bug#30228: desktop files embedding full path

[Efraim Flashner]

On Sun, Feb 18, 2018 at 09:06:11PM +0100, Ricardo Wurmus wrote:
> 
> Efraim Flashner <address@hidden> writes:
> 
> > On Tue, Jan 30, 2018 at 12:00:02PM +0100, Ludovic Courtès wrote:
> >> Hello,
> >> 
> >> Efraim Flashner <address@hidden> skribis:
> >> 
> >> > On Wed, Jan 24, 2018 at 03:58:51PM +0100, Ludovic Courtès wrote:
> >> >> Hi,
> >> >> 
> >> >> Efraim Flashner <address@hidden> skribis:
> >> >> 
> >> >> > the owncloud-client package includes an option to add a .desktop entry
> >> >> > to $HOME/.configure/autostart/, which allows it to autostart when you
> >> >> > log in to your desktop environment. Because the full path of the 
> >> >> > binary
> >> >> > is in the .desktop file, it will always start THAT copy of
> >> >> > owncloud-client, even if it is garbage collected.
> >> >> 
> >> >> I think you shouldn’t copy manually the .desktop file to
> >> >> ~/.configure/autostart, precisely because of that.
> >> >> 
> >> >> Instead this should be done via in indirect GC root (as in “guix build
> >> >> -r the-root owncloud-client”) or, ideally, by having it GuixSD-managed.
> >> >> 
> >> >> Thoughts?
> >> >> 
> >> >> Ludo’.
> >> >
> >> > I agree it shouldn't copy a .desktop file into .config/autostart/. In
> >> > this case, the offending code is here¹, so there's not much that can be
> >> > done about it. In mine I've changed the Exec line to
> >> > /var/guix/profiles/per-user/... so it'll work as expected. In this case
> >> > the code generates a desktop file on the fly, so modifying the .desktop
> >> > file shipping with applications wouldn't even help here.
> >> >
> >> >
> >> > ¹ 
> >> > https://github.com/owncloud/client/blob/f326bf371d690f1929f7c5c06aebf53c7255daa6/src/common/utility_unix.cpp#L73
> >> 
> >> What do you think should be done on the Guix side?  We could patch the
> >> code above to not install the .desktop file in ~/.config, for instance.
> >> 
> >> Thanks,
> >> Ludo’.
> >
> > I've been thinking about it and it would also just be possible to patch
> > the exec line there to only have the binary name. As an unintended
> > consquence, if you did add the desktop entry to .config/autostart/ and
> > the exec was only 'owncloud-client' then we would match the other
> > distros' behaviors of not running uninstalled programs, if you were to
> > later uninstall owncloud-client from your profile.
> >
> > I bet the reason it is coded this way is to allow for
> > /usr/bin/owncloud-client or /usr/local/bin/owncloud-client, but just
> > 'owncloud-client' will pick up the executable if it is in the runpath.
> >
> > I think that's the best option, to change the 'exec' line to just
> > 'owncloud-client'.
> 
> Would that pick up owncloud-client if there is an executable of that
> name somewhere in PATH?  Could this be a security problem?
> 

address@hidden ~$ echo $PATH
/home/efraim/.guix-profile/bin:/home/efraim/.guix-profile/sbin:/run/setuid-programs:/run/current-system/profile/bin:/run/current-system/profile/sbin

probably, but I assume you'd have to modify your default path to add
~/bin or something. It seems less worse than starting an older version
of owncloud-client or trying to start one that's been garbage collected.

-- 
Efraim Flashner   <address@hidden>   אפרים פלשנר
GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted

signature.asc
Description: PGP signature