[SRU] package installation creates /root/.tvtime

[erusan]

Binary package hint: tvtime

Since Dapper, tvtime is installed with root as the owner. This makes it so the user can't save channel data, picture settings, etc.

ProblemType: Bug
Architecture: i386
Date: Fri Mar 16 01:12:08 2007
DistroRelease: Ubuntu 7.04
Uname: Linux godzilla 2.6.20-11-generic #2 SMP Thu Mar 15 08:03:07 UTC 2007 i686 GNU/Linux

SRU JUSTIFICATION:

[Impact] + [Test Case]

From Debian bug (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=694892):

"Hi,

during a test with piuparts I noticed that your package creates files in
/root. From the attached log
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=tvtime_1.0.2-9.log.gz;att=1;bug=694892 (scroll to the bottom):

0m34.1s ERROR: FAIL: Package purging left files on system:
  /root/.tvtime/ not owned

Creating stuff in /root is a FHS and policy violation. (And of course
these files should not be deleted by maintainer scripts.)
But it is also an indication that the package operation may depend on
root's .tvtime configuration (and package installation might even fail if
that configuration is broken). That would be a case for "configuration
files not in /etc"."

This might also be the cause for "this bug" where a users ~/.tvtime/ is
owned by root:root - probably depending on how the user switched to root.

[Regression Potential]

"This is due to tvtime-configure being called in the postinst script.
tvtime-configure uses config_new() which in turn contains this code:

    /* Make the ~/.tvtime directory every time on startup, to be safe. */
    if( asprintf( &temp_dirname, "%s/.tvtime", getenv( "HOME" ) ) < 0 ) {
        /* FIXME: Clean up ?? */
        return 0;
    }
    mkdir_and_force_owner( temp_dirname, ct->uid, getgid() );
    free( temp_dirname );

Therefore, tvtime-configure creates $HOME/.tvtime everytime you
run it, even when the invocation is something like
tvtime-configure -F /etc/tvtime/tvtime.xml

I have attached a patch which will fix the bug (that is, not create
$HOME/.tvtime on every run) but will still work correctly by creating
dirname(config_filename) before saving. I tested it by changing the
deinterlacing setting."

[David (david-redhat-bugs)]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.5)
Gecko/20041107 Firefox/1.0

Description of problem:
The tvtime binary is installed setuid root. Is that wise ?

AFAIK it is because it needs access to /dev/rtc

Can that not be solved in some other way ?

The last thing we need is a remote break-in over TV signals ;-)

Is there really no other way for precise timing but /dev/rtc ?

Version-Release number of selected component (if applicable):
tvtime-0.9.13-1

[Ngo (ngo-redhat-bugs)]

yes, it's needed to set the max-user-freq on /dev/rtc. But I don't see
it's critical because it will be dropped to a user after doing that.

[Ngo (ngo-redhat-bugs)]

in my opinion it's safe by removing setuid root. I will remove it in
next rebuild. Perhaps adding "dev.rtc.max-user-freq = 1024" in
/etc/sysctl.conf.

[flaccid (chris-xhost)]

Yes, this does seem like a logical error.

Here is the output (for eg.):

Running tvtime 1.0.2.
Reading configuration from /etc/tvtime/tvtime.xml
flaccid@boust:~$ I/O warning : failed to load external entity "/home/flaccid/.tvtime/tvtime.xml"
I/O error : Permission denied
I/O error : Permission denied
Cannot change owner of /home/flaccid/.tvtime/tvtime.xml: Permission denied.

Can we please fix this bug asap?
tvtime is good out of the box and works with a lot of people's hardware, pity it doesn't actually work out of the box at all atm because of this :(

[Daniel T Chen (crimsun)]

Is this symptom still reproducible in 8.10 alpha?

[celticmonkey (jamesboston)]

This is still a bug in Ubuntu 8.10.

After installing tvtime, the ~/.tvtime dir is root:root, so settings won't save.

[Samuel Schluep (schluep)]

I confirm that this bug has not been fixed in Ubuntu 8.10.

[David C. Curtis (dccurtis)]

Still occurs in Jaunty.

[Burt P. (pburt0)]

Still exists in Ubuntu 9.04.

[Rafael Gattringer (rafael.gattringer)]

This bug also still exists in Ubuntu 10.04 LTS and Ubuntu 10.10 Alpha 2. (AMD64)

[Rafael Gattringer (rafael.gattringer)]

Who can fix this long confirmed and easy to fix (?) bug? The assigned maintainers the "MOTU Media Team" are no longer active. What now?

[Rafael Gattringer (rafael.gattringer)]

Here is a quick workaround for the command line:

sudo chown -Rv $USERNAME:$USERNAME /home/$USERNAME/.tvtime

This was tested on Ubuntu 10.10 Alpha 2, but should be the same in all distributions.

