bundle relative paths using ".."

John Mazzitelli mazz at redhat.com
Fri Apr 26 13:03:11 UTC 2013


> Try creating a bundle that has a file named password in it and craft a
> relative path that ends up deploying the bundle in /etc - as some users run
> the agent as root, this may end up in a lot of fun ...

This is why I originally asked "should we even support this kind of thing?" :)

But, in the end, we DO support deploying bundle files to any absolute path, so its not like if we don't support ".." in relative paths, that they couldn't do what they want (they just would specify the full absolute path in the recipe, rather than use relative paths).


More information about the rhq-devel mailing list