[Security-Discuss] /etc/lilo.conf.old is world readable after new kernel installation

When you install or remove a kernel /etc/lilo.conf is backed up to
/etc/lilo.conf.old before modifications are made.  Unfortunately the
backup is world readable (subject to umask), exposing any passwords
contained within.  This patch should fix the problem:

--- /usr/share/loader/lilo.orig 2004-10-12 12:20:37.081016730 +0100
+++ /usr/share/loader/lilo      2004-10-12 12:20:48.166470768 +0100
@@ -51,7 +51,7 @@
 (my $options = common::getoptions('1'));$options = join(" ", split " ",$options); #Remove the unused space
 my $root_device = common::getroot();
 
-`cp -f $lilo_conf ${lilo_conf}.old` if -f $lilo_conf && !$debug;
+`cp -p -f $lilo_conf ${lilo_conf}.old` if -f $lilo_conf && !$debug;
 
 #first we parse the files and get all entry.
 {

I haven't checked whether grub or yaboot are similarly affected.

-- 
John Tobin
Why you can't find your system administrators:
(s)he is hiding under a table so that (s)he will not be the one sitting
for hours watching Ultrix reinstall from a single-speed CDROM because
the users who inexplicably have root access have destroyed the
filesystem *again* during a misguided attempt to "improve" /etc/rc by
repartitioning the disk at boot time "so that it doesn't forget".
                                          -- Matt Bandy [email protected]

____________________________________________________
Want to buy your Pack or Services from MandrakeSoft? 
Go to http://www.mandrakestore.com
Join the Club : http://www.mandrakeclub.com
____________________________________________________