pcp
[Top] [All Lists]

pcp updates: secure tmpfile naming

To: pcp@xxxxxxxxxxx
Subject: pcp updates: secure tmpfile naming
From: Nathan Scott <nathans@xxxxxxxxxx>
Date: Mon, 19 Nov 2012 21:52:31 -0500 (EST)
Reply-to: Nathan Scott <nathans@xxxxxxxxxx>
Changes committed to git://oss.sgi.com/pcp/pcp.git dev

 CHANGELOG                                       |   17 ++-
 GNUmakefile                                     |    1 
 Makepkgs                                        |   19 +--
 build/mac/build-installer                       |   10 -
 build/mac/cmdline-install                       |   16 +--
 build/mac/install-pcp                           |   48 ++++-----
 build/rpm/devtoolset.spec                       |   57 ++++++++--
 build/rpm/fedora.spec                           |   12 +-
 build/rpm/pcp.spec.in                           |    2 
 configure                                       |   29 ++++-
 configure.in                                    |   19 +++
 debian/changelog                                |    3 
 man/man1/pcp.1                                  |    1 
 qa/023                                          |    4 
 qa/1049                                         |   12 --
 qa/184                                          |    1 
 qa/184.out                                      |    2 
 qa/280                                          |    4 
 qa/280.out                                      |    4 
 qa/282                                          |    1 
 qa/315                                          |    2 
 qa/368                                          |    3 
 qa/455                                          |    4 
 qa/507                                          |    4 
 qa/564                                          |    1 
 qa/646                                          |    3 
 qa/646.out                                      |    4 
 src/genpmda/genpmda                             |    4 
 src/include/pcp/pmiestats.h                     |    3 
 src/libpcp/src/check-statics                    |   31 ++---
 src/pcp/pcp.sh                                  |  114 ++++++++++-----------
 src/pmafm/mkaf                                  |   12 +-
 src/pmafm/pmafm                                 |   18 +--
 src/pmcd/pmdaproc.sh                            |   82 +++++++--------
 src/pmcd/rc_pcp                                 |    4 
 src/pmcd/rc_pmcd                                |   47 ++++----
 src/pmdas/bash/GNUmakefile                      |    1 
 src/pmdas/bash/Install                          |    3 
 src/pmdas/cisco/Install                         |    4 
 src/pmdas/hotproc/Install                       |    7 -
 src/pmdas/hotproc/help.fmt                      |    6 -
 src/pmdas/mmv/GNUmakefile                       |    1 
 src/pmdas/mmv/Install                           |    3 
 src/pmdas/pmcd/src/pmcd.c                       |   14 +-
 src/pmdas/sample/Install                        |    4 
 src/pmdas/shping/Install                        |   10 -
 src/pmdas/weblog/Install                        |   48 ++++-----
 src/pmdas/weblog/Web.Allservers.pmchart         |   42 +++----
 src/pmdas/weblog/Web.Perserver.Bytes.pmchart    |   32 +++---
 src/pmdas/weblog/Web.Perserver.Requests.pmchart |   34 +++---
 src/pmdas/weblog/server.sh                      |   46 ++++----
 src/pmie/GNUmakefile                            |    3 
 src/pmie/pmie_check.sh                          |   77 +++++++-------
 src/pmie/pmie_daily.sh                          |   78 +++++++-------
 src/pmie/rc_pmie                                |   52 ++++-----
 src/pmie/src/pmie.c                             |   14 +-
 src/pmieconf/rules.c                            |   13 +-
 src/pmieconf/xtractnames                        |    8 -
 src/pmlogconf/pmlogconf-setup.sh                |   37 +++---
 src/pmlogconf/pmlogconf.sh                      |  127 +++++++++++-------------
 src/pmlogctl/pmlogger_check.sh                  |   47 ++++----
 src/pmlogctl/pmlogger_daily.sh                  |   90 ++++++++---------
 src/pmlogctl/pmlogger_merge.sh                  |   25 ++--
 src/pmlogctl/pmnewlog.sh                        |   62 +++++------
 src/pmlogger/GNUmakefile                        |    1 
 src/pmlogger/rc_pmlogger                        |   20 +--
 src/pmlogsummary/pmwtf.sh                       |   45 ++++----
 src/pmns/Make.stdpmid                           |   19 +--
 src/pmns/Rebuild                                |   55 +++++-----
 src/pmns/pmnsadd                                |   20 +--
 src/pmproxy/rc_pmproxy                          |   22 ++--
 71 files changed, 882 insertions(+), 786 deletions(-)

commit b9e95a1069a55ffc2e198786513a024c81893879
Author: David Disseldorp <ddiss@xxxxxxx>
Date:   Mon Nov 19 12:30:29 2012 +1100

    pmns: set a sane umask before creating tmp dir
    
    This allows access to the tmp directory when run with a silly umask
    setting. This is needed to pass test 082.

