Bug#909750: applications tries to write to /usr/* directories via libfontconfig1

[Niels Thykier]

On Sat, 6 Apr 2019 16:38:13 +0200 Chris Hofstaedtler <zeha at debian.org>
wrote:
> * Thierry Fauck at linux.ibm.com <thierry at linux.ibm.com> [190406 14:35]:
> > > >The only occurrence I'm seeing on my system is:
> > > >
> > > >openat(AT_FDCWD, "/usr/lib/firefox/fonts/.uuid.TMP-EWjEq0", O_RDWR|O_CREAT|O_EXCL|O_CLOEXEC, 0600) = -1 EACCES (Permission denied)
> > > 
> > > Now it's the only occurrence for me, too.
> > > 
> > 
> > With current packages I don't see any more issues of openat(....)
> > EACESS(...) when tracing firefox-bin
> 
> With libfontconfig1:amd64 2.13.1-2:
> 
> $ strace -o '| grep -w EACCES' /usr/lib/firefox-esr/firefox-bin
> openat(AT_FDCWD, "/usr/lib/firefox-esr/fonts/.uuid.TMP-pZnI7N", O_RDWR|O_CREAT|O_EXCL|O_CLOEXEC, 0600) = -1 EACCES (Permission denied)
> 
> C.
> 

Hi,

What is the status of this bug? AFAICT, we have *some* fixes from
upstream but Chris's mail implies that the bug is not completely fixed.

Related, upstream closed their side of the bug a few days ago with the note:

"""
uuid related code has been gone in git. this should be improved. closing.
"""

(Not sure if that means they committed some recent changes to fix this).

Thanks,
~Niels