Bug 1043848

Summary: yum-rhn-plugin: slightly insecure use of /var/tmp
Product: Red Hat Enterprise Linux 5 Reporter: Florian Weimer <fweimer>
Component: yum-rhn-pluginAssignee: Milan Zázrivec <mzazrivec>
Status: CLOSED WONTFIX QA Contact: Red Hat Satellite QA List <satqe-list>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 5.11CC: fweimer, msuchy, mzazrivec
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 1043847 Environment:
Last Closed: 2014-03-07 12:49:02 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1043847    
Bug Blocks:    

Description Florian Weimer 2013-12-17 10:49:51 UTC 
+++ This bug was initially created as a clone of Bug #1043847 +++

touch follows symlinks, so this %pre script allows creation of zero-length files (as seen in yum-rhn-plugin-2.0.1-2):

%pre
# 682820 - re-enable yum-rhn-plugin after package upgrade if the system is already registered
export pluginconf='/etc/yum/pluginconf.d/rhnplugin.conf'
if [ $1 -gt 1 ] && [ -f /etc/sysconfig/rhn/systemid ] && [ -f "$pluginconf" ]; then
    if grep -q '^[[:space:]]*enabled[[:space:]]*=[[:space:]]*1[[:space:]]*$' \
       "$pluginconf"; then
        touch /var/tmp/enable-yum-rhn-plugin
    fi
fi

The flag should be stored somewhere else, perhaps in /etc.
Comment 1 RHEL Program Management 2014-03-07 12:39:07 UTC 
This bug/component is not included in scope for RHEL-5.11.0 which is the last RHEL5 minor release. This Bugzilla will soon be CLOSED as WONTFIX (at the end of RHEL5.11 development phase (Apr 22, 2014)). Please contact your account manager or support representative in case you need to escalate this bug.
Comment 2 Florian Weimer 2014-03-07 12:49:02 UTC 
This is so minor that touching the component for this bug alone is not worth the effort, so closing.