commit 2f0fd7aa05b09ccfbdcddf0c87c3a869b6def6cf
Author: Nathan Scott <nathans@xxxxxxxxxx>
Date:   Mon Nov 19 11:26:06 2012 +1100

    Prepare for pcp-3.6.10 release - docs, spec, version updates

commit 8cd331e2b6be0a8d3ec93cb4ec0a031efd53a591
Author: David Disseldorp <ddiss@xxxxxxx>
Date:   Mon Nov 19 10:42:01 2012 +1100

    Fix qa/368 with pmlogconf filter to handle nested tmp

commit dff5c1fe0735bacf6ee194dc55e53a8fdaf8be3b
Author: David Disseldorp <ddiss@xxxxxxx>
Date:   Mon Nov 19 10:37:29 2012 +1100

    Add qa/646 PCP_TMP_DIR filter for mmvdump

commit 72745de30d87eb4ba00c7f426e4e05982a94912e
Author: David Disseldorp <ddiss@xxxxxxx>
Date:   Mon Nov 19 10:34:30 2012 +1100

    fix qa/184 pmnewlog filter as it uses mktemp now

commit e85bfc0c137cb8e06f4678042be6ee36cc52e5f4
Author: David Disseldorp <ddiss@xxxxxxx>
Date:   Mon Nov 19 10:31:40 2012 +1100

    qa/646 use PCP_TMP_DIR for mmv cleanup path

commit 63948e94d0a26893db524389b50d1f2a24d9b3d2
Author: Nathan Scott <nathans@xxxxxxxxxx>
Date:   Mon Nov 19 10:28:10 2012 +1100

    Create PCP_TMP_DIRs at install time removing potential races

commit ed4080387109f946c005871f1400e5459ede55b1
Author: Nathan Scott <nathans@xxxxxxxxxx>
Date:   Mon Nov 19 10:26:10 2012 +1100

    Fix a pcp(1) regression from recent tmpfile fixes

commit c97946c9ed24ae6d71a271fab0495dbd9013f4fd
Author: Nathan Scott <nathans@xxxxxxxxxx>
Date:   Mon Nov 19 09:58:47 2012 +1100

    Small improvement to the pcp(1) status command
    
    Noticed the script was expecting to find "pcplog" in the
    archive path from daemon pmloggers; thats an old IRIXism
    so extend it to also check for the modern variants first
    (.../pmlogger/...) and falling back to the old-style.
    
    Removed redundant cmdline argument handling (-h and args).

commit ca9e7bf7be5cc33b6b23f2653a6df244482b9eb7
Author: Nathan Scott <nathans@xxxxxxxxxx>
Date:   Mon Nov 19 09:53:20 2012 +1100

    Use parameterised PCP_RUN_DIR in qa/023

commit ce67c8f3a58e0cc4bbd4b6f9006900c1aba046e9
Author: David Disseldorp <ddiss@xxxxxxxxx>
Date:   Fri Nov 16 16:51:04 2012 +1100

    Nest tmp files under mktemp subdirs
    
    Many scripts currently manipulate predictable files in /tmp and
    /var/tmp, allowing for symlink race vulnerabilities.
    
    Addresses CVE-2012-5530: insecure pcp script tmp file handling.

commit 0f3908cada8a50e8af04e527ba1a60cb5257e483
Author: David Disseldorp <ddiss@xxxxxxxxx>
Date:   Fri Nov 16 16:25:43 2012 +1100

    Use mktemp for init script temporary state files
    
    Addresses CVE-2012-5530: insecure pcp script tmp file handling.

commit 1506c33e927580ea90040e3a494766908f87da54
Author: David Disseldorp <ddiss@xxxxxxxxx>
Date:   Fri Nov 16 16:11:58 2012 +1100

    Fix tmp file clean-up in mac build-installer script
    
    The trap function erroneously removes any "exit" or "$status" files.

commit 9dc864f4a1aff46cd41c0060e4af0c2572b81297
Author: David Disseldorp <ddiss@xxxxxxxxx>
Date:   Fri Nov 16 15:15:37 2012 +1100

    Remove fixed PMIE_DIR path
    
    Nest pmie subdirectory under PCP_TMP_DIR, as is expected by rc_pmie.

commit f85836da54f9927875c26ef2548862e59867345d
Author: David Disseldorp <ddiss@xxxxxxxxx>
Date:   Fri Nov 16 15:10:28 2012 +1100

    Consistently use PCP_TMP_DIR in pmlogger_check.sh
    
    Rather than a hard-coded /var/tmp path.

commit 0400aaa1576be56dc5dd15c42fb7b299705d5696
Author: David Disseldorp <ddiss@xxxxxxxxx>
Date:   Fri Nov 16 15:08:47 2012 +1100

    Add --with-tmpdir configure argument
    
    Allow for specification of PCP_TMP_DIR at configure time.

<Prev in Thread] Current Thread [Next in Thread>
  • pcp updates: secure tmpfile naming, Nathan Scott <=