From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 27594 invoked by alias); 21 May 2009 14:29:18 -0000 Received: (qmail 27579 invoked by alias); 21 May 2009 14:29:17 -0000 X-SWARE-Spam-Status: No, hits=-2.0 required=5.0 tests=AWL,BAYES_00,SPF_HELO_PASS X-Spam-Status: No, hits=-2.0 required=5.0 tests=AWL,BAYES_00,SPF_HELO_PASS X-Spam-Check-By: sourceware.org X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on bastion2.fedora.phx.redhat.com Subject: cluster: RHEL5 - rgmanager: randomize smb.sh temp file To: cluster-cvs-relay@redhat.com X-Project: Cluster Project X-Git-Module: cluster.git X-Git-Refname: refs/heads/RHEL5 X-Git-Reftype: branch X-Git-Oldrev: 0b686fd6e06cfb8305ffd6177836536d8868a108 X-Git-Newrev: 2e52f12faf68f6d6f56f9e41b9d4c4cfe040b080 From: Lon Hohberger Message-Id: <20090521142831.47D7912029B@lists.fedorahosted.org> Date: Thu, 21 May 2009 14:29:00 -0000 X-Scanned-By: MIMEDefang 2.58 on 172.16.52.254 Mailing-List: contact cluster-cvs-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Post: List-Help: , Sender: cluster-cvs-owner@sourceware.org X-SW-Source: 2009-q2/txt/msg00363.txt.bz2 Gitweb: http://git.fedorahosted.org/git/cluster.git?p=cluster.git;a=commitdiff;h=2e52f12faf68f6d6f56f9e41b9d4c4cfe040b080 Commit: 2e52f12faf68f6d6f56f9e41b9d4c4cfe040b080 Parent: 0b686fd6e06cfb8305ffd6177836536d8868a108 Author: Fabio M. Di Nitto AuthorDate: Thu Oct 30 12:32:08 2008 +0100 Committer: Lon Hohberger CommitterDate: Thu May 21 10:27:58 2009 -0400 rgmanager: randomize smb.sh temp file by using a static path to /tmp, the operation can be used to trigger a local DoS by a normal user. Randomize temp files via mktemp. Signed-off-by: Fabio M. Di Nitto --- rgmanager/src/resources/smb.sh | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/rgmanager/src/resources/smb.sh b/rgmanager/src/resources/smb.sh index f419f43..71ff4fd 100755 --- a/rgmanager/src/resources/smb.sh +++ b/rgmanager/src/resources/smb.sh @@ -350,7 +350,7 @@ add_sha1() verify_sha1() { - declare tmpfile="/tmp/smb-$OCF_RESKEY_name.tmp.$$" + declare tmpfile="$(mktemp /tmp/smb-${OCF_RESKEY}_name.tmp.XXXXXX)" declare current exp exp=$(grep "^# rgmanager-sha1.*$1" "$1" | head -1)