Ubuntu patch prevents custom argv[0]

Bug #2137745 reported by Etienne
16
This bug affects 2 people
Affects Status Importance Assigned to Milestone
rust-coreutils (Ubuntu)
Confirmed
Undecided
Unassigned

Bug Description

On Ubuntu 24.04.03 starting e.g. `true` with a custom argv[0] works:

```
ecordonnier@LBM9V6C4:~/dev/coreutils$ bash -c "exec -a foobar
/usr/lib/cargo/bin/coreutils/true"
foobar 0.0.24 (multi-call binary)

Usage: foobar [function [arguments...]]

Currently defined functions:

    [, arch, b2sum, b3sum, base32, base64, basename, basenc, cat,
chcon, chgrp, chmod, chown,
    chroot, cksum, comm, cp, csplit, cut, date, dd, df, dir,
dircolors, dirname, du, echo,
...
...
```

On Ubuntu 26.04 (development branch) it doesn't work:
```
asteba@asteba-MS-7C75:~$ /usr/lib/cargo/bin/coreutils/true --version
/usr/lib/cargo/bin/coreutils/true (uutils coreutils) 0.2.2

asteba@asteba-MS-7C75:~$ bash -c "exec -a foobar /usr/lib/cargo/bin/coreutils/true"
Security violation: Requested utility `foobar` does not match executable name:
  /usr/lib/cargo/bin/coreutils/true
```

It works with GNU coreutils however:

```
asteba@asteba-MS-7C75:~/dev$ bash -c "exec -a foobar /usr/bin/gnutrue"
asteba@asteba-MS-7C75:~/dev$
```

The error "Security Violation..." comes from a Ubuntu patch ( https://git.launchpad.net/ubuntu/+source/rust-coreutils/tree/debian/patches/require-utility-to-be-invoked-at-matching-path.patch?h=applied/ubuntu/devel ):

```
asteba@asteba-MS-7C75:~/dev/coreutils/ubuntu-sources$ rg -i "security violation" .
./rust-coreutils-0.2.2/debian/patches/require-utility-to-be-invoked-at-matching-path.patch
27:+ "Security violation: Requested utility `{}` does not match executable name:\n {}",

./rust-coreutils-0.2.2/src/bin/coreutils.rs
116: "Security violation: Requested utility `{}` does not match executable name:\n {}",

```

@julian-klode FYI

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in rust-coreutils (Ubuntu):
status: New → Confirmed
Revision history for this message
Julian Andres Klode (juliank) wrote :

Yes this is necessary for security reasons, there is not much we can do except restructure coreutils entirely to be build as a shared library with tiny stub executables call uu_main()

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.