pkg/26551: pkgtools/pkg_tarup crashes when invoked as a normal user

[dgriffi%cs.csubak.edu@localhost]

>Number:         26551
>Category:       pkg
>Synopsis:       pkgtools/pkg_tarup crashes when invoked as a normal user
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Aug 05 00:51:00 UTC 2004
>Closed-Date:
>Last-Modified:
>Originator:     David Griffith
>Release:        1.6.1
>Organization:
>Environment:
NetBSD zaphod 1.6.2 NetBSD 1.6.2 (ZAPHOD) #0: Sat Jun  5 04:50:05 PDT 2004     
dave@arthur:/usr/src/sys/arch/i386/compile/ZAPHOD i386

>Description:
Attempting to create a package with pkg_tarup while a nonroot user, the 
following happens:

zaphod:~$ pkg_tarup foobar
Becoming root@zaphod to create a binary package
/usr/bin/su Password:
Illegal variable name.
zaphod:~$ 

This does not happen when the user is root (ie, using sudo), but it is rather 
annoying.
>How-To-Repeat:
See above
>Fix:
It seems clear to me that the following section of code in the pkg_tarup script 
is at fault:

if [ `${ID} -u` != 0 ]; then
        ${ECHO} "Becoming root@`/bin/hostname` to create a binary package"
        ${ECHO} -n "`${ECHO} ${SU} | ${SED} -e's/[[:space:]].*//'` ";\
        exec ${SU} root -c "$0 \"\$@\"" "$0" "$@"
fi

Those escapes, which appeared in pkg_tarup 1.6, used with the exec call seem to 
be the problem.  I don't know just what is being attempted there.  Whoever did 
it, please explain and hopefully fix it.

>Release-Note:
>Audit-Trail:
>Unformatted: