Re: possibly security bug in mv ?

Nelson Benítez <[email protected]> Mon, 22 Aug 2005 20:26:38 +0000
Newsgroups gmane.comp.gnu.core-utils.bugs,gmane.comp.gnu.fileutils.bugs
Message-ID <[email protected]>
El lun, 22-08-2005 a las 16:10 +0200, Andreas Schwab escribi=F3:
> Nelson Ben=EDtez <[email protected]> writes:
>=20
> > Hi, on man page of mv it is said:
> >
> > "When both source and destination are on the same filesystem,  they  ar=
e
> > the same file (just the name is changed; owner, mode, timestamps remain
> > unchanged).  When they are on different filesystems, the source file is
> > copied  and then deleted.  mv will copy modification time, access time,
> > user and group ID, and mode if possible. When copying user and/or group
> > ID fails, the setuid and setgid bits are cleared in the copy."
> >
> > The last sentence (clearing setuid,setgid bits) doesn't seem to be true
> > in the following testcase:
>=20
> You should report that to the author of the manual page.  There is no suc=
h
> statement in the documentation of coreutils, neither version 5.2.1 nor
> 5.3.0.
>=20
> Andreas.
>=20

About the version at the footer of man page I can read:=20
"This page describes mv as found in the fileutils-4.0 package; other
versions may differ slightly."=20

You talk about 5.2.1 and 5.3.0 but don't know if you refer to fileutils
package or mv program, can you clarify this so I go to file a bug.