Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
Bug 168085 - It is not desirable for a daemon to create a directory under /var/cache. The package should provide such directories
It is not desirable for a daemon to create a directory under /var/cache. The...
Product: Fedora
Classification: Fedora
Component: cups (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Tim Waugh
Depends On:
  Show dependency treegraph
Reported: 2005-09-12 06:15 EDT by Russell Coker
Modified: 2007-11-30 17:11 EST (History)
0 users

See Also:
Fixed In Version: 3.0.2-27
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2005-09-13 05:35:27 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Russell Coker 2005-09-12 06:15:16 EDT
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (compatible; Konqueror/3.4; Linux) KHTML/3.4.2 (like Gecko)

Description of problem:
cupsd in some situations will create the directory /var/cache/foomatic. 
For security reasins it's preferable if we can deny such access, if we have 
two daemons permitted to create such directories then if one was compromised 
then it could be used for a trivial DOS attack against the other. 
If the package provides the directory /var/cache/foomatic then SE Linux rules 
can deny the creation of such directories. 

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
Cause XML files in /usr/share/foomatic/db to be read. 

Actual Results:  Daemon attempted to create the directory in question and SE Linux denied it. 

Additional info:
Comment 1 Tim Waugh 2005-09-12 06:31:37 EDT
It's nothing to do with cupsd.  system-config-printer creates this directory.

I've made the change in foomatic.spec.  Fixed in CVS.

Note You need to log in before you can comment on or make changes to this bug.