Advisories for Cargo/Uu_chmod package

In Chmoder::chmod() the recursive branch overwrites the running result instead of accumulating it, so the exit code reflects only the last file processed: if self.recursive { r = self.walk_dir_with_context(file, true); // overwrites r } else { r = self.chmod_file(file).and(r); } PoC: GNU returns 1 when a file fails; uutils returns 0 if the last entry succeeds: $ chmod -R 0755 chmod-bug/root chmod-bug/user # GNU -> ret=1 $ uutils chmod -R …

Chmoder::chmod() only compares the literal argument against Path::new("/"), so the –preserve-root guard is bypassed by any path that resolves to root — a symlink to / or simply /../. if self.recursive && self.preserve_root && file == Path::new("/") { return Err(ChmodError::PreserveRoot("/".to_string()).into()); } PoC — recursively chmods the entire filesystem to 000 despite –preserve-root: chmod -R –preserve-root 000 /../ -v Impact: –preserve-root is the documented safeguard against destructive recursive operations on /. …