Subject: Re: Bug#405454: [new check] init script in level S must only use commands from /sbin:/bin

From: Raphael Geissert <[email-masked]>
Date: Wed, 16 Sep 2009 17:51:36 -0500

tag 405454 patch
thanks

Hi,

Attached patch implements the first part of the test, by only looking for 
mentions of /var or /usr in the init script. I'll later finish the second 
part of the check, which relies on the list of /bin and /sbin binaries in the 
archive.

Cheers,
-- 
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net

---

From: Russ Allbery <[email-masked]>
Date: Thu, 24 Dec 2009 17:22:58 -0800

Raphael Geissert <[email-masked]> writes:

> Attached patch implements the first part of the test, by only looking
> for mentions of /var or /usr in the init script. I'll later finish the
> second part of the check, which relies on the list of /bin and /sbin
> binaries in the archive.

I looked at this today, but I'm nervous about false positives since the
init script checks currently don't have any of the logic that the scripts
check has to avoid heredocs, conditionals, and so forth.  I'm afraid we'll
trigger on printed output for the user.

I'm going to go ahead and apply this, but mark the new tags as
experimental so that we can run it for a while and see what the results
look like and if there are a lot of false positives.

-- 
Russ Allbery ([email-masked])               <http://www.eyrie.org/~eagle/>

---

From: Raphael Geissert <[email-masked]>
Date: Fri, 25 Dec 2009 18:48:40 -0600

Russ Allbery wrote:

> Raphael Geissert writes:

I'm fine with marking it as experimental, although I ran it against all the
packages providing init script and didn't find any false positive in those
scripts I verified.

A similar check is being run daily (see http://lintian.d.o/~pere/) and it
has helped file many bug reports without any FP as far as I'm aware of, so
far.

Cheers,

---

From: Russ Allbery <[email-masked]>
Date: Fri, 25 Dec 2009 18:31:59 -0800

Raphael Geissert <[email-masked]> writes:

> I'm fine with marking it as experimental, although I ran it against all
> the packages providing init script and didn't find any false positive in
> those scripts I verified.

> A similar check is being run daily (see http://lintian.d.o/~pere/) and
> it has helped file many bug reports without any FP as far as I'm aware
> of, so far.

Oh, okay, in that case feel free to take off the experimental marker if
you think it's justified.  I hadn't realized that there was previous
cross-archive checks done.

---

From: Raphael Geissert <[email-masked]>
Date: Wed, 30 Dec 2009 19:42:49 -0600

> cross-archive checks done.

I didn't remove it because the regex used in lintian is a bit more generic.
I'm now going through the results at lintian.d.o to find and fix false
positives before the next release.

Cheers,