Package: xfsdump
Version: 2.2.38-1
Severity: grave
Tags: security
Whilst xfs_fsr is running, it creates a directory of known name, .fsr,
in the root of the filesystem it's working on. This directory and the
subdirectories it creates are world writeable.
$ ls -la /store/.fsr
total 8
drwxrwxrwx 18 root root 4096 2007-04-05 11:17 .
drwxr-xr-x 25 pm pm 4096 2007-04-05 11:17 ..
drwxrwxrwx 2 root root 6 2007-04-05 11:21 ag0
drwxrwxrwx 2 root root 6 2007-04-05 11:21 ag1
drwxrwxrwx 2 root root 6 2007-04-05 11:19 ag10
drwxrwxrwx 2 root root 6 2007-04-05 11:19 ag11
drwxrwxrwx 2 root root 6 2007-04-05 11:19 ag12
drwxrwxrwx 2 root root 6 2007-04-05 11:20 ag13
drwxrwxrwx 2 root root 6 2007-04-05 11:20 ag14
drwxrwxrwx 2 root root 6 2007-04-05 11:21 ag15
drwxrwxrwx 2 root root 6 2007-04-05 11:21 ag2
drwxrwxrwx 2 root root 6 2007-04-05 11:22 ag3
drwxrwxrwx 2 root root 6 2007-04-05 11:22 ag4
drwxrwxrwx 2 root root 6 2007-04-05 11:22 ag5
drwxrwxrwx 2 root root 6 2007-04-05 11:22 ag6
drwxrwxrwx 2 root root 6 2007-04-05 11:22 ag7
drwxrwxrwx 2 root root 6 2007-04-05 11:22 ag8
drwxrwxrwx 2 root root 6 2007-04-05 11:23 ag9
Looking at fsr/xfs_fsr.c, I find...
static void
tmp_init(char *mnt)
{
int i;
static char buf[SMBUFSZ];
mode_t mask;
tmp_agi = 0;
sprintf(buf, "%s/.fsr", mnt);
mask = umask(0);
if (mkdir(buf, 0777) < 0) {
if (errno == EEXIST) {
-- System Information:
Debian Release: lenny/sid
APT prefers unstable
APT policy: (500, 'unstable'), (500, 'testing'), (500, 'stable'), (99,
'experimental')
Architecture: i386 (i686)
Shell: /bin/sh linked to /bin/bash
Kernel: Linux 2.6.18-4-686
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Versions of packages xfsdump depends on:
ii libattr1 1:2.4.32-1.1 Extended attribute shared library
ii libc6 2.3.6.ds1-13 GNU C Library: Shared libraries
ii libdm0 2.2.4-1 Data Management API runtime enviro
ii libncurs 5.5-5 Shared libraries for terminal hand
ii libuuid1 1.39+1.40-WIP-2006.11.14+dfsg-2 universally unique id library
ii xfsprogs 2.8.18-1 Utilities for managing the XFS fil
xfsdump recommends no packages.
-- no debconf information
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
