Hey,
the cronjob script in the cheermeup package contains a serious privilege
escalation bug by sourcing the "user configuration settings" as root user:
# ...
localconfig="$homedir/.config/cheermeup/config"
if [ -f "$localconfig" ]; then
. $localconfig
else
# ...
A local user can therefore execute arbitrary commands as root by simply
putting them to ~/.config/cheermeup/config and wait for the next run.
The package should drop privileges way earlier, e.g. by using ConsoleKit
to determine the currently open user sessions and running a separate
script as the logged-in user(s) to create the cheers.
Secondly, the cronjob sometimes writes stuff to stdout/err and may exit
with a non-zero exit code, e.g. if no (GNOME/Unity) user is currently
logged in, which leads to rather annoying mails to root.
I really like the idea, but this package may need some work (beyond
polygen support requested by Enrico) before being suitable for distribution.
Greetings from Oldenburg,
Philipp
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
