#9035 NORM Not Tri: rainbow preload hack causes g_get_home_dir() to return "/root"

[Zarro Boogs per Child]

#9035: rainbow preload hack causes g_get_home_dir() to return "/root"
----------------------------+-----------------------------------------------
 Reporter:  dsd             |                 Owner:  mstone       
     Type:  defect          |                Status:  new          
 Priority:  normal          |             Milestone:  Not Triaged  
Component:  security        |               Version:  not specified
 Keywords:  joyride-2556:-  |           Next_action:  never set    
 Verified:  0               |   Deployment_affected:               
Blockedby:                  |              Blocking:               
----------------------------+-----------------------------------------------
 glib's g_get_home_dir() is implemented as:

 {{{
 G_CONST_RETURN gchar*
 g_get_home_dir (void)
 {
   g_get_any_init_locked ();
   return g_home_dir;
 }
 }}}

 The first time it is called, g_get_any_init_locked() causes glib to lookup
 and cache various details such as hostname, login username, home directory
 (g_home_dir above), etc. On subsequent calls, nothing happens.

 g_get_any_init_locked() is also called by: g_get_user_name()
 g_get_real_name() g_get_tmp_dir() g_get_host_name()



 rainbow preloads GTK+, glib, etc while running as root. If something calls
 one of the above functions during the preload sequence, then the user info
 *for root* will be cached indefinitely. Then when an activity launches and
 takes advantage of the preloaded glib, g_get_home_dir() will return root's
 home directory, and so on.

 Presumably, for 8.2, nothing in the preload sequence caused any of the
 above functions to be called. But with the new sugar and Fedora 10 stuff,
 something in the initialization of the preloaded modules is causing one of
 those functions to be called.

 As a result, any activity which tries to use g_get_home_dir() to find a
 storage location ends up fumbling around (and failing) in /root. This
 breaks all gstreamer-based activities and probably a lot more.

 Perhaps we should disable the preload hack, at least temporarily?

-- 
Ticket URL: <http://dev.laptop.org/ticket/9035>
One Laptop Per Child <http://laptop.org/>
OLPC bug tracking system