Bug 1264783

Summary:	tmux: local denial of service by creating /tmp/tmux-$UID files
Product:	[Fedora] Fedora	Reporter:	Florian Weimer <fweimer>
Component:	tmux	Assignee:	Sven Lankes <sven>
Status:	CLOSED EOL	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	22	CC:	dcantrell, praiskup, release-test-team-automation, rosset.filipe, strobert, sven
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:	1036136	Environment:
Last Closed:	2016-07-19 17:57:53 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1036120

Description Florian Weimer 2015-09-21 08:30:01 UTC

+++ This bug was initially created as a clone of Bug #1036136 +++

This has already been reported as a Debian bug, <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=529082>.  If another user creates a path /tmp/tmux-$UID, user $UID cannot start tmux.

An easy fix would use XDG_RUNTIME_DIR by default, but that depends on fixing bug 753882.

Comment 1 Sven Lankes 2015-09-24 13:01:17 UTC

It was reported in Debian, then it was fixed (for a very old version) and almost all additions to the debian packages were removed again.

$upstream doesn't seem to be interested in changing the behaviour.

I wonder if it's worth to have our own patch to fix this and if so what the best way to do it would be.

Comment 2 Fedora End Of Life 2016-07-19 17:57:53 UTC

Fedora 22 changed to end-of-life (EOL) status on 2016-07-19. Fedora 22 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.