The Puppet Labs Issue Tracker has Moved: https://tickets.puppetlabs.com

This issue tracker is now in read-only archive mode and automatic ticket export has been disabled. Redmine users will need to create a new JIRA account to file tickets using https://tickets.puppetlabs.com. See the following page for information on filing tickets with JIRA:

Refactor #13643

The use of FileUtils.rm_rf should be made secure

Added by Kelsey Hightower over 3 years ago. Updated about 3 years ago.

Status:ClosedStart date:04/05/2012
Priority:NormalDue date:
Assignee:Kelsey Hightower% Done:

0%

Category:security
Target version:2.7.14
Affected Puppet version:2.7.12 Branch:https://github.com/puppetlabs/puppet/pull/629
Keywords:geordi cleanup

We've Moved!

Ticket tracking is now hosted in JIRA: https://tickets.puppetlabs.com


Description

All uses of the FileUtils.rm_rf method should be made secure by setting the :secure option to true.

From the online docs:

This method causes local vulnerability if one of parent directories or removing directory tree are world writable (including /tmp, whose permission is 1777), and the current process has strong privilege such as Unix super user (root), and the system has symbolic link. For secure removing, read the documentation of remove_entry_secure carefully, and set :secure option to true. Default is :secure=>false.

NOTE: This method calls remove_entry_secure if :secure option is set.

History

#1 Updated by Kelsey Hightower over 3 years ago

  • Status changed from Accepted to In Topic Branch Pending Review
  • Branch set to https://github.com/puppetlabs/puppet/pull/629

#2 Updated by Anonymous about 3 years ago

  • Status changed from In Topic Branch Pending Review to Merged - Pending Release
  • Target version changed from 2.7.x to 2.7.14

#3 Updated by Matthaus Owens about 3 years ago

  • Status changed from Merged - Pending Release to Closed

Released in Puppet 2.7.14rc1

Also available in: Atom PDF