Bug 174211 - cron.daily/rpm should have other name than rpm
Summary: cron.daily/rpm should have other name than rpm
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: rpm
Version: 4
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Paul Nasrat
QA Contact: Mike McLean
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2005-11-25 22:40 UTC by Sergio Basto
Modified: 2007-11-30 22:11 UTC (History)
1 user (show)

Fixed In Version: rpm-4.4.2-11
Clone Of:
Environment:
Last Closed: 2005-12-01 13:40:28 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Sergio Basto 2005-11-25 22:40:54 UTC
Description of problem:

As root, I like put, . in PATH and if I go to /etc/cron.daily and run rpm I send
machine down!

Version-Release number of selected component (if applicable):
all

Steps to Reproduce:
1. export PATH=.:$PATH
2. cd /etc/cron.daily 
3. rpm
  
Additional info:
this send machine down
2 ways to resolve this issue 
mv rpm rpm.cron 
or
edit rpm and change rpm to /bin/rpm 

the problem is have 2 rpm files and one call rpm again this could be avoid

Comment 1 Paul Nasrat 2005-11-26 16:51:05 UTC
Having '.' in PATH as root is heavily discouraged, for reasons such as the above
(consider /tmp where all users can write for example)

Comment 2 Sergio Basto 2005-12-01 04:09:56 UTC
well the problem is not the . in PATH, the problem is having 2 executables with
the same name.
Try put in PATH /etc/cron.daily/ before /usr/bin and see what happens when run
/etc/cron.daily/rpm .
This have 2 problems /etc/cron.daily/rpm call rpm without PATH so bash have to
looking in the path for a rpm which could be himself.

Do you understand what is my point ? 

Comment 3 Paul Nasrat 2005-12-01 13:40:28 UTC
The root cause of your problem is having '.' in a path causing the script to be
in your PATH.

I as a malicous user can create a +s shell add a new uid 0 user or any number of
things in /tmp/rpm or /tmp/anylikelycommand if you have . in PATH as root and
are not careful.

/etc/cron.daily should never be in any sane PATH so normal users don't care.


Comment 4 Sergio Basto 2005-12-01 16:29:58 UTC
Well , I give up ,
this discussion don't go anywhere,

but keep in mind, for me, the problem is having two executables files called rpm
one /bin/rpm and other /etc/cron.daily/rpm and
/etc/cron.daily/rpm call rpm without any PATH.
if /etc/cron.daily/rpm call /bin/rpm, I won't have this problem.  

Comment 5 Michael Jennings (KainX) 2005-12-01 16:37:32 UTC
The problem is not that the /etc/cron.daily/rpm script is named rpm.  The
problem is that it doesn't give an absolute path to /bin/rpm when invoking it,
nor does it reset the PATH variable to a well-defined secure value.  This is
indeed a potential risk.

This should be reopened.

Comment 6 Paul Nasrat 2005-12-07 15:32:00 UTC
rpm-4.4.2-11


Note You need to log in before you can comment on or make changes to this bug.