Bug 8950

Summary: Default /etc/man.config creates catman files owned by normal users
Product: [Retired] Red Hat Linux Reporter: mcl8
Component: manAssignee: Bernhard Rosenkraenzer <bero>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: 6.1Keywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2000-01-28 21:10:42 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description mcl8 2000-01-28 21:10:42 UTC 
The default /etc/man.config file with RedHat 6.1 (i386) has the FSSTND
option enabled, which tells man to create formatted versions of man pages
and place them in /var/catman/cat* the first time they're accessed by a
user.  These formatted catman files are being created with 0464 permission,
owned by the user who ran the man command and group 'man'.  Each subsequent
access of these man pages is then retrieved from the catman directories.

   Because these catman files are owned by regular users, it's a simple
matter for them to change the permissions on their catman files, and
replace the contents with whatever they choose.  In my opinion, this
constitutes a security problem.  Users can present bogus man page
information to others on the system, and can bypass disk quotas by storing
files in the catman tree.

   As a workaround, you can disable the FSSTND option in /etc/man.config.
Comment 1 Bernhard Rosenkraenzer 2000-08-31 10:12:07 UTC 
This is required behavior by the FSSTND and FHS standards.
If you don't like preformatted pages, alias man="man -c".