Debian Bug report logs - #989602
dpkg-deb overwrites symlinks with directories

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Marc Haber <mh+debian-packages@zugschlus.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: dpkg-deb overwrites symlinks with directories

Date: Tue, 08 Jun 2021 14:08:46 +0200

Package: dpkg
Version: 1.20.9
Severity: minor

Hi,

dpkg-deb -x package.deb happily overwrites symlinks on the filesystems
with directories. I don't know whether this is desired behavior.

tl;dr:
For some reason, a system of mine ended up without
/sbin/start-stop-daemon. Not knowing about dpkg --force-bad-path, I was
unable to use dpkg to repair dpkg because dpkg refuses work if there is
no /sbin/start-stop-daemon.

dpkg-deb -x /var/cache/apt/archives/dpkg*.deb / happily replaced the
/sbin => /usr/sbin with an /sbin directory containing only
/sbin/start-stop-daemon.

Wouldn't it be nicer to have dpkg follow symlinks before creating
directories in the times of usrmerge?

Severity: minor because dpkg --force-bad-path --install dpkg*.deb works.

Greetings
Marc


-- Package-specific info:

-- System Information:
Debian Release: 11.0
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.12.9-zgws1 (SMP w/4 CPU threads)
Kernel taint flags: TAINT_OOT_MODULE
Locale: LANG=de_DE.utf8, LC_CTYPE=de_DE.utf8 (charmap=UTF-8), LANGUAGE=en
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages dpkg depends on:
ii  libbz2-1.0   1.0.8-4
ii  libc6        2.31-12
ii  liblzma5     5.2.5-2
ii  libselinux1  3.1-3
ii  tar          1.34+dfsg-1
ii  zlib1g       1:1.2.11.dfsg-2

dpkg recommends no packages.

Versions of packages dpkg suggests:
ii  apt            2.2.3
pn  debsig-verify  <none>

-- no debconf information

Message #8 received at 989602@bugs.debian.org (full text, mbox, reply):

From: Johannes Schauer Marin Rodrigues <josch@debian.org>

To: mh+debian-packages@zugschlus.de

Cc: 989602@bugs.debian.org

Subject: Re: dpkg-deb overwrites symlinks with directories

Date: Tue, 08 Jun 2021 17:34:57 +0200

[Message part 1 (text/plain, inline)]

On Tue, 08 Jun 2021 14:08:46 +0200 Marc Haber <mh+debian-packages@zugschlus.de> wrote:
> dpkg-deb -x package.deb happily overwrites symlinks on the filesystems
> with directories. I don't know whether this is desired behavior.
> 
> tl;dr:
> For some reason, a system of mine ended up without
> /sbin/start-stop-daemon. Not knowing about dpkg --force-bad-path, I was
> unable to use dpkg to repair dpkg because dpkg refuses work if there is
> no /sbin/start-stop-daemon.
> 
> dpkg-deb -x /var/cache/apt/archives/dpkg*.deb / happily replaced the
> /sbin => /usr/sbin with an /sbin directory containing only
> /sbin/start-stop-daemon.
> 
> Wouldn't it be nicer to have dpkg follow symlinks before creating
> directories in the times of usrmerge?
> 
> Severity: minor because dpkg --force-bad-path --install dpkg*.deb works.

you can also use:

dpkg-deb --fsys-tarfile dpkg*.deb | tar -C / --keep-directory-symlink --extract --file -

Thanks!

cheers, josch

[signature.asc (application/pgp-signature, inline)]

Message #13 received at 989602@bugs.debian.org (full text, mbox, reply):

From: Marc Haber <mh+debian-bugs@zugschlus.de>

To: Johannes Schauer Marin Rodrigues <josch@debian.org>

Cc: 989602@bugs.debian.org

Subject: Re: dpkg-deb overwrites symlinks with directories

Date: Tue, 8 Jun 2021 21:58:27 +0200

On Tue, Jun 08, 2021 at 05:34:57PM +0200, Johannes Schauer Marin Rodrigues wrote:
> dpkg-deb --fsys-tarfile dpkg*.deb | tar -C / --keep-directory-symlink --extract --file -

That is totally unintuitive, though.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Leimen, Germany    |  lose things."    Winona Ryder | Fon: *49 6224 1600402
Nordisch by Nature |  How to make an American Quilt | Fax: *49 6224 1600421

Message #20 received at 989602-done@bugs.debian.org (full text, mbox, reply):

From: Guillem Jover <guillem@debian.org>

To: Marc Haber <mh+debian-packages@zugschlus.de>, 989602-done@bugs.debian.org

Subject: Re: Bug#989602: dpkg-deb overwrites symlinks with directories

Date: Wed, 9 Jun 2021 02:20:32 +0200

tag 989602 wontfix
thanks

On Tue, 2021-06-08 at 14:08:46 +0200, Marc Haber wrote:
> Package: dpkg
> Version: 1.20.9
> Severity: minor

> dpkg-deb -x package.deb happily overwrites symlinks on the filesystems
> with directories. I don't know whether this is desired behavior.

It's been this way forever, and I'm not comfortable at all replacing
the current behavior by using f.ex. the tar option that josch provided,
which might cause security issues, as the extract action can be
performed on any directory on the filesystem.

> tl;dr:
> For some reason, a system of mine ended up without
> /sbin/start-stop-daemon. Not knowing about dpkg --force-bad-path, I was
> unable to use dpkg to repair dpkg because dpkg refuses work if there is
> no /sbin/start-stop-daemon.
> 
> dpkg-deb -x /var/cache/apt/archives/dpkg*.deb / happily replaced the
> /sbin => /usr/sbin with an /sbin directory containing only
> /sbin/start-stop-daemon.
> 
> Wouldn't it be nicer to have dpkg follow symlinks before creating
> directories in the times of usrmerge?
> 
> Severity: minor because dpkg --force-bad-path --install dpkg*.deb works.

I'm assuming this was done on a system installed or migrated to the
broken merged-usr-via-aliased-dirs layout, which dpkg does not really
support. I've been repeating this over and over, but people seem to
ignore it, or consider these non-issues, to the point that the tech-ctte
has declared that somehow code now magically supports this by the
power of decree… well, at least now there's dpkg-fsys-usrunmess to
revert the damage, for those now willing to endure it. :)

  <https://wiki.debian.org/Teams/Dpkg/FAQ#Q:_Does_dpkg_support_merged-.2Fusr-via-aliased-dirs.3F>

The specific case of «dpkg-deb -x» has even been listed explicitly for
some time now in:

  <https://wiki.debian.org/Teams/Dpkg/MergedUsr>

So closing this now.

Thanks,
Guillem

Message #25 received at 989602@bugs.debian.org (full text, mbox, reply):

From: Marc Haber <mh+debian-packages@zugschlus.de>

To: 989602@bugs.debian.org

Subject: Re: Bug#989602 closed by Guillem Jover <guillem@debian.org> (Re: Bug#989602: dpkg-deb overwrites symlinks with directories)

Date: Wed, 9 Jun 2021 10:24:37 +0200

On Wed, Jun 09, 2021 at 12:24:04AM +0000, Debian Bug Tracking System wrote:
> I'm assuming this was done on a system installed or migrated to the
> broken merged-usr-via-aliased-dirs layout, which dpkg does not really
> support.

It was installed on a platform without official support using the
offical current installer, the one we're planning to release as "Debian
stable, the Universal Operating System" in six weeks.


-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Leimen, Germany    |  lose things."    Winona Ryder | Fon: *49 6224 1600402
Nordisch by Nature |  How to make an American Quilt | Fax: *49 6224 1600421

Send a report that this bug log contains spam.