Description of problem: Rsyslog has (with the -T cmd-line option) option to perform chroot call immediately after starting. However it does not perform any chdir call before or after it. This is violating security policy imposed by rpmlint to prevent processes easy chroot jail escape. Steps to Reproduce: 1. run rpmlint on any rsyslog RPM Actual results: rsyslog.x86_64: E: missing-call-to-chdir-with-chroot /usr/sbin/rsyslogd Expected results: no errors reported Additional info:
Created attachment 1250635 [details] proposed patch
added patch and corresponding upstream issue
patch pushed to rawhide in rsyslog 8.24.0-5
Created attachment 1255677 [details] proposed patch
corrected typo in patch, also fixed in rawhide in rsyslog 8.24.0-6
This bug appears to have been reported against 'rawhide' during the Fedora 26 development cycle. Changing version to '26'.
rsyslog-8.25.0-2.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2017-d2d16edab7
rsyslog-8.25.0-2.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2017-92e2b77ddc
rsyslog-8.25.0-2.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-d2d16edab7
rsyslog-8.25.0-2.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-92e2b77ddc
rsyslog-8.25.0-2.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.
rsyslog-8.25.0-2.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.