Use chroot-sh chmod to remove the symlink attack vector.
authorDaniel Hokka Zakrisson <daniel@hozac.com>
Sat, 25 Nov 2006 19:17:51 +0000 (19:17 +0000)
committerDaniel Hokka Zakrisson <daniel@hozac.com>
Sat, 25 Nov 2006 19:17:51 +0000 (19:17 +0000)
git-svn-id: http://svn.linux-vserver.org/svn/util-vserver/trunk@2406 94cd875c-1c1d-0410-91d2-eb244daf1a30

distrib/redhat/initpost

index 81ca09f..4157a2b 100755 (executable)
@@ -92,14 +92,12 @@ pushd "$vdir" &>/dev/null
 
 exec /sbin/killall5 -15
 EOF
-    # TODO: remove race/symlink-attack
-    chmod +x etc/init.d/halt
+    $_CHROOT_SH chmod 0755 /etc/init.d/halt
     
     : | $_CHROOT_SH truncate /etc/sysctl.conf
     echo "none    /       none    defaults" | $_CHROOT_SH truncate /etc/fstab
     cat "$__DISTRIBDIR"/redhat/rc.sysinit   | $_CHROOT_SH truncate /etc/rc.d/rc.sysinit.vserver
-    # TODO: remove race/symlink-attack
-    chmod +x etc/rc.d/rc.sysinit.vserver
+    $_CHROOT_SH chmod 0755 /etc/rc.d/rc.sysinit.vserver
     subst etc/inittab 's!^\([^#].*:respawn:.* tty\)!#\1!;
                       s!si::sysinit:/etc/rc.d/rc.sysinit!si::sysinit:/etc/rc.d/rc.sysinit.vserver!'
 popd >/dev/null