Bug 1320181

present on rhel-7 too, rpm-4.11.3-17.el7

+++ This bug was initially created as a clone of Bug #1264052 +++

Description of problem:
When rpm replaces an existing file, the new file is deployed to a temporary filename, then renamed to the correct filename, then permissions are set on the file. This leads to a moment where the old file no longer exists and the new file cannot be read as has 000 effective permissions.

this appears to have been introduced with code changes made in relation to CVE-2013-6435 in that the temporary files are now created with 000 permissions.

Version-Release number of selected component (if applicable):
rpm-4.8.0-47.el6.x86_64


How reproducible:
always


Steps to Reproduce:
upgrade an rpm which deploys a file as part of the payload. Whist the rpm is installing stat the file that will be replaced, see snipet of output below achieved using a simple bash loop ls -li on the testfile.

1442324731 140344 ---------- 1 root root 128843776 Sep 15 13:45 /etc/testfile.cdb;55f820f8
1442324731 140342 -rw-r--r-- 1 root root 130459449 Sep 14 13:02 /etc/testfile.cdb
1442324731 140344 ---------- 1 root root 129310720 Sep 15 13:45 /etc/testfile.cdb;55f820f8
1442324731 140342 -rw-r--r-- 1 root root 130459449 Sep 14 13:02 /etc/testfile.cdb
1442324731 140344 ---------- 1 root root 129826816 Sep 15 13:45 /etc/testfile.cdb;55f820f8
1442324731 140342 -rw-r--r-- 1 root root 130459449 Sep 14 13:02 /etc/testfile.cdb
1442324731 140344 ---------- 1 root root 130351104 Sep 15 13:45 /etc/testfile.cdb;55f820f8
1442324731 140344 ---------- 1 root root 130774422 Sep 15 13:45 /etc/testfile.cdb
1442324733 140344 -rw-r--r-- 1 root root 130774422 Sep 14 13:52 /etc/testfile.cdb
1442324733 140344 -rw-r--r-- 1 root root 130774422 Sep 14 13:52 /etc/testfile.cdb
1442324733 140344 -rw-r--r-- 1 root root 130774422 Sep 14 13:52 /etc/testfile.cdb


Additional info:
This has been tested on centos 6 with rpm 4.8.x and centos 7 with rpm 4.11.1 and occurs on both.

the logic behaviour was identified from examining lib/fsm.c in the rpm source code.

 /* XXX Special case /dev/log, which shouldn't be packaged anyways */
        if (!S_ISSOCK(st->st_mode) && !IS_DEV_LOG(fsm->path)) {
            /* Rename temporary to final file name. */
            if (!S_ISDIR(st->st_mode) &&
                (fsm->subdir || fsm->suffix || fsm->nsuffix))
            {
                fsm->opath = fsm->path;
                fsm->path = fsmFsPath(fsm, st, NULL, fsm->nsuffix);
                rc = fsmNext(fsm, FSM_RENAME);
                if (!rc && fsm->nsuffix) {
                    char * opath = fsmFsPath(fsm, st, NULL, NULL);
                    rpmlog(RPMLOG_WARNING, _("%s created as %s\n"),
                                (opath ? opath : ""),
                                (fsm->path ? fsm->path : ""));
                    opath = _free(opath);
                }
                fsm->opath = _constfree(fsm->opath);
            }
            /*
             * Set file security context (if not disabled).
             */
            if (!rc && !getuid()) {
                rc = fsmMapFContext(fsm);
                if (!rc) {
                    rc = fsmNext(fsm, FSM_LSETFCON);
                    freecon(fsm->fcontext);
                }
                fsm->fcontext = NULL;
            }
            if (S_ISLNK(st->st_mode)) {
                if (!rc && !getuid())
                    rc = fsmNext(fsm, FSM_LCHOWN);
            } else {
                if (!rc && !getuid())
                    rc = fsmNext(fsm, FSM_CHOWN);
                if (!rc)
                    rc = fsmNext(fsm, FSM_CHMOD);
                if (!rc) {
                    time_t mtime = st->st_mtime;
                    rpmfi fi = fsmGetFi(fsm);
                    st->st_mtime = rpmfiFMtimeIndex(fi, fsm->ix);
                    rc = fsmNext(fsm, FSM_UTIME);
                    st->st_mtime = mtime;
                }
#if WITH_CAP
                if (!rc && !S_ISDIR(st->st_mode) && !getuid()) {
                    rc = fsmMapFCaps(fsm);
                    if (!rc && fsm->fcaps) {
                        rc = fsmNext(fsm, FSM_SETCAP);
                        cap_free(fsm->fcaps);
                    }
                    fsm->fcaps = NULL;
                }
#endif /* WITH_CAP */
            }
        }