Description of problem:

Description of problem:

/etc/rc.sysinit makes

| find -L /var/lock /var/run ! -type d -exec rm -f {} \;

at every start. It is common practice to have daemon-writable subdirs below /var/run or /var/lock (e.g. /var/run/openldap). When such a daemon is compromised, an attack could create a

| /var/run/openldap/foo -> /

symlink which wipes whole system at next startup.

Version-Release number of selected component (if applicable):

initscripts-8.76.2-1.x8664

How reproducible:

100%

Steps to Reproduce: 1. mkdir /var/run/foo 2. chown nobody:nobody /var/run/foo 3. runuser nobody -s /bin/sh 'ln -s / /var/run/foo/bar' 4. reboot

Actual results:

a lot of 'command not found' errors on startup

Additional info:

Kudos to Herbert Poetzl about discovering this vulnerability.