Description of problem:

/etc/rc.sysinit makes

| find -L /var/lock /var/run ! -type d -exec rm -f {} \;

at every start.  It is common practice to have daemon-writable subdirs below /var/run or /var/lock (e.g. /var/run/openldap).  When such a daemon is compromised, an attack could create a

| /var/run/openldap/foo -> /

symlink which wipes whole system at next startup.


Version-Release number of selected component (if applicable):

initscripts-8.76.2-1.x86_64


How reproducible:

100%

Steps to Reproduce:
1. mkdir /var/run/foo
2. chown nobody:nobody /var/run/foo
3. runuser nobody -s /bin/sh 'ln -s / /var/run/foo/bar'
4. reboot
  
Actual results:

a lot of 'command not found' errors on startup


Additional info:

Kudos to Herbert Poetzl about discovering this vulnerability.