Skip to content

fix: create /var/tmp/rhc if missing - #467

Merged
Archana-PandeyM merged 1 commit into
mainfrom
arpandey/fix-createCollectorTmpDir
Jun 10, 2026
Merged

Archana-PandeyM merged 1 commit into
mainfrom
arpandey/fix-createCollectorTmpDir

Conversation

@Archana-PandeyM

Copy link
Copy Markdown
Collaborator

Create /var/tmp/rhc with root-only permissions before creating the collector-specific temporary directory. This prevents rhc-collector from failing when the parent directory does not already exist.

@Archana-PandeyM
Archana-PandeyM marked this pull request as draft June 4, 2026 09:46
Comment thread cmd/rhc-collector/main.go
Comment thread cmd/rhc-collector/main.go Outdated
@Archana-PandeyM
Archana-PandeyM force-pushed the arpandey/fix-createCollectorTmpDir branch from b8c96a8 to 663b7c3 Compare June 4, 2026 11:30
@Archana-PandeyM
Archana-PandeyM marked this pull request as ready for review June 4, 2026 11:34
@Archana-PandeyM
Archana-PandeyM force-pushed the arpandey/fix-createCollectorTmpDir branch 3 times, most recently from 641b79e to 91bb264 Compare June 9, 2026 09:11

@stephenbourke stephenbourke left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Just needs a rebase.

* Card Id: CCT-2534

Create /var/tmp/rhc with root-only permissions before creating
the collector-specific temporary directory. This prevents
rhc-collector from failing when the parent directory does not
already exist.

Signed-off-by: Archana Pandey <arpandey@redhat.com>
@Archana-PandeyM
Archana-PandeyM force-pushed the arpandey/fix-createCollectorTmpDir branch from 91bb264 to 091a0e5 Compare June 10, 2026 08:21
@Archana-PandeyM
Archana-PandeyM merged commit e5db247 into main Jun 10, 2026
20 of 22 checks passed
@Archana-PandeyM
Archana-PandeyM deleted the arpandey/fix-createCollectorTmpDir branch June 10, 2026 10:18
@cgwalters

Copy link
Copy Markdown

This ended up breaking bootc because our container export flow requires that all content have a SELinux label defined. See bootc-dev/bootc#2395 (which I ended up rolling into another PR).

A few things here.

First, hardcoded file names in /tmp and /var/tmp are just a bad idea. They are at best a DoS vector because there's a chance for e.g. unprivileged other code to create the dirs first.

You added a tmpfiles.d config, which is fine.

But why do you have a hardcoded tmpdir at all? You should have a randomly named tmpdir like rhc-XXXXXX created by a sane language tmpdir API instead, and it should not be owned by the RPM package and not created by systemd-tmpfiles.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants