Bug 168085 - It is not desirable for a daemon to create a directory under /var/cache. The package should provide such directories
Summary: It is not desirable for a daemon to create a directory under /var/cache. The...
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: cups   
(Show other bugs)
Version: rawhide
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Tim Waugh
QA Contact:
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2005-09-12 10:15 UTC by Russell Coker
Modified: 2007-11-30 22:11 UTC (History)
0 users

Fixed In Version: 3.0.2-27
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2005-09-13 09:35:27 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description Russell Coker 2005-09-12 10:15:16 UTC 
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (compatible; Konqueror/3.4; Linux) KHTML/3.4.2 (like Gecko)

Description of problem:
cupsd in some situations will create the directory /var/cache/foomatic. 
 
For security reasins it's preferable if we can deny such access, if we have 
two daemons permitted to create such directories then if one was compromised 
then it could be used for a trivial DOS attack against the other. 
 
If the package provides the directory /var/cache/foomatic then SE Linux rules 
can deny the creation of such directories. 

Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
Cause XML files in /usr/share/foomatic/db to be read. 

Actual Results:  Daemon attempted to create the directory in question and SE Linux denied it. 

Additional info:
Comment 1 Tim Waugh 2005-09-12 10:31:37 UTC 
It's nothing to do with cupsd.  system-config-printer creates this directory.

I've made the change in foomatic.spec.  Fixed in CVS.
Note You need to log in before you can comment on or make changes to this bug.