Module Loader System Corruption

[datasponge]

I just had the frightening experience of a simple uninstall from module loader of a minor SugarForge add-on corrupt my Sugar Installation and display 20 pages of log messages giving permissions errors trying to unlink system files outside the SugarCRM folders.

The uninstall gave a fatal error at the end of the uninstall and failed to uninstall even though it had messed up all of Sugar.

I would like any advice on how to best surgically remove this module from my system and incinerate it.

I had made a full backup of SugarCRM source before the uninstall and restoring from backup has restored basic behavior. The system itself seems OK, so the permissions appear to have been set correctly preventing disaster. But since the log showed this module messing with system files, I would also like any tips for checks I should perform on my system to make extra sure the system itself was not compromised.

I am running Mandriva Linux 2008 with MySQL 5.0.45, Apache 2.2.6, PHP 5.2.4.

I did an upgrade of SugarCRM from 5.2.0f to 5.5.1RC2, but neglected to uninstall several loaded modules before the upgrade. I wasn't sure how the uninstall would work after the upgrade, so I made a full backup of Sugar source and data. 4 other modules uninstalled fine, but this one failed and corrupted Sugar.

The misbehaving module was the "Reschedule call with Call History" module. I don't know whether it was because the version got swapped out underneath it to an unsupported version. But that's pretty serious stuff.

Attached is a screenshot of the log showing the first page of unlink errors.

Any advice welcome.

Phil

[datasponge]

The image didn't attach for some reason, so I'll just copy the text of the first page of warnings:

Warning: unlink(//proc/scsi/device_info) [function.unlink]: Permission denied in /var/www/html/SugarCRM/include/dir_inc.php on line 90

Warning: unlink(//proc/scsi/scsi) [function.unlink]: Permission denied in /var/www/html/SugarCRM/include/dir_inc.php on line 90

Warning: rmdir(//proc/scsi) [function.rmdir]: Permission denied in /var/www/html/SugarCRM/include/dir_inc.php on line 107

Warning: unlink(//proc/asound/SI7012/oss_mixer) [function.unlink]: Permission denied in /var/www/html/SugarCRM/include/dir_inc.php on line 90

Warning: unlink(//proc/asound/SI7012/id) [function.unlink]: Permission denied in /var/www/html/SugarCRM/include/dir_inc.php on line 90

Warning: unlink(//proc/asound/SI7012/intel8x0) [function.unlink]: Permission denied in /var/www/html/SugarCRM/include/dir_inc.php on line 90

Warning: unlink(//proc/asound/SI7012/pcm1c/oss) [function.unlink]: Permission denied in /var/www/html/SugarCRM/include/dir_inc.php on line 90

Warning: unlink(//proc/asound/SI7012/pcm1c/sub0/prealloc_max) [function.unlink]: Permission denied in /var/www/html/SugarCRM/include/dir_inc.php on line 90

Warning: unlink(//proc/asound/SI7012/pcm1c/sub0/prealloc) [function.unlink]: Permission denied in /var/www/html/SugarCRM/include/dir_inc.php on line 90

Warning: unlink(//proc/asound/SI7012/pcm1c/sub0/status) [function.unlink]: Permission denied in /var/www/html/SugarCRM/include/dir_inc.php on line 90

Warning: unlink(//proc/asound/SI7012/pcm1c/sub0/sw_params) [function.unlink]: Permission denied in /var/www/html/SugarCRM/include/dir_inc.php on line 90

Warning: unlink(//proc/asound/SI7012/pcm1c/sub0/hw_params) [function.unlink]: Permission denied in /var/www/html/SugarCRM/include/dir_inc.php on line 90

Phil

[datasponge]

rmdir_recursive is being called for path /

Yup that's right. Sugar is trying to delete the entire file system and there's no check to detect/prevent it. Thank god for permissions and thank god I didn't open them up for some temporary purpose.

I suspect there is a scenario where an error condition occurs handling the manifest file so the current directory is empty resulting in passing root to the function.

I've gotta go, but I'll definitely file a bug in the morning.

Phil

[datasponge]

I filed bug #36196 for this.

I also opened a new thread under 5.5.1 Release Forum in the hopes that Sugar will see it there and get it fixed in time for the GA of that upcoming release. I attached the module zip file in case anyone wants to do their own investigation so they can take their own precautions to protect their system.

See http://www.sugarcrm.com/forums/showthread.php?t=58300

Please post any follow up there.

Phil