compress old puppet reports

[Jan-Frode Myklebust]

On Tue, May 17, 2011 at 04:35:00PM -0400, seth vidal wrote:
> 
> "When changing directories, tmpwatch is very sensitive to possible  race
>  conditions  and will exit with an error if one is detected. It does not
>  follow symbolic links in the directories it's cleaning (even if a  sym‐
>  bolic  link  is  given  as  its argument), will not switch filesystems,
>  skips lost+found directories owned by the root user, and  only  removes
>        empty directories, regular files, and symbolic links."


Not sure if this is a documentation or code bug, but this doesn't
seem true on the two RHEL5/6 systems I just tested.. 


> > > It guards against symlink attack by anyone who can run something as
> > > user "puppet" and replace /var/lib/puppet/reports/ with a symlink to
> > > somewhere else (/).
> 
> so in answer to this - no in fact, tmpwatch can't be exploited that way.
> 

	$ rpm -q tmpwatch
	tmpwatch-2.9.16-3.el6.x86_64
	$ ln -s /etc/ /var/tmp/test
	$ /usr/sbin/tmpwatch --mtime 720 --test /var/tmp/test/
	removing file /etc/csh.login
	removing file /etc/gimp/2.0/unitrc
	removing file /etc/gimp/2.0/sessionrc
	removing file /etc/gimp/2.0/controllerrc
	removing file /etc/gimp/2.0/menurc
	removing file /etc/gimp/2.0/gimprc
	removing file /etc/gimp/2.0/gtkrc
	<snip>

	

  -jf