A symlink-following vulnerability was found in rhc-canonical-facts.service. The service runs as root and performs `touch`, `chown yggdrasil:yggdrasil`, and `StandardOutput=truncate:` on `/var/lib/yggdrasil/canonical-facts.json` — a path inside a directory owned by the unprivileged yggdrasil user (via StateDirectory=yggdrasil). None of these operations reject symlinks.

An attacker with code execution as yggdrasil can replace canonical-facts.json with a symlink to an arbitrary file. When the service triggers (daily timer or `rhc connect`), the target file's ownership is transferred to yggdrasil and its content is truncated and overwritten.

The service has no User= directive, no systemd sandboxing, and no confined SELinux domain (systemd-analyze security: 9.6 UNSAFE). On RHEL 10.2 with SELinux Enforcing, the full exploit chain was confirmed against var_lib_t and systemd_unit_file_t targets. The /etc/shadow path is blocked by SELinux (init_t cannot open shadow_t for StandardOutput), but targeting systemd unit files provides a path to root.

Introduced in rhc v0.3.0. Versions prior to 0.3.0 do not ship this service file.

External reference: PSIRTSUPT-25922