Re: icinga2: CVE-2020-14004: prepare-dirs script allows for symlink attack in the icinga user context

[Michael Orlitzky <michael () orlitzky com>]

On 2020-06-12 05:54, Matthias Gerstner wrote:
> Hello list,
>
> during the review of directories with special permissions in openSUSE
> distributions I noticed an icinga user privilege escalation issue in the
> icinga2 monitoring software [1].

face -> palm

https://github.com/Icinga/icinga2/issues/5793


> But it could still turn out to be subject to
> race conditions on older or alternative `chown` implementations. It
> would also be problematic if the Linux kernel hardlink protection is
> turned off for some reason.

Hardlink protection is off by default in the vanilla kernel.