# Dale Talcott of NASA Ames submitted a bug report and his patch to SGI.
# I herein submitted this patch for him.  - jlan@sgi.com


The openibd startup script from the OFED rpm includes the following code to
create a script that it runs in the background:

...
cat << EOF >> /tmp/ib_set_node_desc.sh
#!/bin/bash

# Wait while node's hostname is set
sleep 10
# Add node description to sysfs
IBSYSDIR="/sys/class/infiniband"
if [ -d \${IBSYSDIR} ]; then
    declare -i hca_id=1
    for hca in \${IBSYSDIR}/*
    do
        if [ -e \${hca}/node_desc ]; then
            logger -i "Set node_desc for \$(basename \$hca): \$(hostname -s)
HCA-\${hca_id}"
            echo -n "\$(hostname -s) HCA-\${hca_id}" >> \${hca}/node_desc
        fi
        let hca_id++
    done
fi
/bin/rm -f \$0
EOF

    chmod 755 /tmp/ib_set_node_desc.sh
    /tmp/ib_set_node_desc.sh > /dev/null 2>&1 &

The problems with this startup script are many, but the security issue is that
the script, while running as root during system startup, writes to a
predictable file name in /tmp (/tmp/ib_set_node_desc.sh).  If a user creates a
symlink with that path ahead of time, the next reboot can clobber any file root
has access to.

There are several fixes, but one is to avoid the use of the temporary file
altogether.


Signed-off-by: Jay Lan <jlan@sgi.com>


---
 ofed_scripts/openibd |   45 ++++++++++++++++++++++-----------------------
 1 file changed, 22 insertions(+), 23 deletions(-)

Index: ofa_kernel-1.5.2.vanilla/ofed_scripts/openibd
===================================================================
--- ofa_kernel-1.5.2.vanilla.orig/ofed_scripts/openibd
+++ ofa_kernel-1.5.2.vanilla/ofed_scripts/openibd
@@ -577,6 +577,27 @@ if test -x /sbin/lspci && test -x /sbin/
 fi
 }
 
+
+ib_set_node_desc()
+{
+      # Wait while node's hostname is set
+      sleep 10
+      # Add node description to sysfs
+      ibsysdir="/sys/class/infiniband"
+      if [ -d ${ibsysdir} ]; then
+          declare -i hca_id=1
+          for hca in ${ibsysdir}/*
+          do
+              if [ -e ${hca}/node_desc ]; then
+                  logger -i "Set node_desc for $(basename $hca): $(hostname -s) HCA-${hca_id}"
+                  echo -n "$(hostname -s) HCA-${hca_id}" >> ${hca}/node_desc
+              fi
+              let hca_id++
+          done
+      fi
+}
+
+
 need_location_code_fix()
 {
 	local sub ARCH KVERSION
@@ -890,29 +911,7 @@ start()
         RC=$[ $RC + $my_rc ]
     fi
 
-cat << EOF >> /tmp/ib_set_node_desc.sh
-#!/bin/bash
-
-# Wait while node's hostname is set
-sleep 10
-# Add node description to sysfs
-IBSYSDIR="/sys/class/infiniband"
-if [ -d \${IBSYSDIR} ]; then
-    declare -i hca_id=1
-    for hca in \${IBSYSDIR}/*
-    do
-        if [ -e \${hca}/node_desc ]; then
-            logger -i "Set node_desc for \$(basename \$hca): \$(hostname -s) HCA-\${hca_id}"
-            echo -n "\$(hostname -s) HCA-\${hca_id}" >> \${hca}/node_desc
-        fi
-        let hca_id++
-    done
-fi
-/bin/rm -f \$0
-EOF
-
-    chmod 755 /tmp/ib_set_node_desc.sh
-    /tmp/ib_set_node_desc.sh > /dev/null 2>&1 &
+    ib_set_node_desc > /dev/null 2>&1 &
 
     ${modprobe} ib_umad > /dev/null 2>&1
     RC=$[ $RC + $? ]
