From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 27901 invoked by alias); 4 Oct 2012 14:51:20 -0000 Received: (qmail 27892 invoked by uid 22791); 4 Oct 2012 14:51:19 -0000 X-SWARE-Spam-Status: No, hits=-2.0 required=5.0 tests=AWL,BAYES_00,RCVD_IN_HOSTKARMA_NO X-Spam-Check-By: sourceware.org Received: from rock.gnat.com (HELO rock.gnat.com) (205.232.38.15) by sourceware.org (qpsmtpd/0.43rc1) with ESMTP; Thu, 04 Oct 2012 14:51:16 +0000 Received: from localhost (localhost.localdomain [127.0.0.1]) by filtered-rock.gnat.com (Postfix) with ESMTP id A2E911C785B; Thu, 4 Oct 2012 10:51:15 -0400 (EDT) Received: from rock.gnat.com ([127.0.0.1]) by localhost (rock.gnat.com [127.0.0.1]) (amavisd-new, port 10024) with LMTP id aPwAW5Jgt7SN; Thu, 4 Oct 2012 10:51:15 -0400 (EDT) Received: from joel.gnat.com (localhost.localdomain [127.0.0.1]) by rock.gnat.com (Postfix) with ESMTP id 578AD1C75FD; Thu, 4 Oct 2012 10:51:15 -0400 (EDT) Received: by joel.gnat.com (Postfix, from userid 1000) id 1499FCB4C8; Thu, 4 Oct 2012 16:51:06 +0200 (CEST) Date: Thu, 04 Oct 2012 14:51:00 -0000 From: Joel Brobecker To: Doug Evans Cc: Khoo Yit Phang , Jan Kratochvil , GDB Patches Subject: Re: [PATCH] Also install data-directory into the build directory as computed by relocate_gdb_directory Message-ID: <20121004145105.GP3028@adacore.com> References: <9F52A338-A158-44DC-90C1-F46503859613@cs.umd.edu> <285502C6-1395-4049-9D55-031EDA3AD06D@cs.umd.edu> <20120924170348.GI4146@adacore.com> <20120927091737.GB2980@adacore.com> <20121004000840.GI3028@adacore.com> <20121004013358.GJ3028@adacore.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Mailing-List: contact gdb-patches-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: gdb-patches-owner@sourceware.org X-SW-Source: 2012-10/txt/msg00078.txt.bz2 > > I think that this is opening the door for allowing GDB to execute > > code without the user being aware of it. I'd rather avoid that. > > How so? Let's say: I build a debugger and install it somewhere, and then tell my collegues: Hey, use my super-duper GDB. Then, someone hacks into my account, set things up to put my GDB into a situation where it will think that it's still in a build directory, and then place some code in the datadir/python area to auto-execute some malicious code... -- Joel