn't seem to work. I tried that after I got
my local copy working. I yanked the symlink, restarted FF and tested,
and no java plugin.

***@brattboy:~$ cd .mozilla/
***@brattboy:~/.mozilla$ ls
appreg firefox
***@brattboy:~/.mozilla$ mkdir plugins
***@brattboy:~/.mozilla$ cd plugins/
***@brattboy:~/.mozilla/plugins$ ln -s
/usr/lib/mozilla-firefox/plugins/libjavaplugin_oji.so
***@brattboy:~/.mozilla/plugins$ ls -l
total 0
lrwxrwxrwx 1 supaplex supaplex 53 Sep 9 12:18 libjavaplugin_oji.so ->
/usr/lib/mozilla-firefox/plugins/libjavaplugin_oji.so

new symlink reports it's bad somehow (in red)

***@brattboy:~/.mozilla/plugins$ rm libjavaplugin_oji.so
***@brattboy:~/.mozilla/plugins$ ls -la /usr/lib/mozilla-firefox/plugins/libjavaplugin_oji.so
lrwxrwxrwx 1 root root 60 Aug 11 2004 /usr/lib/mozilla-firefox/plugins/libjavaplugin_oji.so -> /usr/java/j2re1.4.2/plugin/i386/mozilla/libjavaplugin_oji.so
***@brattboy:~/.mozilla/plugins$ ls -la /usr/java/j2re1.4.2/plugin/i386/mozilla/libjavaplugin_oji.so
ls: /usr/java/j2re1.4.2/plugin/i386/mozilla/libjavaplugin_oji.so: Permission denied
***@brattboy:~/.mozilla/plugins$ sudo ls -la /usr/java/j2re1.4.2/plugin/i386/mozilla/libjavaplugin_oji.so
-rw-r--r-- 1 brattboy brattboy 213660 Dec 16 2003 /usr/java/j2re1.4.2/plugin/i386/mozilla/libjavaplugin_oji.so
***@brattboy:~/.mozilla/plugins$ stat /usr/java/j2re1.4.2/plugin/i386/mozilla/
stat: cannot stat `/usr/java/j2re1.4.2/plugin/i386/mozilla/': Permission denied
***@brattboy:~/.mozilla/plugins$ stat /usr/java/j2re1.4.2/plugin/i386/
stat: cannot stat `/usr/java/j2re1.4.2/plugin/i386/': Permission denied
***@brattboy:~/.mozilla/plugins$ stat /usr/java/j2re1.4.2/plugin/
stat: cannot stat `/usr/java/j2re1.4.2/plugin/': Permission denied
***@brattboy:~/.mozilla/plugins$ stat /usr/java/j2re1.4.2/
File: `/usr/java/j2re1.4.2/'
Size: 4096 Blocks: 8 IO Block: 4096 directory
Device: 301h/769d Inode: 4538562 Links: 7
Access: (0750/drwxr-x---) Uid: ( 1000/brattboy) Gid: ( 1000/brattboy)
Access: 2004-08-11 07:37:16.000000000 -0600
Modify: 2003-12-16 23:12:44.000000000 -0700
Change: 2004-08-11 07:36:36.000000000 -0600
***@brattboy:~/.mozilla/plugins$ sudo chmod 755
/usr/java/j2re1.4.2/ /usr/java/j2re1.4.2/plugin/
/usr/java/j2re1.4.2/plugin/i386/
/usr/java/j2re1.4.2/plugin/i386/mozilla/
***@brattboy:~/.mozilla/plugins$ ls -la
/usr/java/j2re1.4.2/plugin/i386/mozilla/libjavaplugin_oji.so
-rw-r--r-- 1 brattboy brattboy 213660 Dec 16 2003
/usr/java/j2re1.4.2/plugin/i386/mozilla/libjavaplugin_oji.so
***@brattboy:~/.mozilla/plugins$ ls -la
total 8
drwxr-xr-x 2 supaplex supaplex 4096 Sep 9 12:18 .
drwxr-xr-x 4 supaplex supaplex 4096 Sep 9 12:18 ..
***@brattboy:~/.mozilla/plugins$ ln -s /usr/lib/mozilla-firefox/plugins/libjavaplugin_oji.so
***@brattboy:~/.mozilla/plugins$ ls -l
total 8
lrwxrwxrwx 1 supaplex supaplex 53 Sep 9 12:19 libjavaplugin_oji.so -> /usr/lib/mozilla-firefox/plugins/libjavaplugin_oji.so

Restarting FireFox here, and testing a java game works as expected.

