https://bugzilla.novell.com/show_bug.cgi?id=714632 https://bugzilla.novell.com/show_bug.cgi?id=714632#c1 Klaus Kämpf changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED Severity|Normal |Major --- Comment #1 from Klaus Kämpf 2011-08-30 10:56:10 UTC --- Reported upstream as ID 3400659 (https://sourceforge.net/tracker/?func=detail&aid=3400659&group_id=116222&atid=674089) Package fixed -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=714632 https://bugzilla.novell.com/show_bug.cgi?id=714632#c3 --- Comment #3 from Klaus Kämpf 2011-08-30 11:55:27 UTC --- (In reply to comment #2)

That's not quite as intended. The script must not use /var/lock/subsys at all. The theoretical attack is that an attacker that gains access to the lock group could put arbitrary things in /var/lock, e.g. stale symlinks pointing to somewhere. Your init script would follow such a link and touch a file in an arbitrary place. E.g. ln -s /etc/nologin /var/lock/subsys/hpi

Hmm, how's that different from tampering /var/run or any other dir/file used by the ipmiutil package ? I guess protecting the system from unauthorized access (i.e. to the lock group) is outside of ipmiutil. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=714632 https://bugzilla.novell.com/show_bug.cgi?id=714632#c5 --- Comment #5 from Bernhard Wiedemann 2011-10-27 16:00:07 CEST --- This is an autogenerated message for OBS integration: This bug (714632) was mentioned in https://build.opensuse.org/request/show/89549 Factory / ipmiutil -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.