[tomcat7] 02/06: tomcat7.init: Protect /var/log/tomcat7/catalina.out against symlink
Markus Koschany
apo at moszumanska.debian.org
Mon Aug 15 16:13:51 UTC 2016
This is an automated email from the git hooks/post-receive script.
apo pushed a commit to branch jessie
in repository tomcat7.
commit 527ea4a1569f0640ef8f1c552c73c8a52a292116
Author: Markus Koschany <apo at debian.org>
Date: Thu Aug 11 23:51:00 2016 +0200
tomcat7.init: Protect /var/log/tomcat7/catalina.out against symlink
attacks and a possible root privilege escalation.
---
debian/tomcat7.init | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/debian/tomcat7.init b/debian/tomcat7.init
index b2c33f4..b21ee58 100644
--- a/debian/tomcat7.init
+++ b/debian/tomcat7.init
@@ -170,8 +170,10 @@ catalina_sh() {
# Run the catalina.sh script as a daemon
set +e
- touch "$CATALINA_PID" "$CATALINA_BASE"/logs/catalina.out
- chown $TOMCAT7_USER "$CATALINA_PID" "$CATALINA_BASE"/logs/catalina.out
+ if [ ! -f "$CATALINA_BASE"/logs/catalina.out ]; then
+ install -o $TOMCAT7_USER -g adm -m 644 /dev/null "$CATALINA_BASE"/logs/catalina.out
+ fi
+ install -o $TOMCAT7_USER -g adm -m 644 /dev/null "$CATALINA_PID"
start-stop-daemon --start -b -u "$TOMCAT7_USER" -g "$TOMCAT7_GROUP" \
-c "$TOMCAT7_USER" -d "$CATALINA_TMPDIR" -p "$CATALINA_PID" \
-x /bin/bash -- -c "$AUTHBIND_COMMAND $TOMCAT_SH"
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-java/tomcat7.git
More information about the pkg-java-commits
mailing list