Security Advisories (2)
CVE-2011-4114 (2011-07-18)

PAR packed files are extracted to unsafe and predictable temporary directories (this bug was originally reported against PAR::Packer, but it applies to PAR as well).

CVE-2011-5060 (2012-01-13)

The par_mktmpdir function in the PAR module before 1.003 for Perl creates temporary files in a directory with a predictable name without verifying ownership and permissions of this directory, which allows local users to overwrite files when another user extracts a PAR packed program, a different vulnerability in a different package than CVE-2011-4114.

NAME

parl - Binary PAR Loader

SYNOPSIS

(Please see pp for convenient ways to make self-contained executables, scripts or PAR archives from perl programs.)

To use Hello.pm from ./foo.par:

% parl -A./foo.par -MHello 
% parl -A./foo -MHello	# the .par part is optional

Same thing, but search foo.par in the @INC;

% parl -Ifoo.par -MHello 
% parl -Ifoo -MHello 	# ditto

Run test.pl or script/test.pl from foo.par:

    % parl foo.par test.pl	# looks for 'main.pl' by default,
				# otherwise run 'test.pl' 

To make a self-containing executable containing a PAR file :

% parl -O./foo foo.par
% ./foo test.pl		# same as above

To embed the necessary non-core modules and shared objects for PAR's execution (like Zlib, IO, Cwd, etc), use the -b flag:

% parl -b -O./foo foo.par
% ./foo test.pl		# runs anywhere with core modules installed

If you also wish to embed core modules along, use the -B flag instead:

% parl -B -O./foo foo.par
% ./foo test.pl		# runs anywhere with the perl interpreter

This is particularly useful when making stand-alone binary executables; see pp for details.

DESCRIPTION

This stand-alone command offers roughly the same feature as perl -MPAR, except that it takes the pre-loaded .par files via -Afoo.par instead of -MPAR=foo.par.

You can use it to run .par files:

# runs script/run.pl in archive, uses its lib/* as libraries
% parl myapp.par run.pl	# runs run.pl or script/run.pl in myapp.par
% parl otherapp.pl		# also runs normal perl scripts

However, if the .par archive contains either main.pl or script/main.pl, it is used instead:

% parl myapp.par run.pl	# runs main.pl, with 'run.pl' as @ARGV

Finally, as an alternative to Perl2exe or PerlApp, the -O option makes a stand-alone binary from a PAR file:

% parl -B -Omyapp myapp.par
% ./myapp			# run it anywhere without perl binaries
% ./myapp -Omyap2 myapp.par	# makes a ./myap2, identical to ./myapp
% ./myapp -Omyap3 myap3.par	# makes another app with different PAR

For an explanation of stand-alone executable format, please see par.pl.

SEE ALSO

PAR, par.pl, pp

AUTHORS

Autrijus Tang <autrijus@autrijus.org>

COPYRIGHT

Copyright 2002 by Autrijus Tang <autrijus@autrijus.org>.

This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

See http://www.perl.com/perl/misc/Artistic.html