Re: new reject msg from an arm64 buster install -- /usr/bin/tar executable?

On Tue, Sep 03, 2019 at 12:13:33 -0600, Charles Curley wrote:
> If you do a completely new installation of debian 10 (buster), tar shows
> up at /usr/bin/tar.
> 
> root@jhegaala:/media# which tar
> /usr/bin/tar
> root@jhegaala:/media# file $( which tar )
> /usr/bin/tar: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=6664753ff93e3b42aa8681d7fe0f7f9e5259c54f, stripped
> root@jhegaala:/media# 
> 
> But if you upgrade from debian 9 (stretch) to 10 (buster), tar show up
> at /bin/tar, consistent with Nathan's observation on stretch, above.
> 
> root@hawk:~# which tar
> /bin/tar
> root@hawk:~#
> 
> dpkg -S and apt-file both place it at /bin/tar on both machines.
> 
> That, of course, makes it hard for Jose to simply drop a correct
> version of amanda-security.conf into place. His code would have to edit
> it during the installation.

Ah, okay, turns out fresh installs of Buster merge /bin and /usr/bin:
  https://www.debian.org/releases/buster/amd64/release-notes/ch-whats-new.en.html#merged-usr
  "2.2.12. Merged /usr on fresh installs"

Long story short, this means that on affected systems /bin is a symlink
to /usr/bin , and thus even though the "tar" package includes the file
with the path "/bin/tar", it is actually physcially installed at
/usr/bin/tar .

The code which processes /etc/amanda-security.conf does check security
against the canonical path of the binary, which would explain why
Amanda now complains on these merged systems....

Jose, off hand it looks like the code that processes this file (seems
like common-src/security-file.c:security_file_check_path() is the
function in question) defaults to the compile-time GUTAR path if *no*
entry is found for "amgtar:gnutar_path="/"runtar:gnutar_path=", but if
any such line is found then it would not fall back to the default.  So I
think that means one has to manually add the
  amgtar:gnutar_path=/usr/bin/tar
  runtar:gnutar_path=/usr/bin/tar 
, etc. lines to amanda-security.conf in the postinst when installing on
merged systems... or alternatively add both sets of baths explicitely
to the file so the same amanda-security.conf file works on both systems
(even though that's actually duplicating the default compiletime path
for the binary)...


Charles,
Am I correct that on jhegaala, Amanda continues to work correctly if you
have both
=============
runtar:gnutar_path=/bin/tar
runtar:gnutar_path=/usr/bin/tar
=============
in your amanda-security.conf file (rather than only the second one, as I
believe you have currently)?  

And, does it continue to work correctly if you put the /bin/tar line after
the /usr/bin/tar line?


						Nathan


----------------------------------------------------------------------------
Nathan Stratton Treadway  -  [email protected]  -  Mid-Atlantic region
Ray Ontko & Co.  -  Software consulting services  -   http://www.ontko.com/
 GPG Key: http://www.ontko.com/~nathanst/gpg_key.txt   ID: 1023D/ECFB6239
 Key fingerprint = 6AD8 485E 20B9 5C71 231C  0C32 15F3 ADCD ECFB 6239