Source Mage GNU/Linux

Programs
Speedtouch Project
Snoopy Project
eciadsl Project
The bread recipe
Source Mage
BeOS
My resume
My blog
Notes
Donation

en fr

Source Mage GNU/Linux

Benoît Papillault, 2004-11-10

installwatch presentation

installwatch is a tool written by Pancrazio `Ezio' de Mauro in 1998 and maintained since by Felipe Eduardo Sanchez Diaz Duran on his web site : http://asic-linux.com.mx/~izto/checkinstall/installwatch.html. It allows to keep track of files created or modified during the installation of a software. This is how it is used by sorcery.

Bugs in 0.6.3 version

The 0.6.3 version is the latest available version at the time of writing this document. It contains subtil bugs that are not easy to reproduce. Here are the list:

Bug 1: buffer overflows trigger crash when long file name are used.
Bug 2: lchown function is implemented using true_chown function instead of true_lchown function.
Bug 3: if installwatch is used when installwatch itself is installed (which is what happen on Source Mage GNU/Linux), then LD_PRELOAD's modification done when make install is run results in installwatch.so being not tracked.
Bug 4: compilation is done without using the standard variables $(CC) and $(CFLAGS). This makes impossible to add optimisation options (like this is done in Source Mage GNU/Linux). Furthermore, creation of library is not correct and does not work on x86_64 architecture.
Bug 5: installwatch uses syslog and passes a buffer as the second parameter. This can lead to crash.

Original installwatch version: Download installwatch 0.6.3

Bugs's reproduction

In order to correct a bug, one should have a way to reproduce it. As we are talking about bugs that are very hard to reproduce, I wrote a small software that can check for them : installwatch-check-1.0.tar.bz2.

Compilation is done in the usual way:

tar jxvf installwatch-check-1.0.tar.bz2
cd installwatch-check-1.0
make
su
# stop syslog since syslog must not be running during the test
make check

You will get something like the following:

Running check without installwatch
syslog test success
open test success
chown test success
lchown test success
MAXPATHLEN test success
syslog buffer test success
Running check with installwatch
open: No such file or directory
cmp: EOF on log-with.txt
installwatch check FAILED

Corrections made

For each bug enumerated above, here are the corresponding patch:

Bug 1: Length of data being copied is checked. installwatch-buffer.diff.
Bug 2: We use true_lchown like mentionned before. installwatch-errno.diff.
Bug 3: LD_PRELOAD's modification is removed. We use a mixed of cp and mv combination to install a library which is in use. installwatch-ld-preload.diff.
Bug 4: We use $(CC) and $(CFLAGS) like mentionned before. installwatch-cflags.diff.
Bug 5: Correction is to use syslog with %s instead of the buffer.installwatch-syslog.diff.

Patchs should be applied in the following order:

installwatch-ld-preload.diff
installwatch-errno.diff
installwatch-buffer.diff
installwatch-cflags.diff
installwatch-syslog.diff

Patched installwatch version: Download installwatch 0.6.4

Corrections checking

The installwatch-check tool presented above was used to check the corrections done. All tests have been successfull (see below):

Running check without installwatch
syslog test success
open test success
chown test success
lchown test success
MAXPATHLEN test success
syslog buffer test success
Running check with installwatch
syslog test success
open test success
chown test success
lchown test success
MAXPATHLEN test success
syslog buffer test success
installwatch check SUCCESSFULL

Corrections status

Those patches have been emailed to the installwatch's maintainer on November 2004, the 17th. He replied on November 2004, the 21st that he will look at those patches.

Bug 1 and 2:. This patch has been reported with the patch attached : http://bugs.sourcemage.org/show_bug.cgi?id=5497.
Bug 3:. This patch has been integrated in Source Mage GNU/Linux. Voir http://bugs.sourcemage.org/show_bug.cgi?id=4384.

Benoît Papillault