Bug 1245189

Summary:	rear: Insecure temporary file usage
Product:	[Fedora] Fedora	Reporter:	Petr Hracek <phracek>
Component:	rear	Assignee:	Gratien D'haese <gratien.dhaese>
Status:	CLOSED DUPLICATE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	22	CC:	gratien.dhaese, jrusnack, phracek, qe-baseos-daemons
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	1.17.2	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:	1238843	Environment:
Last Closed:	2015-07-24 10:38:05 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1238843
Bug Blocks:	1221181, 1239009

Description Petr Hracek 2015-07-21 12:30:13 UTC

+++ This bug was initially created as a clone of Bug #1238843 +++

Simply grepping for /tmp in source code gives a lot of hits, some of which are dangerous, e.g.:

usr/share/rear/verify/DP/default/50_select_dp_restore.sh:

test -f /tmp/dp_list_of_sessions.in && rm -f /tmp/dp_list_of_sessions.in

Would be nice if all occurences of hardcoded /tmp/.. were replaced with using mktemp.

Filed upstream https://github.com/rear/rear/issues/607

--- Additional comment from RHEL Product and Program Management on 2015-07-02 15:27:41 EDT ---

Since this bug report was entered in bugzilla, the release flag has been
set to ? to ensure that it is properly evaluated for this release.

Comment 1 Gratien D'haese 2015-07-24 10:23:45 UTC

The needed changes were done and we will make an intermediate release of rear-1.17.2

Comment 2 Ján Rusnačko 2015-07-24 10:32:59 UTC

I think this one was cloned by mistake - I don`t see how it`s different from bz#1239009, from which it was cloned, as both are targeted to Fedora 22. 

Petr, do you think this could be closed duplicate ?

Comment 3 Petr Hracek 2015-07-24 10:38:05 UTC

You are right. I have missed it.

*** This bug has been marked as a duplicate of bug 1239009 ***