Bug 147083

Summary:	access to files from system:/media gives weird privileges
Product:	[I don't know] kde	Reporter:	dj_def
Component:	general	Assignee:	Stephan Kulow <coolo>
Status:	RESOLVED UNMAINTAINED
Severity:	normal
Priority:	NOR
Version First Reported In:	unspecified
Target Milestone:	---
Platform:	Gentoo Packages
OS:	Linux
Latest Commit:		Version Fixed/Implemented In:
Sentry Crash Report:

Description dj_def 2007-06-22 14:08:11 UTC

Version:            (using KDE KDE 3.5.5)
Installed from:    Gentoo Packages
OS:                Linux

I opened konsole and wrote with nano (and root privileges) a text file and saved it in /home/anuser/text.txt (ext3 partition).
ls -l /home/anuser/text.txt gives -rw-r--r-- 1 root root 5... 
Now If I login kde with "anuser", go to system:/media, open that file (kate will open it) and try to modify it I discover that I can do it (and save it automatically changing the owner to "anuser")!
If I do the same simply opening konqueror from the start menu I can't modify that file. It seems that when I open system:/media I gain some kind of root privilege (and I did not enter any password).

Comment 1 daniele 2007-06-27 17:02:22 UTC

I've seen that kde-3.5.7 has this bug too while 3.5.6 seems to be immune.
Maybe if someone could help finding the right kpart or module in witch this bug should be limited, I can try to fix it. It seems to be some suid fault btw.
The bug is also reproducible using dolphin instead of konqueror but I suppose it's some lower level module fault.
I've also seen that user can only reply this bug in his own home(or some other folder which he owns).

Comment 2 Stephan Kulow 2007-06-29 09:33:59 UTC

Yeah, try that:
  cp text.txt mynewtxt.txt
  vi mynewtxt.txt
  rm text.txt
  mv mynewtxt.txt text.txt

No suid involved. Might be suprising, but no bug from what I can see.

Comment 3 dj_def 2007-06-30 20:25:05 UTC

I knew that from the terminal all works fine, the problem is when you open the file (i.e. with kate) passing through system:/media

Comment 4 Jekyll Wu 2012-07-10 00:39:41 UTC

KDE3 is unmaintained now. I don't think this problem apply to KDE4.