Re: Security patch for gettext-0.11.5/ltmain.sh

[Paul Eggert]

> From: Bruno Haible <address@hidden>
> Date: Wed, 18 Sep 2002 22:28:16 +0200 (CEST)
> 
> It is platform dependent. On some platforms (like HP-UX and AIX)
> "make install" does require write access to the .libs directories.

Still, it is a security hole to create world-writeable directories.

Here's an idea for improving things.  If "make install" detects that
it lacks write access to a local .libs directory owned by user U, it
does something like this:

  echo 'I lack write access to directory foo/bar/.libs, which is owned by U.'
  echo 'Please enter U's password to complete the installation:'
  su U -c 'command that needs write access to foo/bar/.libs'

That way, there is never an instant when a directory is world-writeable.