-rw-r--r-- 1 supaplex supaplex 14411078 Sep 9 11:43 j2re-1_4_2_09-linux-i586.bin
-rw-r--r-- 1 supaplex supaplex 20963512 Sep 9 11:48 sun-j2re1.4_1.4.2+09_i386.deb
***@brattboy:~$ md5sum j2re-1_4_2_09-linux-i586.bin
f82a38b54315bf87dcfd2efcb5091984 j2re-1_4_2_09-linux-i586.bin

-- System Information:
Debian Release: testing/unstable
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: i386 (i686)
Shell: /bin/sh linked to /bin/bash
Kernel: Linux 2.4.26-1-386
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)

Versions of packages java-package depends on:
ii coreutils 5.2.1-2 The GNU core utilities
ii debhelper 4.9.5 helper programs for debian/rules
ii fakeroot 1.4.3 Gives a fake root environment

java-package recommends no packages.

-- no debconf information

[Debian Bug Tracking System]

Your message dated Fri, 09 Sep 2005 15:43:24 -0400
with message-id <***@bytemason.org>
and subject line Bug#327389: java-package: traversal permissions leading to libjavaplugin_oji.so are too restrictive - fix details included
has caused the attached Bug report to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)

Debian bug tracking system administrator
(administrator, Debian Bugs database)

--------------------------------------
Received: (at submit) by bugs.debian.org; 9 Sep 2005 19:12:27 +0000

[Barry Hawkins]

Post by Scott Edwards
Package: java-package
Version: 0.25
Severity: important
http://supaplex.aros.net/freenode-dpkg-2005-09-09.txt
The system wide approach didn't seem to work. I tried that after I got
my local copy working. I yanked the symlink, restarted FF and tested,
and no java plugin.
appreg firefox
/usr/lib/mozilla-firefox/plugins/libjavaplugin_oji.so
total 0
lrwxrwxrwx 1 supaplex supaplex 53 Sep 9 12:18 libjavaplugin_oji.so ->
/usr/lib/mozilla-firefox/plugins/libjavaplugin_oji.so
new symlink reports it's bad somehow (in red)
lrwxrwxrwx 1 root root 60 Aug 11 2004 /usr/lib/mozilla-firefox/plugins/libjavaplugin_oji.so -> /usr/java/j2re1.4.2/plugin/i386/mozilla/libjavaplugin_oji.so
ls: /usr/java/j2re1.4.2/plugin/i386/mozilla/libjavaplugin_oji.so: Permission denied
-rw-r--r-- 1 brattboy brattboy 213660 Dec 16 2003 /usr/java/j2re1.4.2/plugin/i386/mozilla/libjavaplugin_oji.so
stat: cannot stat `/usr/java/j2re1.4.2/plugin/i386/mozilla/': Permission denied
stat: cannot stat `/usr/java/j2re1.4.2/plugin/i386/': Permission denied
stat: cannot stat `/usr/java/j2re1.4.2/plugin/': Permission denied

[...]
Scott,
Thank you for your use of Debian. You have filed a bug against
java-package when trying to use a JRE that is not packaged by
java-package. The thing you are trying to do is outside the scope of
java-package. Please try installing java-package and generating a
Debian package from a Sun, Blackdown, or IBM binary that you download as
directed in the package's documentation.

Regards,
- --
Barry Hawkins
site: www.bytemason.org
weblog: www.yepthatsme.com

Registered Linux User #368650