[ianos attila (ianosattila)]

After 5 years, this bug still here.

[Laszlo Danciu (rajopoeg)]

It looks like it is installing the binary setuid root, so the bug probably lies with the application itself. (The problem ought to be fixable by simple groups + udev rules)

[Pojar Geo (geoubuntu)]

This is serious bug because package installation creates /root/.tvtime. See http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=694892

[Launchpad Janitor (janitor)]

This bug was fixed in the package tvtime - 1.0.2-10ubuntu1

---------------
tvtime (1.0.2-10ubuntu1) raring; urgency=low

  * Merge from Debian unstable (LP: #92752). Remaining Ubuntu changes:
    - Retain patches:
      tvtime-1.0.1-savematte.patch, desktop_file.patch, tvtime-1.0.2-alsa.patch,
      tvtime-1.0.2-alsamixer.patch, pal_audio_mode_persistence.patch,
      tvtime-1.0.2-screensaver.patch, tvtime-1.0.2-videoinput.patch,
      tvtime-1.0.2-osd.patch, tvtime-1.0.2-usage.patch,
      tvtime-1.0.2-command.patch, tvtime-1.0.2-build.patch,
      tvtime-1.0.2-libtool.patch, tvtime-1.0.2-cursor.patch,
      tvtime-1.0.2-metacity.patch, tvtime-1.0.2-x_size_hint.patch,
      tvtime-1.0.2-menu.patch, tvtime-1.0.2-focus_mouse.patch,
      tvtime-1.0.2-icon.patch, tvtime-1.0.2-tvtimeosd.patch,
      tvtime-1.0.2-cpuid.patch, tvtime-1.0.2-xmltv.patch,
      tvtime-1.0.2-vbidata.patch, tvtime-1.0.2-verbose.patch,
      tvtime-1.0.2-vbiscreen.patch, tvtime-1.0.2-closed_caption.patch,
      tvtime-1.0.2-key_event.patch, tvtime-1.0.2-vbi.patch,
      tvtime-1.0.2-xinerama.patch, tvtime-1.0.2-volume.patch,
      tvtime-1.0.2-output_volume.patch, tvtime-1.0.2-autoconf.patch,
      tvtime-1.0.2-xcommon.patch.
    - debian/control: Build-Depends on autoconf, automake, libasound2-dev,
      libtool and libxss instead of libxtst.
    - debian/rules: Call autoreconf to re-generate the configure script.
    - added debian/source/format file.
  * Droped Debian changes:
    - debian/control: Suggests: oss-compat.
    - debian/control: Build-Depends chrpath.
    - debian/rules: Fixed binary-or-shlib-defines-rpath.
 -- POJAR GEORGE <email address hidden> Sun, 09 Dec 2012 18:02:59 +0000

[Pojar Geo (geoubuntu)]

Please nominate for precise

[Pojar Geo (geoubuntu)]

Please nominate for quantal

[Brian Murray (brian-murray)]

I've uploaded this to the Quantal -proposed queue.

[Brian Murray (brian-murray)]

And to the Precise -proposed queue.

[Brian Murray (brian-murray)]

Hello erusan, or anyone else affected,

Accepted tvtime into quantal-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/tvtime/1.0.2-9ubuntu1.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Brian Murray (brian-murray)]

Hello erusan, or anyone else affected,

Accepted tvtime into precise-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/tvtime/1.0.2-7ubuntu9.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Triniton Adam (trinitonadam)]

Hello, I instaled tvtime from proposed and now this problem seem to be solved.
Thanks

[Zicu Radu (zradu1100)]

Also, I verified for precise and quantal, all is fine now.

[Colin Watson (cjwatson)]

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package tvtime - 1.0.2-7ubuntu9.1

---------------
tvtime (1.0.2-7ubuntu9.1) precise-proposed; urgency=low

  * debian/patches/tvtime-1.0.2-saveconfig.patch: Prevents needless creation of
    $HOME/.tvtime by tvtime-configure. (LP: #92752)
 -- POJAR GEORGE <email address hidden> Wed, 12 Dec 2012 15:47:13 -0800

[Launchpad Janitor (janitor)]

This bug was fixed in the package tvtime - 1.0.2-9ubuntu1.1

---------------
tvtime (1.0.2-9ubuntu1.1) quantal-proposed; urgency=low

  * debian/patches/tvtime-1.0.2-saveconfig.patch: Prevents needless creation of
    $HOME/.tvtime by tvtime-configure. (LP: #92752)
 -- POJAR GEORGE <email address hidden> Wed, 12 Dec 2012 15:36:00 -0800